[A] Pop up ad issues

Inactive
By echow
Feb 19, 2013
Topic Status:
Not open for further replies.
  1. similar symptoms to another poster:
    1) pop up ads
    2) computer goes to sleep by itself
    3)Heavy cpu usage which my resource monitor says is chrome even though it is not doing anything. Since I have tried a few cleaners the cpu usage has gone down but is higher than it should be and never rests. The pop ups persist.
  2. echow

    echow Newcomer, in training Topic Starter Posts: 24

    Malwarebytes Anti-Malware 1.70.0.1100
    www.malwarebytes.org

    Database version: v2013.02.14.08

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 9.0.8112.16421
    Edwin :: EDWIN-PC [administrator]

    2/19/2013 6:27:46 PM
    mbam-log-2013-02-19 (18-27-46).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 246701
    Time elapsed: 2 minute(s), 47 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)
  3. echow

    echow Newcomer, in training Topic Starter Posts: 24

    DDS (Ver_2012-11-20.01) - NTFS_AMD64
    Internet Explorer: 9.0.8112.16464 BrowserJavaVersion: 10.13.2
    Run by Edwin at 18:34:07 on 2013-02-19
    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.4022.1895 [GMT -5:00]
    .
    AV: Kaspersky Internet Security *Enabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
    SP: Kaspersky Internet Security *Enabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    FW: Kaspersky Internet Security *Enabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\ibmpmsvc.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Program Files (x86)\Jetico\BestCrypt\BCWipeSvc.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Program Files (x86)\Jetico\BestCrypt\BCWipeTM.exe
    C:\Program Files (x86)\Jetico\BestCrypt\BCWipeTM.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\System32\WUDFHost.exe
    C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\WLANExt.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k WbioSvcGroup
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
    C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
    C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Windows\system32\AEADISRV.EXE
    C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
    C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    C:\Program Files\LENOVO\HOTKEY\CAMMUTE.exe
    C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
    C:\Program Files\Microsoft LifeCam\MSCamS64.exe
    C:\Windows\system32\msiexec.exe
    C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
    C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Windows\system32\DRIVERS\xaudio64.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\taskhost.exe
    C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe
    C:\Program Files\LENOVO\HOTKEY\shtctky.exe
    C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
    C:\Program Files\Lenovo\Zoom\TpScrex.exe
    C:\Windows\System32\igfxpers.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Program Files\Logitech\SetPointP\SetPoint.exe
    C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Users\Edwin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
    C:\Program Files (x86)\Google\Drive\googledrivesync.exe
    C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
    C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
    C:\Program Files (x86)\Jetico\BestCrypt\BCResident.exe
    C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
    C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe
    C:\Program Files (x86)\iTunes\iTunesHelper.exe
    C:\Program Files (x86)\Google\Drive\googledrivesync.exe
    C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
    C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
    C:\Program Files (x86)\Browny02\BrYNSvc.exe
    C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
    C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
    C:\Windows\system32\igfxext.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\klwtblfs.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\svchost.exe -k SDRSVC
    C:\Users\Edwin\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
    BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
    BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll
    BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL
    BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
    BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll
    uRun: [Spotify Web Helper] "C:\Users\Edwin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
    uRun: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
    uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
    mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe"
    mRun: [TrueImageMonitor.exe] "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun: [SoundMAXPnP] C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [PWMTRV] rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
    mRun: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun: [ControlCenter4] C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun
    mRun: [BrStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
    mRun: [BCWipeTM Startup] "C:\Program Files (x86)\Jetico\BestCrypt\BCWipeTM.exe" startup
    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
    mRun: [AmazonGSDownloaderTray] C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BESTCR~1.LNK - C:\Program Files (x86)\Jetico\BestCrypt\BestCrypt.exe
    uPolicies-Explorer: NoThumbNailCache = dword:1
    uPolicies-Explorer: NoDrives = dword:0
    mPolicies-Explorer: NoDrives = dword:0
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableUIADesktopToggle = dword:0
    IE: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm
    IE: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office15\EXCEL.EXE/3000
    IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~2\Office15\ONBttnIE.dll/105
    IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
    IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll
    DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.6.2.cab
    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
    TCP: NameServer = 10.0.1.1
    TCP: Interfaces\{03D0C421-14E3-4CCB-9311-DE83E9135983} : DHCPNameServer = 192.168.42.129
    TCP: Interfaces\{41A6C8CF-5521-4104-9B60-D50272A29740} : DHCPNameServer = 8.8.8.8
    TCP: Interfaces\{E473B7BE-96BB-4768-AFA0-B670FFE4F8EC} : DHCPNameServer = 10.0.1.1
    TCP: Interfaces\{E473B7BE-96BB-4768-AFA0-B670FFE4F8EC}\2656C6B696E6534376 : DHCPNameServer = 192.168.2.1
    TCP: Interfaces\{E473B7BE-96BB-4768-AFA0-B670FFE4F8EC}\458616E686E49656E6 : DHCPNameServer = 192.168.1.1
    TCP: Interfaces\{E473B7BE-96BB-4768-AFA0-B670FFE4F8EC}\54340284F4453505F445 : DHCPNameServer = 192.168.43.1
    TCP: Interfaces\{E473B7BE-96BB-4768-AFA0-B670FFE4F8EC}\54460284F6473707F647 : DHCPNameServer = 172.16.202.215 172.16.202.215 8.8.8.8
    TCP: Interfaces\{E473B7BE-96BB-4768-AFA0-B670FFE4F8EC}\74344535D23547574656E64737 : DHCPNameServer = 10.1.10.11 10.2.10.11
    TCP: Interfaces\{E473B7BE-96BB-4768-AFA0-B670FFE4F8EC}\86561627D656F6574702D4977596 : DHCPNameServer = 172.16.202.215 172.16.202.215 8.8.8.8
    Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
    Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    SSODL: WebCheck - <orphaned>
    LSA: Notification Packages = scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
    x64-BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
    x64-BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
    x64-BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
    x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    x64-BHO: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll
    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL
    x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL
    x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    x64-BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll
    x64-TB: Astroburn Toolbar: {EFEED92A-A33D-4873-BA8F-32BAA631E54D} -
    x64-Run: [TrackPointSrv] C:\Program Files (x86)\Lenovo\TrackPoint\tp4serv.exe
    x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
    x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
    x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
    x64-Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
    x64-Run: [AcWin7Hlpr] C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe
    x64-Run: [Acronis Scheduler2 Service] "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"
    x64-IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
    x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
    x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
    x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
    x64-IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll
    x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
    x64-DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
    x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
    x64-Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
    x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - <orphaned>
    x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned>
    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
    x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
    x64-Notify: igfxcui - igfxdev.dll
    x64-Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    x64-Notify: psfus - C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
    x64-SSODL: WebCheck - <orphaned>
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\Edwin\AppData\Roaming\Mozilla\Firefox\Profiles\2p8iduiq.default\
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - ExtSQL: 2013-01-11 14:36; {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA}; C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA}
    FF - ExtSQL: 2013-01-12 01:31; anti_banner@kaspersky.com; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
    FF - ExtSQL: 2013-01-12 01:31; content_blocker@kaspersky.com; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
    FF - ExtSQL: 2013-01-12 01:31; online_banking@kaspersky.com; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
    FF - ExtSQL: 2013-01-12 01:31; url_advisor@kaspersky.com; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
    FF - ExtSQL: 2013-01-12 01:31; virtual_keyboard@kaspersky.com; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
    FF - ExtSQL: 2013-02-13 17:51; jid1-yZwVFzbsyfMrqQ@jetpack; C:\Users\Edwin\AppData\Roaming\Mozilla\Firefox\Profiles\2p8iduiq.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
    .
    ---- FIREFOX POLICIES ----
    FF - user.js: network.protocol-handler.warn-external.dnupdate - false
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 bcfnt;bcfnt;C:\Windows\System32\drivers\bcfnt.sys [2011-8-2 187456]
    R0 DzHDD64;DzHDD64;C:\Windows\System32\drivers\DZHDD64.SYS [2011-1-24 29512]
    R0 fsh;fsh;C:\Windows\System32\drivers\fsh.sys [2011-8-2 59456]
    R0 gfibto;gfibto;C:\Windows\System32\drivers\gfibto.sys [2013-2-13 14456]
    R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2011-1-28 55280]
    R0 vididr;Acronis Virtual Disk;C:\Windows\System32\drivers\vididr.sys [2012-4-10 210016]
    R0 vidsflt53;Acronis Disk Storage Filter (53);C:\Windows\System32\drivers\vsflt53.sys [2012-4-10 141920]
    R1 BC_3DES;BC_3DES;C:\Windows\System32\drivers\bc_3des.sys [2010-3-18 34368]
    R1 BC_BF128;BC_BF128;C:\Windows\System32\drivers\bc_bf128.sys [2010-3-18 30784]
    R1 BC_BF448;BC_BF448;C:\Windows\System32\drivers\bc_bf448.sys [2010-3-18 30784]
    R1 BC_BFish;BC_BFish;C:\Windows\System32\drivers\bc_bfish.sys [2010-3-18 30272]
    R1 BC_CAST;BC_CAST;C:\Windows\System32\drivers\bc_cast.sys [2010-3-18 37440]
    R1 BC_DES;BC_DES;C:\Windows\System32\drivers\bc_des.sys [2010-3-18 33856]
    R1 BC_Gost;BC_Gost;C:\Windows\System32\drivers\bc_gost.sys [2010-3-18 25664]
    R1 BC_IDEA;BC_IDEA;C:\Windows\System32\drivers\bc_idea.sys [2010-3-18 27712]
    R1 BC_RC6;BC_RC6;C:\Windows\System32\drivers\bc_rc6.sys [2010-3-18 30272]
    R1 BC_RIJN;BC_RIJN;C:\Windows\System32\drivers\bc_rijn.sys [2010-3-18 51264]
    R1 BC_SERP;BC_SERP;C:\Windows\System32\drivers\bc_serp.sys [2010-3-18 36928]
    R1 BC_TFISH;BC_TFISH;C:\Windows\System32\drivers\bc_tfish.sys [2010-3-18 34368]
    R1 bcbus;BestCrypt bus driver;C:\Windows\System32\drivers\bcbus.sys [2011-8-2 83008]
    R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2013-1-25 283200]
    R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2012-8-2 28504]
    R1 kltdi;kltdi;C:\Windows\System32\drivers\kltdi.sys [2012-6-8 54104]
    R1 kneps;kneps;C:\Windows\System32\drivers\kneps.sys [2012-8-13 178008]
    R1 lenovo.smi;Lenovo System Interface Driver;C:\Windows\System32\drivers\smiifx64.sys [2011-1-24 15472]
    R2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-8-8 1166848]
    R2 AVP;Kaspersky Anti-Virus Service;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe -r --> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe -r [?]
    R2 BCWipeSvc;BCWipe service;C:\Program Files (x86)\Jetico\BestCrypt\BCWipeSvc.exe [2010-3-18 95544]
    R2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-6-3 134928]
    R2 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2012-8-23 13672]
    R2 LENOVO.CAMMUTE;Lenovo Camera Mute;C:\Program Files\Lenovo\HOTKEY\cammute.exe [2011-3-4 54632]
    R2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe [2011-11-28 133992]
    R2 OfficeSvc;Microsoft Office Service;C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-1-25 1855064]
    R2 smihlp;SMI Helper Driver (smihlp);C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [2009-3-13 13840]
    R2 TeamViewer8;TeamViewer 8;C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2013-1-11 3467768]
    R2 TPHKLOAD;Lenovo Hotkey Client Loader;C:\Program Files\Lenovo\HOTKEY\tphkload.exe [2013-2-15 127120]
    R2 TPHKSVC;On Screen Display;C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe [2013-2-15 125504]
    R3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;C:\Windows\System32\drivers\AmpPal.sys [2011-8-8 299008]
    R3 BrYNSvc;BrYNSvc;C:\Program Files (x86)\Browny02\BrYNSvc.exe [2013-1-12 245760]
    R3 CAXHWAZL;CAXHWAZL;C:\Windows\System32\drivers\CAXHWAZL.sys [2006-12-21 300032]
    R3 klkbdflt;Kaspersky Lab KLKBDFLT;C:\Windows\System32\drivers\klkbdflt.sys [2012-10-25 29016]
    R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2012-10-25 29528]
    R3 mhk;mhk;C:\Windows\System32\drivers\mhk.sys [2010-3-18 17472]
    R3 moh;moh;C:\Windows\System32\drivers\moh.sys [2010-3-18 13376]
    R3 NETwLv64; Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\NETwLv64.sys [2010-10-7 7533568]
    R3 Tp4Track;PS/2 TrackPoint Driver;C:\Windows\System32\drivers\tp4track.sys [2012-2-1 29992]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 LENOVO.MICMUTE;Lenovo Microphone Mute;C:\Program Files\Lenovo\HOTKEY\micmute.exe [2013-2-15 127072]
    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-1-8 161536]
    S3 Amazon Download Agent;Amazon Download Agent;C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2011-2-13 401920]
    S3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;C:\Windows\System32\drivers\AmpPal.sys [2011-8-8 299008]
    S3 DozeSvc;Lenovo Doze Mode Service;C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2011-1-24 320576]
    S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-3-11 48488]
    S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]
    S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;C:\Windows\System32\drivers\nx6000.sys [2010-12-13 36720]
    S3 Netaapl;Apple Mobile Device Ethernet Service;C:\Windows\System32\drivers\netaapl64.sys [2011-5-10 22528]
    S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368]
    S3 Power Manager DBC Service;Power Manager DBC Service;C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe [2011-1-24 1665832]
    S3 PwmEWSvc;Cisco EnergyWise Enabler;C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe [2011-6-21 1664296]
    S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-1-12 19456]
    S3 RoxMediaDB10;RoxMediaDB10;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-9-24 1124848]
    S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]
    S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]
    S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]
    S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-1-12 57856]
    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2011-5-10 51712]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-1-26 1255736]
    S4 BCSWAP;BCSWAP;C:\Windows\System32\drivers\bcswap.sys [2011-8-2 102464]
    S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
    .
    =============== Created Last 30 ================
    .
    2013-02-19 23:19:35--------d-----w-C:\$RECYCLE.BIN
    2013-02-19 22:18:4198816----a-w-C:\Windows\sed.exe
    2013-02-19 22:18:41256000----a-w-C:\Windows\PEV.exe
    2013-02-19 22:18:41208896----a-w-C:\Windows\MBR.exe
    2013-02-19 22:03:55--------d-----w-C:\Windows\pss
    2013-02-19 16:46:05--------d-----w-C:\Program Files (x86)\ESET
    2013-02-19 14:57:309161176----a-w-C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{053912CC-640B-4469-BF87-857B6B785D3B}\mpengine.dll
    2013-02-15 21:41:3868864----a-w-C:\Windows\System32\drivers\stream.sys
    2013-02-15 21:40:12--------d-----w-C:\Users\Edwin\AppData\Local\Lenovo
    2013-02-15 21:36:55325120----a-w-C:\Windows\System32\drivers\usbport.sys
    2013-02-15 21:36:5525600----a-w-C:\Windows\System32\drivers\usbohci.sys
    2013-02-15 21:36:5499328----a-w-C:\Windows\System32\drivers\usbccgp.sys
    2013-02-15 21:36:547936----a-w-C:\Windows\System32\drivers\usbd.sys
    2013-02-15 21:36:5452736----a-w-C:\Windows\System32\drivers\usbehci.sys
    2013-02-15 21:36:54343040----a-w-C:\Windows\System32\drivers\usbhub.sys
    2013-02-15 21:36:5430720----a-w-C:\Windows\System32\drivers\usbuhci.sys
    2013-02-15 21:35:5253248----a-r-C:\Users\Edwin\AppData\Roaming\Microsoft\Installer\{0369F866-2CE0-4EB9-B426-88FA122C6E82}\ARPPRODUCTICON.exe
    2013-02-15 21:35:51--------d-----w-C:\Program Files\Common Files\Lenovo
    2013-02-15 21:35:4353248----a-r-C:\Users\Edwin\AppData\Roaming\Microsoft\Installer\{6E6E7725-C7BC-4C39-8B3F-14B67331A120}\ARPPRODUCTICON.exe
    2013-02-15 21:35:42--------d-----w-C:\Program Files (x86)\Common Files\Lenovo
    2013-02-14 21:43:17--------d-----w-C:\Users\Edwin\AppData\Roaming\Malwarebytes
    2013-02-14 21:42:35--------d-----w-C:\ProgramData\Malwarebytes
    2013-02-14 21:42:3424176----a-w-C:\Windows\System32\drivers\mbam.sys
    2013-02-14 21:42:34--------d-----w-C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2013-02-13 22:55:07--------d-----w-C:\Users\Edwin\AppData\Roaming\LavasoftStatistics
    2013-02-13 22:53:01--------d-----w-C:\Program Files (x86)\Ad-Aware Antivirus
    2013-02-13 22:52:17--------d-----w-C:\Users\Edwin\AppData\Local\Downloaded Installations
    2013-02-13 22:52:0314456----a-w-C:\Windows\System32\drivers\gfibto.sys
    2013-02-13 22:51:56--------d-----w-C:\ProgramData\blekko toolbars
    2013-02-13 22:51:54--------d-----w-C:\Users\Edwin\AppData\Local\adawarebp
    2013-02-13 22:51:53--------d-----w-C:\ProgramData\Ad-Aware Browsing Protection
    2013-02-13 22:51:43--------d-----w-C:\Program Files (x86)\adawaretb
    2013-02-13 22:51:41--------d-----w-C:\Program Files (x86)\Toolbar Cleaner
    2013-02-13 22:21:5995648----a-w-C:\Windows\SysWow64\WindowsAccessBridge-32.dll
    2013-02-13 21:40:27--------d-----w-C:\ProgramData\Spybot - Search & Destroy
    2013-02-13 21:40:09--------d-----w-C:\Program Files (x86)\Spybot - Search & Destroy 2
    2013-02-13 14:41:53996352----a-w-C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll
    2013-02-13 14:41:53768000----a-w-C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
    2013-02-13 05:05:255553512----a-w-C:\Windows\System32\ntoskrnl.exe
    2013-02-13 05:05:253967848----a-w-C:\Windows\SysWow64\ntkrnlpa.exe
    2013-02-13 05:05:243913064----a-w-C:\Windows\SysWow64\ntoskrnl.exe
    2013-02-13 05:05:123153408----a-w-C:\Windows\System32\win32k.sys
    2013-02-13 05:05:08215040----a-w-C:\Windows\System32\winsrv.dll
    2013-02-13 05:05:077680----a-w-C:\Windows\SysWow64\instnm.exe
    2013-02-13 05:05:075120----a-w-C:\Windows\SysWow64\wow32.dll
    2013-02-13 05:05:0725600----a-w-C:\Windows\SysWow64\setup16.exe
    2013-02-13 05:05:072048----a-w-C:\Windows\SysWow64\user.exe
    2013-02-13 05:05:0714336----a-w-C:\Windows\SysWow64\ntvdm64.dll
    2013-02-13 05:05:02288088----a-w-C:\Windows\System32\drivers\FWPKCLNT.SYS
    2013-02-13 05:05:021913192----a-w-C:\Windows\System32\drivers\tcpip.sys
    2013-02-08 00:22:06--------d-----w-C:\Users\Edwin\AppData\Local\{63DDEF3B-0856-44EF-9C6C-486CD22EA5A1}
    2013-01-30 21:50:01--------d-s---w-C:\Users\Edwin\Google Drive
    2013-01-30 21:35:31--------d-----w-C:\Program Files (x86)\DC-Unlocker
    2013-01-30 21:11:19--------d-----w-C:\Users\Edwin\AppData\Roaming\MyLifeOrganized
    2013-01-30 21:11:19--------d-----w-C:\Users\Edwin\AppData\Local\MyLifeOrganized
    2013-01-30 20:57:23--------d-----w-C:\Program Files (x86)\MyLifeOrganized.net
    2013-01-29 19:58:48--------d-----w-C:\Users\Edwin\AppData\Roaming\ooVoo Details
    2013-01-29 19:58:05--------d-----w-C:\Program Files (x86)\ooVoo
    2013-01-25 19:41:24--------d-----w-C:\ProgramData\regid.1991-06.com.microsoft
    2013-01-25 19:41:05--------d-----w-C:\Windows\PCHEALTH
    2013-01-25 19:41:05--------d-----w-C:\Program Files (x86)\Microsoft SQL Server
    2013-01-25 18:44:37283200----a-w-C:\Windows\System32\drivers\dtsoftbus01.sys
    2013-01-25 18:40:35--------d-----w-C:\Program Files (x86)\DAEMON Tools Lite
    2013-01-25 17:12:36--------d-----w-C:\Program Files\Microsoft Office 15
    2013-01-25 16:39:486779504----a-w-C:\Program Files\Common Files\Microsoft Shared\OFFICE15\CMigrate.exe
    2013-01-25 16:39:486557808----a-w-C:\Program Files\Common Files\Microsoft Shared\OFFICE15\Csi.dll
    2013-01-25 15:36:1433968----a-w-C:\Program Files (x86)\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll
    2013-01-25 15:29:005065840----a-w-C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\CMigrate.exe
    2013-01-25 15:29:004830832----a-w-C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\Csi.dll
    2013-01-25 15:28:4461010528----a-w-C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSORES.DLL
    2013-01-25 15:28:4425357936----a-w-C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSO.DLL
    .
    ==================== Find3M ====================
    .
    2013-02-13 23:24:2871024----a-w-C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2013-02-13 23:24:28691568----a-w-C:\Windows\SysWow64\FlashPlayerApp.exe
    2013-02-13 22:21:55861088----a-w-C:\Windows\SysWow64\npdeployJava1.dll
    2013-02-13 22:21:55782240----a-w-C:\Windows\SysWow64\deployJava1.dll
    2013-01-30 20:44:4718960----a-w-C:\Windows\System32\drivers\LNonPnP.sys
    2013-01-30 10:53:22273840------w-C:\Windows\System32\MpSigStub.exe
    2013-01-18 04:54:2614106----a-w-C:\Users\Edwin\B462DBDB.tmp
    2013-01-12 06:30:5254104----a-w-C:\Windows\System32\drivers\kltdi.sys
    2013-01-09 11:40:0029512----a-w-C:\Windows\System32\drivers\DZHDD64.SYS
    2013-01-09 11:40:002811688----a-w-C:\Windows\System32\PWMCP64V.cpl
    2013-01-09 11:40:002692904------w-C:\Windows\PWMBTHLV.EXE
    2013-01-09 11:40:0020328----a-w-C:\Windows\System32\drivers\TPPWR64V.SYS
    2013-01-09 01:19:092312704----a-w-C:\Windows\System32\jscript9.dll
    2013-01-09 01:12:031392128----a-w-C:\Windows\System32\wininet.dll
    2013-01-09 01:11:061494528----a-w-C:\Windows\System32\inetcpl.cpl
    2013-01-09 01:07:51173056----a-w-C:\Windows\System32\ieUnatt.exe
    2013-01-09 01:07:47599040----a-w-C:\Windows\System32\vbscript.dll
    2013-01-09 01:04:422382848----a-w-C:\Windows\System32\mshtml.tlb
    2013-01-08 22:11:211800704----a-w-C:\Windows\SysWow64\jscript9.dll
    2013-01-08 22:03:201129472----a-w-C:\Windows\SysWow64\wininet.dll
    2013-01-08 22:03:121427968----a-w-C:\Windows\SysWow64\inetcpl.cpl
    2013-01-08 21:59:02142848----a-w-C:\Windows\SysWow64\ieUnatt.exe
    2013-01-08 21:58:29420864----a-w-C:\Windows\SysWow64\vbscript.dll
    2013-01-08 21:56:232382848----a-w-C:\Windows\SysWow64\mshtml.tlb
    2013-01-04 04:43:2144032----a-w-C:\Windows\apppatch\acwow64.dll
    2012-12-16 17:11:2246080----a-w-C:\Windows\System32\atmlib.dll
    2012-12-16 14:45:03367616----a-w-C:\Windows\System32\atmfd.dll
    2012-12-16 14:13:28295424----a-w-C:\Windows\SysWow64\atmfd.dll
    2012-12-16 14:13:2034304----a-w-C:\Windows\SysWow64\atmlib.dll
    2012-12-11 11:22:0872048----a-w-C:\Windows\System32\ibmpmctl.exe
    2012-12-11 11:22:0860272----a-w-C:\Windows\System32\ibmpmsvc.exe
    2012-12-11 11:22:0842824----a-w-C:\Windows\System32\drivers\ibmpmdrv.sys
    2012-12-11 11:22:0839792----a-w-C:\Windows\System32\tpinspm.dll
    2012-12-07 13:20:16441856----a-w-C:\Windows\System32\Wpc.dll
    2012-12-07 13:15:312746368----a-w-C:\Windows\System32\gameux.dll
    2012-12-07 12:26:17308736----a-w-C:\Windows\SysWow64\Wpc.dll
    2012-12-07 12:20:432576384----a-w-C:\Windows\SysWow64\gameux.dll
    2012-12-07 11:20:0430720----a-w-C:\Windows\System32\usk.rs
    2012-12-07 11:20:0343520----a-w-C:\Windows\System32\csrr.rs
    2012-12-07 11:20:0323552----a-w-C:\Windows\System32\oflc.rs
    2012-12-07 11:20:0145568----a-w-C:\Windows\System32\oflc-nz.rs
    2012-12-07 11:20:0144544----a-w-C:\Windows\System32\pegibbfc.rs
    2012-12-07 11:20:0120480----a-w-C:\Windows\System32\pegi-fi.rs
    2012-12-07 11:20:0020480----a-w-C:\Windows\System32\pegi-pt.rs
    2012-12-07 11:19:5920480----a-w-C:\Windows\System32\pegi.rs
    2012-12-07 11:19:5846592----a-w-C:\Windows\System32\fpb.rs
    2012-12-07 11:19:5740960----a-w-C:\Windows\System32\cob-au.rs
    2012-12-07 11:19:5721504----a-w-C:\Windows\System32\grb.rs
    2012-12-07 11:19:5715360----a-w-C:\Windows\System32\djctq.rs
    2012-12-07 11:19:5655296----a-w-C:\Windows\System32\cero.rs
    2012-12-07 11:19:5551712----a-w-C:\Windows\System32\esrb.rs
    2012-11-30 05:45:35362496----a-w-C:\Windows\System32\wow64win.dll
    2012-11-30 05:45:35243200----a-w-C:\Windows\System32\wow64.dll
    2012-11-30 05:45:3513312----a-w-C:\Windows\System32\wow64cpu.dll
    2012-11-30 05:43:1216384----a-w-C:\Windows\System32\ntvdm64.dll
    2012-11-30 05:41:07424448----a-w-C:\Windows\System32\KernelBase.dll
    2012-11-30 04:53:59274944----a-w-C:\Windows\SysWow64\KernelBase.dll
    2012-11-30 03:23:48338432----a-w-C:\Windows\System32\conhost.exe
    2012-11-30 02:38:596144---ha-w-C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
    2012-11-30 02:38:594608---ha-w-C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
    2012-11-30 02:38:593584---ha-w-C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
    2012-11-30 02:38:593072---ha-w-C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
    2012-11-23 03:13:5768608----a-w-C:\Windows\System32\taskhost.exe
    2012-11-22 05:44:23800768----a-w-C:\Windows\System32\usp10.dll
    2012-11-22 04:45:03626688----a-w-C:\Windows\SysWow64\usp10.dll
    .
    ============= FINISH: 18:34:40.66 ===============
  4. Broni

    Broni Malware Annihilator Posts: 46,123   +251

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ============================

    I still need Attach.txt part of DDS.
  5. echow

    echow Newcomer, in training Topic Starter Posts: 24

    Here it is

    Attached Files:

  6. Broni

    Broni Malware Annihilator Posts: 46,123   +251

    Please observe forum rules.
    All logs have to be pasted not attached.
  7. echow

    echow Newcomer, in training Topic Starter Posts: 24

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 1/24/2011 5:12:17 PM
    System Uptime: 2/19/2013 6:24:08 PM (0 hours ago)
    .
    Motherboard: LENOVO | | 76737EU
    Processor: Intel(R) Core(TM)2 Duo CPU T7300 @ 2.00GHz | None | 2001/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 211 GiB total, 94.791 GiB free.
    D: is FIXED (NTFS) - 12 GiB total, 1.91 GiB free.
    E: is CDROM (UDF)
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP217: 2/19/2013 4:47:10 PM - before malware cleanup
    RP218: 2/19/2013 4:54:16 PM - Windows Update
    .
    ==== Installed Programs ======================
    .
    µTorrent
    Acronis True Image WD Edition
    ActiveState ActivePython 2.7.2.5 (32-bit)
    Ad-Aware Browsing Protection
    Adobe Flash Player 11 ActiveX
    Adobe Flash Player 11 Plugin
    Adobe Reader X (10.1.5)
    AIM 7
    Amazon Games & Software Downloader
    Amazon Kindle
    Amazon MP3 Downloader 1.0.12
    Amazon Send to Kindle
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Ashampoo Burning Studio 10 v.10.0.15
    Avanquest update
    BestCrypt 8.0
    BibleWorks 8
    Bonjour
    Brother MFL-Pro Suite DCP-7065DN
    calibre
    CamToPrint
    CutePDF Writer 2.8
    D3DX10
    DAEMON Tools Lite
    Data Lifeguard Diagnostic for Windows 1.22
    Definition update for Microsoft Office 2013 (KB2760587) 32-Bit Edition
    DimSum 0.7.9
    DirectX 9 Runtime
    eReg
    ESET Online Scanner v3
    eXPert PDF 6
    FlashWorks
    Garmin Communicator Plugin
    Garmin USB Drivers
    Garmin WebUpdater
    Google Chrome
    Google Drive
    Google Earth Plug-in
    Google Talk (remove only)
    Google Talk Plugin
    Google Update Helper
    HanConv 1.20
    iCloud
    Intel PROSet Wireless
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) PROSet/Wireless WiFi Software
    InterVideo Register Manager
    InterVideo WinDVD 8
    ISI ResearchSoft - Export Helper
    iTunes
    Java 7 Update 13
    Java Auto Updater
    Java(TM) 6 Update 25 (64-bit)
    Java(TM) 6 Update 38
    Java(TM) SE Development Kit 6 Update 25
    Java(TM) SE Development Kit 6 Update 25 (64-bit)
    Junk Mail filter update
    Kaspersky Internet Security 2013
    Lenovo Auto Scroll Utility
    Lenovo Patch Utility
    Lenovo Patch Utility 64 bit
    Lenovo Power Management Driver
    Lenovo System Interface Driver
    Lenovo System Update
    Logitech SetPoint 6.32
    Malwarebytes Anti-Malware version 1.70.0.1100
    Mesh Runtime
    Messenger Companion
    Microsoft .NET Framework 4 Client Profile
    Microsoft .NET Framework 4 Extended
    Microsoft Access MUI (English) 2013
    Microsoft Access Setup Metadata MUI (English) 2013
    Microsoft Application Error Reporting
    Microsoft Corporation
    Microsoft DCF MUI (English) 2013
    Microsoft Excel MUI (English) 2013
    Microsoft Groove MUI (English) 2013
    Microsoft InfoPath MUI (English) 2013
    Microsoft LifeCam
    Microsoft Lync MUI (English) 2013
    Microsoft Office 2007 Service Pack 3 (SP3)
    Microsoft Office 2010 Service Pack 1 (SP1)
    Microsoft Office 64-bit Components 2013
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access MUI (English) 2010
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2010
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Excel MUI (English) 2010
    Microsoft Office File Validation Add-In
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office Office 64-bit Components 2007
    Microsoft Office Office 64-bit Components 2010
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office OneNote MUI (English) 2010
    Microsoft Office OSM MUI (English) 2013
    Microsoft Office OSM UX MUI (English) 2013
    Microsoft Office Outlook Connector
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2010
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2010
    Microsoft Office Professional Plus 2013
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (English) 2010
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (French) 2010
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proof (Spanish) 2010
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing (English) 2010
    Microsoft Office Proofing (English) 2013
    Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    Microsoft Office Proofing Tools 2013 - English
    Microsoft Office Proofing Tools 2013 - Español
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Publisher MUI (English) 2010
    Microsoft Office Shared 64-bit MUI (English) 2007
    Microsoft Office Shared 64-bit MUI (English) 2010
    Microsoft Office Shared 64-bit MUI (English) 2013
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2013
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared MUI (English) 2010
    Microsoft Office Shared MUI (English) 2013
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2010
    Microsoft Office Shared Setup Metadata MUI (English) 2013
    Microsoft Office Word MUI (English) 2007
    Microsoft Office Word MUI (English) 2010
    Microsoft OneNote MUI (English) 2013
    Microsoft Outlook MUI (English) 2013
    Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit
    Microsoft PowerPoint MUI (English) 2013
    Microsoft Publisher MUI (English) 2013
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2005 Redistributable (x64)
    Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
    Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Word MUI (English) 2013
    MobileMe Control Panel
    Mozilla Firefox 5.0 (x86 en-US)
    MSVCMergeModules
    MSVCRT
    MSVCRT_amd64
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MyLifeOrganized v. 4.0
    On Screen Display
    ooVoo
    Outils de vérification linguistique 2013 de Microsoft Office - Français
    Picasa 3
    Power Manager
    QuickTime
    Roxio Activation Module
    Roxio Central Audio
    Roxio Central Copy
    Roxio Central Core
    Roxio Central Data
    Roxio Central Tools
    Roxio Creator Business Edition
    Roxio Express Labeler 3
    SanDisk SSD Toolkit 1.0.0.1
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
    Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
    Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
    Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
    Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
    Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition
    Skype Click to Call
    Skype™ 6.1
    Sonic CinePlayer Decoder Pack
    SoundMAX
    Spotify
    System Migration Assistant
    TeamViewer 8
    TekniaHebrew
    ThinkPad FullScreen Magnifier
    ThinkPad Modem
    ThinkPad TrackPoint Driver
    ThinkVantage Fingerprint Software
    TurboTax 2009
    TurboTax 2009 WinPerFedFormset
    TurboTax 2009 WinPerReleaseEngine
    TurboTax 2009 WinPerTaxSupport
    TurboTax 2009 wmaiper
    TurboTax 2009 wrapper
    TurboTax 2010
    TurboTax 2010 WinPerFedFormset
    TurboTax 2010 WinPerReleaseEngine
    TurboTax 2010 WinPerTaxSupport
    TurboTax 2010 wmaiper
    TurboTax 2010 wmdiper
    TurboTax 2010 wrapper
    TurboTax 2011
    TurboTax 2011 WinPerFedFormset
    TurboTax 2011 WinPerReleaseEngine
    TurboTax 2011 WinPerTaxSupport
    TurboTax 2011 wmaiper
    TurboTax 2011 wmdiper
    TurboTax 2011 wrapper
    TurboTax 2012
    TurboTax 2012 WinPerFedFormset
    TurboTax 2012 WinPerReleaseEngine
    TurboTax 2012 WinPerTaxSupport
    TurboTax 2012 wrapper
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
    Update for Microsoft .NET Framework 4 Extended (KB2468871)
    Update for Microsoft .NET Framework 4 Extended (KB2533523)
    Update for Microsoft .NET Framework 4 Extended (KB2600217)
    Update for Microsoft Access 2013 (KB2760350) 32-Bit Edition
    Update for Microsoft Excel 2013 (KB2760339) 32-Bit Edition
    Update for Microsoft Lync 2013 (KB2760512) 32-Bit Edition
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition
    Update for Microsoft Office 2013 (KB2726954) 32-Bit Edition
    Update for Microsoft Office 2013 (KB2726961) 32-Bit Edition
    Update for Microsoft Office 2013 (KB2726996) 32-Bit Edition
    Update for Microsoft Office 2013 (KB2737954) 32-Bit Edition
    Update for Microsoft Office 2013 (KB2752025) 32-Bit Edition
    Update for Microsoft Office 2013 (KB2752101) 32-Bit Edition
    Update for Microsoft Office 2013 (KB2760224) 32-Bit Edition
    Update for Microsoft Office 2013 (KB2760311) 32-Bit Edition
    Update for Microsoft Office 2013 (KB2760318) 32-Bit Edition
    Update for Microsoft Office 2013 (KB2767845) 32-Bit Edition
    Update for Microsoft Office 2013 (KB2767852) 32-Bit Edition
    Update for Microsoft Office 2013 (KB2767861) 32-Bit Edition
    Update for Microsoft Office 2013 (KB2767864) 32-Bit Edition
    Update for Microsoft Office Access 2007 Help (KB963663)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office Infopath 2007 Help (KB963662)
    Update for Microsoft Office OneNote 2007 Help (KB963670)
    Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
    Update for Microsoft Office Outlook 2007 Help (KB963677)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Publisher 2007 Help (KB963667)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 Help (KB963665)
    Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
    Update for Microsoft OneNote 2010 (KB2687277) 32-Bit Edition
    Update for Microsoft OneNote 2013 (KB2737968) 32-Bit Edition
    Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
    Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
    Update for Microsoft PowerPoint 2013 (KB2726947) 32-Bit Edition
    Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition
    Update for Microsoft SkyDrive Pro (KB2760214) 32-Bit Edition
    Update for Microsoft Visio Viewer 2013 (KB2767856) 32-Bit Edition
    Update for Microsoft Word 2013 (KB2760244) 32-Bit Edition
    Update for Microsoft Word 2013 (KB2767854) 32-Bit Edition
    Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Family Safety
    Windows Live ID Sign-in Assistant
    Windows Live Installer
    Windows Live Language Selector
    Windows Live Mail
    Windows Live Mesh
    Windows Live Mesh ActiveX Control for Remote Connections
    Windows Live Messenger
    Windows Live Messenger Companion Core
    Windows Live MIME IFilter
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live Remote Client
    Windows Live Remote Client Resources
    Windows Live Remote Service
    Windows Live Remote Service Resources
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    WinRAR 4.01 (32-bit)
    Xiph.Org Open Codecs 0.85.17777
    Xvid Video Codec
    .
    ==== Event Viewer Messages From Past Week ========
    .
    2/19/2013 6:16:54 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    2/19/2013 6:16:04 PM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
    2/19/2013 5:26:12 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer LILLY-HP that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E473B7BE-96BB-4768-AFA0-B670FFE4F8EC}. The master browser is stopping or an election is being forced.
    2/19/2013 5:16:01 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft Antimalware Service service to connect.
    2/19/2013 5:16:01 PM, Error: Service Control Manager [7000] - The Microsoft Antimalware Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    2/19/2013 5:02:37 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    2/19/2013 5:02:36 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    2/19/2013 5:02:36 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    2/19/2013 5:02:36 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    2/19/2013 5:02:35 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    2/19/2013 5:01:01 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\IWMSSvc.dll Error Code: 21
    2/19/2013 5:00:59 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    2/19/2013 5:00:42 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: bcbus discache KLIF kneps lenovo.smi MpFilter spldr TPPWRIF Wanarpv6
    2/19/2013 4:58:23 PM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.
    2/19/2013 4:56:32 PM, Error: Service Control Manager [7000] - The Microsoft Network Inspection service failed to start due to the following error: The media is write protected.
    2/19/2013 4:56:32 PM, Error: Microsoft Antimalware [3002] -
    2/19/2013 4:52:17 PM, Error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.
    2/19/2013 3:49:56 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TPHKSVC service.
    2/19/2013 3:49:56 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
    2/19/2013 12:18:32 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the PlugPlay service.
    2/15/2013 4:35:20 PM, Error: Service Control Manager [7030] - The Lenovo Doze Mode Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    2/14/2013 7:26:10 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\IWMSSvc.dll Error Code: 258
    2/13/2013 12:46:29 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.
    2/13/2013 12:22:17 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service.
    .
    ==== End Of File ===========================
  8. Broni

    Broni Malware Annihilator Posts: 46,123   +251

    [​IMG] Download RogueKiller on the desktop
    • Close all the running programs
    • Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Download Malwarebytes Anti-Rootkit (MBAR) from HERE
    • Unzip downloaded file.
    • Open the folder where the contents were unzipped and run mbar.exe
    • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
    • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
    • Wait while the system shuts down and the cleanup process is performed.
    • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
    • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt
  9. echow

    echow Newcomer, in training Topic Starter Posts: 24

    RogueKiller V8.5.1 [Feb 19 2013] by Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
    Website : http://tigzy.geekstogo.com/roguekiller.php
    Blog : http://tigzyrk.blogspot.com/

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
    Started in : Normal mode
    User : Edwin [Admin rights]
    Mode : Scan -- Date : 02/19/2013 18:58:29
    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 1 ¤¤¤
    [Microsoft][HJNAME] notepad.exe -- C:\Windows\System32\notepad.exe [7] -> KILLED [TermProc]

    ¤¤¤ Registry Entries : 2 ¤¤¤
    [HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
    [HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤
    --> C:\Windows\system32\drivers\etc\hosts

    127.0.0.1 localhost


    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: SanDisk SDSSDX240GG25 +++++
    --- User ---
    [MBR] da5b9ee4ab84f0eeff21496998e4ba36
    [BSP] 27e2b99671faf39ca03716838b42146e : Windows 7/8 MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 216547 Mo
    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 443695104 | Size: 12286 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    Finished : << RKreport[1]_S_02192013_02d1858.txt >>
    RKreport[1]_S_02192013_02d1858.txt
  10. echow

    echow Newcomer, in training Topic Starter Posts: 24

    RogueKiller V8.5.1 [Feb 19 2013] by Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
    Website : http://tigzy.geekstogo.com/roguekiller.php
    Blog : http://tigzyrk.blogspot.com/

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
    Started in : Normal mode
    User : Edwin [Admin rights]
    Mode : Remove -- Date : 02/19/2013 19:00:00
    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 1 ¤¤¤
    [Microsoft][HJNAME] notepad.exe -- C:\Windows\System32\notepad.exe [7] -> KILLED [TermProc]

    ¤¤¤ Registry Entries : 1 ¤¤¤
    [HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> DELETED

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤
    --> C:\Windows\system32\drivers\etc\hosts

    127.0.0.1 localhost


    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: SanDisk SDSSDX240GG25 +++++
    --- User ---
    [MBR] da5b9ee4ab84f0eeff21496998e4ba36
    [BSP] 27e2b99671faf39ca03716838b42146e : Windows 7/8 MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 216547 Mo
    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 443695104 | Size: 12286 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    Finished : << RKreport[2]_D_02192013_02d1900.txt >>
    RKreport[1]_S_02192013_02d1858.txt ; RKreport[2]_D_02192013_02d1900.txt
  11. echow

    echow Newcomer, in training Topic Starter Posts: 24

    Malwarebytes Anti-Rootkit BETA 1.01.0.1020
    www.malwarebytes.org

    Database version: v2013.02.19.07

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 9.0.8112.16421
    Edwin :: EDWIN-PC [administrator]

    2/19/2013 7:09:51 PM
    mbar-log-2013-02-19 (19-09-51).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
    Scan options disabled:
    Objects scanned: 32225
    Time elapsed: 7 minute(s), 27 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)
     
  12. echow

    echow Newcomer, in training Topic Starter Posts: 24

    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.01.0.1020

    (c) Malwarebytes Corporation 2011-2012

    OS version: 6.1.7601 Windows 7 Service Pack 1 x64

    Account is Administrative

    Internet Explorer version: 9.0.8112.16421

    Java version: 1.6.0_38

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
    CPU speed: 1.995000 GHz
    Memory total: 4217683968, free: 2182291456

    ------------ Kernel report ------------
    02/19/2013 19:01:50
    ------------ Loaded modules -----------
    \SystemRoot\system32\ntoskrnl.exe
    \SystemRoot\system32\hal.dll
    \SystemRoot\system32\kdcom.dll
    \SystemRoot\system32\mcupdate_GenuineIntel.dll
    \SystemRoot\system32\PSHED.dll
    \SystemRoot\system32\CLFS.SYS
    \SystemRoot\system32\CI.dll
    \SystemRoot\system32\drivers\Wdf01000.sys
    \SystemRoot\system32\drivers\WDFLDR.SYS
    \SystemRoot\system32\drivers\ACPI.sys
    \SystemRoot\system32\drivers\WMILIB.SYS
    \SystemRoot\system32\drivers\msisadrv.sys
    \SystemRoot\system32\drivers\pci.sys
    \SystemRoot\system32\drivers\vdrvroot.sys
    \SystemRoot\system32\DRIVERS\vsflt53.sys
    \SystemRoot\system32\drivers\gfibto.sys
    \SystemRoot\system32\DRIVERS\kl1.sys
    \SystemRoot\System32\drivers\partmgr.sys
    \SystemRoot\system32\DRIVERS\compbatt.sys
    \SystemRoot\system32\DRIVERS\BATTC.SYS
    \SystemRoot\system32\drivers\volmgr.sys
    \SystemRoot\System32\drivers\volmgrx.sys
    \SystemRoot\system32\drivers\intelide.sys
    \SystemRoot\system32\drivers\PCIIDEX.SYS
    \SystemRoot\system32\DRIVERS\pcmcia.sys
    \SystemRoot\System32\Drivers\bcfnt.sys
    \SystemRoot\System32\drivers\mountmgr.sys
    \SystemRoot\system32\drivers\vmbus.sys
    \SystemRoot\system32\drivers\winhv.sys
    \SystemRoot\system32\DRIVERS\iaStor.sys
    \SystemRoot\system32\drivers\atapi.sys
    \SystemRoot\system32\drivers\ataport.SYS
    \SystemRoot\system32\drivers\msahci.sys
    \SystemRoot\system32\drivers\amdxata.sys
    \SystemRoot\system32\drivers\fltmgr.sys
    \SystemRoot\system32\drivers\fileinfo.sys
    \SystemRoot\System32\Drivers\fsh.sys
    \SystemRoot\System32\Drivers\PxHlpa64.sys
    \SystemRoot\System32\Drivers\Ntfs.sys
    \SystemRoot\System32\Drivers\msrpc.sys
    \SystemRoot\System32\Drivers\ksecdd.sys
    \SystemRoot\System32\Drivers\cng.sys
    \SystemRoot\System32\drivers\pcw.sys
    \SystemRoot\System32\DRIVERS\DzHDD64.sys
    \SystemRoot\System32\Drivers\Fs_Rec.sys
    \SystemRoot\system32\drivers\ndis.sys
    \SystemRoot\system32\drivers\NETIO.SYS
    \SystemRoot\System32\Drivers\ksecpkg.sys
    \SystemRoot\System32\drivers\tcpip.sys
    \SystemRoot\System32\drivers\fwpkclnt.sys
    \SystemRoot\system32\DRIVERS\timntr.sys
    \SystemRoot\system32\DRIVERS\vididr.sys
    \SystemRoot\system32\drivers\vmstorfl.sys
    \SystemRoot\system32\drivers\volsnap.sys
    \SystemRoot\System32\Drivers\spldr.sys
    \SystemRoot\system32\DRIVERS\snapman.sys
    \SystemRoot\System32\drivers\rdyboost.sys
    \SystemRoot\System32\Drivers\mup.sys
    \SystemRoot\System32\drivers\hwpolicy.sys
    \SystemRoot\System32\DRIVERS\fvevol.sys
    \SystemRoot\system32\DRIVERS\disk.sys
    \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
    \SystemRoot\system32\DRIVERS\dtsoftbus01.sys
    \SystemRoot\System32\Drivers\BC_3DES.SYS
    \SystemRoot\System32\Drivers\BC_BF128.SYS
    \SystemRoot\System32\Drivers\BC_BF448.SYS
    \SystemRoot\System32\Drivers\BC_BFish.SYS
    \SystemRoot\System32\Drivers\BC_CAST.SYS
    \SystemRoot\System32\Drivers\BC_DES.SYS
    \SystemRoot\System32\Drivers\BC_Gost.SYS
    \SystemRoot\System32\Drivers\BC_IDEA.SYS
    \SystemRoot\System32\Drivers\BC_RC6.SYS
    \SystemRoot\System32\Drivers\BC_RIJN.SYS
    \SystemRoot\System32\Drivers\BC_SERP.SYS
    \SystemRoot\System32\Drivers\BC_TFISH.SYS
    \SystemRoot\system32\DRIVERS\klif.sys
    \SystemRoot\system32\DRIVERS\klflt.sys
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \SystemRoot\System32\drivers\vga.sys
    \SystemRoot\System32\drivers\VIDEOPRT.SYS
    \SystemRoot\System32\drivers\watchdog.sys
    \SystemRoot\System32\DRIVERS\RDPCDD.sys
    \SystemRoot\system32\drivers\rdpencdd.sys
    \SystemRoot\system32\drivers\rdprefmp.sys
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\system32\DRIVERS\tdx.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\system32\DRIVERS\kltdi.sys
    \SystemRoot\system32\drivers\afd.sys
    \SystemRoot\System32\DRIVERS\netbt.sys
    \SystemRoot\system32\drivers\ws2ifsl.sys
    \SystemRoot\system32\DRIVERS\wfplwf.sys
    \SystemRoot\system32\DRIVERS\pacer.sys
    \SystemRoot\system32\DRIVERS\klim6.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\wanarp.sys
    \SystemRoot\System32\drivers\Tppwr64v.sys
    \SystemRoot\system32\drivers\termdd.sys
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\drivers\nsiproxy.sys
    \SystemRoot\system32\drivers\mssmbios.sys
    \SystemRoot\system32\DRIVERS\smiifx64.sys
    \SystemRoot\system32\DRIVERS\kneps.sys
    \SystemRoot\System32\drivers\discache.sys
    \SystemRoot\system32\drivers\csc.sys
    \SystemRoot\System32\Drivers\dfsc.sys
    \SystemRoot\system32\DRIVERS\blbdrive.sys
    \SystemRoot\system32\DRIVERS\bcbus.sys
    \SystemRoot\system32\DRIVERS\tunnel.sys
    \SystemRoot\system32\DRIVERS\intelppm.sys
    \SystemRoot\system32\DRIVERS\igdkmd64.sys
    \SystemRoot\System32\drivers\dxgkrnl.sys
    \SystemRoot\System32\drivers\dxgmms1.sys
    \SystemRoot\system32\DRIVERS\e1e6032e.sys
    \SystemRoot\system32\DRIVERS\usbuhci.sys
    \SystemRoot\system32\DRIVERS\USBPORT.SYS
    \SystemRoot\system32\DRIVERS\usbehci.sys
    \SystemRoot\system32\drivers\HDAudBus.sys
    \SystemRoot\system32\DRIVERS\NETwLv64.sys
    \SystemRoot\system32\drivers\1394ohci.sys
    \SystemRoot\system32\drivers\sdbus.sys
    \SystemRoot\system32\drivers\i8042prt.sys
    \SystemRoot\system32\DRIVERS\klkbdflt.sys
    \SystemRoot\system32\drivers\kbdclass.sys
    \SystemRoot\System32\Drivers\mhk.SYS
    \SystemRoot\system32\DRIVERS\tp4track.sys
    \SystemRoot\system32\DRIVERS\klmouflt.sys
    \SystemRoot\system32\DRIVERS\mouclass.sys
    \SystemRoot\System32\Drivers\moh.SYS
    \SystemRoot\system32\drivers\tpm.sys
    \SystemRoot\system32\DRIVERS\CmBatt.sys
    \SystemRoot\system32\DRIVERS\ibmpmdrv.sys
    \SystemRoot\system32\DRIVERS\AMPPAL.sys
    \SystemRoot\system32\drivers\CompositeBus.sys
    \SystemRoot\system32\DRIVERS\serscan.sys
    \SystemRoot\system32\drivers\ksthunk.sys
    \SystemRoot\system32\drivers\ks.sys
    \SystemRoot\system32\DRIVERS\AgileVpn.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\rassstp.sys
    \SystemRoot\system32\DRIVERS\rdpbus.sys
    \SystemRoot\system32\DRIVERS\psadd.sys
    \SystemRoot\system32\drivers\swenum.sys
    \SystemRoot\system32\drivers\umbus.sys
    \SystemRoot\system32\DRIVERS\usbhub.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\system32\DRIVERS\cdrom.sys
    \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
    \SystemRoot\system32\drivers\ADIHdAud.sys
    \SystemRoot\system32\drivers\portcls.sys
    \SystemRoot\system32\drivers\drmk.sys
    \SystemRoot\system32\DRIVERS\CAXHWAZL.sys
    \SystemRoot\system32\DRIVERS\CAX_DPV.sys
    \SystemRoot\system32\DRIVERS\CAX_CNXT.sys
    \SystemRoot\system32\drivers\modem.sys
    \SystemRoot\System32\Drivers\crashdmp.sys
    \SystemRoot\System32\Drivers\dump_iaStor.sys
    \SystemRoot\System32\Drivers\dump_dumpfve.sys
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\drivers\Dxapi.sys
    \SystemRoot\system32\DRIVERS\monitor.sys
    \SystemRoot\System32\TSDDD.dll
    \SystemRoot\System32\cdd.dll
    \SystemRoot\System32\ATMFD.DLL
    \SystemRoot\system32\drivers\luafv.sys
    \??\C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys
    \SystemRoot\system32\drivers\WudfPf.sys
    \SystemRoot\system32\DRIVERS\WinUSB.sys
    \SystemRoot\system32\DRIVERS\WUDFRd.sys
    \SystemRoot\system32\DRIVERS\lltdio.sys
    \SystemRoot\system32\DRIVERS\nwifi.sys
    \SystemRoot\system32\DRIVERS\ndisuio.sys
    \SystemRoot\system32\DRIVERS\rspndr.sys
    \SystemRoot\system32\drivers\HTTP.sys
    \SystemRoot\system32\DRIVERS\bowser.sys
    \SystemRoot\System32\drivers\mpsdrv.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\system32\DRIVERS\mrxsmb10.sys
    \SystemRoot\system32\DRIVERS\mrxsmb20.sys
    \SystemRoot\system32\DRIVERS\mdmxsdk.sys
    \SystemRoot\system32\drivers\peauth.sys
    \SystemRoot\System32\Drivers\secdrv.SYS
    \SystemRoot\System32\DRIVERS\srvnet.sys
    \SystemRoot\System32\drivers\tcpipreg.sys
    \SystemRoot\system32\DRIVERS\xaudio64.sys
    \SystemRoot\System32\DRIVERS\srv2.sys
    \SystemRoot\System32\DRIVERS\srv.sys
    \SystemRoot\system32\DRIVERS\udfs.sys
    \SystemRoot\system32\DRIVERS\asyncmac.sys
    \??\C:\Windows\system32\drivers\mbamchameleon.sys
    \??\C:\Windows\system32\drivers\mbamswissarmy.sys
    \Windows\System32\ntdll.dll
    \Windows\System32\smss.exe
    \Windows\System32\apisetschema.dll
    ----------- End -----------
    <<<1>>>
    Upper Device Name: \Device\Harddisk0\DR0
    Upper Device Object: 0xfffffa8004c26060
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\Ide\IAAStorageDevice-0\
    Lower Device Object: 0xfffffa8004a45050
    Lower Device Driver Name: \Driver\iaStor\
    Driver name found: iaStor
    Initialization returned 0x0
    Load Function returned 0x0
    Downloaded database version: v2013.02.19.07
    Initializing...
    Done!
    <<<2>>>
    Device number: 0, partition: 2
    Physical Sector Size: 512
    Drive: 0, DevicePointer: 0xfffffa8004c26060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xfffffa8004c2a060, DeviceName: \Device\DozeHDD0\, DriverName: \Driver\DzHDD64\
    DevicePointer: 0xfffffa8004c26b70, DeviceName: Unknown, DriverName: \Driver\snapman\
    DevicePointer: 0xfffffa8004c27b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xfffffa8004c26d80, DeviceName: Unknown, DriverName: \Driver\bcfnt\
    DevicePointer: 0xfffffa8004c26060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    DevicePointer: 0xfffffa8004c24390, DeviceName: Unknown, DriverName: \Driver\vidsflt53\
    DevicePointer: 0xfffffa8004a34040, DeviceName: Unknown, DriverName: \Driver\ACPI\
    DevicePointer: 0xfffffa8004a45050, DeviceName: \Device\Ide\IAAStorageDevice-0\, DriverName: \Driver\iaStor\
    ------------ End ----------
    Alternate DeviceName: Unknown, DriverName: \Driver\snapman\
    Upper DeviceData: 0xfffff8a010381a40, 0xfffffa8004c26060, 0xfffffa8008bc6790
    Lower DeviceData: 0xfffff8a0044fa540, 0xfffffa8004a45050, 0xfffffa8003f61640
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Scanning directory: C:\Windows\system32\drivers...
    <<<2>>>
    Device number: 0, partition: 2
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Done!
    Drive 0
    Scanning MBR on drive 0...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: 307CF2F5

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048 Numsec = 204800
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848 Numsec = 443488256

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 443695104 Numsec = 25161728

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 240057409536 bytes
    Sector size: 512 bytes

    Scanning physical sectors of unpartitioned space on drive 0 (1-2047-468842128-468862128)...
    Done!
    Performing system, memory and registry scan...
    Done!
    Scan finished
    =======================================
  13. Broni

    Broni Malware Annihilator Posts: 46,123   +251

    [​IMG] Create new restore point before proceeding with the next step....
    How to:
    - Windows 8: http://www.vikitech.com/11302/system-restore-windows-8
    - Windows 7: http://www.howtogeek.com/howto/3195/create-a-system-restore-point-in-windows-7/
    - Vista: http://www.howtogeek.com/howto/wind...tore-point-for-windows-vistas-system-restore/
    - XP: http://support.microsoft.com/kb/948247

    [​IMG] Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
  14. echow

    echow Newcomer, in training Topic Starter Posts: 24

    ComboFix 13-02-18.02 - Edwin 02/19/2013 20:00:09.2.2 - x64
    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.4022.2313 [GMT -5:00]
    Running from: c:\users\Edwin\Desktop\ComboFix.exe
    AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
    FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
    SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\_ctypes.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\_elementtree.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\_hashlib.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\_socket.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\_ssl.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\pyexpat.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\pysqlite2._sqlite.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\python26.dll
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\pythoncom26.dll
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\PyWinTypes26.dll
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\select.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\unicodedata.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\win32api.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\win32com.shell.shell.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\win32crypt.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\win32event.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\win32file.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\win32inet.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\win32pdh.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\win32process.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\win32profile.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\win32security.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\win32ts.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\windows._cacheinvalidation.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\wx._controls_.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\wx._core_.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\wx._gdi_.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\wx._html2.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\wx._misc_.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\wx._windows_.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\wx._wizard.pyd
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\wxbase293u_net_vc.dll
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\wxbase293u_vc.dll
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\wxmsw293u_adv_vc.dll
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\wxmsw293u_core_vc.dll
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\wxmsw293u_html_vc.dll
    c:\users\Edwin\AppData\Local\Temp\_MEI17362\wxmsw293u_webview_vc.dll
    c:\users\Edwin\B462DBDB.tmp
    .
    .
    ((((((((((((((((((((((((( Files Created from 2013-01-20 to 2013-02-20 )))))))))))))))))))))))))))))))
    .
    .
    2013-02-20 01:09 . 2013-02-20 01:09--------d-----w-c:\users\Default\AppData\Local\temp
    2013-02-20 01:09 . 2013-02-20 01:09--------d-----w-c:\users\Administrator\AppData\Local\temp
    2013-02-19 16:46 . 2013-02-19 16:46--------d-----w-c:\program files (x86)\ESET
    2013-02-19 14:57 . 2013-01-08 05:329161176----a-w-c:\programdata\Microsoft\Windows Defender\Definition Updates\{053912CC-640B-4469-BF87-857B6B785D3B}\mpengine.dll
    2013-02-15 21:41 . 2012-01-14 04:4168864----a-w-c:\windows\system32\drivers\stream.sys
    2013-02-15 21:40 . 2013-02-15 21:40--------d-----w-c:\users\Edwin\AppData\Local\Lenovo
    2013-02-15 21:36 . 2011-10-05 03:41325120----a-w-c:\windows\system32\drivers\usbport.sys
    2013-02-15 21:36 . 2011-10-05 03:4125600----a-w-c:\windows\system32\drivers\usbohci.sys
    2013-02-15 21:36 . 2011-10-05 03:41343040----a-w-c:\windows\system32\drivers\usbhub.sys
    2013-02-15 21:36 . 2011-10-05 03:4199328----a-w-c:\windows\system32\drivers\usbccgp.sys
    2013-02-15 21:36 . 2011-10-05 03:4152736----a-w-c:\windows\system32\drivers\usbehci.sys
    2013-02-15 21:36 . 2011-10-05 03:4130720----a-w-c:\windows\system32\drivers\usbuhci.sys
    2013-02-15 21:36 . 2011-10-05 03:417936----a-w-c:\windows\system32\drivers\usbd.sys
    2013-02-15 21:35 . 2013-02-15 21:3553248----a-r-c:\users\Edwin\AppData\Roaming\Microsoft\Installer\{0369F866-2CE0-4EB9-B426-88FA122C6E82}\ARPPRODUCTICON.exe
    2013-02-15 21:35 . 2013-02-15 21:35--------d-----w-c:\program files\Common Files\Lenovo
    2013-02-15 21:35 . 2013-02-15 21:3553248----a-r-c:\users\Edwin\AppData\Roaming\Microsoft\Installer\{6E6E7725-C7BC-4C39-8B3F-14B67331A120}\ARPPRODUCTICON.exe
    2013-02-15 21:35 . 2013-02-15 21:35--------d-----w-c:\program files (x86)\Common Files\Lenovo
    2013-02-14 21:43 . 2013-02-14 21:43--------d-----w-c:\users\Edwin\AppData\Roaming\Malwarebytes
    2013-02-14 21:42 . 2013-02-14 21:42--------d-----w-c:\programdata\Malwarebytes
    2013-02-14 21:42 . 2013-02-14 21:42--------d-----w-c:\program files (x86)\Malwarebytes' Anti-Malware
    2013-02-14 21:42 . 2012-12-14 21:4924176----a-w-c:\windows\system32\drivers\mbam.sys
    2013-02-13 22:55 . 2013-02-13 22:55--------d-----w-c:\users\Edwin\AppData\Roaming\LavasoftStatistics
    2013-02-13 22:53 . 2013-02-14 14:57--------d-----w-c:\program files (x86)\Ad-Aware Antivirus
    2013-02-13 22:52 . 2013-02-13 22:52--------d-----w-c:\users\Edwin\AppData\Local\Downloaded Installations
    2013-02-13 22:52 . 2013-02-13 22:5214456----a-w-c:\windows\system32\drivers\gfibto.sys
    2013-02-13 22:51 . 2013-02-13 22:51--------d-----w-c:\programdata\blekko toolbars
    2013-02-13 22:51 . 2013-02-13 22:51--------d-----w-c:\users\Edwin\AppData\Local\adawarebp
    2013-02-13 22:51 . 2013-02-13 22:51--------d-----w-c:\programdata\Ad-Aware Browsing Protection
    2013-02-13 22:51 . 2013-02-13 22:51--------d-----w-c:\program files (x86)\adawaretb
    2013-02-13 22:51 . 2013-02-13 22:51--------d-----w-c:\program files (x86)\Toolbar Cleaner
    2013-02-13 22:21 . 2013-02-13 22:2195648----a-w-c:\windows\SysWow64\WindowsAccessBridge-32.dll
    2013-02-13 21:40 . 2013-02-13 22:32--------d-----w-c:\programdata\Spybot - Search & Destroy
    2013-02-13 21:40 . 2013-02-15 00:25--------d-----w-c:\program files (x86)\Spybot - Search & Destroy 2
    2013-02-13 14:41 . 2013-01-09 01:10996352----a-w-c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
    2013-02-13 14:41 . 2013-01-08 22:01768000----a-w-c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
    2013-02-13 05:05 . 2013-01-05 05:535553512----a-w-c:\windows\system32\ntoskrnl.exe
    2013-02-13 05:05 . 2013-01-05 05:003967848----a-w-c:\windows\SysWow64\ntkrnlpa.exe
    2013-02-13 05:05 . 2013-01-05 05:003913064----a-w-c:\windows\SysWow64\ntoskrnl.exe
    2013-02-13 05:05 . 2013-01-04 03:263153408----a-w-c:\windows\system32\win32k.sys
    2013-02-13 05:05 . 2013-01-04 05:46215040----a-w-c:\windows\system32\winsrv.dll
    2013-02-13 05:05 . 2013-01-04 04:515120----a-w-c:\windows\SysWow64\wow32.dll
    2013-02-13 05:05 . 2013-01-04 02:4725600----a-w-c:\windows\SysWow64\setup16.exe
    2013-02-13 05:05 . 2013-01-04 02:477680----a-w-c:\windows\SysWow64\instnm.exe
    2013-02-13 05:05 . 2013-01-04 02:472048----a-w-c:\windows\SysWow64\user.exe
    2013-02-13 05:05 . 2013-01-04 02:4714336----a-w-c:\windows\SysWow64\ntvdm64.dll
    2013-02-13 05:05 . 2013-01-03 06:001913192----a-w-c:\windows\system32\drivers\tcpip.sys
    2013-02-13 05:05 . 2013-01-03 06:00288088----a-w-c:\windows\system32\drivers\FWPKCLNT.SYS
    2013-01-30 21:50 . 2013-02-19 23:52--------d-s---w-c:\users\Edwin\Google Drive
    2013-01-30 21:35 . 2013-01-31 01:20--------d-----w-c:\program files (x86)\DC-Unlocker
    2013-01-30 21:11 . 2013-01-30 21:11--------d-----w-c:\users\Edwin\AppData\Roaming\MyLifeOrganized
    2013-01-30 21:11 . 2013-01-30 21:11--------d-----w-c:\users\Edwin\AppData\Local\MyLifeOrganized
    2013-01-30 20:57 . 2013-01-30 20:57--------d-----w-c:\program files (x86)\MyLifeOrganized.net
    2013-01-29 19:58 . 2013-01-29 19:58--------d-----w-c:\users\Edwin\AppData\Roaming\ooVoo Details
    2013-01-29 19:58 . 2013-01-29 19:58--------d-----w-c:\program files (x86)\ooVoo
    2013-01-25 19:41 . 2013-01-25 19:41--------d-----w-c:\programdata\regid.1991-06.com.microsoft
    2013-01-25 19:41 . 2013-01-25 19:41--------d-----w-c:\program files (x86)\Microsoft SQL Server
    2013-01-25 19:41 . 2013-01-25 19:41--------d-----w-c:\windows\PCHEALTH
    2013-01-25 18:54 . 2013-01-25 18:55--------d-----w-c:\users\Edwin\AppData\Roaming\Download Manager
    2013-01-25 18:44 . 2013-01-25 18:44283200----a-w-c:\windows\system32\drivers\dtsoftbus01.sys
    2013-01-25 18:40 . 2013-01-25 18:44--------d-----w-c:\program files (x86)\DAEMON Tools Lite
    2013-01-25 17:12 . 2013-01-25 18:52--------d-----w-c:\program files\Microsoft Office 15
    2013-01-25 16:39 . 2013-01-25 16:396779504----a-w-c:\program files\Common Files\Microsoft Shared\OFFICE15\CMigrate.exe
    2013-01-25 16:39 . 2013-01-25 16:396557808----a-w-c:\program files\Common Files\Microsoft Shared\OFFICE15\Csi.dll
    2013-01-25 15:36 . 2013-01-25 15:3633968----a-w-c:\program files (x86)\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll
    2013-01-25 15:29 . 2013-01-25 15:295065840----a-w-c:\program files (x86)\Common Files\Microsoft Shared\OFFICE15\CMigrate.exe
    2013-01-25 15:29 . 2013-01-25 15:294830832----a-w-c:\program files (x86)\Common Files\Microsoft Shared\OFFICE15\Csi.dll
    2013-01-25 15:28 . 2013-01-25 15:2861010528----a-w-c:\program files (x86)\Common Files\Microsoft Shared\OFFICE15\MSORES.DLL
    2013-01-25 15:28 . 2013-01-25 15:2825357936----a-w-c:\program files (x86)\Common Files\Microsoft Shared\OFFICE15\MSO.DLL
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2013-02-15 06:43 . 2011-01-25 00:2770004024----a-w-c:\windows\system32\MRT.exe
    2013-02-13 23:24 . 2012-04-04 20:34691568----a-w-c:\windows\SysWow64\FlashPlayerApp.exe
    2013-02-13 23:24 . 2011-06-27 20:4271024----a-w-c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2013-02-13 22:21 . 2013-01-11 19:36861088----a-w-c:\windows\SysWow64\npdeployJava1.dll
    2013-02-13 22:21 . 2011-04-24 02:06782240----a-w-c:\windows\SysWow64\deployJava1.dll
    2013-01-30 20:44 . 2011-02-01 19:3718960----a-w-c:\windows\system32\drivers\LNonPnP.sys
    2013-01-30 10:53 . 2011-01-24 22:43273840------w-c:\windows\system32\MpSigStub.exe
    2013-01-12 06:30 . 2012-06-08 16:3854104----a-w-c:\windows\system32\drivers\kltdi.sys
    2013-01-12 06:30 . 2012-10-25 22:23613720----a-w-c:\windows\system32\drivers\klif.sys
    2013-01-11 23:25 . 2013-01-11 23:2553248----a-r-c:\users\Edwin\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
    2013-01-09 11:40 . 2011-01-25 01:532692904------w-c:\windows\PWMBTHLV.EXE
    2013-01-09 11:40 . 2011-01-25 01:5229512----a-w-c:\windows\system32\drivers\DZHDD64.SYS
    2013-01-09 11:40 . 2011-01-25 01:522811688----a-w-c:\windows\system32\PWMCP64V.cpl
    2013-01-09 11:40 . 2011-01-25 01:5220328----a-w-c:\windows\system32\drivers\TPPWR64V.SYS
    2013-01-04 04:43 . 2013-02-13 05:0544032----a-w-c:\windows\apppatch\acwow64.dll
    2012-12-16 17:11 . 2013-01-12 06:5246080----a-w-c:\windows\system32\atmlib.dll
    2012-12-16 14:45 . 2013-01-12 06:52367616----a-w-c:\windows\system32\atmfd.dll
    2012-12-16 14:13 . 2013-01-12 06:52295424----a-w-c:\windows\SysWow64\atmfd.dll
    2012-12-16 14:13 . 2013-01-12 06:5234304----a-w-c:\windows\SysWow64\atmlib.dll
    2012-12-11 11:22 . 2012-12-11 11:2272048----a-w-c:\windows\system32\ibmpmctl.exe
    2012-12-11 11:22 . 2012-12-11 11:2260272----a-w-c:\windows\system32\ibmpmsvc.exe
    2012-12-11 11:22 . 2012-12-11 11:2242824----a-w-c:\windows\system32\drivers\ibmpmdrv.sys
    2012-12-11 11:22 . 2012-12-11 11:2239792----a-w-c:\windows\system32\tpinspm.dll
    2012-12-07 13:20 . 2013-01-12 06:32441856----a-w-c:\windows\system32\Wpc.dll
    2012-12-07 13:15 . 2013-01-12 06:322746368----a-w-c:\windows\system32\gameux.dll
    2012-12-07 12:26 . 2013-01-12 06:32308736----a-w-c:\windows\SysWow64\Wpc.dll
    2012-12-07 12:20 . 2013-01-12 06:322576384----a-w-c:\windows\SysWow64\gameux.dll
    2012-12-07 11:20 . 2013-01-12 06:3230720----a-w-c:\windows\system32\usk.rs
    2012-12-07 11:20 . 2013-01-12 06:3243520----a-w-c:\windows\system32\csrr.rs
    2012-12-07 11:20 . 2013-01-12 06:3223552----a-w-c:\windows\system32\oflc.rs
    2012-12-07 11:20 . 2013-01-12 06:3245568----a-w-c:\windows\system32\oflc-nz.rs
    2012-12-07 11:20 . 2013-01-12 06:3244544----a-w-c:\windows\system32\pegibbfc.rs
    2012-12-07 11:20 . 2013-01-12 06:3220480----a-w-c:\windows\system32\pegi-fi.rs
    2012-12-07 11:20 . 2013-01-12 06:3220480----a-w-c:\windows\system32\pegi-pt.rs
    2012-12-07 11:19 . 2013-01-12 06:3220480----a-w-c:\windows\system32\pegi.rs
    2012-12-07 11:19 . 2013-01-12 06:3246592----a-w-c:\windows\system32\fpb.rs
    2012-12-07 11:19 . 2013-01-12 06:3240960----a-w-c:\windows\system32\cob-au.rs
    2012-12-07 11:19 . 2013-01-12 06:3215360----a-w-c:\windows\system32\djctq.rs
    2012-12-07 11:19 . 2013-01-12 06:3221504----a-w-c:\windows\system32\grb.rs
    2012-12-07 11:19 . 2013-01-12 06:3255296----a-w-c:\windows\system32\cero.rs
    2012-12-07 11:19 . 2013-01-12 06:3251712----a-w-c:\windows\system32\esrb.rs
    2012-12-07 10:46 . 2013-01-12 06:3243520----a-w-c:\windows\SysWow64\csrr.rs
    2012-12-07 10:46 . 2013-01-12 06:3230720----a-w-c:\windows\SysWow64\usk.rs
    2012-12-07 10:46 . 2013-01-12 06:3245568----a-w-c:\windows\SysWow64\oflc-nz.rs
    2012-12-07 10:46 . 2013-01-12 06:3244544----a-w-c:\windows\SysWow64\pegibbfc.rs
    2012-12-07 10:46 . 2013-01-12 06:3220480----a-w-c:\windows\SysWow64\pegi-pt.rs
    2012-12-07 10:46 . 2013-01-12 06:3223552----a-w-c:\windows\SysWow64\oflc.rs
    2012-12-07 10:46 . 2013-01-12 06:3220480----a-w-c:\windows\SysWow64\pegi-fi.rs
    2012-12-07 10:46 . 2013-01-12 06:3246592----a-w-c:\windows\SysWow64\fpb.rs
    2012-12-07 10:46 . 2013-01-12 06:3220480----a-w-c:\windows\SysWow64\pegi.rs
    2012-12-07 10:46 . 2013-01-12 06:3221504----a-w-c:\windows\SysWow64\grb.rs
    2012-12-07 10:46 . 2013-01-12 06:3240960----a-w-c:\windows\SysWow64\cob-au.rs
    2012-12-07 10:46 . 2013-01-12 06:3215360----a-w-c:\windows\SysWow64\djctq.rs
    2012-12-07 10:46 . 2013-01-12 06:3255296----a-w-c:\windows\SysWow64\cero.rs
    2012-12-07 10:46 . 2013-01-12 06:3251712----a-w-c:\windows\SysWow64\esrb.rs
    2012-11-30 05:45 . 2013-01-12 06:33362496----a-w-c:\windows\system32\wow64win.dll
    2012-11-30 05:45 . 2013-01-12 06:33243200----a-w-c:\windows\system32\wow64.dll
    2012-11-30 05:45 . 2013-01-12 06:3313312----a-w-c:\windows\system32\wow64cpu.dll
    2012-11-30 05:43 . 2013-01-12 06:3316384----a-w-c:\windows\system32\ntvdm64.dll
    2012-11-30 05:41 . 2013-01-12 06:33424448----a-w-c:\windows\system32\KernelBase.dll
    2012-11-30 05:41 . 2013-01-12 06:331161216----a-w-c:\windows\system32\kernel32.dll
    2012-11-30 05:38 . 2013-01-12 06:336144---ha-w-c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:334608---ha-w-c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:334608---ha-w-c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:334096---ha-w-c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:334096---ha-w-c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333584---ha-w-c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333584---ha-w-c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333584---ha-w-c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333584---ha-w-c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333072---ha-w-c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333072---ha-w-c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333072---ha-w-c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333072---ha-w-c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:335120---ha-w-c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:334096---ha-w-c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:334096---ha-w-c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333584---ha-w-c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333584---ha-w-c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333584---ha-w-c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333072---ha-w-c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333072---ha-w-c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333072---ha-w-c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333072---ha-w-c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333072---ha-w-c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333072---ha-w-c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333072---ha-w-c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333072---ha-w-c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
    2012-11-30 05:38 . 2013-01-12 06:333072---ha-w-c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
    2012-11-30 04:53 . 2013-01-12 06:33274944----a-w-c:\windows\SysWow64\KernelBase.dll
    2012-11-30 04:45 . 2013-01-12 06:334608---ha-w-c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
    2012-11-30 04:45 . 2013-01-12 06:334096---ha-w-c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
    2012-11-30 04:45 . 2013-01-12 06:334096---ha-w-c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
    2012-11-30 04:45 . 2013-01-12 06:334096---ha-w-c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
    2012-11-30 04:45 . 2013-01-12 06:334096---ha-w-c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
    2012-11-30 04:45 . 2013-01-12 06:334096---ha-w-c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
    2012-11-30 04:45 . 2013-01-12 06:333584---ha-w-c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
    2012-11-30 04:45 . 2013-01-12 06:333584---ha-w-c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
    2012-11-30 04:45 . 2013-01-12 06:333584---ha-w-c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
    2012-11-30 04:45 . 2013-01-12 06:333584---ha-w-c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2013-02-01 15:191722488----a-w-c:\progra~2\MICROS~2\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2013-02-01 15:191722488----a-w-c:\progra~2\MICROS~2\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2013-02-01 15:191722488----a-w-c:\progra~2\MICROS~2\Office15\GROOVEEX.DLL
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Spotify Web Helper"="c:\users\Edwin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-01-18 1199576]
    "GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2012-12-18 16328976]
    "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-01-08 3674320]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [2013-01-12 356376]
    "TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [2011-06-22 2637824]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
    "SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-05-18 1314816]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
    "PWMTRV"="c:\progra~2\ThinkPad\UTILIT~1\PWMTR64V.DLL" [2013-01-09 6000936]
    "LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]
    "ControlCenter4"="c:\program files (x86)\ControlCenter4\BrCcBoot.exe" [2011-04-20 139264]
    "BrStsMon00"="c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2010-06-10 2621440]
    "BCWipeTM Startup"="c:\program files (x86)\Jetico\BestCrypt\BCWipeTM.exe" [2011-12-29 1088312]
    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-12 59280]
    "AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
    "AmazonGSDownloaderTray"="c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
    "Ad-Aware Browsing Protection"="c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe" [2012-12-11 542104]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    BestCrypt Auto Open.lnk - c:\program files (x86)\Jetico\BestCrypt\BestCrypt.exe [2011-8-2 1642808]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoThumbNailCache"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
    "LoadAppInit_DLLs"=1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecuteREG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Notification PackagesREG_MULTI_SZ scecli c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1248549332-523462300-163367360-1001\Scripts\Logoff\0\0]
    "Script"=c:\program files (x86)\Jetico\BestCrypt\BCWipeTM.exe
    .
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2012-08-23 13672]
    R2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [2012-08-24 127072]
    R3 Amazon Download Agent;Amazon Download Agent;c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2009-10-23 401920]
    R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys [2011-08-08 299008]
    R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [x]
    R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys [x]
    R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys [x]
    R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys [x]
    R3 AndNetDiag;LG AndroidNet USB Serial Port;c:\windows\system32\DRIVERS\lgandnetdiag64.sys [x]
    R3 AndNetGps;LG AndroidNet USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandnetgps64.sys [x]
    R3 ANDNetModem;LG AndroidNet USB Modem;c:\windows\system32\DRIVERS\lgandnetmodem64.sys [x]
    R3 andnetndis;LG AndroidNet NDIS Ethernet Adapter;c:\windows\system32\DRIVERS\lgandnetndis64.sys [x]
    R3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe [2010-01-25 245760]
    R3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2013-01-09 320576]
    R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2010-12-13 36720]
    R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [2011-05-10 22528]
    R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
    R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2013-01-09 1665832]
    R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [2013-01-09 1664296]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
    R3 RoxMediaDB10;RoxMediaDB10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-09-24 1124848]
    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-26 1255736]
    R4 BCSWAP;BCSWAP; [x]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
    S0 bcfnt;bcfnt; [x]
    S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys [2013-01-09 29512]
    S0 fsh;fsh; [x]
    S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys [2013-02-13 14456]
    S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]
    S0 vididr;Acronis Virtual Disk;c:\windows\system32\DRIVERS\vididr.sys [2012-04-10 210016]
    S0 vidsflt53;Acronis Disk Storage Filter (53);c:\windows\system32\DRIVERS\vsflt53.sys [2012-04-10 141920]
    S1 BC_3DES;BC_3DES; [x]
    S1 BC_BF128;BC_BF128; [x]
    S1 BC_BF448;BC_BF448; [x]
    S1 BC_BFish;BC_BFish; [x]
    S1 BC_CAST;BC_CAST; [x]
    S1 BC_DES;BC_DES; [x]
    S1 BC_Gost;BC_Gost; [x]
    S1 BC_IDEA;BC_IDEA; [x]
    S1 BC_RC6;BC_RC6; [x]
    S1 BC_RIJN;BC_RIJN; [x]
    S1 BC_SERP;BC_SERP; [x]
    S1 BC_TFISH;BC_TFISH; [x]
    S1 bcbus;BestCrypt bus driver;c:\windows\system32\DRIVERS\bcbus.sys [2011-08-25 83008]
    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2013-01-25 283200]
    S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2012-08-02 28504]
    S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys [2013-01-12 54104]
    S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys [2012-08-13 178008]
    S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiifx64.sys [2010-09-07 15472]
    S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-08-08 1166848]
    S2 BCWipeSvc;BCWipe service;c:\program files (x86)\Jetico\BestCrypt\BCWipeSvc.exe [2011-03-28 95544]
    S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-06-03 134928]
    S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\LENOVO\HOTKEY\CAMMUTE.exe [2009-11-09 54632]
    S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [2011-07-12 133992]
    S2 OfficeSvc;Microsoft Office Service;c:\program files\Microsoft Office 15\ClientX64\integratedoffice.exe [2012-11-23 1855064]
    S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]
    S2 smihlp;SMI Helper Driver (smihlp);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [2009-03-13 13840]
    S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2012-12-14 3467768]
    S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [2012-12-18 127120]
    S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [2012-12-04 125504]
    S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [2011-08-08 299008]
    S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys [2006-12-21 300032]
    S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys [2012-10-25 29016]
    S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2012-10-25 29528]
    S3 mhk;mhk; [x]
    S3 moh;moh; [x]
    S3 NETwLv64; Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\NETwLv64.sys [2010-10-07 7533568]
    S3 Tp4Track;PS/2 TrackPoint Driver;c:\windows\system32\DRIVERS\tp4track.sys [2011-11-01 29992]
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2013-02-20 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 23:24]
    .
    2013-02-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-01 04:23]
    .
    2013-02-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-01 04:23]
    .
    2013-02-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1248549332-523462300-163367360-1001Core.job
    - c:\users\Edwin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-25 00:42]
    .
    2013-02-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1248549332-523462300-163367360-1001UA.job
    - c:\users\Edwin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-25 00:42]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{EFEED92A-A33D-4873-BA8F-32BAA631E54D}"= "c:\program files (x86)\Astroburn Toolbar\ABToolbar64.dll" [BU]
    .
    [HKEY_CLASSES_ROOT\CLSID\{EFEED92A-A33D-4873-BA8F-32BAA631E54D}]
    [HKEY_CLASSES_ROOT\ABToolbar.ToolBandObj.1]
    [HKEY_CLASSES_ROOT\TypeLib\{142EECD7-B6CA-4e29-AE5D-A4798EF4FD7F}]
    [HKEY_CLASSES_ROOT\ABToolbar.ToolBandObj]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2013-02-01 16:562324576----a-w-c:\progra~1\MICROS~1\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2013-02-01 16:562324576----a-w-c:\progra~1\MICROS~1\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2013-02-01 16:562324576----a-w-c:\progra~1\MICROS~1\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
    @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
    [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
    2012-12-18 00:50755816----a-w-c:\program files (x86)\Google\Drive\googledrivesync64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
    @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
    [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
    2012-12-18 00:50755816----a-w-c:\program files (x86)\Google\Drive\googledrivesync64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
    @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
    [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
    2012-12-18 00:50755816----a-w-c:\program files (x86)\Google\Drive\googledrivesync64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
    @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
    [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
    2012-12-18 00:50755816----a-w-c:\program files (x86)\Google\Drive\googledrivesync64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TrackPointSrv"="c:\program files (x86)\Lenovo\TrackPoint\tp4serv.exe" [BU]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-06 363544]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-06 165912]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-06 385560]
    "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
    "AcWin7Hlpr"="c:\program files (x86)\Lenovo\Access Connections\AcTBenabler.exe" [BU]
    "Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2011-06-22 395392]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = *.local
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office15\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~2\MICROS~2\Office15\ONBttnIE.dll/105
    TCP: DhcpNameServer = 10.0.1.1
    Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
    FF - ProfilePath - c:\users\Edwin\AppData\Roaming\Mozilla\Firefox\Profiles\2p8iduiq.default\
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - ExtSQL: 2013-01-11 14:36; {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA}; c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA}
    FF - ExtSQL: 2013-01-12 01:31; anti_banner@kaspersky.com; c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
    FF - ExtSQL: 2013-01-12 01:31; content_blocker@kaspersky.com; c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
    FF - ExtSQL: 2013-01-12 01:31; online_banking@kaspersky.com; c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
    FF - ExtSQL: 2013-01-12 01:31; url_advisor@kaspersky.com; c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
    FF - ExtSQL: 2013-01-12 01:31; virtual_keyboard@kaspersky.com; c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
    FF - ExtSQL: 2013-02-13 17:51; jid1-yZwVFzbsyfMrqQ@jetpack; c:\users\Edwin\AppData\Roaming\Mozilla\Firefox\Profiles\2p8iduiq.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
    FF - user.js: network.protocol-handler.warn-external.dnupdate - false
    .
    - - - - ORPHANS REMOVED - - - -
    .
    ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    AddRemove-TekniaHebrew - c:\teknia\UNWISE.EXE
    AddRemove-{90140000-0015-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-0016-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-0018-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-0019-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-001A-0409-0000-0000000FF1CE}_Office14.SingleImage_{1EEFF749-6F29-4F0B-AB08-4C6EA52AA110} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-001A-0409-0000-0000000FF1CE}_Office14.SingleImage_{47894754-0FEC-4920-9A65-6C1E732587AC} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-001A-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-001B-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{C4F26A9B-B121-4135-8084-A0D9C780C7C8} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{460FF681-BC66-4C38-99DF-7012E03F1EBA} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.SingleImage_{C633216E-FF30-45B6-B2AB-21922A9353EF} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.SingleImage_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{1CBEDB37-C438-473F-8BA0-2535B0D237E2} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{5DA2D071-A54C-47C0-83E5-43C63DBFD936} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{DFE7321B-F914-4AB5-8C74-1F8CC932B1B0} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-002A-0409-1000-0000000FF1CE}_Office14.SingleImage_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-002C-0409-0000-0000000FF1CE}_Office14.SingleImage_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-006E-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-006E-0409-0000-0000000FF1CE}_Office14.SingleImage_{73E67A3A-8D61-44EF-90C2-1697C3DBE668} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-00A1-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-00A1-0409-0000-0000000FF1CE}_Office14.SingleImage_{9865DC3A-2898-48D9-B96A-46397571C934} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-0115-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-0116-0409-1000-0000000FF1CE}_Office14.SingleImage_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    AddRemove-{90140000-0117-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_168_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_168_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_168_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_168_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.11"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
    @Denied: (A) (Everyone)
    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
    @Denied: (A) (Everyone)
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
    "Key"="ActionsPane3"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\LENOVO\HOTKEY\tposdsvc.exe
    c:\program files\Lenovo\HOTKEY\TPONSCR.exe
    c:\program files\Lenovo\Zoom\TpScrex.exe
    c:\program files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    c:\program files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    .
    **************************************************************************
    .
    Completion time: 2013-02-19 20:14:07 - machine was rebooted
    ComboFix-quarantined-files.txt 2013-02-20 01:14
    ComboFix2.txt 2013-02-19 23:22
    .
    Pre-Run: 101,718,388,736 bytes free
    Post-Run: 101,393,100,800 bytes free
    .
    - - End Of File - - F7C772A0C21C6FD37D89CE9CE80BC271
  15. Broni

    Broni Malware Annihilator Posts: 46,123   +251

    Looks good.

    How is computer doing?

    =================================

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Delete.
    • Confirm each time with Ok.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

    [​IMG] Download OTL to your Desktop.
    Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
  16. echow

    echow Newcomer, in training Topic Starter Posts: 24

    Still has pop ups
  17. Broni

    Broni Malware Annihilator Posts: 46,123   +251

    Which browser?

    Go ahead with steps from my previous reply.
  18. echow

    echow Newcomer, in training Topic Starter Posts: 24

    # AdwCleaner v2.112 - Logfile created 02/19/2013 at 20:38:23
    # Updated 10/02/2013 by Xplode
    # Operating system : Windows 7 Professional Service Pack 1 (64 bits)
    # User : Edwin - EDWIN-PC
    # Boot Mode : Normal
    # Running from : C:\Users\Edwin\Desktop\adwcleaner0.exe
    # Option [Delete]


    ***** [Services] *****


    ***** [Files / Folders] *****

    Folder Deleted : C:\Program Files (x86)\adawaretb
    Folder Deleted : C:\Program Files (x86)\Astroburn Toolbar
    Folder Deleted : C:\ProgramData\blekko toolbars
    Folder Deleted : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\f7n63uic.default\adawaretb
    Folder Deleted : C:\Users\Edwin\AppData\LocalLow\adawaretb
    Folder Deleted : C:\Users\Edwin\AppData\Roaming\Mozilla\Firefox\Profiles\2p8iduiq.default\adawaretb

    ***** [Registry] *****

    Key Deleted : HKCU\Software\AppDataLow\TENCENT
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5F970FDE-702B-4EF9-920C-5F2848A5AF26}
    Key Deleted : HKLM\Software\TENCENT

    ***** [Internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16464

    [OK] Registry is clean.

    -\\ Mozilla Firefox v5.0 (en-US)

    File : C:\Users\Edwin\AppData\Roaming\Mozilla\Firefox\Profiles\2p8iduiq.default\prefs.js

    C:\Users\Edwin\AppData\Roaming\Mozilla\Firefox\Profiles\2p8iduiq.default\user.js ... Deleted !

    [OK] File is clean.

    File : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\f7n63uic.default\prefs.js

    [OK] File is clean.

    -\\ Google Chrome v24.0.1312.57

    File : C:\Users\Edwin\AppData\Local\Google\Chrome\User Data\Default\Preferences

    [OK] File is clean.

    *************************

    AdwCleaner[R1].txt - [1816 octets] - [19/02/2013 20:38:08]
    AdwCleaner[S1].txt - [1714 octets] - [19/02/2013 20:38:23]

    ########## EOF - C:\AdwCleaner[S1].txt - [1774 octets] ##########
  19. echow

    echow Newcomer, in training Topic Starter Posts: 24

  20. Broni

    Broni Malware Annihilator Posts: 46,123   +251

    Go on...
  21. echow

    echow Newcomer, in training Topic Starter Posts: 24

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 4.6.5 (02.18.2013:1)
    OS: Windows 7 Professional x64
    Ran by Edwin on Tue 02/19/2013 at 20:45:13.39
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys

    Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{1ff7973d-ab0a-496d-82c1-4eadbba11e7b}



    ~~~ Files



    ~~~ Folders

    Successfully deleted: [Folder] "C:\Users\Edwin\AppData\Roaming\tencent"
    Successfully deleted: [Folder] "C:\Users\Edwin\appdata\local\adawarebp"



    ~~~ FireFox

    Successfully deleted: [File] C:\Users\Edwin\AppData\Roaming\mozilla\firefox\profiles\2p8iduiq.default\searchplugins\absearch-search.xml
    Successfully deleted: [Folder] C:\Users\Edwin\AppData\Roaming\mozilla\firefox\profiles\2p8iduiq.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Tue 02/19/2013 at 21:02:45.43
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  22. echow

    echow Newcomer, in training Topic Starter Posts: 24

    OTL Extras logfile created on: 2/19/2013 9:14:23 PM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Edwin\Desktop
    64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    3.93 Gb Total Physical Memory | 1.88 Gb Available Physical Memory | 47.85% Memory free
    7.85 Gb Paging File | 5.31 Gb Available in Paging File | 67.59% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 211.47 Gb Total Space | 94.39 Gb Free Space | 44.64% Space Free | Partition Type: NTFS
    Drive D: | 12.00 Gb Total Space | 1.91 Gb Free Space | 15.92% Space Free | Partition Type: NTFS
    Drive E: | 2.99 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

    Computer Name: EDWIN-PC | User Name: Edwin | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
    .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
    .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

    ========== Shell Spawning ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
    http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
    InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
    InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{00050BB7-56BB-4ECA-A4B3-26007D35F945}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{103A2F22-EE1F-4598-9BE2-4108594F7444}" = rport=10243 | protocol=6 | dir=out | app=system |
    "{113F8CF5-AB86-420C-9B18-9C0A2CB5C337}" = lport=54925 | protocol=17 | dir=in | name=brothernetwork scanner |
    "{1B3C6E23-B02B-4C82-B7E4-7BB04D7F01D0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
    "{1E092D1C-18EA-4C5F-9A58-1C1FB9D8824C}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service v4\intuitupdater.exe |
    "{2C9EE944-464E-41AE-A97B-A32C58D52620}" = lport=445 | protocol=6 | dir=in | app=system |
    "{2DA31E60-5A97-41A2-B56E-23040A93CD07}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{2E475573-B560-4E3E-BC81-3AA5E9B12463}" = lport=8725 | protocol=6 | dir=in | name=I-clickr.exe operation port (8725) |
    "{328279D5-8A6A-4414-9E25-A617C646FF15}" = lport=138 | protocol=17 | dir=in | app=system |
    "{3794F59E-5DB6-4BE0-85EB-D3F96287E055}" = lport=1725 | protocol=6 | dir=in | name=I-clickr.exe operation port (1725) |
    "{3E8FA502-A299-4F78-8883-1C66B4C43D39}" = lport=8725 | protocol=6 | dir=in | name=I-clickr.exe operation port (8725) |
    "{435E7BBD-419A-424C-8AC8-6358BF2AB17F}" = lport=2869 | protocol=6 | dir=in | app=system |
    "{505D5A04-5964-4E15-9EC1-998C99E149E7}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{567BD764-4EC6-462C-B0A3-C875B806C139}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
    "{58F8D680-E1FA-46CB-9598-8401C398BB7D}" = rport=137 | protocol=17 | dir=out | app=system |
    "{65392471-F028-4B8A-A42F-B86EAB312F4F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{7D7255C9-2233-4349-8A25-A1E708B802C5}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
    "{85A892E9-2B75-4D8F-BACE-6EA1C58D94D9}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{8ED77272-7A18-4B72-9D2E-0CEABD8A6E60}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office15\outlook.exe |
    "{921E5786-784D-4859-8581-A915434D4AB7}" = rport=138 | protocol=17 | dir=out | app=system |
    "{978B3310-5DEE-4869-B293-9182015F344F}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service\intuitupdateservice.exe |
    "{97B46174-5F15-4314-8157-4EA531FB89BC}" = rport=139 | protocol=6 | dir=out | app=system |
    "{AE21BFE3-4332-401C-AB20-BEBD2DCE1305}" = lport=1725 | protocol=6 | dir=in | name=I-clickr.exe operation port (1725) |
    "{B5158974-7568-4109-B54D-95BB337691A0}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
    "{B68854EC-E4BA-419B-AF96-35109275B940}" = lport=139 | protocol=6 | dir=in | app=system |
    "{BBD0473D-5FE6-4253-9727-D2CFFEE724DC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{C84DD638-D5ED-44C0-9923-3F3E6BEFDBCC}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
    "{CB4D84AB-92B4-453E-8394-48E4B4763B6D}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service v4\intuitupdateservice.exe |
    "{CF079BBB-0855-4733-B222-24EEECE27705}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service\intuitupdater.exe |
    "{CFBD12B1-4122-4EC1-8C1B-3751D98B6C36}" = rport=445 | protocol=6 | dir=out | app=system |
    "{E715F3AB-2462-4A54-83D7-F0054C6FB0B4}" = lport=10243 | protocol=6 | dir=in | app=system |
    "{F14365AD-C297-42EE-B7EF-E60CD24D658A}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
    "{F2A2304F-ABB2-41E0-A7FA-45D6E840252B}" = lport=137 | protocol=17 | dir=in | app=system |

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{089FCE8F-033A-4953-A431-A5B4B303FD95}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer_service.exe |
    "{15A388AD-55C4-41CF-AE3F-22C9E9D226B7}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office15\ucmapi.exe |
    "{2DD9D4F7-6F32-4556-852A-0309F986A094}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
    "{2E41620B-F955-48A0-8DE1-4F0585064D9C}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office15\ucmapi.exe |
    "{318F55CF-47FB-4583-8114-84D9A5E8555C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
    "{333ADA2A-41EC-4232-9B5E-C09D1487310D}" = protocol=6 | dir=in | app=c:\program files (x86)\senstic\I-clickr\I-clickr.exe |
    "{3844313C-152F-41DD-80A6-243710DA8C03}" = protocol=17 | dir=in | app=c:\program files (x86)\aim\aim.exe |
    "{3BB5D26F-36B1-4CB6-9FC5-11FE29D73C49}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{3E4993C5-E4A5-4F52-97C7-1A11CE21DCFD}" = protocol=6 | dir=in | app=c:\users\edwin\appdata\local\google\google talk plugin\googletalkplugin.exe |
    "{40EA0073-034C-486A-91EE-54A9C5F838D8}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
    "{44319376-8F84-405D-8266-4F8EC93D7548}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
    "{474EA005-7392-4163-93BE-A0E568BE60B2}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifetray.exe |
    "{4A81C9BD-D656-4BF3-84FC-5FB2DE6C87C1}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
    "{4BF6BBCB-3D1A-45A3-AEA6-D13F78A29416}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{4DA3380C-30AA-42B1-B9F2-6D7825FF9031}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifecam.exe |
    "{50D95014-6BC2-42C4-A552-EC08C38A18C7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{51017D72-88B6-4D05-AF87-25017A8F3CDE}" = protocol=17 | dir=in | app=c:\users\edwin\appdata\local\google\google talk plugin\googletalkplugin.exe |
    "{59C516A5-12E1-4D59-8856-71BAE79DD475}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
    "{59D605BE-FD03-4A5F-8F52-75B848960240}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
    "{5BBCFF45-CE3F-49CC-AEC4-9779F2C3AB01}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office15\lync.exe |
    "{5E2E62ED-985B-4866-AD8B-B94B2467A339}" = protocol=17 | dir=in | app=c:\program files (x86)\senstic\I-clickr\I-clickr.exe |
    "{67C0061F-F878-4B13-8FDD-44105E96E0E0}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer.exe |
    "{69A7F0DA-8964-453E-9BB0-79161DC5B820}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
    "{6C0AD8D1-B26C-4B1D-A368-EA4A1FED37CE}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{6D285145-1720-4315-8D8D-04FA9DA3AFE8}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
    "{6DC7798C-6A00-42E0-9377-5540CECE3C21}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
    "{6DD7DEB9-18BC-44FF-94FF-40321A4BB9ED}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
    "{6F5E7C94-C0DA-48DE-A7CD-282F5BB31D63}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
    "{70FCEF13-203F-486F-905E-68824F78B61F}" = protocol=6 | dir=in | app=c:\program files (x86)\aim\aim.exe |
    "{794744E5-D246-45D9-8CF4-0373F6B6F9C8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{7A78BAE7-2BC7-4454-8232-35C25CDBBF37}" = protocol=17 | dir=in | app=c:\program files (x86)\senstic\I-clickr\I-clickr.exe |
    "{7D2F82F9-FFC1-43E8-B3BF-87238F8AA394}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeenc2.exe |
    "{83FEDDDE-9033-4E88-B21C-80F1ECA07505}" = protocol=17 | dir=in | app=c:\program files (x86)\lenovo\system update\uncserver.exe |
    "{84E9E3D0-310D-40ED-AD0C-1671193653BE}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office15\lync.exe |
    "{871E8C44-97AA-408F-AA42-51D7D2229236}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
    "{8AD7DBDE-68BE-44C5-9BAB-3B3E3F2DD4EE}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
    "{8D59602B-8DA1-4AC8-9890-71ABC44CBE57}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
    "{8F7A8FA3-DEAC-4ABB-8C76-43A471A53AE1}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer_service.exe |
    "{9138EA65-E8E2-4686-9D1A-0EEA1296B2EE}" = protocol=6 | dir=in | app=c:\program files (x86)\lenovo\system update\uncserver.exe |
    "{91C18D3F-DAF6-4332-9F83-0A43B7AAEF67}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
    "{941AED7C-D4AF-44C1-B281-4D8C9B528ADE}" = protocol=6 | dir=in | app=c:\users\edwin\appdata\roaming\dropbox\bin\dropbox.exe |
    "{961BF3CC-DCC1-436A-A65A-16362CE8D9A2}" = protocol=6 | dir=in | app=c:\program files (x86)\lenovo\system update\uncserver.exe |
    "{9782AFBE-FDF4-4B09-8FD5-234CF16C2D76}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{998E5CDB-7109-40AD-85AE-1D6CC224DC76}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
    "{99FB7F46-F3C0-4797-9136-1BF8B985221B}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
    "{9CE932EB-B686-45AE-8D99-B6EFEC4E0877}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office15\ucmapi.exe |
    "{9DEB3089-8049-4DBA-BEF6-9BA324DE4912}" = protocol=6 | dir=in | app=c:\program files (x86)\senstic\I-clickr\I-clickr.exe |
    "{9F52001A-6D4E-4FAF-833E-EB201A135D2E}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeenc2.exe |
    "{A2DBFD19-0319-4EEC-9722-D47279D8FC7D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{A4C7F9F1-E4CB-476A-8548-674A6A893FC8}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
    "{A5186A5A-49B7-49C4-8986-E8E2CCC8EFD6}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer.exe |
    "{ABF88F76-63BD-46DB-8AC7-6763FBFAFB14}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
    "{B1E0C305-D756-4E01-9216-EE757591F4D0}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
    "{B2DEF667-4A2E-4F1A-8435-31EAF64B2895}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeexp.exe |
    "{B832CD60-3F40-4A1D-9E1C-3B0F8DD1FBA2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{B98DC051-8177-492E-8E8A-AD5C3018CC00}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifetray.exe |
    "{BAA6B51F-6497-4DBF-95DC-9C370AD65767}" = protocol=17 | dir=in | app=c:\users\edwin\appdata\roaming\dropbox\bin\dropbox.exe |
    "{BDDF5169-71D6-4CC1-8E7E-107A7591B983}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
    "{BEEFE876-3B77-4EB5-8094-80537E95EA69}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
    "{BF1BE88E-BFA6-41EA-8C02-88227F071E5F}" = protocol=17 | dir=in | app=c:\program files (x86)\lenovo\system update\uncserver.exe |
    "{C5B0EB09-6668-4489-AAE5-C07DC95430D3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{C5F1B68D-324E-44D6-9DD2-1275D4EFFB27}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{CCD48A61-7E17-4B7D-8942-8EEC58F3CFE6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{CEE5ED1D-F0E8-4EAD-B55B-C40AB01331A0}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office15\ucmapi.exe |
    "{D9E530C6-F839-4500-8EE6-B5B4C3A9A7F1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
    "{E5E837C1-618D-49C8-99C8-55D447702EB1}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
    "{EDB150CF-90B8-4CBB-97F5-3C535DACFF5A}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifecam.exe |
    "{EDE59D69-744A-4AE9-82C2-7012F102B05D}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeexp.exe |
    "{F1DDC1AE-25FA-4291-9163-4091B0B6F2D5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{F24B1946-4BEB-43FF-A0E0-B774DA33691E}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
    "{F4C16F15-D135-4466-974E-4B4BB9DF9298}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
    "{F6E0487E-8CBF-4C35-A11B-49219BE3A7DE}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
    "{F80587E2-444D-4B62-9CA1-F220077E2015}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office15\lync.exe |
    "{FA367044-DA48-4AAD-9F92-8E0FDD1EE530}" = protocol=6 | dir=out | app=system |
    "{FDD88F85-549E-44E5-AA29-778FE2CA2DDD}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office15\lync.exe |
    "TCP Query User{28038088-9798-47B5-A592-3085C3C24B01}C:\program files (x86)\qvodplayer\qvodterminal.exe" = protocol=6 | dir=in | app=c:\program files (x86)\qvodplayer\qvodterminal.exe |
    "UDP Query User{620595B0-B41C-4ED3-9621-49E1C225FA3F}C:\program files (x86)\qvodplayer\qvodterminal.exe" = protocol=17 | dir=in | app=c:\program files (x86)\qvodplayer\qvodterminal.exe |

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{0369F866-2CE0-4EB9-B426-88FA122C6E82}" = Lenovo Patch Utility 64 bit
    "{0E5D76AD-A3FB-48D5-8400-8903B10317D3}" = iTunes
    "{1AAF3A3B-7B32-4DDF-8ABB-438DAEB46EEC}" = Windows Live Family Safety
    "{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
    "{25FBDA9A-E868-4B3B-B9FF-D923818511A1}" = Intel(R) PROSet/Wireless WiFi Software
    "{26A24AE4-039D-4CA4-87B4-2F86416025FF}" = Java(TM) 6 Update 25 (64-bit)
    "{46A5FBE9-ADB3-4493-A1CC-B4CFFD24D26A}" = Windows Live Family Safety
    "{55CEDC7F-3965-47C0-AC71-40AAA418B6A5}" = ThinkVantage Fingerprint Software
    "{5CE7E3F5-9803-4F32-AA89-2D8848A80109}" = Microsoft LifeCam
    "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
    "{64A3A4F4-B792-11D6-A78A-00B0D0160250}" = Java(TM) SE Development Kit 6 Update 25 (64-bit)
    "{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
    "{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
    "{6DD01FF3-63CE-436B-96DB-61363EAA4EB8}" = MobileMe Control Panel
    "{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
    "{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
    "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
    "{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
    "{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
    "{8B485965-8EFE-464A-842F-CF8F18C3DFD7}" = iCloud
    "{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
    "{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
    "{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
    "{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
    "{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
    "{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
    "{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
    "{90150000-002A-0000-1000-0000000FF1CE}" = Microsoft Office 64-bit Components 2013
    "{90150000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2013
    "{90150000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2013
    "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{9C5A08BF-BB99-4998-81BD-F6CC32483B34}" = Microsoft Corporation
    "{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
    "{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
    "{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
    "{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
    "{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}" = Apple Mobile Device Support
    "{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
    "{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
    "{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
    "{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
    "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
    "49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
    "CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10140588" = ThinkPad Modem
    "CutePDF Writer Installation" = CutePDF Writer 2.8
    "HDMI" = Intel(R) Graphics Media Accelerator Driver
    "LENOVO.SMIIF" = Lenovo System Interface Driver
    "LenovoAutoScrollUtility" = Lenovo Auto Scroll Utility
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
    "OnScreenDisplay" = On Screen Display
    "Power Management Driver" = Lenovo Power Management Driver
    "ProInst" = Intel PROSet Wireless
    "sp6" = Logitech SetPoint 6.32
    "ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
    "TrackPoint" = ThinkPad TrackPoint Driver

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    "{05BDC796-3451-4F81-B91D-E98F7ADA76C2}" = TurboTax 2010 WinPerTaxSupport
    "{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Central Data
    "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
    "{113AC946-0CEB-49C7-828A-230FF9EB1DBB}" = TurboTax 2010 wmdiper
    "{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
    "{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Central Tools
    "{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
    "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
    "{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
    "{25C64847-B900-48AD-A164-1B4F9B774650}" = Lenovo System Update
    "{26326B5B-3D62-4C12-8841-6B55A19B552D}_is1" = SanDisk SSD Toolkit 1.0.0.1
    "{26A24AE4-039D-4CA4-87B4-2F83216038FF}" = Java(TM) 6 Update 38
    "{26A24AE4-039D-4CA4-87B4-2F83217013FF}" = Java 7 Update 13
    "{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
    "{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
    "{32A3A4F4-B792-11D6-A78A-00B0D0160250}" = Java(TM) SE Development Kit 6 Update 25
    "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
    "{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
    "{3782EC09-4000-475E-8A59-9CABD6F03B4C}" = TurboTax 2010 WinPerFedFormset
    "{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset
    "{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine
    "{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport
    "{395AD660-EAA2-012B-ADE3-000000000000}" = TurboTax 2009 wmaiper
    "{3ACCCFB3-7B17-4E9F-ACB0-46868FCD4487}" = Brother MFL-Pro Suite DCP-7065DN
    "{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper
    "{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
    "{49351FE8-DB8F-4C56-9DA6-B2D6CE3F7BF8}" = ActiveState ActivePython 2.7.2.5 (32-bit)
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
    "{4F2FCCCF-29F3-44B9-886F-6D16F8417522}" = TurboTax 2010 wrapper
    "{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
    "{510D2239-6C2E-457B-9590-485EC552D94D}" = Garmin USB Drivers
    "{519C4DB6-B53B-4F5C-8297-89B2BE949FA5}_is1" = Data Lifeguard Diagnostic for Windows 1.22
    "{537BF16E-7412-448C-95D8-846E85A1D817}" = Roxio Creator Business Edition
    "{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013
    "{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
    "{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
    "{66A722B4-C3A4-4599-A1AF-AAF8E808AF5D}" = calibre
    "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
    "{69333A04-5134-40A5-A055-9166A7AA1EC8}" =
    "{6ADC1384-4E79-44D5-BB9A-F1DB4038C79E}" = TurboTax 2011 wmaiper
    "{6E6E7725-C7BC-4C39-8B3F-14B67331A120}" = Lenovo Patch Utility
    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
    "{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Central Audio
    "{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
    "{7A21C722-F259-4976-B7AA-6658E5FDEDAF}" = Google Drive
    "{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
    "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
    "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
    "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    "{89EC099E-958D-462E-972C-385591946978}" = TurboTax 2012 WinPerFedFormset
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8A4DB1CA-8206-4ADC-805C-66ACF1611DA3}" = System Migration Assistant
    "{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
    "{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
    "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
    "{8ED02445-D491-414C-A56D-2ED6BBB7239A}" = Garmin Communicator Plugin
    "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
    "{90120000-0015-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
    "{90120000-0016-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
    "{90120000-0018-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
    "{90120000-0019-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
    "{90120000-001A-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
    "{90120000-001B-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}_ULTIMATER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}_ULTIMATER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}_ULTIMATER_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    "{90120000-002A-0000-1000-0000000FF1CE}_ULTIMATER_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-002A-0409-1000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
    "{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
    "{90120000-0044-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
    "{90120000-00A1-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
    "{90120000-00BA-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
    "{90120000-0114-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
    "{90120000-0115-0409-0000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0116-0409-1000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
    "{90120000-0117-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
    "{90140000-0015-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
    "{90140000-0016-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
    "{90140000-0018-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
    "{90140000-0019-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
    "{90140000-001A-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
    "{90140000-001B-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
    "{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
    "{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
    "{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.SingleImage_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-002A-0409-1000-0000000FF1CE}_Office14.SingleImage_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
    "{90140000-002C-0409-0000-0000000FF1CE}_Office14.SingleImage_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
    "{90140000-006E-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
    "{90140000-00A1-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
    "{90140000-0115-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-0116-0409-1000-0000000FF1CE}_Office14.SingleImage_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
    "{90140000-0117-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
    "{90150000-0015-0409-0000-0000000FF1CE}" = Microsoft Access MUI (English) 2013
    "{90150000-0016-0409-0000-0000000FF1CE}" = Microsoft Excel MUI (English) 2013
    "{90150000-0018-0409-0000-0000000FF1CE}" = Microsoft PowerPoint MUI (English) 2013
    "{90150000-0019-0409-0000-0000000FF1CE}" = Microsoft Publisher MUI (English) 2013
    "{90150000-001A-0409-0000-0000000FF1CE}" = Microsoft Outlook MUI (English) 2013
    "{90150000-001B-0409-0000-0000000FF1CE}" = Microsoft Word MUI (English) 2013
    "{90150000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proofing Tools 2013 - English
    "{90150000-001F-040C-0000-0000000FF1CE}" = Outils de vérification linguistique 2013 de Microsoft Office - Français
    "{90150000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proofing Tools 2013 - Español
    "{90150000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2013
    "{90150000-0044-0409-0000-0000000FF1CE}" = Microsoft InfoPath MUI (English) 2013
    "{90150000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2013
    "{90150000-0090-0409-0000-0000000FF1CE}" = Microsoft DCF MUI (English) 2013
    "{90150000-00A1-0409-0000-0000000FF1CE}" = Microsoft OneNote MUI (English) 2013
    "{90150000-00BA-0409-0000-0000000FF1CE}" = Microsoft Groove MUI (English) 2013
    "{90150000-00E1-0409-0000-0000000FF1CE}" = Microsoft Office OSM MUI (English) 2013
    "{90150000-00E2-0409-0000-0000000FF1CE}" = Microsoft Office OSM UX MUI (English) 2013
    "{90150000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2013
    "{90150000-0117-0409-0000-0000000FF1CE}" = Microsoft Access Setup Metadata MUI (English) 2013
    "{90150000-012B-0409-0000-0000000FF1CE}" = Microsoft Lync MUI (English) 2013
    "{91150000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2013
    "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
    "{95140000-007A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
    "{95140000-007D-0409-0000-0000000FF1CE}" = Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "{9B683A28-2172-4CF1-B85D-41375E80652A}" = Acronis True Image WD Edition
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
    "{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
    "{A525E00B-6609-442E-9DCD-64453C233E8D}" = TurboTax 2010 WinPerReleaseEngine
    "{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
    "{A8B1F076-965D-4663-A9D4-C2FB58A42AE4}" = TurboTax 2012 WinPerTaxSupport
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
    "{AA721D14-CFE2-410E-B975-79FE5F82F99F}" = MSVCMergeModules
    "{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
    "{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
    "{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.5)
    "{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
    "{AF9E97C1-7431-426D-A8D5-ABE40995C0B1}" = DirectX 9 Runtime
    "{B038A58E-EAF0-44CB-ADCA-3895ECD0812D}" = BibleWorks 8
    "{B05B22B8-72AE-4DC3-8D6F-FBC2233CAF41}" = Roxio Creator Business Edition
    "{B39177F9-269D-4A9B-82F2-7A48589CCCEF}" = Garmin WebUpdater
    "{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
    "{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Central Copy
    "{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
    "{C383CBAD-61FA-417E-B784-2E9F1E843DF2}" = TurboTax 2010 wmaiper
    "{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
    "{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
    "{C6D442EC-14C6-4E5B-8378-305BAE7EDBBF}" = TurboTax 2011 wmdiper
    "{CAF5B770-082F-40C4-853D-3973BB81BDAA}" = TurboTax 2011 WinPerTaxSupport
    "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
    "{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
    "{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
    "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
    "{D952C4F9-2488-3723-84BE-1BFA907DCAC9}" = Google Talk Plugin
    "{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}" = Power Manager
    "{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
    "{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
    "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
    "{E463E171-4082-4744-A466-F7CBE8502789}" = TurboTax 2011 WinPerReleaseEngine
    "{E83F5F27-43F3-4163-ABE5-F68C989286ED}" = TurboTax 2012 wrapper
    "{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
    "{EC877639-07AB-495C-BFD1-D63AF9140810}" = Roxio Activation Module
    "{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Central Core
    "{EE556A3E-EB37-4392-9637-BAA8EC2F47FA}" = TurboTax 2011 wrapper
    "{F014B696-28C5-4554-802F-A15380418F53}" = TurboTax 2012 WinPerReleaseEngine
    "{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
    "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
    "{F18DB86D-BC16-4E01-BCCE-63F62B931D82}" = InterVideo Register Manager
    "{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
    "{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}" = ooVoo
    "{FAD3D68B-2F9C-459B-AA79-C04B9090FD72}" = TurboTax 2011 WinPerFedFormset
    "{FC279721-37A6-4777-AFD8-7A56681EBA14}" = eXPert PDF 6
    "{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
    "Ad-Aware Browsing Protection" = Ad-Aware Browsing Protection
    "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
    "AIM_7" = AIM 7
    "Amazon Games & Software Downloader_is1" = Amazon Games & Software Downloader
    "Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.12
    "Ashampoo Burning Studio 10_is1" = Ashampoo Burning Studio 10 v.10.0.15
    "BestCrypt" = BestCrypt 8.0
    "CamToPrint" = CamToPrint
    "DAEMON Tools Lite" = DAEMON Tools Lite
    "DimSum_is1" = DimSum 0.7.9
    "ESET Online Scanner" = ESET Online Scanner v3
    "FlashWorks_is1" = FlashWorks
    "HanConv_is1" = HanConv 1.20
    "InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
    "InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013
    "ISI ResearchSoft - Export Helper" = ISI ResearchSoft - Export Helper
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.70.0.1100
    "Mozilla Firefox 5.0 (x86 en-US)" = Mozilla Firefox 5.0 (x86 en-US)
    "MyLife Organized" = MyLifeOrganized v. 4.0
    "Office15.PROPLUSR" = Microsoft Office Professional Plus 2013
    "Open Codecs" = Xiph.Org Open Codecs 0.85.17777
    "Picasa 3" = Picasa 3
    "ProInst" = Intel PROSet Wireless
    "SendToKindle" = Amazon Send to Kindle
    "TeamViewer 8" = TeamViewer 8
    "TekniaHebrew" = TekniaHebrew
    "TurboTax 2009" = TurboTax 2009
    "TurboTax 2010" = TurboTax 2010
    "TurboTax 2011" = TurboTax 2011
    "TurboTax 2012" = TurboTax 2012
    "uTorrent" = µTorrent
    "WinLiveSuite" = Windows Live Essentials
    "WinRAR archiver" = WinRAR 4.01 (32-bit)
    "Xvid Video Codec 1.3.2" = Xvid Video Codec

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-1248549332-523462300-163367360-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
    "Amazon Kindle" = Amazon Kindle
    "Google Chrome" = Google Chrome
    "Spotify" = Spotify

    ========== Last 20 Event Log Errors ==========

    [ System Events ]
    Error - 2/19/2013 10:06:14 PM | Computer Name = Edwin-PC | Source = iaStor | ID = 262153
    Description = The device, \Device\Ide\iaStor0, did not respond within the timeout
    period.

    Error - 2/19/2013 10:14:04 PM | Computer Name = Edwin-PC | Source = bowser | ID = 8003
    Description =


    < End of report >
  23. echow

    echow Newcomer, in training Topic Starter Posts: 24

    The OTL.txt file exceeds the character limit for posts.
  24. Broni

    Broni Malware Annihilator Posts: 46,123   +251

    Split it between couple of replies.
  25. echow

    echow Newcomer, in training Topic Starter Posts: 24

    OTL logfile created on: 2/19/2013 9:14:23 PM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Edwin\Desktop
    64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    3.93 Gb Total Physical Memory | 1.88 Gb Available Physical Memory | 47.85% Memory free
    7.85 Gb Paging File | 5.31 Gb Available in Paging File | 67.59% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 211.47 Gb Total Space | 94.39 Gb Free Space | 44.64% Space Free | Partition Type: NTFS
    Drive D: | 12.00 Gb Total Space | 1.91 Gb Free Space | 15.92% Space Free | Partition Type: NTFS
    Drive E: | 2.99 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

    Computer Name: EDWIN-PC | User Name: Edwin | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2013/02/19 20:47:49 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Edwin\Desktop\OTL.exe
    PRC - [2013/01/17 22:10:28 | 001,199,576 | ---- | M] (Spotify Ltd) -- C:\Users\Edwin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
    PRC - [2013/01/12 01:07:32 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
    PRC - [2013/01/09 06:40:00 | 000,127,784 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
    PRC - [2013/01/08 03:41:08 | 003,674,320 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
    PRC - [2012/12/18 21:15:46 | 000,331,408 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
    PRC - [2012/12/18 09:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    PRC - [2012/12/17 19:50:28 | 016,328,976 | ---- | M] (Google) -- C:\Program Files (x86)\Google\Drive\googledrivesync.exe
    PRC - [2012/12/14 04:17:04 | 003,467,768 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
    PRC - [2012/12/11 18:20:50 | 000,542,104 | ---- | M] (Lavasoft) -- C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
    PRC - [2012/12/04 14:04:40 | 000,125,504 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
    PRC - [2012/08/23 12:37:16 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    PRC - [2012/08/17 21:38:34 | 000,128,440 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\klwtblfs.exe
    PRC - [2011/12/29 03:06:20 | 001,088,312 | ---- | M] (Jetico, Inc.) -- C:\Program Files (x86)\Jetico\BestCrypt\BCWipeTM.exe
    PRC - [2011/07/12 18:03:32 | 000,069,568 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
    PRC - [2011/07/12 17:17:04 | 000,138,680 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\ZOOM\TpScrex.exe
    PRC - [2011/06/22 10:17:14 | 000,395,392 | ---- | M] (Acronis) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
    PRC - [2011/06/22 10:15:44 | 002,637,824 | ---- | M] (Acronis) -- C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
    PRC - [2011/04/20 17:58:02 | 001,204,224 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
    PRC - [2011/04/20 17:53:10 | 000,335,872 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
    PRC - [2011/03/28 06:26:14 | 000,095,544 | ---- | M] (Jetico, Inc.) -- C:\Program Files (x86)\Jetico\BestCrypt\BCWipeSvc.exe
    PRC - [2011/02/17 00:24:44 | 000,200,704 | ---- | M] (Jetico, Inc.) -- C:\Program Files (x86)\Jetico\BestCrypt\BCResident.exe
    PRC - [2010/08/23 20:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    PRC - [2010/06/10 13:42:44 | 002,621,440 | R--- | M] (Brother Industries, Ltd.) -- C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
    PRC - [2010/01/25 08:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files (x86)\Browny02\BrYNSvc.exe
    PRC - [2009/11/09 13:48:34 | 000,054,632 | ---- | M] (Lenovo Group Limited) -- C:\Program Files\Lenovo\HOTKEY\cammute.exe
    PRC - [2007/01/04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) -- C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe


    ========== Modules (No Company Name) ==========

    MOD - [2013/02/19 21:11:47 | 001,169,408 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\wx._core_.pyd
    MOD - [2013/02/19 21:11:47 | 001,024,616 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\windows._cacheinvalidation.pyd
    MOD - [2013/02/19 21:11:47 | 000,807,424 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\wx._windows_.pyd
    MOD - [2013/02/19 21:11:47 | 000,792,576 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\wx._gdi_.pyd
    MOD - [2013/02/19 21:11:47 | 000,731,136 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\wx._misc_.pyd
    MOD - [2013/02/19 21:11:47 | 000,645,120 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\_ssl.pyd
    MOD - [2013/02/19 21:11:47 | 000,571,392 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\pysqlite2._sqlite.pyd
    MOD - [2013/02/19 21:11:47 | 000,354,304 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\pythoncom26.dll
    MOD - [2013/02/19 21:11:47 | 000,311,808 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\_hashlib.pyd
    MOD - [2013/02/19 21:11:47 | 000,263,168 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\win32com.shell.shell.pyd
    MOD - [2013/02/19 21:11:47 | 000,153,088 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\pyexpat.pyd
    MOD - [2013/02/19 21:11:47 | 000,121,856 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\wx._wizard.pyd
    MOD - [2013/02/19 21:11:47 | 000,111,104 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\win32file.pyd
    MOD - [2013/02/19 21:11:47 | 000,110,592 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\win32security.pyd
    MOD - [2013/02/19 21:11:47 | 000,110,592 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\PyWinTypes26.dll
    MOD - [2013/02/19 21:11:47 | 000,096,256 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\win32api.pyd
    MOD - [2013/02/19 21:11:47 | 000,086,016 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\_elementtree.pyd
    MOD - [2013/02/19 21:11:47 | 000,073,728 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\_ctypes.pyd
    MOD - [2013/02/19 21:11:47 | 000,070,656 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\wx._html2.pyd
    MOD - [2013/02/19 21:11:47 | 000,040,448 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\_socket.pyd
    MOD - [2013/02/19 21:11:47 | 000,039,424 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\win32inet.pyd
    MOD - [2013/02/19 21:11:47 | 000,036,352 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\win32process.pyd
    MOD - [2013/02/19 21:11:47 | 000,023,040 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\win32ts.pyd
    MOD - [2013/02/19 21:11:47 | 000,022,528 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\win32pdh.pyd
    MOD - [2013/02/19 21:11:47 | 000,017,920 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\win32profile.pyd
    MOD - [2013/02/19 21:11:47 | 000,011,776 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\win32crypt.pyd
    MOD - [2013/02/19 21:11:46 | 001,056,256 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\wx._controls_.pyd
    MOD - [2013/02/19 21:11:46 | 000,585,728 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\unicodedata.pyd
    MOD - [2013/02/19 21:11:46 | 000,017,920 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\win32event.pyd
    MOD - [2013/02/19 21:11:46 | 000,011,776 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Temp\_MEI42362\select.pyd
    MOD - [2013/02/13 10:01:50 | 012,638,576 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll
    MOD - [2013/01/25 21:35:06 | 000,460,240 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppgooglenaclpluginchrome.dll
    MOD - [2013/01/25 21:35:04 | 004,012,496 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll
    MOD - [2013/01/25 21:34:19 | 000,597,968 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Google\Chrome\Application\24.0.1312.57\libglesv2.dll
    MOD - [2013/01/25 21:34:18 | 000,124,368 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Google\Chrome\Application\24.0.1312.57\libegl.dll
    MOD - [2013/01/25 21:34:16 | 001,552,848 | ---- | M] () -- C:\Users\Edwin\AppData\Local\Google\Chrome\Application\24.0.1312.57\ffmpegsumo.dll
    MOD - [2012/08/17 21:38:56 | 000,479,160 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
    MOD - [2011/06/24 21:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
    MOD - [2011/06/24 21:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
    MOD - [2011/01/31 02:19:17 | 000,070,968 | ---- | M] () -- C:\Program Files (x86)\Jetico\BestCrypt\dismount.dll
    MOD - [2009/02/27 16:38:20 | 000,139,264 | R--- | M] () -- C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll


    ========== Services (SafeList) ==========

    SRV:64bit: - [2012/12/18 12:30:54 | 000,127,120 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD)
    SRV:64bit: - [2012/12/11 06:22:08 | 000,060,272 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Windows\SysNative\ibmpmsvc.exe -- (IBMPMSVC)
    SRV:64bit: - [2012/12/04 14:04:40 | 000,125,504 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)
    SRV:64bit: - [2012/11/23 18:07:10 | 001,855,064 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe -- (OfficeSvc)
    SRV:64bit: - [2012/08/24 18:33:26 | 000,127,072 | ---- | M] (Lenovo Group Limited) [Auto | Stopped] -- C:\Program Files\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE)
    SRV:64bit: - [2011/09/27 14:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
    SRV:64bit: - [2011/08/08 07:39:18 | 001,166,848 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3)
    SRV:64bit: - [2011/07/27 21:04:48 | 001,517,328 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
    SRV:64bit: - [2011/07/27 20:44:18 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
    SRV:64bit: - [2011/07/12 16:53:58 | 000,133,992 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC)
    SRV:64bit: - [2011/06/03 12:51:38 | 000,134,928 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr)
    SRV:64bit: - [2010/12/13 14:37:16 | 000,194,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc)
    SRV:64bit: - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
    SRV:64bit: - [2009/11/09 13:48:34 | 000,054,632 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files\Lenovo\HOTKEY\cammute.exe -- (LENOVO.CAMMUTE)
    SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
    SRV:64bit: - [2009/07/13 20:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
    SRV:64bit: - [2008/07/15 13:09:48 | 000,111,616 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\AEADISRV.EXE -- (AEADIFilters)
    SRV:64bit: - [2006/11/27 17:45:16 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysNative\drivers\XAudio64.exe -- (XAudioService)
    SRV - [2013/02/13 18:24:28 | 000,251,248 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
    SRV - [2013/02/04 10:26:30 | 000,022,376 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe -- (SUService)
    SRV - [2013/01/12 01:07:32 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe -- (AVP)
    SRV - [2013/01/09 06:40:00 | 001,665,832 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service)
    SRV - [2013/01/09 06:40:00 | 001,664,296 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe -- (PwmEWSvc)
    SRV - [2013/01/09 06:40:00 | 000,320,576 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE -- (DozeSvc)
    SRV - [2013/01/08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
    SRV - [2012/12/18 09:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
    SRV - [2012/12/14 04:17:04 | 003,467,768 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe -- (TeamViewer8)
    SRV - [2012/08/23 12:37:16 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe -- (IntuitUpdateServiceV4)
    SRV - [2011/06/22 10:18:40 | 001,191,656 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
    SRV - [2011/03/28 06:26:14 | 000,095,544 | ---- | M] (Jetico, Inc.) [Auto | Running] -- C:\Program Files (x86)\Jetico\BestCrypt\BCWipeSvc.exe -- (BCWipeSvc)
    SRV - [2010/08/23 20:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
    SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
    SRV - [2010/01/25 08:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) [On_Demand | Running] -- C:\Program Files (x86)\Browny02\BrYNSvc.exe -- (BrYNSvc)
    SRV - [2009/10/23 12:31:44 | 000,401,920 | ---- | M] (Amazon.com) [On_Demand | Stopped] -- C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe -- (Amazon Download Agent)
    SRV - [2009/09/24 05:01:04 | 001,124,848 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe -- (RoxMediaDB10)
    SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
    SRV - [2007/01/04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)


    ========== Driver Services (SafeList) ==========

    DRV:64bit: - [2013/02/13 17:52:03 | 000,014,456 | ---- | M] (GFI Software) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\gfibto.sys -- (gfibto)
    DRV:64bit: - [2013/01/25 13:44:37 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
    DRV:64bit: - [2013/01/12 01:30:52 | 000,054,104 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kltdi.sys -- (kltdi)
    DRV:64bit: - [2013/01/12 01:30:51 | 000,613,720 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\SysNative\drivers\klif.sys -- (KLIF)
    DRV:64bit: - [2013/01/09 06:40:00 | 000,029,512 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\DZHDD64.SYS -- (DzHDD64)
    DRV:64bit: - [2013/01/09 06:40:00 | 000,020,328 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\TPPWR64V.SYS -- (TPPWRIF)
    DRV:64bit: - [2012/12/11 06:22:08 | 000,042,824 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ibmpmdrv.sys -- (IBMPMDRV)
    DRV:64bit: - [2012/10/25 17:23:06 | 000,029,528 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klmouflt.sys -- (klmouflt)
    DRV:64bit: - [2012/10/25 17:23:06 | 000,029,016 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klkbdflt.sys -- (klkbdflt)
    DRV:64bit: - [2012/08/23 09:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
    DRV:64bit: - [2012/08/23 09:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
    DRV:64bit: - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
    DRV:64bit: - [2012/08/13 16:49:40 | 000,178,008 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kneps.sys -- (kneps)
    DRV:64bit: - [2012/08/02 15:09:34 | 000,028,504 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klim6.sys -- (KLIM6)
    DRV:64bit: - [2012/06/19 17:28:12 | 000,458,584 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\kl1.sys -- (KL1)
    DRV:64bit: - [2012/04/10 14:15:42 | 000,971,360 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\timntr.sys -- (timounter)
    DRV:64bit: - [2012/04/10 14:15:26 | 000,210,016 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vididr.sys -- (vididr)
    DRV:64bit: - [2012/04/10 14:15:08 | 000,141,920 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vsflt53.sys -- (vidsflt53)
    DRV:64bit: - [2012/04/10 14:15:03 | 000,275,552 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\snapman.sys -- (snapman)
    DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
    DRV:64bit: - [2011/11/01 11:30:24 | 000,029,992 | ---- | M] (Lenovo Group Limited) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tp4track.sys -- (Tp4Track)
    DRV:64bit: - [2011/09/02 01:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
    DRV:64bit: - [2011/09/02 01:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
    DRV:64bit: - [2011/08/31 05:18:57 | 000,059,456 | ---- | M] (Jetico, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\fsh.sys -- (fsh)
    DRV:64bit: - [2011/08/25 04:23:24 | 000,083,008 | ---- | M] (Jetico, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bcbus.sys -- (bcbus)
    DRV:64bit: - [2011/08/19 05:52:41 | 000,102,464 | ---- | M] (Jetico, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\bcswap.sys -- (BCSWAP)
    DRV:64bit: - [2011/08/08 07:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP)
    DRV:64bit: - [2011/08/08 07:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL)
    DRV:64bit: - [2011/08/01 22:56:41 | 000,187,456 | ---- | M] (Jetico, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\bcfnt.sys -- (bcfnt)
    DRV:64bit: - [2011/05/10 07:06:14 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)
    DRV:64bit: - [2011/05/10 07:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
    DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
    DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
    DRV:64bit: - [2010/12/13 14:37:18 | 000,036,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nx6000.sys -- (MSHUSBVideo)
    DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
    DRV:64bit: - [2010/11/20 04:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
    DRV:64bit: - [2010/10/07 05:11:52 | 007,533,568 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwLv64.sys -- (NETwLv64)
    DRV:64bit: - [2010/09/23 00:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
    DRV:64bit: - [2010/09/07 14:09:34 | 000,015,472 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\smiifx64.sys -- (lenovo.smi)
    DRV:64bit: - [2010/07/16 23:02:40 | 000,013,376 | ---- | M] (Jetico, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\moh.sys -- (moh)
    DRV:64bit: - [2010/07/16 23:02:18 | 000,017,472 | ---- | M] (Jetico, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mhk.sys -- (mhk)
    DRV:64bit: - [2010/05/17 23:05:47 | 000,033,856 | ---- | M] (Jetico, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bc_des.sys -- (BC_DES)
    DRV:64bit: - [2010/05/17 23:01:40 | 000,034,368 | ---- | M] (Jetico, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bc_3des.sys -- (BC_3DES)
    DRV:64bit: - [2009/12/22 08:56:50 | 000,034,368 | ---- | M] (Jetico, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bc_tfish.sys -- (BC_TFISH)
    DRV:64bit: - [2009/12/22 08:56:42 | 000,036,928 | ---- | M] (Michael Oestergaard Pedersen) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bc_serp.sys -- (BC_SERP)
    DRV:64bit: - [2009/12/22 08:56:33 | 000,051,264 | ---- | M] (Jetico, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bc_rijn.sys -- (BC_RIJN)
    DRV:64bit: - [2009/12/22 08:56:24 | 000,030,272 | ---- | M] (Michael Oestergaard Pedersen) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bc_rc6.sys -- (BC_RC6)
    DRV:64bit: - [2009/12/22 08:56:16 | 000,027,712 | ---- | M] (Iarsn) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bc_idea.sys -- (BC_IDEA)
    DRV:64bit: - [2009/12/22 08:56:08 | 000,025,664 | ---- | M] (Jetico, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bc_gost.sys -- (BC_Gost)
    DRV:64bit: - [2009/12/22 08:55:44 | 000,037,440 | ---- | M] (Jetico, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bc_cast.sys -- (BC_CAST)
    DRV:64bit: - [2009/12/22 08:55:36 | 000,030,272 | ---- | M] (Jetico, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bc_bfish.sys -- (BC_BFish)
    DRV:64bit: - [2009/12/22 08:55:27 | 000,030,784 | ---- | M] (Jetico, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bc_bf448.sys -- (BC_BF448)
    DRV:64bit: - [2009/12/22 08:55:19 | 000,030,784 | ---- | M] (Jetico, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\bc_bf128.sys -- (BC_BF128)
    DRV:64bit: - [2009/08/07 05:24:14 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
    DRV:64bit: - [2009/08/06 17:06:44 | 006,150,304 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
    DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
    DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
    DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
    DRV:64bit: - [2009/07/13 19:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
    DRV:64bit: - [2009/07/13 19:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
    DRV:64bit: - [2009/07/13 18:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
    DRV:64bit: - [2009/07/09 03:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
    DRV:64bit: - [2009/06/10 16:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
    DRV:64bit: - [2009/06/10 16:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
    DRV:64bit: - [2009/06/10 16:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
    DRV:64bit: - [2009/06/10 15:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64)
    DRV:64bit: - [2009/06/10 15:35:20 | 000,278,016 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1e6032e.sys -- (e1express)
    DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
    DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
    DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
    DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
    DRV:64bit: - [2009/05/18 13:31:56 | 000,497,152 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ADIHdAud.sys -- (ADIHdAudAddService)
    DRV:64bit: - [2009/03/13 14:47:34 | 000,013,840 | ---- | M] (UPEK Inc.) [Kernel | Auto | Running] -- C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys -- (smihlp)
    DRV:64bit: - [2007/02/19 00:56:38 | 000,027,136 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\psadd.sys -- (psadd)
    DRV:64bit: - [2006/12/21 13:33:28 | 001,511,936 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_DPV.sys -- (HSF_DPV)
    DRV:64bit: - [2006/12/21 13:30:50 | 000,300,032 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAXHWAZL.sys -- (CAXHWAZL)
    DRV:64bit: - [2006/12/21 13:29:48 | 000,731,648 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_CNXT.sys -- (winachsf)
    DRV:64bit: - [2006/11/27 17:45:06 | 000,009,728 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\XAudio64.sys -- (XAudio)
    DRV:64bit: - [2006/06/18 15:27:24 | 000,017,024 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\mdmxsdk.sys -- (mdmxsdk)
    DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
    IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    IE - HKLM\..\SearchScopes,DefaultScope =
    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


    IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-21-1248549332-523462300-163367360-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
    IE - HKU\S-1-5-21-1248549332-523462300-163367360-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 69 49 BC 94 28 BC CB 01 [binary data]
    IE - HKU\S-1-5-21-1248549332-523462300-163367360-1001\..\SearchScopes,DefaultScope =
    IE - HKU\S-1-5-21-1248549332-523462300-163367360-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
    IE - HKU\S-1-5-21-1248549332-523462300-163367360-1001\..\SearchScopes\{1938C29B-F165-49BD-93DC-62F831E9F24A}: "URL" = http://www.google.com/search?q={sea...rce}&ie={inputEncoding?}&oe={outputEncoding?}
    IE - HKU\S-1-5-21-1248549332-523462300-163367360-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-1248549332-523462300-163367360-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - prefs.js..browser.startup.homepage: "www.google.com"
    FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
    FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
    FF - prefs.js..extensions.enabledAddons: mozrepl@hyperstruct.net:1.1
    FF - prefs.js..extensions.enabledAddons: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3
    FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA}:6.0.38
    FF - prefs.js..extensions.enabledItems: KavAntiBanner@Kaspersky.ru:11.0.2.556
    FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:11.0.2.556
    FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
    FF - user.js - File not found

    FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_149.dll File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll ()
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
    FF - HKLM\Software\MozillaPlugins\google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF - HKLM\Software\MozillaPlugins\google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
    FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.13.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Edwin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
    FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Edwin\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
    FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Edwin\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
    FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Edwin\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\url_advisor@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2013/01/12 01:31:03 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtual_keyboard@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2013/01/12 01:31:03 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\content_blocker@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2013/01/12 01:31:03 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\anti_banner@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2013/01/12 01:31:03 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\online_banking@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2013/01/12 01:31:03 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/10/26 17:19:53 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/02/15 01:46:21 | 000,000,000 | ---D | M]

    [2011/01/25 21:16:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Edwin\AppData\Roaming\Mozilla\Extensions
    [2013/02/19 21:01:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Edwin\AppData\Roaming\Mozilla\Firefox\Profiles\2p8iduiq.default\extensions
    [2012/03/09 23:10:12 | 000,027,841 | ---- | M] () (No name found) -- C:\Users\Edwin\AppData\Roaming\Mozilla\Firefox\Profiles\2p8iduiq.default\extensions\mozrepl@hyperstruct.net.xpi
    [2012/03/09 23:10:12 | 000,634,964 | ---- | M] () (No name found) -- C:\Users\Edwin\AppData\Roaming\Mozilla\Firefox\Profiles\2p8iduiq.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
    [2013/01/11 14:36:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
    [2011/11/05 20:42:29 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
    [2011/04/23 21:06:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
    [2011/06/28 19:57:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
    [2013/01/11 14:36:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA}
    [2011/01/26 03:54:24 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak
    [2011/01/26 03:54:22 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak
    [2011/06/25 09:47:56 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
    [2013/01/25 10:36:14 | 000,033,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll
    [2010/01/01 03:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.