Allieraptor
Posts: 81 +0
COMBO fix report
ComboFix 13-05-25.02 - Allie 05/26/2013 11:36:17.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.16111.13751 [GMT -5:00]
Running from: c:\users\Allie\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-04-26 to 2013-05-26 )))))))))))))))))))))))))))))))
.
.
2013-05-26 16:41 . 2013-05-26 16:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-26 10:28 . 2013-05-26 10:28 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{53312170-6FA2-4544-AEBA-877758364ACC}\offreg.dll
2013-05-26 04:29 . 2013-05-26 04:39 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-05-26 04:24 . 2013-05-26 04:24 -------- d-----w- c:\programdata\WinZip
2013-05-26 04:24 . 2013-05-26 04:24 -------- d-----w- c:\program files\WinZip
2013-05-25 22:24 . 2013-05-25 22:25 181064 ----a-w- c:\windows\PSEXESVC.EXE
2013-05-25 22:21 . 2013-05-25 22:21 -------- d-----w- C:\RegBackup
2013-05-25 22:19 . 2013-05-25 22:19 -------- d-----w- c:\program files (x86)\Tweaking.com
2013-05-14 07:13 . 2013-05-14 07:13 -------- d-----w- c:\users\Allie\AppData\Roaming\Apple Computer
2013-05-14 07:13 . 2013-05-14 07:13 -------- d-----w- c:\users\Allie\AppData\Local\Apple Computer
2013-05-14 07:13 . 2013-05-14 07:13 -------- d-----w- c:\users\Allie\AppData\Roaming\Barnes & Noble
2013-05-14 07:13 . 2013-05-14 07:13 -------- d-----w- c:\program files (x86)\Barnes & Noble
2013-05-09 04:58 . 2013-05-09 18:04 -------- d-----w- c:\users\Allie\AppData\Roaming\FLV and Media Player
2013-05-09 04:58 . 2013-05-09 04:58 -------- d-----w- c:\users\Allie\AppData\Roaming\vlc
2013-05-09 03:26 . 2013-05-09 03:26 -------- d-----w- c:\program files (x86)\Applian Technologies
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-16 07:49 . 2011-03-29 02:36 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-14 19:02 . 2012-11-10 02:59 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-14 19:02 . 2012-11-10 02:59 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-09 08:59 . 2013-03-20 03:21 189936 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-05-09 08:59 . 2013-03-20 03:21 65336 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-05-09 08:59 . 2012-11-10 02:21 72016 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-05-09 08:59 . 2012-11-10 02:21 64288 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-05-09 08:59 . 2012-11-10 02:21 378432 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-05-09 08:59 . 2012-11-10 02:21 1025808 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-05-09 08:59 . 2012-11-10 02:21 33400 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-05-09 08:59 . 2012-11-10 02:21 80816 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-05-09 08:58 . 2012-11-10 02:21 41664 ----a-w- c:\windows\avastSS.scr
2013-05-09 08:58 . 2012-11-10 02:21 287840 ----a-w- c:\windows\system32\aswBoot.exe
2013-04-19 18:52 . 2013-04-19 18:52 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-19 18:51 . 2012-11-10 04:16 866720 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-04-19 18:51 . 2012-11-10 04:16 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-04-14 11:52 . 2013-04-14 11:52 89600 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-04-14 11:52 . 2013-04-14 11:52 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-14 11:52 . 2013-04-14 11:52 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-04-14 11:52 . 2013-04-14 11:52 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-04-14 11:52 . 2013-04-14 11:52 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-04-14 11:52 . 2013-04-14 11:52 61440 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-04-14 11:52 . 2013-04-14 11:52 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-04-14 11:52 . 2013-04-14 11:52 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-04-14 11:52 . 2013-04-14 11:52 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-04-14 11:52 . 2013-04-14 11:52 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-04-14 11:52 . 2013-04-14 11:52 2877440 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-04-14 11:52 . 2013-04-14 11:52 2706432 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-04-14 11:52 . 2013-04-14 11:52 2647040 ----a-w- c:\windows\system32\iertutil.dll
2013-04-14 11:52 . 2013-04-14 11:52 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-04-14 11:52 . 2013-04-14 11:52 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-04-14 11:52 . 2013-04-14 11:52 216064 ----a-w- c:\windows\system32\msls31.dll
2013-04-14 11:52 . 2013-04-14 11:52 197120 ----a-w- c:\windows\system32\msrating.dll
2013-04-14 11:52 . 2013-04-14 11:52 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-04-14 11:52 . 2013-04-14 11:52 1766912 ----a-w- c:\windows\SysWow64\wininet.dll
2013-04-14 11:52 . 2013-04-14 11:52 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-04-14 11:52 . 2013-04-14 11:52 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-04-14 11:52 . 2013-04-14 11:52 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-04-14 11:52 . 2013-04-14 11:52 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-04-14 11:52 . 2013-04-14 11:52 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-04-14 11:52 . 2013-04-14 11:52 1365504 ----a-w- c:\windows\system32\urlmon.dll
2013-04-14 11:52 . 2013-04-14 11:52 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-04-14 11:52 . 2013-04-14 11:52 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-04-14 11:52 . 2013-04-14 11:52 109056 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-04-14 11:52 . 2013-04-14 11:52 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-14 11:52 . 2013-04-14 11:52 2240512 ----a-w- c:\windows\system32\wininet.dll
2013-04-14 11:52 . 2013-04-14 11:52 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-04-14 11:52 . 2013-04-14 11:52 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-04-14 11:52 . 2013-04-14 11:52 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-04-14 11:52 . 2013-04-14 11:52 855552 ----a-w- c:\windows\system32\jscript.dll
2013-04-14 11:52 . 2013-04-14 11:52 81408 ----a-w- c:\windows\system32\icardie.dll
2013-04-14 11:52 . 2013-04-14 11:52 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-04-14 11:52 . 2013-04-14 11:52 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-04-14 11:52 . 2013-04-14 11:52 67072 ----a-w- c:\windows\system32\iesetup.dll
2013-04-14 11:52 . 2013-04-14 11:52 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-04-14 11:52 . 2013-04-14 11:52 603136 ----a-w- c:\windows\system32\msfeeds.dll
2013-04-14 11:52 . 2013-04-14 11:52 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-04-14 11:52 . 2013-04-14 11:52 53248 ----a-w- c:\windows\system32\jsproxy.dll
2013-04-14 11:52 . 2013-04-14 11:52 526336 ----a-w- c:\windows\system32\ieui.dll
2013-04-14 11:52 . 2013-04-14 11:52 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-04-14 11:52 . 2013-04-14 11:52 51712 ----a-w- c:\windows\system32\ie4uinit.exe
2013-04-14 11:52 . 2013-04-14 11:52 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-04-14 11:52 . 2013-04-14 11:52 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-04-14 11:52 . 2013-04-14 11:52 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-04-14 11:52 . 2013-04-14 11:52 441856 ----a-w- c:\windows\system32\html.iec
2013-04-14 11:52 . 2013-04-14 11:52 39936 ----a-w- c:\windows\system32\iernonce.dll
2013-04-14 11:52 . 2013-04-14 11:52 3958784 ----a-w- c:\windows\system32\jscript9.dll
2013-04-14 11:52 . 2013-04-14 11:52 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-04-14 11:52 . 2013-04-14 11:52 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-04-14 11:52 . 2013-04-14 11:52 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-04-14 11:52 . 2013-04-14 11:52 2706432 ----a-w- c:\windows\system32\mshtml.tlb
2013-04-14 11:52 . 2013-04-14 11:52 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-04-14 11:52 . 2013-04-14 11:52 235008 ----a-w- c:\windows\system32\url.dll
2013-04-14 11:52 . 2013-04-14 11:52 19230208 ----a-w- c:\windows\system32\mshtml.dll
2013-04-14 11:52 . 2013-04-14 11:52 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-14 11:52 . 2013-04-14 11:52 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-04-14 11:52 . 2013-04-14 11:52 15404544 ----a-w- c:\windows\system32\ieframe.dll
2013-04-14 11:52 . 2013-04-14 11:52 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-04-14 11:52 . 2013-04-14 11:52 149504 ----a-w- c:\windows\system32\occache.dll
2013-04-14 11:52 . 2013-04-14 11:52 144896 ----a-w- c:\windows\system32\wextract.exe
2013-04-14 11:52 . 2013-04-14 11:52 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-04-14 11:52 . 2013-04-14 11:52 13824 ----a-w- c:\windows\system32\mshta.exe
2013-04-14 11:52 . 2013-04-14 11:52 136704 ----a-w- c:\windows\system32\iesysprep.dll
2013-04-14 11:52 . 2013-04-14 11:52 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-04-14 11:52 . 2013-04-14 11:52 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-04-14 11:52 . 2013-04-14 11:52 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-04-14 11:52 . 2013-04-14 11:52 102912 ----a-w- c:\windows\system32\inseng.dll
2013-04-14 11:51 . 2013-04-14 11:51 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 2560 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2011-03-04 2741616]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Six Engine"="c:\program files (x86)\ASUS\EPU\EPU.exe" [2011-04-12 5402752]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-12-15 103720]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2011-03-30 87336]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2011-09-28 75048]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-06-25 1073352]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe" [2013-05-11 3478600]
"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2013-03-28 450560]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2013-02-13 1263952]
.
c:\users\Allie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
GameStop Now.lnk - c:\program files (x86)\GameStop App\Now\GameStopNow.exe [2012-11-5 2039568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2012-6-27 572000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe [2012-06-11 193616]
R2 CLKMSVC10_38F51D56;CyberLink Product - 2012/11/06 11:15;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [2011-04-20 241648]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
R3 cpuz134;cpuz134;c:\users\Allie\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2013-01-13 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2011-11-03 56208]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-10-26 204288]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-05-09 80816]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2012-06-27 1326176]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2012-06-27 681056]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\drivers\asmthub3.sys [2011-06-02 128488]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\drivers\asmtxhci.sys [2011-06-02 401896]
S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe [2012-06-11 240208]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2011-12-16 17976]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - CLKMDRV10_38F51D56
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-03-04 17:29 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-05-24 05:38 1165776 ----a-w- c:\program files (x86)\Google\Chrome\Application\27.0.1453.94\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-10 19:02]
.
2013-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-20 03:23]
.
2013-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-20 03:23]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 133840 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-03 11545192]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-03-21 472992]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://nmd.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Allie\AppData\Roaming\Mozilla\Firefox\Profiles\6k8e54uw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.drudgereport.com/
FF - ExtSQL: 2013-05-18 11:22; scriptish@erikvold.com; c:\users\Allie\AppData\Roaming\Mozilla\Firefox\Profiles\6k8e54uw.default\extensions\scriptish@erikvold.com.xpi
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKCU-Run-EA Core - c:\program files (x86)\Electronic Arts\EADM\Core.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-Sid Meier's Pirates! - I:\pirates\UninstHelper.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-420960200-3095099426-3751781556-1000\Software\SecuROM\License information*]
"datasecu"=hex:50,cf,05,b1,16,53,9d,a3,58,19,a2,4a,b5,67,87,b7,72,88,e3,d2,d3,
50,c6,51,50,b9,1a,b1,3c,6a,8a,1a,90,02,54,7d,c8,00,ca,46,13,d6,a1,3a,8d,e2,\
"rkeysecu"=hex:b1,04,e7,1e,86,10,5d,25,75,82,93,26,c6,cb,3f,d0
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-05-26 11:43:01
ComboFix-quarantined-files.txt 2013-05-26 16:43
.
Pre-Run: 1,775,133,282,304 bytes free
Post-Run: 1,774,991,736,832 bytes free
.
- - End Of File - - B0CE649ADF14BEED9BE6B0B8E626BC11
ComboFix 13-05-25.02 - Allie 05/26/2013 11:36:17.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.16111.13751 [GMT -5:00]
Running from: c:\users\Allie\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-04-26 to 2013-05-26 )))))))))))))))))))))))))))))))
.
.
2013-05-26 16:41 . 2013-05-26 16:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-26 10:28 . 2013-05-26 10:28 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{53312170-6FA2-4544-AEBA-877758364ACC}\offreg.dll
2013-05-26 04:29 . 2013-05-26 04:39 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-05-26 04:24 . 2013-05-26 04:24 -------- d-----w- c:\programdata\WinZip
2013-05-26 04:24 . 2013-05-26 04:24 -------- d-----w- c:\program files\WinZip
2013-05-25 22:24 . 2013-05-25 22:25 181064 ----a-w- c:\windows\PSEXESVC.EXE
2013-05-25 22:21 . 2013-05-25 22:21 -------- d-----w- C:\RegBackup
2013-05-25 22:19 . 2013-05-25 22:19 -------- d-----w- c:\program files (x86)\Tweaking.com
2013-05-14 07:13 . 2013-05-14 07:13 -------- d-----w- c:\users\Allie\AppData\Roaming\Apple Computer
2013-05-14 07:13 . 2013-05-14 07:13 -------- d-----w- c:\users\Allie\AppData\Local\Apple Computer
2013-05-14 07:13 . 2013-05-14 07:13 -------- d-----w- c:\users\Allie\AppData\Roaming\Barnes & Noble
2013-05-14 07:13 . 2013-05-14 07:13 -------- d-----w- c:\program files (x86)\Barnes & Noble
2013-05-09 04:58 . 2013-05-09 18:04 -------- d-----w- c:\users\Allie\AppData\Roaming\FLV and Media Player
2013-05-09 04:58 . 2013-05-09 04:58 -------- d-----w- c:\users\Allie\AppData\Roaming\vlc
2013-05-09 03:26 . 2013-05-09 03:26 -------- d-----w- c:\program files (x86)\Applian Technologies
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-16 07:49 . 2011-03-29 02:36 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-14 19:02 . 2012-11-10 02:59 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-14 19:02 . 2012-11-10 02:59 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-09 08:59 . 2013-03-20 03:21 189936 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-05-09 08:59 . 2013-03-20 03:21 65336 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-05-09 08:59 . 2012-11-10 02:21 72016 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-05-09 08:59 . 2012-11-10 02:21 64288 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-05-09 08:59 . 2012-11-10 02:21 378432 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-05-09 08:59 . 2012-11-10 02:21 1025808 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-05-09 08:59 . 2012-11-10 02:21 33400 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-05-09 08:59 . 2012-11-10 02:21 80816 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-05-09 08:58 . 2012-11-10 02:21 41664 ----a-w- c:\windows\avastSS.scr
2013-05-09 08:58 . 2012-11-10 02:21 287840 ----a-w- c:\windows\system32\aswBoot.exe
2013-04-19 18:52 . 2013-04-19 18:52 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-19 18:51 . 2012-11-10 04:16 866720 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-04-19 18:51 . 2012-11-10 04:16 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-04-14 11:52 . 2013-04-14 11:52 89600 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-04-14 11:52 . 2013-04-14 11:52 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-14 11:52 . 2013-04-14 11:52 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-04-14 11:52 . 2013-04-14 11:52 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-04-14 11:52 . 2013-04-14 11:52 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-04-14 11:52 . 2013-04-14 11:52 61440 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-04-14 11:52 . 2013-04-14 11:52 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-04-14 11:52 . 2013-04-14 11:52 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-04-14 11:52 . 2013-04-14 11:52 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-04-14 11:52 . 2013-04-14 11:52 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-04-14 11:52 . 2013-04-14 11:52 2877440 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-04-14 11:52 . 2013-04-14 11:52 2706432 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-04-14 11:52 . 2013-04-14 11:52 2647040 ----a-w- c:\windows\system32\iertutil.dll
2013-04-14 11:52 . 2013-04-14 11:52 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-04-14 11:52 . 2013-04-14 11:52 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-04-14 11:52 . 2013-04-14 11:52 216064 ----a-w- c:\windows\system32\msls31.dll
2013-04-14 11:52 . 2013-04-14 11:52 197120 ----a-w- c:\windows\system32\msrating.dll
2013-04-14 11:52 . 2013-04-14 11:52 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-04-14 11:52 . 2013-04-14 11:52 1766912 ----a-w- c:\windows\SysWow64\wininet.dll
2013-04-14 11:52 . 2013-04-14 11:52 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-04-14 11:52 . 2013-04-14 11:52 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-04-14 11:52 . 2013-04-14 11:52 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-04-14 11:52 . 2013-04-14 11:52 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-04-14 11:52 . 2013-04-14 11:52 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-04-14 11:52 . 2013-04-14 11:52 1365504 ----a-w- c:\windows\system32\urlmon.dll
2013-04-14 11:52 . 2013-04-14 11:52 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-04-14 11:52 . 2013-04-14 11:52 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-04-14 11:52 . 2013-04-14 11:52 109056 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-04-14 11:52 . 2013-04-14 11:52 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-14 11:52 . 2013-04-14 11:52 2240512 ----a-w- c:\windows\system32\wininet.dll
2013-04-14 11:52 . 2013-04-14 11:52 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-04-14 11:52 . 2013-04-14 11:52 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-04-14 11:52 . 2013-04-14 11:52 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-04-14 11:52 . 2013-04-14 11:52 855552 ----a-w- c:\windows\system32\jscript.dll
2013-04-14 11:52 . 2013-04-14 11:52 81408 ----a-w- c:\windows\system32\icardie.dll
2013-04-14 11:52 . 2013-04-14 11:52 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-04-14 11:52 . 2013-04-14 11:52 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-04-14 11:52 . 2013-04-14 11:52 67072 ----a-w- c:\windows\system32\iesetup.dll
2013-04-14 11:52 . 2013-04-14 11:52 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-04-14 11:52 . 2013-04-14 11:52 603136 ----a-w- c:\windows\system32\msfeeds.dll
2013-04-14 11:52 . 2013-04-14 11:52 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-04-14 11:52 . 2013-04-14 11:52 53248 ----a-w- c:\windows\system32\jsproxy.dll
2013-04-14 11:52 . 2013-04-14 11:52 526336 ----a-w- c:\windows\system32\ieui.dll
2013-04-14 11:52 . 2013-04-14 11:52 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-04-14 11:52 . 2013-04-14 11:52 51712 ----a-w- c:\windows\system32\ie4uinit.exe
2013-04-14 11:52 . 2013-04-14 11:52 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-04-14 11:52 . 2013-04-14 11:52 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-04-14 11:52 . 2013-04-14 11:52 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-04-14 11:52 . 2013-04-14 11:52 441856 ----a-w- c:\windows\system32\html.iec
2013-04-14 11:52 . 2013-04-14 11:52 39936 ----a-w- c:\windows\system32\iernonce.dll
2013-04-14 11:52 . 2013-04-14 11:52 3958784 ----a-w- c:\windows\system32\jscript9.dll
2013-04-14 11:52 . 2013-04-14 11:52 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-04-14 11:52 . 2013-04-14 11:52 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-04-14 11:52 . 2013-04-14 11:52 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-04-14 11:52 . 2013-04-14 11:52 2706432 ----a-w- c:\windows\system32\mshtml.tlb
2013-04-14 11:52 . 2013-04-14 11:52 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-04-14 11:52 . 2013-04-14 11:52 235008 ----a-w- c:\windows\system32\url.dll
2013-04-14 11:52 . 2013-04-14 11:52 19230208 ----a-w- c:\windows\system32\mshtml.dll
2013-04-14 11:52 . 2013-04-14 11:52 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-14 11:52 . 2013-04-14 11:52 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-04-14 11:52 . 2013-04-14 11:52 15404544 ----a-w- c:\windows\system32\ieframe.dll
2013-04-14 11:52 . 2013-04-14 11:52 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-04-14 11:52 . 2013-04-14 11:52 149504 ----a-w- c:\windows\system32\occache.dll
2013-04-14 11:52 . 2013-04-14 11:52 144896 ----a-w- c:\windows\system32\wextract.exe
2013-04-14 11:52 . 2013-04-14 11:52 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-04-14 11:52 . 2013-04-14 11:52 13824 ----a-w- c:\windows\system32\mshta.exe
2013-04-14 11:52 . 2013-04-14 11:52 136704 ----a-w- c:\windows\system32\iesysprep.dll
2013-04-14 11:52 . 2013-04-14 11:52 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-04-14 11:52 . 2013-04-14 11:52 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-04-14 11:52 . 2013-04-14 11:52 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-04-14 11:52 . 2013-04-14 11:52 102912 ----a-w- c:\windows\system32\inseng.dll
2013-04-14 11:51 . 2013-04-14 11:51 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-04-14 11:51 . 2013-04-14 11:51 2560 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2011-03-04 2741616]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Six Engine"="c:\program files (x86)\ASUS\EPU\EPU.exe" [2011-04-12 5402752]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-12-15 103720]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2011-03-30 87336]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2011-09-28 75048]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-06-25 1073352]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe" [2013-05-11 3478600]
"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2013-03-28 450560]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2013-02-13 1263952]
.
c:\users\Allie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
GameStop Now.lnk - c:\program files (x86)\GameStop App\Now\GameStopNow.exe [2012-11-5 2039568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2012-6-27 572000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe [2012-06-11 193616]
R2 CLKMSVC10_38F51D56;CyberLink Product - 2012/11/06 11:15;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [2011-04-20 241648]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
R3 cpuz134;cpuz134;c:\users\Allie\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2013-01-13 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2011-11-03 56208]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-10-26 204288]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-05-09 80816]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2012-06-27 1326176]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2012-06-27 681056]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\drivers\asmthub3.sys [2011-06-02 128488]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\drivers\asmtxhci.sys [2011-06-02 401896]
S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe [2012-06-11 240208]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2011-12-16 17976]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - CLKMDRV10_38F51D56
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-03-04 17:29 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-05-24 05:38 1165776 ----a-w- c:\program files (x86)\Google\Chrome\Application\27.0.1453.94\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-10 19:02]
.
2013-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-20 03:23]
.
2013-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-20 03:23]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 133840 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-03 11545192]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-03-21 472992]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://nmd.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Allie\AppData\Roaming\Mozilla\Firefox\Profiles\6k8e54uw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.drudgereport.com/
FF - ExtSQL: 2013-05-18 11:22; scriptish@erikvold.com; c:\users\Allie\AppData\Roaming\Mozilla\Firefox\Profiles\6k8e54uw.default\extensions\scriptish@erikvold.com.xpi
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKCU-Run-EA Core - c:\program files (x86)\Electronic Arts\EADM\Core.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-Sid Meier's Pirates! - I:\pirates\UninstHelper.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-420960200-3095099426-3751781556-1000\Software\SecuROM\License information*]
"datasecu"=hex:50,cf,05,b1,16,53,9d,a3,58,19,a2,4a,b5,67,87,b7,72,88,e3,d2,d3,
50,c6,51,50,b9,1a,b1,3c,6a,8a,1a,90,02,54,7d,c8,00,ca,46,13,d6,a1,3a,8d,e2,\
"rkeysecu"=hex:b1,04,e7,1e,86,10,5d,25,75,82,93,26,c6,cb,3f,d0
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-05-26 11:43:01
ComboFix-quarantined-files.txt 2013-05-26 16:43
.
Pre-Run: 1,775,133,282,304 bytes free
Post-Run: 1,774,991,736,832 bytes free
.
- - End Of File - - B0CE649ADF14BEED9BE6B0B8E626BC11
