Solved Multiple trojans, multiple removals, issues remain

A

Auvic

Posts: 131   +1
Been a while, hasn't it? Such a good streak of not getting my computer infected, but here I am again, unfortunately.

Computer was working just fine until last night, at which point I turned o a temporary screen saver and took a nap; by the time I woke up, my computer seemed to be under active attack, or something of the sort. Unsure where the infection came from, as I haven't downloaded anything strange recently, as far as I'm aware.
I've already tried to run the mbam/mse scans multiple times and removed everything that's come up, but the main feature of the infection is an overload of the COM SURROGATE process, which eats up all my cpu and ram.

More bothersome is how after running an mbam scan in safe mode, I haven't been able to successfully boot into safe mode (win7, should be able to just hold f8 to get in) afterwards; either the drive just spins and nothing happens, or I get an error, or it just goes straight to normal boot.
Moreover, subsequent attempts to try and run mbam scans have all failed during the prescan, which makes me a little more worried about this infection.

I've since disconnected my computer from the internet, and it seems to be helping.

Regardless, logs from mbam; I have two, though I've run multiple scans. After these two scans, nothing else was detected, though the problem remains.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 11/9/2014
Scan Time: 7:03:29 AM
Logfile: 1.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.11.09.01
Rootkit Database: v2014.11.08.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Vincent

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 450402
Time Elapsed: 37 min, 36 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
Trojan.Agent.ED, C:\Users\Vincent\AppData\Local\Temp\stuprt.exe, Quarantined, [9fb5b089f08c191db181845cc1408c74],

Physical Sectors: 0
(No malicious items detected)


(end)
 
Second mbam log:
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 11/8/2014
Scan Time: 8:12:05 PM
Logfile: 2.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.11.09.01
Rootkit Database: v2014.11.08.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Vincent

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 478022
Time Elapsed: 1 hr, 35 min, 48 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 1
Trojan.FakeMS.ED, HKLM\SOFTWARE\CLASSES\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}, Quarantined, [2c28261336461b1b2ac731aba95811ef],

Registry Values: 1
Trojan.Agent.RN, HKU\S-1-5-21-1394883155-3604719780-1674705818-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON|SHELL, explorer.exe, "C:\Users\Vincent\AppData\Local\{1e5bd682-3899-d414-b55f-c6d10d1a1eb2}\{1e5bd682-3899-d414-b55f-c6d10d1a1eb2}.exe", Quarantined, [81d3eb4e116bb0860531046945bf6997]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 10
Trojan.Agent.ED, C:\ProgramData\Windows Genuine Advantage\{2C937A93-CFEE-426F-9ECE-3AE62AA1C3BE}\msiexec.exe, Quarantined, [282ccc6d6b11989e43e5fbe554adc838],
Trojan.Agent.ED, C:\ProgramData\Windows Genuine Advantage\{63331615-DD09-460A-A78B-971541D5F87C}\msiexec.exe, Quarantined, [b0a473c6067643f33f7a7768d52c34cc],
Trojan.Agent.ED, C:\ProgramData\Windows Genuine Advantage\{665355AF-439D-4498-B8C9-55A56A718D5C}\msiexec.exe, Quarantined, [61f39d9c2c5004322701736dae5307f9],
Trojan.Inject, C:\ProgramData\Windows Genuine Advantage\{A2FA2273-40A6-4E89-AABF-731057583AF7}\msiexec.exe, Quarantined, [e371b08916660b2b183c02de9f62af51],
Trojan.Agent.ED, C:\ProgramData\Windows Genuine Advantage\{C1C597FF-BC17-46E2-8F70-F0849B21298A}\msiexec.exe, Quarantined, [93c140f9c9b392a45564c817ac55bf41],
Trojan.Inject, C:\ProgramData\Windows Genuine Advantage\{FF839BA0-C272-436B-9213-FCE9D5B5C7CA}\msiexec.exe, Quarantined, [59fb80b93a424aecdb795d8337cad62a],
Trojan.FakeMS.ED, C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\ddrawex.dll, Delete-on-Reboot, [2c28261336461b1b2ac731aba95811ef],
Trojan.Crypt.NKN, C:\Users\Vincent\AppData\Local\Temp\zejotixi.exe, Quarantined, [95bf0831cab2be784149601fc23fb24e],
Trojan.Proxy.Bunitu, C:\Users\Vincent\AppData\Local\acillao.dll, Quarantined, [1d373ffadba11e18929e11cb27dafa06],
Trojan.Agent.ED, C:\Users\Vincent\AppData\Local\{1e5bd682-3899-d414-b55f-c6d10d1a1eb2}\{1e5bd682-3899-d414-b55f-c6d10d1a1eb2}.exe, Delete-on-Reboot, [391be752740816209a979050946d6997],

Physical Sectors: 0
(No malicious items detected)


(end)


DDS log incoming.

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17344 BrowserJavaVersion: 10.71.2
Run by Vincent at 11:00:07 on 2014-11-09
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8154.4969 [GMT -6:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
SP: Microsoft Security Essentials *Enabled/Updated* {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k NetworkService
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Program Files (x86)\Tenda\Common\RaRegistry.exe
C:\Program Files (x86)\Tenda\Common\RaRegistry64.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\viakaraokesrv.exe
c:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
c:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Users\Vincent\AppData\Local\FluxSoftware\Flux\flux.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Users\Vincent\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Users\Vincent\AppData\Local\Google\Update\1.3.25.5\GoogleCrashHandler64.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Users\Vincent\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
C:\Program Files (x86)\Tenda\Common\RaUI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:Tabs
mWinlogon: Userinit = userinit.exe,
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
uRun: [Google Update] "C:\Users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
uRun: [F.lux] "C:\Users\Vincent\AppData\Local\FluxSoftware\Flux\flux.exe" /noshow
uRun: [Akamai NetSession Interface] "C:\Users\Vincent\AppData\Local\Akamai\netsession_win.exe"
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
mRun: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Razer Synapse] "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
StartupFolder: C:\Users\Vincent\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\TENDAW~1.LNK - C:\Program Files (x86)\Tenda\Common\RaUI.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\Smart Print\SmartPrintSetup.exe
Trusted Zone: aeriagames.com
Trusted Zone: aeriagames.com
DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} - hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab
TCP: Interfaces\{2AD7CCB2-C9D4-4E8D-A828-978A4C4C370A} : DHCPNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{2AD7CCB2-C9D4-4E8D-A828-978A4C4C370A}\84F4D454D223934473 : DHCPNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{4BEA369F-1692-48CB-8C9D-C04296CE099F} : DHCPNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{5CAEDA6A-853C-4616-92BA-82E5A16B2F82} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{5CAEDA6A-853C-4616-92BA-82E5A16B2F82}\751686168616 : DHCPNameServer = 192.168.1.220 8.8.8.8
TCP: Interfaces\{5CDE5B42-1343-4F45-9B81-4EDFE9E74768} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{5CDE5B42-1343-4F45-9B81-4EDFE9E74768}\2375942554336383 : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{8D49AEB4-5171-4857-B69B-0B4F90EADD1B} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{8D49FFCB-2FB6-4B3B-BB58-19B00D6BD85C} : DHCPNameServer = 192.168.1.254
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
SSODL: WebCheck - <orphaned>
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
x64-Run: [Nvtmru] "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Vincent\AppData\Roaming\Mozilla\Firefox\Profiles\tigpirsy.default-1411634339210\
FF - prefs.js: browser.startup.homepage - gmail.com
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017300.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll
FF - plugin: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll
FF - plugin: C:\Users\Vincent\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll
FF - plugin: C:\Users\Vincent\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Users\Vincent\AppData\Roaming\raidcall\plugins\nprcplugin.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll
.
============= SERVICES / DRIVERS ===============
.
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2012-10-15 19224]
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2014-7-17 269008]
R1 AppleCharger;AppleCharger;C:\Windows\System32\drivers\AppleCharger.sys [2012-10-15 21616]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2012-8-19 283200]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-1-26 203776]
R2 RalinkRegistryWriter;RalinkRegistryWriter;C:\Program Files (x86)\Tenda\Common\RaRegistry.exe [2014-10-6 375872]
R2 RalinkRegistryWriter64;RalinkRegistryWriter64;C:\Program Files (x86)\Tenda\Common\RaRegistry64.exe [2014-10-6 454208]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-6-24 411936]
R2 VIAKaraokeService;VIA Karaoke digital mixer Service;C:\Windows\System32\ViakaraokeSrv.exe [2014-3-6 27768]
R3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;C:\Windows\System32\drivers\EtronHub3.sys [2012-1-6 59392]
R3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;C:\Windows\System32\drivers\EtronXHCI.sys [2012-1-6 84608]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2012-10-15 356632]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2012-10-15 789272]
R3 rzendpt;rzendpt;C:\Windows\System32\drivers\rzendpt.sys [2014-9-4 39592]
R3 rzudd;Razer Mouse Driver;C:\Windows\System32\drivers\rzudd.sys [2014-9-4 160424]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\System32\drivers\viahduaa.sys [2014-3-6 689840]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S3 AE1000;Linksys AE1000 Driver;C:\Windows\System32\drivers\ae1000w7.sys [2012-10-23 1600064]
S3 AppleChargerSrv;AppleChargerSrv;system32\AppleChargerSrv.exe --> system32\AppleChargerSrv.exe [?]
S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2011-4-12 71168]
S3 GVTDrv64;GVTDrv64;C:\Windows\GVTDrv64.sys [2012-10-15 30528]
S3 HTCAND64;HTC Device Driver;C:\Windows\System32\drivers\ANDROIDUSB.sys [2009-11-2 33736]
S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2012-10-15 160256]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-10-17 111616]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2012-10-15 104560]
S3 mbamchameleon;mbamchameleon;C:\Windows\System32\drivers\mbamchameleon.sys [2014-4-8 93400]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2012-8-30 125584]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2014-8-22 368624]
S3 RaMediaServer;RaMediaServer;C:\Program Files (x86)\Tenda\Common\RaMediaServer.exe [2014-10-6 621632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2014-2-27 19456]
S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-3-1 187392]
S3 RTL8187B;NETGEAR WG111v3 Wireless-G USB Adapter Win7 Driver;C:\Windows\System32\drivers\wg111v3.sys [2012-7-28 446976]
S3 Synth3dVsc;Synth3dVsc;C:\Windows\System32\drivers\Synth3dVsc.sys [2011-4-12 88960]
S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\System32\drivers\terminpt.sys [2014-2-27 29696]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-2-27 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2014-2-27 30208]
S3 tsusbhub;tsusbhub;C:\Windows\System32\drivers\tsusbhub.sys [2011-4-12 117248]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-7-28 1255736]
.
=============== Created Last 30 ================
.
2014-11-09 16:45:17 34808 ----a-w- C:\Windows\System32\drivers\TrueSight.sys
2014-11-09 16:45:15 -------- d-----w- C:\ProgramData\RogueKiller
2014-11-09 16:34:31 75888 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6A6D844A-AC80-4FA3-B3A7-07B9EFC9A291}\offreg.dll
2014-11-09 16:27:25 1188440 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FE4796B3-4593-3372-8F97-80D732FB6876}\GapaEngine.dll
2014-11-09 16:27:03 11627712 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6A6D844A-AC80-4FA3-B3A7-07B9EFC9A291}\mpengine.dll
2014-11-09 04:26:15 -------- d-----w- C:\Program Files (x86)\ESET
2014-11-09 01:11:38 -------- d-----w- C:\ProgramData\RufoLdolz
2014-11-09 01:11:29 -------- d-----w- C:\ProgramData\PuseQzupa
2014-11-09 00:44:38 -------- d--h--w- C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
2014-11-08 13:40:49 -------- d-----w- C:\Users\Vincent\AppData\Local\qBittorrent
2014-11-08 13:40:13 -------- d-----w- C:\Program Files (x86)\qBittorrent
2014-11-08 12:59:33 -------- d-----w- C:\Users\Vincent\AppData\Local\{1e5bd682-3899-d414-b55f-c6d10d1a1eb2}
2014-11-07 04:43:47 220784 ----a-w- C:\Program Files (x86)\Mozilla Firefox\sandboxbroker.dll
2014-11-06 13:09:48 11627712 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-11-04 12:58:11 1188440 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7EC2ED02-0464-4989-BBFA-164CB9FEEA65}\gapaengine.dll
2014-11-01 16:31:19 -------- d-----w- C:\Users\Vincent\AppData\Local\Razer
2014-11-01 01:15:13 -------- d-----w- C:\Users\Vincent\AppData\Local\Razer_Inc
2014-10-31 23:04:49 -------- d-----r- C:\Program Files (x86)\Skype
2014-10-18 15:57:12 98216 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2014-10-18 01:25:55 681984 ----a-w- C:\Windows\System32\termsrv.dll
.
==================== Find3M ====================
.
2014-11-09 16:31:03 129752 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2014-10-30 11:25:26 275080 ----a-w- C:\Windows\System32\MpSigStub.exe
2014-10-18 15:55:56 71344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-10-18 15:55:56 701104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2014-10-10 02:05:59 276480 ----a-w- C:\Windows\System32\generaltel.dll
2014-10-10 02:05:42 507392 ----a-w- C:\Windows\System32\aepdu.dll
2014-10-10 02:00:38 424448 ----a-w- C:\Windows\System32\aeinv.dll
2014-10-09 09:07:10 89088 ----a-w- C:\Windows\SysWow64\rzdevinfo.dll
2014-10-01 15:11:26 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys
2014-10-01 15:11:16 93400 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
2014-10-01 15:11:12 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys
2014-09-30 05:32:42 901632 ----a-w- C:\Windows\SysWow64\rzdevicedll.dll
2014-09-30 05:32:36 419840 ----a-w- C:\Windows\SysWow64\rzaudiodll.dll
2014-09-29 00:58:48 3198976 ----a-w- C:\Windows\System32\win32k.sys
2014-09-25 22:32:04 2017280 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2014-09-25 22:31:02 2108416 ----a-w- C:\Windows\System32\inetcpl.cpl
2014-09-25 02:08:38 371712 ----a-w- C:\Windows\System32\qdvd.dll
2014-09-25 01:40:50 519680 ----a-w- C:\Windows\SysWow64\qdvd.dll
2014-09-19 01:56:02 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
2014-09-19 01:55:49 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
2014-09-19 01:40:43 66048 ----a-w- C:\Windows\System32\iesetup.dll
2014-09-19 01:40:03 547328 ----a-w- C:\Windows\System32\vbscript.dll
2014-09-19 01:39:58 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
2014-09-19 01:38:27 83968 ----a-w- C:\Windows\System32\MshtmlDac.dll
2014-09-19 01:36:57 5829632 ----a-w- C:\Windows\System32\jscript9.dll
2014-09-19 01:26:00 139264 ----a-w- C:\Windows\System32\ieUnatt.exe
2014-09-19 01:25:49 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe
2014-09-19 01:25:12 4201472 ----a-w- C:\Windows\SysWow64\jscript9.dll
2014-09-19 01:25:09 758272 ----a-w- C:\Windows\System32\jscript9diag.dll
2014-09-19 01:18:02 940032 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
2014-09-19 01:14:57 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2014-09-19 01:06:47 72704 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-09-19 01:02:07 454656 ----a-w- C:\Windows\SysWow64\vbscript.dll
2014-09-19 01:01:47 61952 ----a-w- C:\Windows\SysWow64\iesetup.dll
2014-09-19 01:01:03 51200 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
2014-09-19 00:59:40 61952 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll
2014-09-19 00:50:16 112128 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2014-09-19 00:49:31 597504 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
2014-09-19 00:40:12 1249280 ----a-w- C:\Windows\System32\mshtmlmedia.dll
2014-09-19 00:36:23 60416 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
2014-09-19 00:33:18 2309632 ----a-w- C:\Windows\System32\wininet.dll
2014-09-19 00:18:55 1068032 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll
2014-09-18 23:59:11 1810944 ----a-w- C:\Windows\SysWow64\wininet.dll
2014-09-18 02:00:42 3241472 ----a-w- C:\Windows\System32\msi.dll
2014-09-18 01:32:52 2363904 ----a-w- C:\Windows\SysWow64\msi.dll
2014-09-13 01:58:18 77312 ----a-w- C:\Windows\System32\packager.dll
2014-09-13 01:40:05 67072 ----a-w- C:\Windows\SysWow64\packager.dll
2014-09-11 06:57:10 78848 ----a-w- C:\Windows\SysWow64\rzvirtualdev.dll
2014-09-11 06:57:08 155136 ----a-w- C:\Windows\SysWow64\rztouchdll.dll
2014-09-11 06:57:02 117248 ----a-w- C:\Windows\SysWow64\rzdisplaydll.dll
2014-09-09 22:11:04 2048 ----a-w- C:\Windows\System32\tzres.dll
2014-09-09 21:47:10 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2014-09-05 03:27:52 39592 ----a-w- C:\Windows\System32\drivers\rzendpt.sys
2014-09-05 03:27:52 160424 ----a-w- C:\Windows\System32\drivers\rzudd.sys
2014-09-05 02:11:09 6584320 ----a-w- C:\Windows\System32\mstscax.dll
2014-09-05 01:52:41 5703168 ----a-w- C:\Windows\SysWow64\mstscax.dll
2014-09-04 05:23:20 424448 ----a-w- C:\Windows\System32\rastls.dll
2014-09-04 05:04:15 372736 ----a-w- C:\Windows\SysWow64\rastls.dll
2014-08-29 02:07:13 3179520 ----a-w- C:\Windows\System32\rdpcorets.dll
2014-08-23 02:07:00 404480 ----a-w- C:\Windows\System32\gdi32.dll
2014-08-23 01:45:55 311808 ----a-w- C:\Windows\SysWow64\gdi32.dll
2014-08-14 09:58:14 255352 ----a-w- C:\Windows\SysWow64\awrdscdc.ax
.
============= FINISH: 11:02:48.00 ===============
 
Attach log:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 7/28/2012 8:53:51 PM
System Uptime: 11/9/2014 10:26:40 AM (1 hours ago)
.
Motherboard: Gigabyte Technology Co., Ltd. | | Z77-D3H
Processor: Intel(R) Core(TM) i5-3550 CPU @ 3.30GHz | Intel(R) Core(TM) i5-3550 CPU @ 3.30GHz | 3663/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 931 GiB total, 225.019 GiB free.
D: is CDROM ()
H: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP365: 10/26/2014 1:37:36 AM - Windows Update
RP366: 10/31/2014 6:18:17 PM - Windows Update
RP367: 11/4/2014 6:57:09 AM - Windows Update
RP368: 11/8/2014 12:12:34 AM - Windows Update
.
==== Installed Programs ======================
.
@Bios
[MH] Touhou Project - Collection 2011
µTorrent
Adobe Flash Player 15 ActiveX
Adobe Flash Player 15 Plugin
Adobe Reader XI (11.0.09)
Akamai NetSession Interface
Amazon MP3 Downloader 1.0.17
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Archeage
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
AudibleManager
AutoGreen B12.0206.1
Awesome Duplicate Photo Finder v. 1.1
Bandisoft MPEG-1 Decoder
Battle.net
Bonjour
Borderlands 2
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Combined Community Codec Pack 2014-04-20
CPUID CPU-Z 1.61.3
DAEMON Tools Lite
Dota 2
DragonNest
Easy Tune 6 B12.0525.1
Etron USB3.0 Host Controller
f.lux
FINAL FANTASY XIV - A Realm Reborn
GIF Viewer 3.3
GIMP 2.8.10
Glyph
Google Chrome
Guild Wars 2
GunZ 2: The Second Duel
Happy Cloud Client
Hearthstone
HP Deskjet 1010 series Basic Device Software
HP Deskjet 1010 series Help
HP FWUpdateEDO2
HP Update
Intel(R) Management Engine Components
Intel(R) Processor Graphics
Intel(R) USB 3.0 eXtensible Host Controller Driver
iTunes
Java 7 Update 71
Java Auto Updater
jMonkeyEngine SDK
Juniper Networks Host Checker
Juniper Networks Network Connect 7.0.0
Juniper Networks Setup Client
Juniper Networks Setup Client Activex Control
League of Legends
LOLReplay
Malwarebytes Anti-Malware version 2.0.3.1025
Microsoft .NET Framework 4.5.1
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft Office Access database engine 2007 (English)
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft XNA Framework Redistributable 3.1
Mozilla Firefox 33.0.3 (x86 en-US)
Mozilla Maintenance Service
MPC-HC 1.6.2.4902 (64-bit)
Mumble 1.2.5
Nexon Game Manager
NVIDIA 3D Vision Controller Driver 320.49
NVIDIA 3D Vision Driver 335.23
NVIDIA Control Panel 335.23
NVIDIA GeForce Experience 1.5
NVIDIA Graphics Driver 335.23
NVIDIA HD Audio Driver 1.3.26.4
NVIDIA Install Application
NVIDIA PhysX
NVIDIA PhysX System Software 9.13.0604
NVIDIA Stereoscopic 3D Driver
NVIDIA Update 10.4.0
NVIDIA Update Components
ON_OFF Charge B11.1102.1
OpenOffice.org 3.4.1
paint.net
Path of Exile
Pepakura Viewer 3
Platform
RaidCall
Razer Synapse 2.0
Security Update for Microsoft .NET Framework 4.5.1 (KB2894854v2)
Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
Security Update for Microsoft .NET Framework 4.5.1 (KB2931368)
Security Update for Microsoft .NET Framework 4.5.1 (KB2972107)
Security Update for Microsoft .NET Framework 4.5.1 (KB2972216)
Security Update for Microsoft .NET Framework 4.5.1 (KB2979578v2)
Skype™ 6.21
Speccy
SpeedFan (remove only)
Steam
Team Fortress 2
TeamSpeak 3 Client
Tenda Wireless LAN Card
TERA
To the Moon
Unity Web Player
Unreal Development Kit: 2012-10
Ventrilo Client for Windows x64
VIA Platform Device Manager
Vindictus
WhoCrashed 4.02
Windows Live ID Sign-in Assistant
WinRAR 4.20 (64-bit)
.
==== Event Viewer Messages From Past Week ========
.
11/9/2014 9:59:15 AM, Error: Service Control Manager [7023] - The Windows Update service terminated with the following error: %%-2147467243
11/9/2014 7:12:25 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
11/9/2014 7:01:37 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
11/9/2014 7:01:37 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
11/9/2014 7:01:35 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
11/9/2014 7:01:35 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
11/9/2014 7:01:31 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
11/9/2014 7:01:25 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
11/9/2014 7:01:13 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AppleCharger CSC DfsC discache MpFilter NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf
11/9/2014 7:01:12 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
11/9/2014 7:01:12 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
11/9/2014 7:01:12 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
11/9/2014 7:01:12 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
11/9/2014 7:01:12 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
11/9/2014 7:01:12 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
11/9/2014 7:01:12 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
11/9/2014 7:01:12 AM, Error: Service Control Manager [7001] - The Microsoft Network Inspection System service depends on the Microsoft Malware Protection Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/9/2014 7:01:12 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
11/9/2014 7:01:12 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/9/2014 7:01:12 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
11/9/2014 7:01:12 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x8007043c Error description: This service cannot be started in Safe Mode Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.
11/9/2014 6:38:05 AM, Error: Schannel [36887] - The following fatal alert was received: 80.
11/9/2014 10:45:17 AM, Error: Application Popup [1060] - \??\C:\Windows\System32\drivers\TrueSight.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
11/8/2014 8:50:22 PM, Error: Schannel [36887] - The following fatal alert was received: 50.
11/2/2014 7:25:55 PM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004
.
==== End Of File ===========================
 
Please, observe following rules:
  • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
  • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
  • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
  • Never run more than one scan at a time.
  • Keep updating me regarding your computer behavior, good, or bad.
  • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
  • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
  • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

====================================

Please download Powelikscleaner (by ESET) and save it to your Desktop.

1. Double-click on ESETPoweliksCleaner.exe to start the tool.

2. Read the terms of the End-user license agreement and click Agree.

3. The tool will run automatically. If the cleaner finds a Poweliks infection, press the Y key on your keyboard to remove it.

newtool1_zpsa1caa06e.png


4. If Poweliks was detected "Win32/Poweliks was successfully removed from your system" will be displayed. Press any key to exit the tool and reboot your PC.

newtool2_zps0e6d39b1.png


The tool will produce a log in the same directory the tool was run from.

Please copy and paste the log in your next reply.
 
[2014.11.09 13:39:41.941] - Begin
[2014.11.09 13:39:41.941] -
[2014.11.09 13:39:41.942] - ....................................
[2014.11.09 13:39:41.942] - ..::::::::::::::::::....................
[2014.11.09 13:39:41.943] - .::EEEEEE:::SSSSSS::..EEEEEE..TTTTTTTT.. Win32/Poweliks
[2014.11.09 13:39:41.944] - .::EE::::EE:SS:::::::.EE....EE....TT...... Version: 1.0.0.1
[2014.11.09 13:39:41.944] - .::EEEEEEEE::SSSSSS::.EEEEEEEE....TT...... Built: Oct 15 2014
[2014.11.09 13:39:41.945] - .::EE:::::::::::::SS:.EE..........TT......
[2014.11.09 13:39:41.946] - .::EEEEEE:::SSSSSS::..EEEEEE.....TT..... Copyright (c) ESET, spol. s r.o.
[2014.11.09 13:39:41.946] - ..::::::::::::::::::.................... 1992-2013. All rights reserved.
[2014.11.09 13:39:41.946] - ....................................
[2014.11.09 13:39:41.946] -
[2014.11.09 13:39:41.946] - --------------------------------------------------------------------------------
[2014.11.09 13:39:41.946] -
[2014.11.09 13:39:41.947] - INFO: OS: 6.1.7601 SP1
[2014.11.09 13:39:41.947] - INFO: Product Type: Workstation
[2014.11.09 13:39:41.947] - INFO: WoW64: True
[2014.11.09 13:39:41.947] - INFO: Machine guid: A74951F0-19FD-4D36-A135-B8B48C667524
[2014.11.09 13:39:41.947] -
[2014.11.09 13:39:46.338] - INFO: Scanning for system infection...
[2014.11.09 13:39:46.339] - --------------------------------------------------------------------------------
[2014.11.09 13:39:46.339] -
[2014.11.09 13:39:46.339] - INFO: Processing [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]...
[2014.11.09 13:39:46.339] - INFO: Processing [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]...
[2014.11.09 13:39:46.339] - INFO: Processing [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]...
[2014.11.09 13:39:46.340] - INFO: Processing [HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce]...
[2014.11.09 13:39:46.340] - INFO: Processing classes...
[2014.11.09 13:39:46.341] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}]
[2014.11.09 13:39:46.341] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}]
[2014.11.09 13:39:46.341] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{08FB66B9-2D2D-4B35-A747-D5D9E9F472E2}]
[2014.11.09 13:39:46.341] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}]
[2014.11.09 13:39:46.341] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{0F9285DF-3511-4FE6-A587-CD8F61A121CA}]
[2014.11.09 13:39:46.341] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{21902B91-1E80-4282-AFDE-AB014CB4ED5A}]
[2014.11.09 13:39:46.341] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{220DFF67-87CE-4D26-8020-27E0B554A880}]
[2014.11.09 13:39:46.341] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}]
[2014.11.09 13:39:46.341] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}]
[2014.11.09 13:39:46.341] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{305CA226-D286-468e-B848-2B2E8E697B74}]
[2014.11.09 13:39:46.341] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{3063357E-821C-4A7D-B49A-F61EA772BF9B}]
[2014.11.09 13:39:46.341] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}]
[2014.11.09 13:39:46.341] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{3f04dadf-6ea4-44d1-a507-03cad176f443}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{49BBAA3C-C574-419E-8378-783C362E9C15}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{699A646B-C61E-4C36-A253-620E4EBD294C}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{71FDCAEA-B6F2-4B6C-A18C-6C85F0E4662F}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{91EFB276-CEFE-48EC-BB3A-57795A7B4008}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{A1436E43-F58F-4D3B-B908-B6DA44563B00}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{A480C024-04D0-4F28-8CF0-ADACE2BD839C}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{b226c901-b163-53c9-a14c-5b55ebb03907}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{B41AD4BE-25BA-4A51-A0BB-FC1584E316F1}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{C9E37353-EC76-4A58-B575-BBA8B4BD06D1}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.342] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.343] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.344] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.345] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.346] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.346] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.346] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.346] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.346] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.346] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.346] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.346] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.346] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.346] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}]
 
[2014.11.09 13:39:46.354] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.354] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.354] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.354] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.354] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.354] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.354] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.354] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.354] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.354] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.354] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.354] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.355] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0028-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0028-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0028-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.356] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0040-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0040-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0040-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0041-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0041-ABCDEFFEDCBB}]
 
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0041-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0042-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0042-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0042-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0043-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0043-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0043-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0044-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0044-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0044-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.357] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0046-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0046-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0046-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0047-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0047-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0047-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0049-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0049-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0049-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0050-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0050-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0050-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0051-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0051-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0051-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0052-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0052-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0052-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0053-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0053-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0053-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0054-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0054-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0054-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0055-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0055-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0055-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0056-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.358] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0056-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0056-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0057-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0057-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0057-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0058-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0058-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0058-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0059-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0059-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0059-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0060-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0060-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0060-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0061-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0061-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0061-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0062-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0062-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0062-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0064-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0064-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0064-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0065-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0065-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0065-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0066-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0066-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0066-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0067-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0067-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0067-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.359] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0068-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0068-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0068-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0069-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0069-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0069-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0070-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0070-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0070-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0071-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0071-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0071-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0072-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0072-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0072-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0073-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0073-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0073-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0074-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0074-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0074-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0075-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0075-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0075-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0076-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0076-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0076-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0077-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0077-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0077-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0079-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0079-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0079-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.360] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0080-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0081-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0081-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0081-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0082-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0082-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0082-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0083-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0083-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0083-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0084-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0084-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0084-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0085-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0085-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0085-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0002-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0002-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0004-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0004-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0004-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.361] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0006-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0006-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0006-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0008-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0008-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0008-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0009-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0009-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0010-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0010-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0010-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0014-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0014-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0014-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0015-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0015-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0015-ABCDEFFEDCBC}]
 
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0016-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0016-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.362] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0016-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0017-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0017-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0018-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0018-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0018-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0019-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0019-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0019-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0020-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0020-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0020-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0022-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0022-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0022-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0023-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0023-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0023-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0024-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0024-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0024-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0026-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0026-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0026-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0027-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0027-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0027-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0028-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0028-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.363] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0028-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0029-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0029-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0029-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0031-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0031-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0031-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0034-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0034-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0034-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0035-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0035-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0035-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0036-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0036-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0036-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0037-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0037-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0037-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0038-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0038-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0038-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0039-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0039-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0039-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0040-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0040-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0040-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.364] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0041-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0041-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0041-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0042-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0042-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0042-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0045-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0045-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0046-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0046-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0046-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0047-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0047-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0047-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0048-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0048-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0048-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0049-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0049-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0049-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0051-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0051-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.365] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0051-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0052-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0052-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0052-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0053-ABCDEFFEDCBA}]
 
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0053-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0053-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0054-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0054-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0054-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0055-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0055-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0055-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0056-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0056-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0056-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0057-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0057-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0057-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0058-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0058-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0058-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0059-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0059-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0059-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0060-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0060-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0060-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0061-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0061-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0061-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0062-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0062-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0062-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0063-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.366] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0063-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0063-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0064-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0064-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0064-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0065-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0065-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0065-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0066-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0066-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0066-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0067-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0067-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0067-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0068-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0068-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0068-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0069-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0069-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0069-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0070-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0070-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0070-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0071-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0071-ABCDEFFEDCBB}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0071-ABCDEFFEDCBC}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-FFFF-ABCDEFFEDCBA}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{CD221623-4F9A-4FA5-A9EE-A77EC8F0E7BD}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{DBFA3C03-20D5-4EE5-8C06-B8C4C2B71783}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}]
[2014.11.09 13:39:46.367] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{FD10EA6A-0D14-4AA2-A376-0C8D51CA8779}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{3063357E-821C-4A7D-B49A-F61EA772BF9B}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{31261F21-2B16-45EE-BEAB-07C4CFA18B65}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{3f04dadf-6ea4-44d1-a507-03cad176f443}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{B41AD4BE-25BA-4A51-A0BB-FC1584E316F1}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{CD221623-4F9A-4FA5-A9EE-A77EC8F0E7BD}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1001\SOFTWARE\Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{0F9285DF-3511-4FE6-A587-CD8F61A121CA}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{699A646B-C61E-4C36-A253-620E4EBD294C}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{71FDCAEA-B6F2-4B6C-A18C-6C85F0E4662F}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{C9E37353-EC76-4A58-B575-BBA8B4BD06D1}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}]
[2014.11.09 13:39:46.368] - INFO: Processing clsid [\Registry\User\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}]
[2014.11.09 13:39:46.368] - INFO: Processing [HKLM\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32]...
[2014.11.09 13:39:46.370] - INFO: Processing value [] = [%systemroot%\sysWOW64\wbem\wmiprvse.exe]
[2014.11.09 13:39:46.370] - INFO: Processing value [] = [%systemroot%\system32\wbem\wmiprvse.exe]
[2014.11.09 13:39:46.370] - INFO: Processing invalid values in [HKLM\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32]...
[2014.11.09 13:39:46.370] - INFO: Processing value [] = [%systemroot%\sysWOW64\wbem\wmiprvse.exe]
[2014.11.09 13:39:46.371] - INFO: Processing value [ServerExecutable] = [%systemroot%\sysWOW64\wbem\wmiprvse.exe]
[2014.11.09 13:39:46.371] - INFO: Processing value [] = [%systemroot%\system32\wbem\wmiprvse.exe]
[2014.11.09 13:39:46.371] - INFO: Processing value [ServerExecutable] = [%systemroot%\system32\wbem\wmiprvse.exe]
[2014.11.09 13:39:46.371] - INFO: Processing invalid subkeys in [HKLM\SOFTWARE\Classes\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32]...
[2014.11.09 13:39:46.371] - INFO: Processing [HKLM\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}]...
[2014.11.09 13:39:46.371] - INFO: Processing subkey [\Registry\Machine\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32]
[2014.11.09 13:39:46.372] - INFO: Processing subkey [\Registry\Machine\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32]
[2014.11.09 13:39:46.372] - INFO: Win32/Poweliks not found
[2014.11.09 13:40:16.751] - End
 
redtarget.gif
Download RogueKiller from one of the following links and save it to your Desktop:

Link 1
Link 2

  • Close all the running programs
  • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
  • Otherwise just double-click on RogueKiller.exe
  • Pre-scan will start. Let it finish.
  • Click on SCAN button.
  • Wait until the Status box shows Scan Finished
  • Click on Delete.
  • Wait until the Status box shows Deleting Finished.
  • Click on Report and copy/paste the content of the Notepad into your next reply.
  • RKreport.txt could also be found on your desktop.
  • If more than one log is produced post all logs.
  • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

redtarget.gif
Create new restore point before proceeding with the next step....
How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

Download
51a5f31352b88-icon_MBAR.png
Malwarebytes Anti-Rootkit to your desktop.
  • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
  • Double click on downloaded file. OK self extracting prompt.
  • MBAR will start. Click "Next" to continue.
  • Click in the following screen "Update" to obtain the latest malware definitions.
  • Once the update is complete select "Next" and click "Scan".
  • When the scan is finished and no malware has been found select "Exit".
  • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
  • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
    • "mbar-log-{date} (xx-xx-xx).txt"
    • "system-log.txt"
 
Mbar log:
Malwarebytes Anti-Rootkit BETA 1.07.0.1012
www.malwarebytes.org

Database version: v2014.11.09.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17358
Vincent :: NOISEMACHINE [administrator]

11/9/2014 2:12:53 PM
mbar-log-2014-11-09 (14-12-53).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 449584
Time elapsed: 52 minute(s), 36 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Users\Vincent\AppData\Local\Temp\ECCB.tmp (Trojan.Agent) -> Delete on reboot. [ec99608fcab1a2946877746cc63ba65a]
C:\Users\Vincent\AppData\Local\Temp\160C.tmp (Trojan.Agent) -> Delete on reboot. [2c59c32cd7a48aac56896e720ef333cd]

Physical Sectors Detected: 0
(No malicious items detected)

(end)
 
System log:
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17107

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.292000 GHz
Memory total: 8550342656, free: 6210236416

Downloaded database version: v2014.05.17.10
Downloaded database version: v2014.03.27.01
=======================================
Initializing...
------------ Kernel report ------------
05/17/2014 13:51:38
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\DRIVERS\iusb3hcs.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\SysWOW64\speedfan.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\dtsoftbus01.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\AppleCharger.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\iusb3xhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\L1C62x64.sys
\SystemRoot\System32\Drivers\EtronXHCI.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\dsNcAdpt.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\hamachi.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\EtronHub3.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\iusb3hub.sys
\SystemRoot\system32\drivers\viahduaa.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\nvhda64v.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\SystemRoot\System32\ATMFD.DLL
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\advapi32.dll
\Windows\System32\shell32.dll
\Windows\System32\setupapi.dll
\Windows\System32\wininet.dll
\Windows\System32\iertutil.dll
\Windows\System32\kernel32.dll
\Windows\System32\difxapi.dll
\Windows\System32\imm32.dll
\Windows\System32\gdi32.dll
\Windows\System32\msvcrt.dll
\Windows\System32\oleaut32.dll
\Windows\System32\urlmon.dll
\Windows\System32\psapi.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\imagehlp.dll
\Windows\System32\lpk.dll
\Windows\System32\msctf.dll
\Windows\System32\comdlg32.dll
\Windows\System32\Wldap32.dll
\Windows\System32\shlwapi.dll
\Windows\System32\ole32.dll
\Windows\System32\user32.dll
\Windows\System32\sechost.dll
\Windows\System32\clbcatq.dll
\Windows\System32\ws2_32.dll
\Windows\System32\usp10.dll
\Windows\System32\normaliz.dll
\Windows\System32\nsi.dll
\Windows\System32\KernelBase.dll
\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
\Windows\System32\devobj.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\crypt32.dll
\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
\Windows\System32\comctl32.dll
\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
\Windows\System32\wintrust.dll
\Windows\System32\msasn1.dll
\Windows\SysWOW64\normaliz.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa8007750060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP3T0L0-3\
Lower Device Object: 0xfffffa80073d9060
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa800774f060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP1T0L0-1\
Lower Device Object: 0xfffffa8007348060
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa800774e060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T1L0-5\
Lower Device Object: 0xfffffa8007345060
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xfffffa8007750060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8007750b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8007750060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80073d9060, DeviceName: \Device\Ide\IdeDeviceP3T0L0-3\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa800774e060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800774eb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800774e060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80072d09b0, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8007345060, DeviceName: \Device\Ide\IdeDeviceP0T1L0-5\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 0
Scanning MBR on drive 0...
MBR buffers are not equal
MBR is forged! [5b875a22f8ce39ec096216471c83be3f]
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2A0BC502

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition is not bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 1953314816

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1953505168-1953525168)...
Sectors 1953521663 - 1953521663 --> [Forged physical sectors]
Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa800774f060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800774fb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800774f060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8007344520, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8007348060, DeviceName: \Device\Ide\IdeDeviceP1T0L0-1\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
MBR on drive 1 is invalid or encrypted
Disk Size: 60022480896 bytes
Sector size: 512 bytes

Done!
Drive 2
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2A0BC502

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 1953314816

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Scan finished
Creating System Restore point...
Cleaning up...
Removal scheduling successful. System shutdown needed.
System shutdown occurred
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-c.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\LBA-0-1953521663-u.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\LBA-0-1953521663-k.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-2-0-2048-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...
Removal finished
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17107

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.292000 GHz
Memory total: 8550342656, free: 5349384192

Downloaded database version: v2014.05.26.01
Downloaded database version: v2014.05.21.01
=======================================
Initializing...
Done!
Scan Interrupted
Scan Interrupted
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Scan was aborted.
=======================================


---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1012

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17126

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.292000 GHz
Memory total: 8550342656, free: 6384160768

Downloaded database version: v2014.06.27.08
Downloaded database version: v2014.06.23.02
=======================================
Initializing...
------------ Kernel report ------------
06/27/2014 16:40:32
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\DRIVERS\iusb3hcs.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\SysWOW64\speedfan.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\dtsoftbus01.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\AppleCharger.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\iusb3xhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\L1C62x64.sys
\SystemRoot\System32\Drivers\EtronXHCI.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\dsNcAdpt.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\hamachi.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\EtronHub3.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\iusb3hub.sys
\SystemRoot\system32\drivers\viahduaa.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\nvhda64v.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\clbcatq.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa80077d1060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP3T0L0-3\
Lower Device Object: 0xfffffa8007517060
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa80077d0060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP1T0L0-1\
Lower Device Object: 0xfffffa800750c060
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa80077cf060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T1L0-5\
Lower Device Object: 0xfffffa8007509060
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xfffffa80077d1060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8007617990, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077d1060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8007517060, DeviceName: \Device\Ide\IdeDeviceP3T0L0-3\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa80077cf060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80077cfb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077cf060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8007523520, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8007509060, DeviceName: \Device\Ide\IdeDeviceP0T1L0-5\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 0
Scanning MBR on drive 0...
MBR on drive 0 is invalid or encrypted
Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa80077d0060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80077d0b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077d0060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8007508520, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa800750c060, DeviceName: \Device\Ide\IdeDeviceP1T0L0-1\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
MBR on drive 1 is invalid or encrypted
Disk Size: 60022480896 bytes
Sector size: 512 bytes

Done!
Drive 2
This is a System drive
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2A0BC502

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 1953314816

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 2 (1-2047-1953505168-1953525168)...
Done!
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-2-0-2048-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...
Removal finished
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1012

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17207

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.292000 GHz
Memory total: 8550342656, free: 4626821120

Downloaded database version: v2014.07.09.13
Canceled update
Downloaded database version: v2014.07.09.13
Downloaded database version: v2014.07.09.01
=======================================
Initializing...
Done!
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Drive 0
Scanning MBR on drive 0...
MBR on drive 0 is invalid or encrypted
Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Drive 1
Scanning MBR on drive 1...
MBR on drive 1 is invalid or encrypted
Disk Size: 60022480896 bytes
Sector size: 512 bytes

Done!
Drive 2
This is a System drive
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2A0BC502

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 1953314816

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 2 (1-2047-1953505168-1953525168)...
Done!
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-2-0-2048-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...
Removal finished
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1012

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17280

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.292000 GHz
Memory total: 8550342656, free: 6866038784

Downloaded database version: v2014.09.25.03
Downloaded database version: v2014.09.19.01
=======================================
Initializing...
------------ Kernel report ------------
09/25/2014 03:46:10
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\xibu.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\DRIVERS\iusb3hcs.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\SysWOW64\speedfan.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\dtsoftbus01.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\netfilter64.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\AppleCharger.sys
\SystemRoot\system32\DRIVERS\iusb3xhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\L1C62x64.sys
\SystemRoot\System32\Drivers\EtronXHCI.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\dsNcAdpt.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\hamachi.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\EtronHub3.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\iusb3hub.sys
\SystemRoot\system32\drivers\viahduaa.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\nvhda64v.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\drivers\usbaudio.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\SystemRoot\system32\drivers\qwavedrv.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa80077ce060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP3T0L0-3\
Lower Device Object: 0xfffffa8007512060
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa80077cd060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP1T0L0-1\
Lower Device Object: 0xfffffa8007506680
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa80077cc060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T1L0-5\
Lower Device Object: 0xfffffa8007519680
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xfffffa80077ce060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80077ceb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077ce060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8007512060, DeviceName: \Device\Ide\IdeDeviceP3T0L0-3\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa80077cc060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80077ccb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077cc060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800751e520, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8007519680, DeviceName: \Device\Ide\IdeDeviceP0T1L0-5\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 0
Scanning MBR on drive 0...
MBR on drive 0 is invalid or encrypted
Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa80077cd060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80077cdb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077cd060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8007510580, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8007506680, DeviceName: \Device\Ide\IdeDeviceP1T0L0-1\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
MBR on drive 1 is invalid or encrypted
Disk Size: 60022480896 bytes
Sector size: 512 bytes

Done!
Drive 2
This is a System drive
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2A0BC502

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 1953314816

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 2 (1-2047-1953505168-1953525168)...
Done!
---------------------------------------
 
Malwarebytes Anti-Rootkit BETA 1.07.0.1012

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17280

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.292000 GHz
Memory total: 8550342656, free: 3108577280

Could not load protection driver
Downloaded database version: v2014.09.25.04
Downloaded database version: v2014.09.25.05
Downloaded database version: v2014.09.25.06
Downloaded database version: v2014.09.25.07
Downloaded database version: v2014.09.25.08
Downloaded database version: v2014.09.25.09
Downloaded database version: v2014.09.25.10
Downloaded database version: v2014.09.25.11
=======================================
Initializing...
------------ Kernel report ------------
09/25/2014 20:03:44
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\DRIVERS\iusb3hcs.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\SysWOW64\speedfan.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\dtsoftbus01.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\AppleCharger.sys
\SystemRoot\system32\DRIVERS\iusb3xhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\L1C62x64.sys
\SystemRoot\System32\Drivers\EtronXHCI.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\dsNcAdpt.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\hamachi.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\EtronHub3.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\iusb3hub.sys
\SystemRoot\system32\drivers\viahduaa.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\nvhda64v.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\qwavedrv.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\SystemRoot\System32\ATMFD.DLL
\??\C:\Windows\system32\drivers\EagleX64.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa80077a8060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP3T0L0-3\
Lower Device Object: 0xfffffa80072ce060
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa80077a7060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP1T0L0-1\
Lower Device Object: 0xfffffa8007150680
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa80077a6060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T1L0-5\
Lower Device Object: 0xfffffa80072d5680
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xfffffa80077a8060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80077a8b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077a8060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80072ce060, DeviceName: \Device\Ide\IdeDeviceP3T0L0-3\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa80077a6060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80077a6b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077a6060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80072da520, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa80072d5680, DeviceName: \Device\Ide\IdeDeviceP0T1L0-5\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 0
Scanning MBR on drive 0...
MBR on drive 0 is invalid or encrypted
Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa80077a7060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80075ea990, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077a7060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8007154520, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8007150680, DeviceName: \Device\Ide\IdeDeviceP1T0L0-1\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
MBR on drive 1 is invalid or encrypted
Disk Size: 60022480896 bytes
Sector size: 512 bytes

Done!
Drive 2
This is a System drive
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2A0BC502

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 1953314816

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 2 (1-2047-1953505168-1953525168)...
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa80077a8060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP3T0L0-3\
Lower Device Object: 0xfffffa80072ce060
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa80077a7060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP1T0L0-1\
Lower Device Object: 0xfffffa8007150680
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa80077a6060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T1L0-5\
Lower Device Object: 0xfffffa80072d5680
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-2-0-2048-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...
Removal finished
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1012

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17358

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.292000 GHz
Memory total: 8550342656, free: 2853253120

Could not load protection driver
Downloaded database version: v2014.11.09.01
Downloaded database version: v2014.11.08.01
Initializing...
=======================================
------------ Kernel report ------------
11/08/2014 22:43:03
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\System32\drivers\xwkasus.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\DRIVERS\iusb3hcs.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\SysWOW64\speedfan.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\DRIVERS\dtsoftbus01.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\AppleCharger.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\iusb3xhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\System32\Drivers\EtronXHCI.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\dsNcAdpt.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\EtronHub3.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\iusb3hub.sys
\SystemRoot\system32\drivers\viahduaa.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\nvhda64v.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\netr28ux.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\rzendpt.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\rzudd.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\system32\drivers\usbaudio.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\SystemRoot\system32\drivers\qwavedrv.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\comdlg32.dll
\Windows\System32\msvcrt.dll
\Windows\System32\ole32.dll
\Windows\System32\normaliz.dll
\Windows\System32\imagehlp.dll
\Windows\System32\clbcatq.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\user32.dll
\Windows\System32\gdi32.dll
\Windows\System32\sechost.dll
\Windows\System32\iertutil.dll
\Windows\System32\lpk.dll
\Windows\System32\ws2_32.dll
\Windows\System32\shell32.dll
\Windows\System32\nsi.dll
\Windows\System32\Wldap32.dll
\Windows\System32\oleaut32.dll
\Windows\System32\imm32.dll
\Windows\System32\setupapi.dll
\Windows\System32\shlwapi.dll
\Windows\System32\psapi.dll
\Windows\System32\advapi32.dll
\Windows\System32\msctf.dll
\Windows\System32\difxapi.dll
\Windows\System32\usp10.dll
\Windows\System32\urlmon.dll
\Windows\System32\kernel32.dll
\Windows\System32\wininet.dll
\Windows\System32\comctl32.dll
\Windows\System32\KernelBase.dll
\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
\Windows\System32\crypt32.dll
\Windows\System32\userenv.dll
\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
\Windows\System32\devobj.dll
\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\wintrust.dll
\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
\Windows\System32\profapi.dll
\Windows\System32\msasn1.dll
\Windows\SysWOW64\normaliz.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa80077cc060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP3T0L0-3\
Lower Device Object: 0xfffffa8007179060
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa80077cb060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP1T0L0-1\
Lower Device Object: 0xfffffa800716d680
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa80077c9060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T1L0-5\
Lower Device Object: 0xfffffa80071b1680
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xfffffa80077cc060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80077cb990, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077cc060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8007179060, DeviceName: \Device\Ide\IdeDeviceP3T0L0-3\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa80077c9060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80077c9b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077c9060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800710b4d0, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa80071b1680, DeviceName: \Device\Ide\IdeDeviceP0T1L0-5\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 0
Scanning MBR on drive 0...
MBR on drive 0 is invalid or encrypted
Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa80077cb060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800760d990, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077cb060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800716c2d0, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa800716d680, DeviceName: \Device\Ide\IdeDeviceP1T0L0-1\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
MBR on drive 1 is invalid or encrypted
Disk Size: 60022480896 bytes
Sector size: 512 bytes

Done!
Drive 2
This is a System drive
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2A0BC502

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 1953314816

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 2 (1-2047-1953505168-1953525168)...
Done!
Scan finished
=======================================


---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1012

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17358

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.292000 GHz
Memory total: 8550342656, free: 6458744832

Could not load protection driver
=======================================
Initializing...
Removal queue found; removal started
Removing 햽嫹⩓‟ꕤ覆橻ȉ꣛汢믺哳ⲭ붿릨笋혝ꇜ㸥᠊뾂婃璍ࠖ튥꒸㷆٤㴁蛶ᅺؗ�㜷柦ٳᤊ⊊ꮧ䪍੊箾嚤乽�៬禳쑊꺒᳣ⶮ텄䖓唒�浶쿋懎⯎偊᥎ᆲ편쾽昫庹౎ᇹ频�揧疪꟬ை菛蜼奤衞停効⇡䍹ꁺ냖ⲍﬕ嵬渘㮥稡〲䡛䭡赟뚌쌺යᛥ溋揃Ⱘ沋狞Ვ⤗池谰㇕丨ꞅᡁ氯㫉��帥钹狖ಮ즇쳊ٙ磔ⅴလ逞Ï䐍�퍋䰉Შ�꣟눚虜樵韲쯉材Ⰶ丄�锈櫤艋鍚�笁陾㏚�썙䋊㫼鯁꫹౼ꙷ쾾Ⳍ왰췉壉鿊圜쌖ᬷⳎ▍㊼峯燹鐜塽歉ﲩᎸ팠탪郔⛓ꮏ0읻鸰冈f...
Removal finished
Done!
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Drive 0
Scanning MBR on drive 0...
MBR on drive 0 is invalid or encrypted
Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Drive 1
Scanning MBR on drive 1...
MBR on drive 1 is invalid or encrypted
Disk Size: 60022480896 bytes
Sector size: 512 bytes

Done!
Drive 2
This is a System drive
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2A0BC502

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 1953314816

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 2 (1-2047-1953505168-1953525168)...
Done!
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1012

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17358

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.292000 GHz
Memory total: 8550342656, free: 4487651328

Could not load protection driver
Downloaded database version: v2014.11.09.02
Downloaded database version: v2014.11.09.07
Canceled update
=======================================


---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1012

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17358

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.292000 GHz
Memory total: 8550342656, free: 4477689856

Could not load protection driver
Downloaded database version: v2014.11.09.02
Downloaded database version: v2014.11.09.07
=======================================
Initializing...
------------ Kernel report ------------
11/09/2014 14:12:47
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\DRIVERS\iusb3hcs.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\SysWOW64\speedfan.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\dtsoftbus01.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\AppleCharger.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\iusb3xhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\System32\Drivers\EtronXHCI.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\dsNcAdpt.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\EtronHub3.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\iusb3hub.sys
\SystemRoot\system32\drivers\viahduaa.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\nvhda64v.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\rzendpt.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\rzudd.sys
\SystemRoot\system32\DRIVERS\netr28ux.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\shell32.dll
\Windows\System32\setupapi.dll
\Windows\System32\msctf.dll
\Windows\System32\advapi32.dll
\Windows\System32\urlmon.dll
\Windows\System32\imagehlp.dll
\Windows\System32\wininet.dll
\Windows\System32\iertutil.dll
\Windows\System32\clbcatq.dll
\Windows\System32\user32.dll
\Windows\System32\kernel32.dll
\Windows\System32\comdlg32.dll
\Windows\System32\imm32.dll
\Windows\System32\Wldap32.dll
\Windows\System32\lpk.dll
\Windows\System32\usp10.dll
\Windows\System32\oleaut32.dll
\Windows\System32\shlwapi.dll
\Windows\System32\sechost.dll
\Windows\System32\gdi32.dll
\Windows\System32\normaliz.dll
\Windows\System32\ole32.dll
\Windows\System32\nsi.dll
\Windows\System32\ws2_32.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\psapi.dll
\Windows\System32\difxapi.dll
\Windows\System32\msvcrt.dll
\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
\Windows\System32\KernelBase.dll
\Windows\System32\devobj.dll
\Windows\System32\comctl32.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\userenv.dll
\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
\Windows\System32\wintrust.dll
\Windows\System32\crypt32.dll
\Windows\System32\msasn1.dll
\Windows\System32\profapi.dll
\Windows\SysWOW64\normaliz.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa80077cb060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP3T0L0-3\
Lower Device Object: 0xfffffa8007515060
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa80077ca060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP1T0L0-1\
Lower Device Object: 0xfffffa80074a9060
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa80077c9060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T1L0-5\
Lower Device Object: 0xfffffa80074a6060
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xfffffa80077cb060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8007613990, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077cb060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8007515060, DeviceName: \Device\Ide\IdeDeviceP3T0L0-3\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa80077c9060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80077c9b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077c9060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80071239b0, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa80074a6060, DeviceName: \Device\Ide\IdeDeviceP0T1L0-5\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 0
Scanning MBR on drive 0...
MBR on drive 0 is invalid or encrypted
Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa80077ca060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80077cab90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80077ca060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80074a5520, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa80074a9060, DeviceName: \Device\Ide\IdeDeviceP1T0L0-1\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
MBR on drive 1 is invalid or encrypted
Disk Size: 60022480896 bytes
Sector size: 512 bytes

Done!
Drive 2
This is a System drive
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2A0BC502

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 1953314816

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 2 (1-2047-1953505168-1953525168)...
Done!
Infected: C:\Users\Vincent\AppData\Local\Temp\ECCB.tmp --> [Trojan.Agent]
Infected: C:\Users\Vincent\AppData\Local\Temp\160C.tmp --> [Trojan.Agent]
Scan finished
Creating System Restore point...
Cleaning up...
Removal scheduling successful. System shutdown needed.
System shutdown occurred
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-2-0-2048-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...
Removal finished
 
My bad, thought I uploaded them already.

RogueKiller V10.0.4.0 [Oct 29 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Vincent [Administrator]
Mode : Delete -- Date : 11/09/2014 14:09:27

¤¤¤ Processes : 1 ¤¤¤
[Suspicious.Path] GoogleCrashHandler.exe -- C:\Users\Vincent\AppData\Local\Google\Update\1.3.25.5\GoogleCrashHandler.exe[7] -> Killed [TermProc]

¤¤¤ Registry : 12 ¤¤¤
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\gdrv (\??\C:\Windows\gdrv.sys) -> Not selected
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GVTDrv64 (\??\C:\Windows\GVTDrv64.sys) -> Not selected
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gdrv (\??\C:\Windows\gdrv.sys) -> Not selected
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GVTDrv64 (\??\C:\Windows\GVTDrv64.sys) -> Not selected
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\gdrv (\??\C:\Windows\gdrv.sys) -> Not selected
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\GVTDrv64 (\??\C:\Windows\GVTDrv64.sys) -> Not selected
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1394883155-3604719780-1674705818-1000\Software\Microsoft\Internet Explorer\Main | Start Page : about:Tabs -> Not selected
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1394883155-3604719780-1674705818-1000\Software\Microsoft\Internet Explorer\Main | Start Page : about:Tabs -> Not selected
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

¤¤¤ Web browsers : 1 ¤¤¤
[PUM.HomePage][FIREFX:Config] tigpirsy.default-1411634339210 : user_pref("browser.startup.homepage", "gmail.com"); -> Not selected

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: +++++
Error reading User MBR! NOT VALID!
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! NOT VALID!

+++++ PhysicalDrive1: Corsair Force 3 SSD ATA Device +++++
Error reading User MBR! NOT VALID!
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! NOT VALID!

+++++ PhysicalDrive2: WDC WD1001FALS-00J7B0 ATA Device +++++
--- User ---
[MBR] cdb75de8c6ee33e68451b8df8e89b4cf
[BSP] ed6cdb27f8619c7b14a9dd0f94b8db3f : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 953767 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_SCN_11092014_105442.log - RKreport_SCN_11092014_140850.log
 
For x86 (x32) bit systems please download Listparts
For x64 bit systems please download Listparts64

Click on Scan button.

Scan result will open in Notepad.
Post it in your next reply.
 
ListParts by Farbar Version: 31-07-2014
Ran by Vincent (administrator) on 09-11-2014 at 17:16:35
Windows 7 (X64)
Running From: C:\Users\Vincent\Downloads
Language: English (United States)
************************************************************

========================= Memory info ======================

Percentage of memory in use: 55%
Total physical RAM: 8154.24 MB
Available physical RAM: 3641.07 MB
Total Pagefile: 16306.66 MB
Available Pagefile: 11463.89 MB
Total Virtual: 8192 MB
Available Virtual: 8191.91 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:931.41 GB) (Free:248.02 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 931 GB 931 GB
Disk 1 Online 55 GB 55 GB
Disk 2 Online 931 GB 0 B

Partitions of Disk 0:
===============

Disk ID: 00000000

There are no partitions on this disk to show.

======================================================================================================

Partitions of Disk 1:
===============

Disk ID: 00000000

There are no partitions on this disk to show.

======================================================================================================

Partitions of Disk 2:
===============

Disk ID: 2A0BC502

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 100 MB 1024 KB
Partition 2 Primary 931 GB 101 MB

======================================================================================================

Disk: 2
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 System Rese NTFS Partition 100 MB Healthy System (partition with boot components)

======================================================================================================

Disk: 2
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 C NTFS Partition 931 GB Healthy Boot

======================================================================================================
============================== MBR Partition Table ==================
Could not read MBR for disk 0.
Could not read MBR for disk 1.

==============================
Partitions of Disk 2:
===============
Disk ID: 2A0BC502
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)


****** End Of Log ******
 
Good :)

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Never rename Combofix unless instructed.
  • Close any open browsers.
  • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    If the connection is not there use restore point you created prior to running Combofix.
  • Double click on combofix.exe & follow the prompts.

  • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
    NOTE 2. If Combofix asks you to update the program, always do so.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt"
**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • Do not reboot until instructed.
  • If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
 
ComboFix 14-11-09.02 - Vincent 11/09/2014 18:47:15.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8154.5210 [GMT -6:00]
Running from: c:\users\Vincent\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
SP: Microsoft Security Essentials *Disabled/Updated* {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\programdata\893686b8
c:\users\Vincent\AppData\Roaming\893686b8
c:\users\Vincent\xobglu32.dll
c:\windows\msdownld.tmp
.
.
((((((((((((((((((((((((( Files Created from 2014-10-10 to 2014-11-10 )))))))))))))))))))))))))))))))
.
.
2014-11-09 21:24 . 2014-09-16 15:48 1188440 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E1291011-4988-4F14-9AF5-D94478650BA0}\gapaengine.dll
2014-11-09 21:24 . 2014-10-14 19:59 11627712 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0DE64D58-548E-420A-AC6A-A5F2E7B6830E}\mpengine.dll
2014-11-09 19:09 . 2014-11-09 19:09 -------- d-----w- c:\program files\CCleaner
2014-11-09 16:45 . 2014-11-09 20:05 34808 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2014-11-09 16:45 . 2014-11-09 16:45 -------- d-----w- c:\programdata\RogueKiller
2014-11-09 16:27 . 2014-10-14 19:59 11627712 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-11-09 04:26 . 2014-11-09 04:26 -------- d-----w- c:\program files (x86)\ESET
2014-11-09 01:11 . 2014-11-09 01:11 -------- d-----w- c:\programdata\RufoLdolz
2014-11-09 01:11 . 2014-11-09 01:11 -------- d-----w- c:\programdata\PuseQzupa
2014-11-09 00:44 . 2014-11-09 04:18 -------- d--h--w- c:\programdata\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
2014-11-08 13:40 . 2014-11-08 13:40 -------- d-----w- c:\users\Vincent\AppData\Local\qBittorrent
2014-11-08 13:40 . 2014-11-09 18:22 -------- d-----w- c:\program files (x86)\qBittorrent
2014-11-07 04:43 . 2014-11-07 04:43 220784 ----a-w- c:\program files (x86)\Mozilla Firefox\sandboxbroker.dll
2014-11-04 12:58 . 2014-09-16 15:48 1188440 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7EC2ED02-0464-4989-BBFA-164CB9FEEA65}\gapaengine.dll
2014-11-01 16:31 . 2014-11-01 16:31 -------- d-----w- c:\users\Vincent\AppData\Local\Razer
2014-11-01 00:51 . 2014-11-01 00:51 -------- d-----w- c:\programdata\Razer
2014-11-01 00:50 . 2014-11-01 16:29 -------- d-----w- c:\program files (x86)\Razer
2014-10-31 23:04 . 2014-10-31 23:04 -------- d-----w- c:\program files (x86)\Common Files\Skype
2014-10-31 23:04 . 2014-10-31 23:04 -------- d-----r- c:\program files (x86)\Skype
2014-10-18 15:58 . 2014-10-18 15:58 -------- d-----w- c:\program files (x86)\Common Files\Java
2014-10-18 15:57 . 2014-10-18 15:57 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-10-18 15:57 . 2014-10-18 15:57 -------- d-----w- c:\program files (x86)\Java
2014-10-18 01:25 . 2014-07-17 02:07 235520 ----a-w- c:\windows\system32\winsta.dll
2014-10-18 01:20 . 2014-10-18 01:20 -------- d-----w- c:\program files (x86)\Common Files\Adobe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-11-09 20:12 . 2014-05-18 09:53 128728 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-10-30 11:25 . 2010-11-21 03:27 275080 ------w- c:\windows\system32\MpSigStub.exe
2014-10-18 15:55 . 2012-08-01 23:43 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-10-18 15:55 . 2012-08-01 23:43 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-10-18 07:00 . 2012-07-29 02:37 103265616 ----a-w- c:\windows\system32\MRT.exe
2014-10-09 09:07 . 2014-10-09 09:07 89088 ----a-w- c:\windows\SysWow64\rzdevinfo.dll
2014-10-01 15:11 . 2014-05-18 09:53 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-10-01 15:11 . 2014-04-08 09:02 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-10-01 15:11 . 2012-08-14 11:28 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-09-30 05:32 . 2014-09-30 05:32 901632 ----a-w- c:\windows\SysWow64\rzdevicedll.dll
2014-09-30 05:32 . 2014-09-30 05:32 419840 ----a-w- c:\windows\SysWow64\rzaudiodll.dll
2014-09-25 02:08 . 2014-10-06 19:49 371712 ----a-w- c:\windows\system32\qdvd.dll
2014-09-25 01:40 . 2014-10-06 19:49 519680 ----a-w- c:\windows\SysWow64\qdvd.dll
2014-09-16 15:48 . 2012-09-30 14:45 1188440 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-09-11 06:57 . 2014-09-11 06:57 78848 ----a-w- c:\windows\SysWow64\rzvirtualdev.dll
2014-09-11 06:57 . 2014-09-11 06:57 155136 ----a-w- c:\windows\SysWow64\rztouchdll.dll
2014-09-11 06:57 . 2014-09-11 06:57 117248 ----a-w- c:\windows\SysWow64\rzdisplaydll.dll
2014-09-09 22:11 . 2014-09-25 05:27 2048 ----a-w- c:\windows\system32\tzres.dll
2014-09-09 21:47 . 2014-09-25 05:27 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-09-05 03:27 . 2014-09-05 03:27 39592 ----a-w- c:\windows\system32\drivers\rzendpt.sys
2014-09-05 03:27 . 2014-09-05 03:27 160424 ----a-w- c:\windows\system32\drivers\rzudd.sys
2014-08-23 02:07 . 2014-09-03 04:27 404480 ----a-w- c:\windows\system32\gdi32.dll
2014-08-23 01:45 . 2014-09-03 04:27 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2014-08-14 09:58 . 2014-08-14 09:58 255352 ----a-w- c:\windows\SysWow64\awrdscdc.ax
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2014-10-21 1938624]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872]
"F.lux"="c:\users\Vincent\AppData\Local\FluxSoftware\Flux\flux.exe" [2013-10-15 1016712]
"Akamai NetSession Interface"="c:\users\Vincent\AppData\Local\Akamai\netsession_win.exe" [2014-04-18 4672920]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-10-01 22065760]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2014-10-30 6501656]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2013-11-13 4694192]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-03-27 291608]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-28 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-10 421776]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-09-12 959176]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-09-26 271744]
"Razer Synapse"="c:\program files (x86)\Razer\Synapse\RzSynapse.exe" [2014-10-25 585536]
.
c:\users\Vincent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Tenda Wireless Utility.lnk - c:\program files (x86)\Tenda\Common\RaUI.exe -s [2014-10-6 12419072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 AE1000;Linksys AE1000 Driver;c:\windows\system32\DRIVERS\ae1000w7.sys;c:\windows\SYSNATIVE\DRIVERS\ae1000w7.sys [x]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe;c:\windows\SYSNATIVE\AppleChargerSrv.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys;c:\windows\GVTDrv64.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 hxsyol;hxsyol;c:\aeriagames\AuraKingdom\avital\hxsy64.sys;c:\aeriagames\AuraKingdom\avital\hxsy64.sys [x]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RaMediaServer;RaMediaServer;c:\program files (x86)\Tenda\Common\RaMediaServer.exe;c:\program files (x86)\Tenda\Common\RaMediaServer.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 RTL8187B;NETGEAR WG111v3 Wireless-G USB Adapter Win7 Driver;c:\windows\system32\DRIVERS\wg111v3.sys;c:\windows\SYSNATIVE\DRIVERS\wg111v3.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 X6va017;X6va017;c:\windows\SysWOW64\Drivers\X6va017;c:\windows\SysWOW64\Drivers\X6va017 [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AppleCharger.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 RalinkRegistryWriter64;RalinkRegistryWriter64;c:\program files (x86)\Tenda\Common\RaRegistry64.exe;c:\program files (x86)\Tenda\Common\RaRegistry64.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe;c:\windows\SYSNATIVE\viakaraokesrv.exe [x]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 rzendpt;rzendpt;c:\windows\system32\DRIVERS\rzendpt.sys;c:\windows\SYSNATIVE\DRIVERS\rzendpt.sys [x]
S3 rzudd;Razer Mouse Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2014-11-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-01 15:55]
.
2014-11-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1394883155-3604719780-1674705818-1000Core.job
- c:\users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-31 03:26]
.
2014-11-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1394883155-3604719780-1674705818-1000UA.job
- c:\users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-31 03:26]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-08-22 1331288]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-05-16 1012000]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-12-14 172144]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-12-14 399984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-12-14 441968]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2013-11-13 4694192]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:Tabs
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local;<local>
Trusted Zone: aeriagames.com
Trusted Zone: neople.com\dnf
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
FF - ProfilePath - c:\users\Vincent\AppData\Roaming\Mozilla\Firefox\Profiles\tigpirsy.default-1411634339210\
FF - prefs.js: browser.startup.homepage - gmail.com
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va017]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va017"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-11-09 19:06:32
ComboFix-quarantined-files.txt 2014-11-10 01:06
.
Pre-Run: 266,144,677,888 bytes free
Post-Run: 270,611,943,424 bytes free
.
- - End Of File - - 8C68509A26755EFCD55A1AC5BD76008E
5FB38429D5D77768867C76DCBDB35194
 
Looks good.

redtarget.gif
Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.



redtarget.gif
Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.



redtarget.gif
Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please copy and paste it to your reply.
 
# AdwCleaner v4.101 - Report created 09/11/2014 at 19:40:49
# Updated 09/11/2014 by Xplode
# Database : 2014-11-07.1 [Live]
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : Vincent - NOISEMACHINE
# Running from : C:\Users\Vincent\Desktop\adwcleaner_4.101.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Vincent\AppData\Local\CrashRpt

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Mozilla Firefox v33.0.3 (x86 en-US)


-\\ Google Chrome v

[C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

-\\ Chromium v

[C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [1572 octets] - [25/06/2014 19:29:21]
AdwCleaner[R1].txt - [1625 octets] - [25/09/2014 02:40:17]
AdwCleaner[R2].txt - [1392 octets] - [09/11/2014 10:45:42]
AdwCleaner[R3].txt - [1568 octets] - [09/11/2014 19:39:19]
AdwCleaner[S0].txt - [1565 octets] - [25/06/2014 19:59:12]
AdwCleaner[S1].txt - [1669 octets] - [25/09/2014 02:42:42]
AdwCleaner[S2].txt - [1795 octets] - [09/11/2014 19:40:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1855 octets] ##########


JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.7 (11.08.2014:1)
OS: Windows 7 Ultimate x64
Ran by Vincent on Sun 11/09/2014 at 19:43:27.50
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Vincent\appdata\local\{1e5bd682-3899-d414-b55f-c6d10d1a1eb2}



~~~ FireFox

Emptied folder: C:\Users\Vincent\AppData\Roaming\mozilla\firefox\profiles\tigpirsy.default-1411634339210\minidumps [10 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 11/09/2014 at 19:45:38.51
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-11-2014 01
Ran by Vincent (administrator) on NOISEMACHINE on 09-11-2014 19:48:06
Running from C:\Users\Vincent\Desktop
Loaded Profiles: Vincent & UpdatusUser (Available profiles: Vincent & UpdatusUser)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Juniper Networks) C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Tenda\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Tenda\Common\RaRegistry64.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\ComUpdatus.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Flux Software LLC) C:\Users\Vincent\AppData\Local\FluxSoftware\Flux\flux.exe
(Akamai Technologies, Inc.) C:\Users\Vincent\AppData\Local\Akamai\netsession_win.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Akamai Technologies, Inc.) C:\Users\Vincent\AppData\Local\Akamai\netsession_win.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(Tenda Technology, Corp.) C:\Program Files (x86)\Tenda\Common\RaUI.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Thorvald Natvig) C:\Program Files (x86)\Mumble\mumble.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(NEXON Corp.) C:\Nexon\Vindictus\en-US\Vindictus.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1012000 2013-05-16] (NVIDIA Corporation)
HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [4694192 2013-11-13] (VIA)
HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [4694192 2013-11-13] (VIA)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-09-09] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-09-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [585536 2014-10-24] (Razer Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1938624 2014-10-21] (Valve Corporation)
HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3671872 2012-04-17] (DT Soft Ltd)
HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\Run: [F.lux] => C:\Users\Vincent\AppData\Local\FluxSoftware\Flux\flux.exe [1016712 2013-10-15] (Flux Software LLC)
HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Vincent\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.)
HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-30] (Piriform Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Tenda Wireless Utility.lnk
ShortcutTarget: Tenda Wireless Utility.lnk -> C:\Program Files (x86)\Tenda\Common\RaUI.exe (Tenda Technology, Corp.)
Startup: C:\Users\Vincent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1C296B638647CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {0D41B8C5-2599-4893-8183-00195EC8D5F9} http://support.asus.com/select/asusTek_sys_ctrl3.cab
DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

FireFox:
========
FF ProfilePath: C:\Users\Vincent\AppData\Roaming\Mozilla\Firefox\Profiles\tigpirsy.default-1411634339210
FF Homepage: gmail.com
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_189.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nexon.net/NxGame -> C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1394883155-3604719780-1674705818-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1394883155-3604719780-1674705818-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1394883155-3604719780-1674705818-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Vincent\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-1394883155-3604719780-1674705818-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017300.dll (Amazon.com, Inc.)
FF Plugin HKU\S-1-5-21-1394883155-3604719780-1674705818-1000: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF Extension: Switch to Tab no more - C:\Users\Vincent\AppData\Roaming\Mozilla\Firefox\Profiles\tigpirsy.default-1411634339210\Extensions\{7edcdfc0-3056-11e0-91fa-0800200c9a66}.xpi [2014-11-02]
FF Extension: Adblock Plus - C:\Users\Vincent\AppData\Roaming\Mozilla\Firefox\Profiles\tigpirsy.default-1411634339210\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-26]

Chrome:
=======
CHR HomePage: Default -> hxxp://gmail.com/
CHR StartupUrls: Default -> "hxxp://xfinity.comcast.net/?cid=insDate05192013"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Vincent\AppData\Local\Google\Chrome\Application\38.0.2125.111\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Vincent\AppData\Local\Google\Chrome\Application\38.0.2125.111\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Vincent\AppData\Local\Google\Chrome\Application\38.0.2125.111\gcswf32.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
CHR Plugin: (Google Update) - C:\Users\Vincent\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Profile: C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-24]
CHR Extension: (YouTube) - C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-07-30]
CHR Extension: (Google Search) - C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-07-31]
CHR Extension: (Chrome Remote Desktop) - C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2013-10-14]
CHR Extension: (Google Wallet) - C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Gmail) - C:\Users\Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-07-30]
CHR StartMenuInternet: Google Chrome - C:\Users\Vincent\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 RalinkRegistryWriter; C:\Program Files (x86)\Tenda\Common\RaRegistry.exe [375872 2011-03-31] (Ralink Technology, Corp.)
R2 RalinkRegistryWriter64; C:\Program Files (x86)\Tenda\Common\RaRegistry64.exe [454208 2011-03-31] (Ralink Technology, Corp.)
S3 RaMediaServer; C:\Program Files (x86)\Tenda\Common\RaMediaServer.exe [621632 2011-03-04] ()
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AE1000; C:\Windows\System32\DRIVERS\ae1000w7.sys [1600064 2011-06-08] (Ralink Technology Corp.)
R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21616 2011-11-02] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-08-19] (DT Soft Ltd)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2013-03-26] ()
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-10-01] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
S3 RTL8187B; C:\Windows\System32\DRIVERS\wg111v3.sys [446976 2009-11-18] (NETGEAR Inc. ) [File not signed]
R3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [39592 2014-09-04] (Razer Inc)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [34808 2014-11-09] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
R3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 hxsyol; \??\C:\AeriaGames\AuraKingdom\avital\hxsy64.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 X6va017; \??\C:\Windows\SysWOW64\Drivers\X6va017 [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-09 19:48 - 2014-11-09 19:48 - 00017476 _____ () C:\Users\Vincent\Desktop\FRST.txt
2014-11-09 19:48 - 2014-11-09 19:48 - 00000000 ____D () C:\FRST
2014-11-09 19:45 - 2014-11-09 19:45 - 00000889 _____ () C:\Users\Vincent\Desktop\JRT.txt
2014-11-09 19:42 - 2014-11-09 19:42 - 00001935 _____ () C:\Users\Vincent\Desktop\AdwCleaner[S2].txt
2014-11-09 19:38 - 2014-11-09 19:38 - 02116096 _____ (Farbar) C:\Users\Vincent\Desktop\FRST64.exe
2014-11-09 19:37 - 2014-11-09 19:37 - 02140160 _____ () C:\Users\Vincent\Desktop\adwcleaner_4.101.exe
2014-11-09 19:37 - 2014-11-09 19:37 - 01706808 _____ (Thisisu) C:\Users\Vincent\Desktop\JRT.exe
2014-11-09 19:06 - 2014-11-09 19:06 - 00020788 _____ () C:\ComboFix.txt
2014-11-09 18:45 - 2014-11-09 19:06 - 00000000 ____D () C:\Qoobox
2014-11-09 18:45 - 2014-11-09 19:05 - 00000000 ____D () C:\Windows\erdnt
2014-11-09 18:45 - 2014-11-09 18:45 - 00000000 ____D () C:\Users\Vincent\AppData\Local\CrashDumps
2014-11-09 18:45 - 2011-06-26 00:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-11-09 18:45 - 2010-11-07 11:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-11-09 18:45 - 2009-04-19 22:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-11-09 18:45 - 2000-08-30 18:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-11-09 18:45 - 2000-08-30 18:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-11-09 18:45 - 2000-08-30 18:00 - 00098816 _____ () C:\Windows\sed.exe
2014-11-09 18:45 - 2000-08-30 18:00 - 00080412 _____ () C:\Windows\grep.exe
2014-11-09 18:45 - 2000-08-30 18:00 - 00068096 _____ () C:\Windows\zip.exe
2014-11-09 17:16 - 2014-11-09 17:16 - 00957952 _____ (Farbar) C:\Users\Vincent\Downloads\ListParts64.exe
2014-11-09 17:16 - 2014-11-09 17:16 - 00002985 _____ () C:\Users\Vincent\Downloads\Result.txt
2014-11-09 15:11 - 2014-11-09 19:46 - 00000224 _____ () C:\Windows\setupact.log
2014-11-09 15:11 - 2014-11-09 19:41 - 00007690 _____ () C:\Windows\PFRO.log
2014-11-09 15:11 - 2014-11-09 15:11 - 00000000 _____ () C:\Windows\setuperr.log
2014-11-09 14:09 - 2014-11-09 14:09 - 00003613 _____ () C:\Users\Vincent\Desktop\RKreport_DEL_11092014_140927.log
2014-11-09 13:09 - 2014-11-09 13:09 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-11-09 13:09 - 2014-11-09 13:09 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-11-09 13:09 - 2014-11-09 13:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-11-09 10:45 - 2014-11-09 14:05 - 00034808 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2014-11-09 10:45 - 2014-11-09 10:45 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-11-09 03:40 - 2014-11-09 03:44 - 00039385 _____ () C:\Users\Vincent\AppData\Local\893686b8
2014-11-08 22:26 - 2014-11-08 22:26 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-11-08 19:13 - 2014-11-08 19:13 - 00000160 ____H () C:\ProgramData\@system3.att
2014-11-08 19:12 - 2014-11-08 19:13 - 00000424 _____ () C:\ProgramData\@system.temp
2014-11-08 19:12 - 2014-11-08 19:12 - 00000448 ____H () C:\Users\Vincent\AppData\Roaming\麽鎒駓覜
2014-11-08 19:11 - 2014-11-08 19:11 - 00000000 ____D () C:\ProgramData\RufoLdolz
2014-11-08 19:11 - 2014-11-08 19:11 - 00000000 ____D () C:\ProgramData\PuseQzupa
2014-11-08 18:44 - 2014-11-09 12:22 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage
2014-11-08 18:44 - 2014-11-08 22:18 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
2014-11-08 07:40 - 2014-11-09 12:22 - 00000000 ____D () C:\Program Files (x86)\qBittorrent
2014-11-08 07:40 - 2014-11-08 07:40 - 00000000 ____D () C:\Users\Vincent\AppData\Local\qBittorrent
2014-11-01 10:31 - 2014-11-01 10:31 - 00000000 ____D () C:\Users\Vincent\AppData\Local\Razer
2014-10-31 19:15 - 2014-10-31 19:15 - 00000000 ____D () C:\Users\Vincent\AppData\Local\Razer_Inc
2014-10-31 19:14 - 2014-10-31 19:14 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_rzudd_01009.Wdf
2014-10-31 19:14 - 2014-10-31 19:14 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_rzendpt_01009.Wdf
2014-10-31 19:13 - 2014-10-31 19:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2014-10-31 18:51 - 2014-10-31 18:51 - 00000000 ____D () C:\ProgramData\Razer
2014-10-31 18:50 - 2014-11-01 10:29 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-10-31 17:04 - 2014-10-31 17:04 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-10-31 17:04 - 2014-10-31 17:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-10-26 12:16 - 2014-10-26 12:16 - 00000029 _____ () C:\Users\Vincent\Desktop\new acct.txt
2014-10-18 09:57 - 2014-10-18 09:57 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-10-18 09:57 - 2014-10-18 09:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-10-18 09:57 - 2014-10-18 09:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-10-18 09:57 - 2014-10-18 09:57 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-10-18 09:57 - 2014-10-18 09:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-10-18 09:57 - 2014-10-18 09:57 - 00000000 ____D () C:\Program Files (x86)\Java
2014-10-17 19:26 - 2014-10-09 20:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-17 19:26 - 2014-10-09 20:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-17 19:26 - 2014-10-09 20:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-17 19:26 - 2014-10-06 20:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-17 19:26 - 2014-10-06 20:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-17 19:26 - 2014-09-28 18:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-17 19:26 - 2014-09-25 16:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-17 19:26 - 2014-09-25 16:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-17 19:26 - 2014-09-25 16:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-17 19:26 - 2014-09-25 16:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-17 19:26 - 2014-09-25 16:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-17 19:26 - 2014-09-25 16:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-17 19:26 - 2014-09-25 16:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-17 19:26 - 2014-09-18 20:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-17 19:26 - 2014-09-18 19:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-17 19:26 - 2014-09-18 19:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-17 19:26 - 2014-09-18 19:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-17 19:26 - 2014-09-18 19:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-17 19:26 - 2014-09-18 19:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-17 19:26 - 2014-09-18 19:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-17 19:26 - 2014-09-18 19:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-17 19:26 - 2014-09-18 19:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-17 19:26 - 2014-09-18 19:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-17 19:26 - 2014-09-18 19:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-17 19:26 - 2014-09-18 19:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-17 19:26 - 2014-09-18 19:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-17 19:26 - 2014-09-18 19:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-17 19:26 - 2014-09-18 19:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-17 19:26 - 2014-09-18 19:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-17 19:26 - 2014-09-18 19:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-17 19:26 - 2014-09-18 19:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-17 19:26 - 2014-09-18 19:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-17 19:26 - 2014-09-18 19:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-17 19:26 - 2014-09-18 19:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-17 19:26 - 2014-09-18 19:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-17 19:26 - 2014-09-18 19:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-17 19:26 - 2014-09-18 19:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-17 19:26 - 2014-09-18 19:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-17 19:26 - 2014-09-18 19:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-17 19:26 - 2014-09-18 18:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-17 19:26 - 2014-09-18 18:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-17 19:26 - 2014-09-18 18:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-17 19:26 - 2014-09-18 18:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-17 19:26 - 2014-09-18 18:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-17 19:26 - 2014-09-18 18:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-17 19:26 - 2014-09-18 18:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-17 19:26 - 2014-09-18 18:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-17 19:26 - 2014-09-18 18:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-17 19:26 - 2014-09-18 18:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-17 19:26 - 2014-09-18 18:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-17 19:26 - 2014-09-18 18:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-17 19:26 - 2014-09-18 18:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-17 19:26 - 2014-09-18 18:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-17 19:26 - 2014-09-18 18:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-17 19:26 - 2014-09-18 18:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-17 19:26 - 2014-09-18 18:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-17 19:26 - 2014-09-18 17:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-17 19:26 - 2014-09-18 17:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-17 19:26 - 2014-09-18 17:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-17 19:26 - 2014-09-18 17:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-17 19:26 - 2014-09-17 20:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-17 19:26 - 2014-09-17 19:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-17 19:26 - 2014-09-03 23:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-17 19:26 - 2014-09-03 23:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-17 19:26 - 2014-08-28 20:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-17 19:26 - 2014-06-18 16:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-17 19:26 - 2014-06-18 16:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-17 19:26 - 2014-06-18 16:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-17 19:26 - 2014-06-18 16:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-17 19:26 - 2014-06-18 16:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-17 19:26 - 2014-06-18 16:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-17 19:25 - 2014-09-12 19:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-17 19:25 - 2014-09-12 19:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-17 19:25 - 2014-09-04 20:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-17 19:25 - 2014-09-04 19:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-17 19:25 - 2014-07-16 20:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-17 19:25 - 2014-07-16 20:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-17 19:25 - 2014-07-16 20:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-17 19:25 - 2014-07-16 20:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-17 19:25 - 2014-07-16 20:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-17 19:25 - 2014-07-16 20:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-17 19:25 - 2014-07-16 19:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-17 19:25 - 2014-07-16 19:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-17 19:25 - 2014-07-16 19:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-17 19:25 - 2014-07-16 19:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-17 19:25 - 2014-07-16 19:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-17 19:20 - 2014-10-17 19:20 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-10-17 19:20 - 2014-10-17 19:20 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-10-17 19:20 - 2014-10-17 19:20 - 00000000 ____D () C:\Program Files (x86)\Adobe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-09 19:48 - 2012-11-02 18:08 - 00000000 ____D () C:\Users\Vincent\AppData\Roaming\Mumble
2014-11-09 19:47 - 2009-07-13 23:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-09 19:45 - 2012-07-28 19:53 - 01514324 _____ () C:\Windows\WindowsUpdate.log
2014-11-09 19:44 - 2012-08-02 05:18 - 00000000 ____D () C:\Users\Vincent\AppData\Roaming\Skype
2014-11-09 19:42 - 2012-08-14 21:24 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-11-09 19:41 - 2014-05-26 04:12 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-11-09 19:41 - 2012-09-30 08:43 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-11-09 19:41 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-09 19:40 - 2014-06-25 19:27 - 00000000 ____D () C:\AdwCleaner
2014-11-09 19:39 - 2012-10-23 18:00 - 00000000 ____D () C:\Users\Vincent\Downloads\Anime
2014-11-09 19:29 - 2012-07-30 21:26 - 00000916 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1394883155-3604719780-1674705818-1000UA.job
2014-11-09 19:06 - 2009-07-13 21:20 - 00000000 __RHD () C:\Users\Default
2014-11-09 19:04 - 2009-07-13 20:34 - 00000215 _____ () C:\Windows\system.ini
2014-11-09 19:03 - 2012-10-04 23:58 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-09 19:03 - 2012-07-28 19:53 - 00000000 ____D () C:\Users\Vincent
2014-11-09 15:19 - 2009-07-13 22:45 - 00031808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-09 15:19 - 2009-07-13 22:45 - 00031808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-09 15:11 - 2011-04-12 02:28 - 00000000 ____D () C:\Windows\CSC
2014-11-09 15:10 - 2014-05-17 11:50 - 00000000 ____D () C:\Users\Vincent\Desktop\mbar
2014-11-09 14:34 - 2014-06-21 03:37 - 00000000 ____D () C:\Users\Vincent\Desktop\Torrent
2014-11-09 14:12 - 2014-05-18 03:53 - 00128728 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-09 13:15 - 2013-12-16 17:30 - 00000000 ____D () C:\Users\Vincent\AppData\Roaming\Ventrilo
2014-11-09 13:15 - 2012-08-19 23:22 - 00000000 ____D () C:\Users\Vincent\AppData\Roaming\DAEMON Tools Lite
2014-11-09 13:15 - 2012-08-03 23:49 - 00000000 ____D () C:\Users\Vincent\AppData\Roaming\Media Player Classic
2014-11-09 13:15 - 2012-08-02 22:49 - 00000000 ____D () C:\Users\Vincent\AppData\Roaming\uTorrent
2014-11-09 13:15 - 2012-07-31 21:44 - 00000000 ____D () C:\Users\Vincent\Tracing
2014-11-09 13:14 - 2012-07-28 22:37 - 00000000 ____D () C:\Windows\Panther
2014-11-09 12:22 - 2014-02-28 15:50 - 00000000 ____D () C:\Users\Vincent\AppData\Local\Akamai
2014-11-09 12:22 - 2012-07-31 21:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-09 12:07 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\registration
2014-11-09 11:38 - 2013-09-01 20:30 - 00000000 ____D () C:\Program Files (x86)\RaidCall
2014-11-09 11:29 - 2012-07-30 21:26 - 00000864 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1394883155-3604719780-1674705818-1000Core.job
2014-11-09 10:44 - 2012-07-28 19:53 - 00000000 ____D () C:\Users\Vincent\AppData\Local\VirtualStore
2014-11-09 10:29 - 2013-09-04 00:00 - 04624896 ___SH () C:\Users\Vincent\Downloads\Thumbs.db
2014-11-06 22:43 - 2014-09-18 22:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-01 10:29 - 2012-07-28 20:52 - 00064880 _____ () C:\Users\Vincent\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-01 10:29 - 2009-07-13 22:45 - 00293376 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-31 20:08 - 2014-05-01 20:29 - 00000000 ____D () C:\Users\Vincent\AppData\Roaming\HpUpdate
2014-10-31 17:04 - 2012-08-02 05:18 - 00002515 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-10-31 17:04 - 2012-08-02 05:18 - 00000000 ____D () C:\ProgramData\Skype
2014-10-31 17:02 - 2014-05-18 03:53 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-10-30 05:25 - 2010-11-20 21:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-26 19:09 - 2014-05-18 03:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-10-26 19:09 - 2012-08-14 05:28 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-10-21 15:08 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\rescache
2014-10-21 09:24 - 2012-07-30 21:26 - 00003890 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1394883155-3604719780-1674705818-1000UA
2014-10-21 09:24 - 2012-07-30 21:26 - 00003494 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1394883155-3604719780-1674705818-1000Core
2014-10-18 17:17 - 2012-10-02 22:58 - 00000000 ____D () C:\Users\Vincent\AppData\Local\Paint.NET
2014-10-18 17:12 - 2012-10-02 22:59 - 00001188 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paint.NET.lnk
2014-10-18 17:12 - 2012-10-02 22:59 - 00001176 _____ () C:\Users\Public\Desktop\Paint.NET.lnk
2014-10-18 17:12 - 2012-10-02 22:59 - 00000000 ____D () C:\Program Files\Paint.NET
2014-10-18 09:58 - 2013-10-20 14:35 - 00000000 ____D () C:\ProgramData\Oracle
2014-10-18 09:57 - 2014-08-21 00:41 - 00000000 ____D () C:\Users\Vincent\AppData\Local\Adobe
2014-10-18 09:56 - 2012-10-04 23:58 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-10-18 09:55 - 2012-08-01 17:43 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-18 09:55 - 2012-08-01 17:43 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-18 02:59 - 2014-05-06 01:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-18 01:04 - 2013-07-22 12:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-18 01:00 - 2012-07-28 20:37 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-17 20:02 - 2012-09-18 20:58 - 00000000 ____D () C:\Users\Vincent\Documents\My Games
2014-10-17 19:20 - 2012-08-16 16:57 - 00000000 ____D () C:\ProgramData\Adobe
2014-10-17 19:19 - 2012-08-05 22:27 - 00000000 ____D () C:\Users\Vincent\Desktop\Camera

Files to move or delete:
====================
C:\Users\Vincent\xobglu16.dll


Some content of TEMP:
====================
C:\Users\Vincent\AppData\Local\Temp\Quarantine.exe
C:\Users\Vincent\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-09 13:58

==================== End Of Log ============================
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-11-2014 01
Ran by Vincent at 2014-11-09 19:48:54
Running from C:\Users\Vincent\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

@Bios (HKLM-x32\...\{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}) (Version: 2.24 - GIGABYTE)
[MH] Touhou Project - Collection 2011 (HKLM-x32\...\{B19DDE41-A3A3-4738-9E3B-69910A9BE518}) (Version: 1.00.0000 - Maverick Hunters)
µTorrent (HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\uTorrent) (Version: 3.4.2.34944 - BitTorrent Inc.)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\Akamai) (Version: - Akamai Technologies, Inc)
Amazon MP3 Downloader 1.0.17 (HKLM-x32\...\Amazon MP3 Downloader) (Version: 1.0.17 - Amazon Services LLC)
Apple Application Support (HKLM-x32\...\{63EC2120-1742-4625-AA47-C6A8AEC9C64C}) (Version: 2.2.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}) (Version: 6.0.0.59 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Archeage (HKLM-x32\...\Glyph Archeage) (Version: - Trion Worlds, Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.0.4.4 - Atheros Communications Inc.)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 2011118846.48.56.37883114 - Audible, Inc.)
AutoGreen B12.0206.1 (HKLM-x32\...\InstallShield_{C75FAD21-EC08-42F3-92D6-C9C0AB355345}) (Version: 1.00.0000 - GIGABYTE)
AutoGreen B12.0206.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
Awesome Duplicate Photo Finder v. 1.1 (HKLM-x32\...\Awesome Duplicate Photo Finder_is1) (Version: - Duplicate-Finder.com)
Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version: - )
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version: - Gearbox Software)
CCleaner (HKLM\...\CCleaner) (Version: 4.19 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Combined Community Codec Pack 2014-04-20 (HKLM-x32\...\Combined Community Codec Pack_is1) (Version: 2014.04.20.0 - CCCP Project)
CPUID CPU-Z 1.61.3 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.45.4.0315 - DT Soft Ltd)
Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve)
DragonNest (HKLM-x32\...\DragonNest) (Version: - )
Easy Tune 6 B12.0525.1 (HKLM-x32\...\InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}) (Version: 1.00.0000 - GIGABYTE)
Easy Tune 6 B12.0525.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
Etron USB3.0 Host Controller (x32 Version: 0.109 - Etron Technology) Hidden
f.lux (HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\Flux) (Version: - )
FINAL FANTASY XIV - A Realm Reborn (HKLM-x32\...\{2B41E132-07DF-4925-A3D3-F2D1765CCDFE}) (Version: 1.0.0000 - SQUARE ENIX CO., LTD.)
GIF Viewer 3.3 (HKLM-x32\...\GIF Viewer) (Version: 3.3 - Stefan Wobbe)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Glyph (HKLM-x32\...\Glyph) (Version: - Trion Worlds, Inc.)
Google Chrome (HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.)
GunZ 2: The Second Duel (HKLM-x32\...\Steam App 242720) (Version: - MAIET Entertainment)
Happy Cloud Client (HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\HappyCloud) (Version: 3.41 - Happy Cloud, Inc.)
HP Deskjet 1010 series Basic Device Software (HKLM\...\{43211ACE-5EBF-48A1-8497-8F53CB0FC1E4}) (Version: 30.0.1093.41190 - Hewlett-Packard Co.)
HP Deskjet 1010 series Help (HKLM-x32\...\{BFB6C2B0-9643-4B59-A706-71DEB3017A99}) (Version: 30.0.0 - Hewlett Packard)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Update (HKLM-x32\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.002 - Hewlett-Packard)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)
iTunes (HKLM\...\{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}) (Version: 10.7.0.21 - Apple Inc.)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Juniper Networks Host Checker (HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\Neoteris_Host_Checker) (Version: 7.0.0.17289 - Juniper Networks)
Juniper Networks Network Connect 7.0.0 (HKLM-x32\...\Juniper Network Connect 7.0.0) (Version: 7.0.0.17289 - Juniper Networks)
Juniper Networks Setup Client (HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\Juniper_Setup_Client) (Version: 2.2.4.9429 - Juniper Networks)
Juniper Networks Setup Client Activex Control (HKLM-x32\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Juniper Networks)
League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office Access database engine 2007 (English) (HKLM-x32\...\{90120000-00D1-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Mozilla Firefox 33.0.3 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 33.0.3 (x86 en-US)) (Version: 33.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MPC-HC 1.6.2.4902 (64-bit) (HKLM\...\{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1) (Version: 1.6.2.4902 - MPC-HC Team)
Mumble 1.2.5 (HKLM-x32\...\{C7BC557D-8C8B-4F5F-83AB-D20C58CF4575}) (Version: 1.2.5 - Thorvald Natvig)
Nexon Game Manager (HKLM-x32\...\{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}) (Version: - )
NVIDIA 3D Vision Controller Driver 320.49 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 320.49 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 335.23 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.5 - NVIDIA Corporation)
NVIDIA Graphics Driver 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.0604 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0604 - NVIDIA Corporation)
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
ON_OFF Charge B11.1102.1 (HKLM-x32\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE)
OpenOffice.org 3.4.1 (HKLM-x32\...\{9F1F2AEA-C72A-4DD6-991E-C5506A5625E4}) (Version: 3.41.9593 - Apache Software Foundation)
paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version: 4.0.3 - dotPDN LLC)
Path of Exile (HKLM-x32\...\{90A4562F-D4A1-4B65-906D-41F236CF6902}) (Version: 0.9.13.22054 - Grinding Gear Games)
Pepakura Viewer 3 (HKLM-x32\...\pepakura_viewer3en) (Version: - TamaSoftware)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden
Razer Synapse 2.0 (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.17.22879 - Razer Inc.)
Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
Speccy (HKLM\...\Speccy) (Version: 1.17 - Piriform)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
Tenda Wireless LAN Card (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 1.5.12.0 - Tenda)
TERA (HKLM-x32\...\{0FCDA0F8-F3E5-402E-B9B6-13CB2B01182B}) (Version: 1.6 - En Masse Entertainment)
To the Moon (HKLM-x32\...\Steam App 206440) (Version: - Freebird Games)
Unity Web Player (HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
Unreal Development Kit: 2012-10 (HKLM\...\UDK-50b3fb0e-0f6e-4525-b85f-b6c727276662) (Version: - Epic Games, Inc.)
Ventrilo Client for Windows x64 (HKLM\...\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}) (Version: 3.0.8.0 - Flagship Industries, Inc.)
VIA Platform Device Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.39 - VIA Technologies, Inc.)
Vindictus (HKLM-x32\...\Vindictus) (Version: - )
WhoCrashed 4.02 (HKLM\...\WhoCrashed_is1) (Version: - Resplendence Software Projects Sp.)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1394883155-3604719780-1674705818-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1394883155-3604719780-1674705818-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1394883155-3604719780-1674705818-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1394883155-3604719780-1674705818-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1394883155-3604719780-1674705818-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

==================== Restore Points =========================

09-11-2014 20:10:59 broni
09-11-2014 21:10:22 Malwarebytes Anti-Rootkit Restore Point
09-11-2014 21:23:50 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 20:34 - 2014-11-09 19:04 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {16ACDFCB-D144-4BFB-B09E-3839CB5115EC} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-10-30] (Piriform Ltd)
Task: {1A13DE65-5058-4120-B846-CABD857F896D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-18] (Adobe Systems Incorporated)
Task: {806E9B2D-E127-4FC0-BB11-B89F7CA0F2AC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1394883155-3604719780-1674705818-1000UA => C:\Users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-30] (Google Inc.)
Task: {F6218ECD-3EA9-4A8B-A498-F8B4AC437055} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1394883155-3604719780-1674705818-1000Core => C:\Users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-30] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1394883155-3604719780-1674705818-1000Core.job => C:\Users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1394883155-3604719780-1674705818-1000UA.job => C:\Users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-09-30 08:42 - 2014-03-04 07:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-03-06 01:48 - 2012-11-14 01:22 - 00078456 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2014-03-06 01:48 - 2012-11-14 01:22 - 00386168 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2012-08-27 20:33 - 2012-08-27 20:33 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-08-27 20:33 - 2012-08-27 20:33 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-09-02 22:20 - 2014-08-21 12:15 - 01171456 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-09-02 22:20 - 2014-08-21 12:15 - 00442368 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-09-02 22:20 - 2014-08-21 12:15 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2013-03-12 16:10 - 2014-10-01 17:16 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2014-05-25 14:43 - 2014-10-21 13:22 - 02226880 _____ () C:\Program Files (x86)\Steam\video.dll
2014-09-02 22:20 - 2014-08-21 12:15 - 00403968 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-09-02 22:20 - 2014-08-21 12:15 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2012-08-14 21:26 - 2014-10-21 13:22 - 00682176 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2014-10-06 13:43 - 2011-05-04 17:53 - 01058664 _____ () C:\Program Files (x86)\Tenda\Common\RaWLAPI.dll
2014-01-31 21:22 - 2014-01-31 21:22 - 00134576 _____ () C:\Program Files (x86)\Mumble\mumble_ol.dll
2012-08-10 15:51 - 2012-08-10 15:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2012-08-14 21:26 - 2014-09-04 17:29 - 34589376 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2014-09-18 22:42 - 2014-11-06 22:43 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-01-31 21:21 - 2014-01-31 21:21 - 00220080 _____ () C:\Program Files (x86)\Mumble\opus.dll
2014-01-31 21:21 - 2014-01-31 21:21 - 02311600 _____ () C:\Program Files (x86)\Mumble\libsndfile-1.dll
2014-01-31 21:21 - 2014-01-31 21:21 - 04476336 _____ () C:\Program Files (x86)\Mumble\libmysql.dll
2014-01-31 21:22 - 2014-01-31 21:22 - 00114608 _____ () C:\Program Files (x86)\Mumble\ZLIB1.dll
2014-01-31 21:21 - 2014-01-31 21:21 - 00168368 _____ () C:\Program Files (x86)\Mumble\speex.dll
2014-01-31 21:22 - 2014-01-31 21:22 - 00073648 _____ () C:\Program Files (x86)\Mumble\celt0.0.7.0.sse2.dll
2014-01-31 21:21 - 2014-01-31 21:21 - 00089520 _____ () C:\Program Files (x86)\Mumble\celt0.0.11.0.sse2.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00046912 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\aoc.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00030528 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\arma2.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00030528 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\bf1942.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00048960 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\bf2.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00032064 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\bf2142.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00048960 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\bf3.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00030528 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\bfbc2.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00030528 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\bfheroes.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00032064 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\blacklight.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00033600 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\borderlands.dll
2013-08-27 18:10 - 2014-08-12 02:52 - 00032064 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\borderlands2.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00030528 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\breach.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00030528 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\cod2.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00032576 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\cod4.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00030528 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\cod5.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00030528 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\codmw2.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00030528 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\codmw2so.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00032064 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\cs.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00047424 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\dys.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00032576 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\etqw.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00047424 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\gmod.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00031040 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\gtaiv.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00032576 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\gw.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00047424 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\insurgency.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00030528 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\jc2.dll
2012-11-02 18:18 - 2014-08-12 02:52 - 00032576 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\l4d.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00041792 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\l4d2.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00028992 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\link.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00032576 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\lol.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00032576 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\lotro.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00081216 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\manual.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00033088 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\sto.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00030528 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\ut2004.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00030528 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\ut3.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00042304 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\ut99.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00034624 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\wolfet.dll
2012-11-02 18:19 - 2014-08-12 02:52 - 00041792 _____ () C:\Users\Vincent\AppData\Roaming\Mumble\Plugins\wow.dll
2014-10-18 09:55 - 2014-10-18 09:55 - 16832176 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-1394883155-3604719780-1674705818-500 - Administrator - Disabled)
Guest (S-1-5-21-1394883155-3604719780-1674705818-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1394883155-3604719780-1674705818-1003 - Limited - Enabled)
UpdatusUser (S-1-5-21-1394883155-3604719780-1674705818-1001 - Limited - Enabled) => C:\Users\UpdatusUser
Vincent (S-1-5-21-1394883155-3604719780-1674705818-1000 - Administrator - Enabled) => C:\Users\Vincent

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (11/09/2014 07:46:50 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
Date: 2014-11-09 19:03:55.420
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-11-09 19:03:55.390
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-03-06 11:57:21.994
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\VIASysFx.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-03-06 11:57:21.964
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\VIASysFx.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-3550 CPU @ 3.30GHz
Percentage of memory in use: 48%
Total physical RAM: 8154.24 MB
Available physical RAM: 4227.13 MB
Total Pagefile: 16306.66 MB
Available Pagefile: 12382.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:252.03 GB) NTFS

==================== MBR & Partition Table ==================
Could not read MBR for disk 0.
Could not read MBR for disk 1.

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 2A0BC502)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== End Of Log ============================
 
Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST(FRST64) and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
 

Attachments

  • fixlist.txt
    2 KB · Views: 2
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 09-11-2014 01
Ran by Vincent at 2014-11-09 20:01:54 Run:1
Running from C:\Users\Vincent\Desktop
Loaded Profiles: Vincent & UpdatusUser (Available profiles: Vincent & UpdatusUser)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
CHR Plugin: (Native Client) - C:\Users\Vincent\AppData\Local\Google\Chrome\Application\38.0.2125.111\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\Vincent\AppData\Local\Google\Chrome\Application\38.0.2125.111\gcswf32.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
CHR Plugin: (Google Update) - C:\Users\Vincent\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
R3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 hxsyol; \??\C:\AeriaGames\AuraKingdom\avital\hxsy64.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 X6va017; \??\C:\Windows\SysWOW64\Drivers\X6va017 [X]
2014-11-08 19:12 - 2014-11-08 19:12 - 00000448 ____H () C:\Users\Vincent\AppData\Roaming\????
2014-11-08 19:11 - 2014-11-08 19:11 - 00000000 ____D () C:\ProgramData\RufoLdolz
2014-11-08 19:11 - 2014-11-08 19:11 - 00000000 ____D () C:\ProgramData\PuseQzupa
C:\Users\Vincent\xobglu16.dll
C:\Users\Vincent\AppData\Local\Temp\Quarantine.exe
C:\Users\Vincent\AppData\Local\Temp\sqlite3.dll
CustomCLSID: HKU\S-1-5-21-1394883155-3604719780-1674705818-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1394883155-3604719780-1674705818-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1394883155-3604719780-1674705818-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Vincent\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"HKU\S-1-5-21-1394883155-3604719780-1674705818-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin" => Key deleted successfully.
C:\Users\Vincent\AppData\Local\Google\Chrome\Application\38.0.2125.111\ppGoogleNaClPluginChrome.dll not found.
C:\Users\Vincent\AppData\Local\Google\Chrome\Application\38.0.2125.111\gcswf32.dll not found.
C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll not found.
C:\Users\Vincent\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll not found.
catchme => Service deleted successfully.
EagleX64 => Unable to stop service
EagleX64 => Service deleted successfully.
hxsyol => Service deleted successfully.
VGPU => Service deleted successfully.
X6va017 => Service deleted successfully.

"C:\Users\Vincent\AppData\Roaming\????" directory move:

Could not move "C:\Users\Vincent\AppData\Roaming\????" directory. => Scheduled to move on reboot.

C:\ProgramData\RufoLdolz => Moved successfully.
C:\ProgramData\PuseQzupa => Moved successfully.
C:\Users\Vincent\xobglu16.dll => Moved successfully.
C:\Users\Vincent\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Vincent\AppData\Local\Temp\sqlite3.dll => Moved successfully.
"HKU\S-1-5-21-1394883155-3604719780-1674705818-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}" => Key deleted successfully.
"HKU\S-1-5-21-1394883155-3604719780-1674705818-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}" => Key deleted successfully.
"HKU\S-1-5-21-1394883155-3604719780-1674705818-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}" => Key deleted successfully.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-11-09 20:04:22)<=

"C:\Users\Vincent\AppData\Roaming\????" => Directory could not move.

==== End of Fixlog ====
 
You must log in or register to reply here.

Similar threads

Cal Jeffrey
Researchers prove they can exploit chatbots to spread AI worms
Replies
3
Views
157
Cal Jeffrey
Cal Jeffrey
A
A clever trick turns antivirus software into unstoppable data wiping scourges
Replies
1
Views
595
johnhzzz16
J
E
Solved Svchost.exe launching multiple iexplore.exe - unknown cause
Replies
23
Views
3K
Broni
Broni

Latest posts

Back