Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Loss of internet/mouse, unable to turn off computer, ect.

Started by Lammalord , Sep 23 2012 08:26 PM

  • Please log in to reply

#1
Lammalord
Posted 23 September 2012 - 08:26 PM

Lammalord

    New Member

  • Member
  • Pip
  • 5 posts
Okay, I'm not 100% sure this is a virus, or maleware or what, when it happened once it was a fluke, but now the same problem has occurred four times so I'm assuming there is an issue. Here is what happens: It starts with losing internet connection, then the mouse wont work (external) I have a laptop. Then things like my Network Places won't open and when I turn off the computer it will idle and never fully shut down or reset(I have to hard reset the computer). My antivirus doesn't find anything (avast, also ran malwarebytes) and I don't see any new processes in my task manager - the ones that I wasn't sure of I looked up and didn't see any problems.

** EDIT **
It happened again, so naturally I went looking for other problems. Here is what I found: can't delete (send anything to trash bin), antivirus wouldn't run (stayed at 0% scanned and wouldn't scan any files) OTL wouldn't scan (just froze) but hijackthis would (I have a log of "during the problem" if requested). Couldn't open control panel/my computer/documents ect, and couldn't enable any wi-fi networks (or disable for that matter). after a while Task manger had ghost processes (I was ending and reopening explorer when the files/wifi networks were freezing, and each time it left a ghost "explorer.exe" in the task manager, this happening with other processes I was ending after a while too, OTL, hijackthis, ect.)
** EDIT **

Now my Wifi and mouse are both external, so I'm not sure if it shuts down all internet connection or if its just interfering with my USB ports - it does seem to be interfering with USB ports - nothing works (keyboard works till unplugged, then mouse if unplugged looks like its not getting power)


Log:

OTL logfile created on: 9/23/2012 7:09:02 PM - Run 1
OTL by OldTimer - Version 3.2.66.2 Folder = C:\Users\Cameron Cook\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.75 Gb Total Physical Memory | 6.05 Gb Available Physical Memory | 78.12% Memory free
15.49 Gb Paging File | 13.02 Gb Available in Paging File | 84.06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 217.79 Gb Total Space | 15.30 Gb Free Space | 7.02% Space Free | Partition Type: NTFS
Drive H: | 122.03 Mb Total Space | 88.88 Mb Free Space | 72.84% Space Free | Partition Type: FAT32

Computer Name: LAMMALORD-PC | User Name: Cameron Cook | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/09/23 19:06:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Cameron Cook\Desktop\OTL.exe
PRC - [2012/09/09 18:14:40 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012/09/06 15:51:54 | 015,668,432 | ---- | M] (Google) -- C:\Program Files (x86)\Google\Drive\googledrivesync.exe
PRC - [2012/08/21 02:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/08/21 02:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/08/04 13:53:45 | 001,353,080 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exe
PRC - [2012/07/24 19:08:10 | 026,909,544 | ---- | M] (Dropbox, Inc.) -- C:\Users\Cameron Cook\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2011/10/18 20:58:41 | 000,045,056 | ---- | M] () -- C:\Windows\SysWOW64\UTSCSI.EXE
PRC - [2011/02/14 06:55:16 | 000,043,520 | R--- | M] () -- C:\Program Files\HTC\ModeSelection\VMMModeSelection.exe
PRC - [2010/08/10 02:06:16 | 000,975,952 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2010/08/10 02:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2010/08/10 02:06:16 | 000,305,744 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2010/08/09 10:45:42 | 002,922,496 | ---- | M] (WhatPulse.org) -- C:\Program Files (x86)\WhatPulse\WhatPulse.exe
PRC - [2010/06/28 16:23:12 | 000,265,984 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
PRC - [2010/06/28 16:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2010/04/14 19:17:30 | 000,529,024 | -H-- | M] (Cisco Consumer Products LLC) -- C:\Program Files (x86)\Cisco Systems\Cisco Valet Connector\CiscoAdapterSvc.exe
PRC - [2010/04/10 09:03:46 | 000,077,824 | ---- | M] () -- C:\Windows\KMService.exe
PRC - [2010/01/28 17:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe
PRC - [2010/01/08 06:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
PRC - [2009/11/09 00:18:00 | 000,065,216 | ---- | M] (WordWeb Software) -- C:\Program Files (x86)\WordWeb\wweb32.exe
PRC - [2003/04/18 19:06:26 | 000,008,192 | ---- | M] () -- C:\Windows\SysWOW64\srvany.exe


========== Modules (No Company Name) ==========

MOD - [2012/09/23 18:10:59 | 000,086,016 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\_elementtree.pyd
MOD - [2012/09/23 18:10:59 | 000,040,448 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\_socket.pyd
MOD - [2012/09/23 18:10:58 | 000,096,256 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\win32api.pyd
MOD - [2012/09/23 18:10:57 | 000,571,392 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\pysqlite2._sqlite.pyd
MOD - [2012/09/23 18:10:52 | 000,263,168 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\win32com.shell.shell.pyd
MOD - [2012/09/23 18:10:50 | 000,070,656 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\wx._html2.pyd
MOD - [2012/09/23 18:10:49 | 000,011,776 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\win32crypt.pyd
MOD - [2012/09/23 18:10:47 | 001,024,024 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\windows._cacheinvalidation.pyd
MOD - [2012/09/23 18:10:47 | 000,792,576 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\wx._gdi_.pyd
MOD - [2012/09/23 18:10:46 | 000,354,304 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\pythoncom26.dll
MOD - [2012/09/23 18:10:46 | 000,073,728 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\_ctypes.pyd
MOD - [2012/09/23 18:10:45 | 000,731,136 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\wx._misc_.pyd
MOD - [2012/09/23 18:10:45 | 000,110,592 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\win32security.pyd
MOD - [2012/09/23 18:10:42 | 000,645,120 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\_ssl.pyd
MOD - [2012/09/23 18:10:40 | 000,036,352 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\win32process.pyd
MOD - [2012/09/23 18:10:40 | 000,022,528 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\win32pdh.pyd
MOD - [2012/09/23 18:10:39 | 001,169,408 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\wx._core_.pyd
MOD - [2012/09/23 18:10:38 | 000,807,424 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\wx._windows_.pyd
MOD - [2012/09/23 18:10:38 | 000,311,808 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\_hashlib.pyd
MOD - [2012/09/23 18:10:37 | 000,121,856 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\wx._wizard.pyd
MOD - [2012/09/23 18:10:37 | 000,111,104 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\win32file.pyd
MOD - [2012/09/23 18:10:35 | 000,110,592 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\pywintypes26.dll
MOD - [2012/09/23 18:10:35 | 000,039,424 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\win32inet.pyd
MOD - [2012/09/23 18:10:31 | 001,056,256 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\wx._controls_.pyd
MOD - [2012/09/23 18:10:29 | 000,017,920 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\win32event.pyd
MOD - [2012/09/23 18:10:26 | 000,153,088 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\pyexpat.pyd
MOD - [2012/09/23 18:10:25 | 000,585,728 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\unicodedata.pyd
MOD - [2012/09/23 18:10:24 | 000,011,776 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI40002\select.pyd
MOD - [2012/09/23 06:07:43 | 020,317,008 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\libcef.dll
MOD - [2012/09/23 06:07:25 | 000,902,480 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\chromehtml.dll
MOD - [2012/09/23 06:07:24 | 000,123,232 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avutil-51.dll
MOD - [2012/09/23 06:07:23 | 001,099,616 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avcodec-53.dll
MOD - [2012/09/23 06:07:23 | 000,190,816 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avformat-53.dll
MOD - [2012/09/09 18:14:39 | 002,244,064 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012/07/30 06:19:23 | 006,277,280 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
MOD - [2011/10/15 13:37:23 | 002,212,608 | ---- | M] () -- C:\Windows\wweb32.dll
MOD - [2011/10/10 19:50:32 | 000,022,800 | ---- | M] () -- C:\Program Files (x86)\WordWeb\WUCNT.dll
MOD - [2011/03/17 01:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2011/02/14 06:55:16 | 000,043,520 | R--- | M] () -- C:\Program Files\HTC\ModeSelection\VMMModeSelection.exe
MOD - [2010/10/20 16:45:26 | 008,801,120 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
MOD - [2010/06/28 16:20:54 | 000,465,576 | ---- | M] () -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
MOD - [2009/05/19 23:02:04 | 000,072,200 | ---- | M] () -- C:\Program Files (x86)\Launch Manager\CdDirIo.dll


========== Services (SafeList) ==========

SRV:64bit: - [2012/08/21 02:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2011/07/07 23:36:06 | 000,365,568 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2011/07/07 20:25:02 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010/06/11 14:27:26 | 000,868,896 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV:64bit: - [2010/01/28 17:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV:64bit: - [2009/07/13 18:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/09/09 18:14:40 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/08/29 12:03:36 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011/11/24 23:27:32 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/10/18 20:58:41 | 000,045,056 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\UTSCSI.EXE -- (UTSCSI)
SRV - [2011/04/12 23:02:07 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/10/12 10:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010/08/10 02:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010/06/28 16:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010/04/14 19:17:30 | 000,529,024 | -H-- | M] (Cisco Consumer Products LLC) [Auto | Running] -- C:\Program Files (x86)\Cisco Systems\Cisco Valet Connector\CiscoAdapterSvc.exe -- (RaAutoInstSrv_AM10)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/08 06:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009/06/10 14:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2003/04/18 19:06:26 | 000,008,192 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\srvany.exe -- (KMService)
SRV - [2002/12/17 17:26:22 | 007,520,337 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -- (MSSQL$SONY_MEDIAMGR)
SRV - [2002/12/17 17:23:30 | 000,311,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -- (SQLAgent$SONY_MEDIAMGR)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/08/21 02:13:13 | 000,969,200 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2012/08/21 02:13:13 | 000,359,464 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2012/08/21 02:13:13 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2012/08/21 02:13:12 | 000,071,600 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2012/08/21 02:13:12 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2012/08/21 02:13:11 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2011/08/16 14:35:41 | 000,270,912 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011/07/07 21:15:50 | 009,884,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011/07/07 19:47:04 | 000,307,712 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011/03/10 23:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/10 23:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/12/15 00:08:06 | 000,153,600 | ---- | M] (HTC Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\htcusbnet.sys -- (htcusbnet)
DRV:64bit: - [2010/11/20 06:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 04:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 03:49:51 | 000,146,432 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rmcast.sys -- (RMCAST)
DRV:64bit: - [2010/09/23 17:46:32 | 000,116,752 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2010/07/08 20:51:50 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2010/06/17 02:18:28 | 000,246,376 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010/06/16 14:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie)
DRV:64bit: - [2010/05/14 14:48:28 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:64bit: - [2010/05/11 19:11:40 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010/04/28 14:43:20 | 000,038,528 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2010/04/19 19:35:14 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2010/03/23 14:53:16 | 001,101,600 | -H-- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\am10w7.sys -- (AM10)
DRV:64bit: - [2010/02/18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2009/12/10 04:25:10 | 000,301,104 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 18:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 17:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009/07/13 17:01:09 | 000,679,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xnacc.sys -- (xnacc)
DRV:64bit: - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/03/18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV - [2009/07/13 18:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://acer.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://acer.msn.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://acer.msn.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.facebook.com/profile.php?id=740999791&ref=tn_tnmn|http://co114w.col114.mail.live.com/mail/InboxLight.aspx?n=992731797&fid=1&fav=1&mid=925f118f-9621-11e1-bbfa-00215ad9bcc2&fv=1#!/mail/InboxLight.aspx?n=566437276!n=1291749278&fid=1b8e76bf6ed04ac8a7c62a7d07324b4f|https://login.fictionpress.com/pm2/post.php?rid=375878#last|https://email.1and1.com/ox6/ox.html|http://webmail.darththebook.com/email/scripts/index.pl?EV1=1336506801364695|https://blackboard.sdsu.edu/webapps/portal/frameset.jsp?tab_tab_group_id=_2_1&url=%2Fwebapps%2Fblackboard%2Fexecute%2Flauncher%3Ftype%3DCourse%26id%3D_69859_1%26url%3D|http://my.deviantart.com/messages/#view=feedback|http://www.sea-o.net/ind.php|http://www.spaceo.net/ind.php|http://www.wattpad.com/user/Lammalord|http://www.wattpad.com/user/Mr_Aek|http://www.youtube.com/watch?v=4HSBWSoMna8&feature=BFa&list=PL3A8E1A8B5D75A87F"
FF - prefs.js..extensions.enabledAddons: [email protected]:0.1.3
FF - prefs.js..extensions.enabledAddons: [email protected]:5.0.1701
FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.1
FF - prefs.js..extensions.enabledAddons: [email protected]:7.0.1466


FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Cameron Cook\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Cameron Cook\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/09/17 18:53:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/09/09 18:14:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/09/09 18:14:35 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\WordWeb\WCaptureMoz [2011/10/26 23:49:13 | 000,000,000 | ---D | M]

[2011/07/24 18:24:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cameron Cook\AppData\Roaming\Mozilla\Extensions
[2012/09/16 20:38:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cameron Cook\AppData\Roaming\Mozilla\Firefox\Profiles\8h4jo96h.default\extensions
[2012/06/28 19:47:36 | 000,002,794 | ---- | M] () (No name found) -- C:\Users\Cameron Cook\AppData\Roaming\Mozilla\Firefox\Profiles\8h4jo96h.default\extensions\[email protected]
[2012/07/24 20:07:12 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Cameron Cook\AppData\Roaming\Mozilla\Firefox\Profiles\8h4jo96h.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/09/16 20:38:38 | 000,270,876 | ---- | M] () (No name found) -- C:\Users\Cameron Cook\AppData\Roaming\Mozilla\Firefox\Profiles\8h4jo96h.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2012/05/10 13:20:13 | 000,002,057 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Roaming\Mozilla\Firefox\Profiles\8h4jo96h.default\searchplugins\youtube-video-search.xml
[2012/09/09 18:14:34 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/10/26 23:49:13 | 000,000,000 | ---D | M] (WordWeb one-click lookup) -- C:\PROGRAM FILES (X86)\WORDWEB\WCAPTUREMOZ
[2012/09/17 18:53:39 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012/09/09 18:14:40 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/09/09 04:49:07 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/09/09 04:49:07 | 000,002,253 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms},
CHR - homepage:
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\Application\21.0.1180.83\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\Application\21.0.1180.83\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\Application\21.0.1180.83\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: downloadUpdater (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
CHR - plugin: downloadUpdater2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL
CHR - plugin: Java™ Platform SE 7 U5 (Enabled) = C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.50.255 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Cameron Cook\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: avast! WebRep = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1456_0\
CHR - Extension: Gmail = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2009/06/10 14:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [itype] c:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe File not found
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [VMM Mode Selection] C:\Program Files\HTC\ModeSelection\VMMModeSelection.exe ()
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [GoogleDriveSync] C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Google)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O4 - HKCU..\Run: [WhatPulse] C:\Program Files (x86)\WhatPulse\WhatPulse.exe (WhatPulse.org)
O4 - HKCU..\Run: [WordWeb] C:\Program Files (x86)\WordWeb\wweb32.exe (WordWeb Software)
O4 - Startup: C:\Users\Cameron Cook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\Cameron Cook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Cameron Cook\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.0.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{92951286-D6C6-47A7-9076-AEF4E8A33846}: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{98C7DF9A-6D5D-4DF6-8087-3BE8A8DE16CF}: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0C3DEE0-B379-4910-9E51-022DF382F99F}: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F373EA46-BA3C-41FB-9E5E-76AF13E62314}: DhcpNameServer = 66.174.92.14 69.78.96.14
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA21DB47-8378-4211-817F-A53076043726}: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/15 07:51:04 | 000,000,240 | -H-- | M] () - H:\autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{033aba1a-a8a3-11e1-89c6-b753ccf6bddd}\Shell - "" = AutoRun
O33 - MountPoints2\{033aba1a-a8a3-11e1-89c6-b753ccf6bddd}\Shell\AutoRun\command - "" = F:\TL-Bootstrap.exe
O33 - MountPoints2\{033aba3d-a8a3-11e1-89c6-b753ccf6bddd}\Shell - "" = AutoRun
O33 - MountPoints2\{033aba3d-a8a3-11e1-89c6-b753ccf6bddd}\Shell\AutoRun\command - "" = F:\TL-Bootstrap.exe
O33 - MountPoints2\{cdf205e5-c7a0-11e0-9c75-b870f46f4988}\Shell - "" = AutoRun
O33 - MountPoints2\{cdf205e5-c7a0-11e0-9c75-b870f46f4988}\Shell\AutoRun\command - "" = E:\SETUP.EXE
O33 - MountPoints2\{cdf205e5-c7a0-11e0-9c75-b870f46f4988}\Shell\configure\command - "" = E:\SETUP.EXE
O33 - MountPoints2\{cdf205e5-c7a0-11e0-9c75-b870f46f4988}\Shell\install\command - "" = E:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/09/23 19:06:15 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Cameron Cook\Desktop\OTL.exe
[2012/09/23 18:25:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2012/09/23 18:25:46 | 000,000,000 | ---D | C] -- C:\Users\Cameron Cook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012/09/21 19:10:16 | 000,000,000 | ---D | C] -- C:\trans
[2012/09/21 18:15:21 | 000,000,000 | ---D | C] -- C:\Users\Cameron Cook\AppData\Roaming\ExpressFiles
[2012/09/20 16:27:44 | 000,000,000 | ---D | C] -- C:\Users\Cameron Cook\AppData\Roaming\vlc
[2012/09/20 16:27:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012/09/20 16:26:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VideoLAN
[2012/09/19 16:52:06 | 000,000,000 | ---D | C] -- C:\Users\Cameron Cook\AppData\Roaming\Real
[2012/09/18 17:19:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2012/09/18 17:19:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi
[2012/09/18 13:55:01 | 000,000,000 | --SD | C] -- C:\Users\Cameron Cook\Google Drive
[2012/09/18 13:53:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
[2012/09/18 13:53:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2012/09/11 17:04:20 | 000,000,000 | ---D | C] -- C:\Users\Cameron Cook\AppData\Local\{05284F90-8437-4C96-B595-E6141BFE143E}
[2012/09/09 18:14:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

========== Files - Modified Within 30 Days ==========

[2012/09/23 19:06:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Cameron Cook\Desktop\OTL.exe
[2012/09/23 19:05:00 | 000,000,936 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1647628775-2255411078-310753894-1001UA.job
[2012/09/23 18:58:01 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/09/23 18:50:56 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/23 18:50:56 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/23 18:25:46 | 000,003,007 | ---- | M] () -- C:\Users\Cameron Cook\Desktop\HiJackThis.lnk
[2012/09/23 18:17:01 | 000,752,718 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/09/23 18:17:01 | 000,642,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/09/23 18:17:01 | 000,114,440 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/09/23 18:10:08 | 000,000,214 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job
[2012/09/23 18:09:35 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/09/23 18:09:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/09/23 18:09:02 | 1942,142,975 | -HS- | M] () -- C:\hiberfil.sys
[2012/09/23 18:05:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1647628775-2255411078-310753894-1001Core.job
[2012/09/23 06:09:58 | 000,001,256 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk
[2012/09/20 16:27:12 | 000,001,030 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/09/19 16:57:48 | 000,006,144 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/18 13:55:03 | 000,001,710 | ---- | M] () -- C:\Users\Cameron Cook\Desktop\Google Drive.lnk
[2012/09/17 18:53:40 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012/09/04 02:00:57 | 000,002,492 | ---- | M] () -- C:\Users\Cameron Cook\Desktop\Google Chrome.lnk

========== Files Created - No Company Name ==========

[2012/09/23 18:25:46 | 000,003,007 | ---- | C] () -- C:\Users\Cameron Cook\Desktop\HiJackThis.lnk
[2012/09/20 16:27:12 | 000,001,030 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/09/18 13:55:03 | 000,001,710 | ---- | C] () -- C:\Users\Cameron Cook\Desktop\Google Drive.lnk
[2012/09/18 13:53:40 | 000,000,910 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/09/18 13:53:38 | 000,000,906 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/05 23:55:08 | 000,000,020 | ---- | C] () -- C:\Windows\cmm.dat
[2012/08/05 23:54:39 | 000,000,187 | ---- | C] () -- C:\Windows\SysWow64\CleanMem.ini
[2012/07/26 19:27:40 | 000,000,262 | ---- | C] () -- C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2012/03/03 14:33:36 | 000,000,024 | ---- | C] () -- C:\Users\Cameron Cook\random.dat
[2012/03/03 14:33:35 | 000,000,051 | ---- | C] () -- C:\Users\Cameron Cook\jagex_cl_runescape_LIVE.dat
[2012/02/09 12:34:33 | 000,007,605 | ---- | C] () -- C:\Users\Cameron Cook\AppData\Local\Resmon.ResmonCfg
[2011/11/05 02:56:03 | 000,614,400 | ---- | C] () -- C:\Windows\AutoKMS.exe
[2011/11/05 02:56:03 | 000,000,135 | ---- | C] () -- C:\Windows\AutoKMS.ini
[2011/10/27 13:29:25 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2011/10/26 23:49:13 | 002,212,608 | ---- | C] () -- C:\Windows\wweb32.dll
[2011/10/18 20:58:40 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\UTSCSI.EXE
[2011/10/03 13:04:47 | 000,077,824 | ---- | C] () -- C:\Windows\KMService.exe
[2011/10/03 13:04:47 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe
[2011/09/28 03:45:51 | 000,006,144 | ---- | C] () -- C:\Users\Cameron Cook\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/09/28 02:56:54 | 000,743,534 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/09/20 18:29:03 | 000,186,844 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011/08/16 15:10:35 | 000,197,120 | ---- | C] () -- C:\Windows\patchw32.dll
[2011/07/25 12:52:37 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat
[2011/07/24 18:24:17 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011/07/07 23:37:28 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011/04/12 22:41:52 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011/03/17 10:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

========== ZeroAccess Check ==========

[2009/07/13 21:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/01/04 03:44:25 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/01/04 01:59:38 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 18:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/08/31 06:50:54 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\.minecraft
[2011/10/19 11:50:55 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\acccore
[2011/08/16 15:21:42 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Atari
[2011/11/06 00:47:41 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Azureus
[2011/08/15 16:52:21 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\BitTorrent
[2011/08/05 00:09:42 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\COWON
[2011/11/06 00:47:45 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\DAEMON Tools Lite
[2011/10/09 17:32:04 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\DarksporeData
[2012/09/23 18:11:42 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Dropbox
[2012/09/21 18:15:30 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\ExpressFiles
[2011/08/16 15:10:37 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Leadertech
[2011/08/10 07:23:34 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\LolClient
[2012/05/23 22:55:26 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\LolClient2
[2011/09/28 02:58:27 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Publish Providers
[2011/09/28 02:58:13 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Sony
[2011/10/26 14:55:15 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\TheSage
[2012/04/21 01:33:23 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Thumbnail me
[2012/09/23 18:04:00 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\uTorrent
[2011/10/24 18:22:53 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\WhatPulse
[2011/10/11 21:06:41 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Windows Live Writer
[2012/08/07 14:11:35 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\WordWeb

========== Purity Check ==========



< End of report >






OTL Extras logfile created on: 9/23/2012 7:09:02 PM - Run 1
OTL by OldTimer - Version 3.2.66.2 Folder = C:\Users\Cameron Cook\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.75 Gb Total Physical Memory | 6.05 Gb Available Physical Memory | 78.12% Memory free
15.49 Gb Paging File | 13.02 Gb Available in Paging File | 84.06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 217.79 Gb Total Space | 15.30 Gb Free Space | 7.02% Space Free | Partition Type: NTFS
Drive H: | 122.03 Mb Total Space | 88.88 Mb Free Space | 72.84% Space Free | Partition Type: FAT32

Computer Name: LAMMALORD-PC | User Name: Cameron Cook | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0221268C-9F88-489A-B3A4-04CAFBA1A812}" = lport=6935 | protocol=6 | dir=in | name=league of legends launcher |
"{029653B0-2F6A-4C9B-B760-E0FC4DAB0E9C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0D5684EC-4E18-417B-A2B7-DF7A3267FE33}" = lport=8382 | protocol=6 | dir=in | name=league of legends launcher |
"{0EF40D9D-7F04-45B7-AB32-C2790BC2555E}" = lport=8382 | protocol=6 | dir=in | name=league of legends launcher |
"{10B074A6-235F-4A52-AAF5-29A66E67ECCC}" = lport=6982 | protocol=17 | dir=in | name=league of legends launcher |
"{15DDCB7E-16C2-467A-B5CB-A6C17691D20C}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{163F707D-C65C-436F-8D3E-B349AFC92164}" = lport=6948 | protocol=6 | dir=in | name=league of legends launcher |
"{177D7DF7-79AE-4427-8424-DC60272112DF}" = lport=139 | protocol=6 | dir=in | app=system |
"{19BCBBD0-09C5-4F39-A298-59AE9E77485A}" = rport=139 | protocol=6 | dir=out | app=system |
"{27809D83-AD42-4BBA-A242-8F6F3A994F26}" = lport=8381 | protocol=6 | dir=in | name=league of legends launcher |
"{27FEF4A4-3B52-4752-B0C9-3FF7F88AF6D9}" = rport=138 | protocol=17 | dir=out | app=system |
"{3777735D-6FA3-4B30-9960-6D864A303127}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{3F94A114-0A1C-48F4-80CC-C7283FEB5C42}" = lport=8381 | protocol=6 | dir=in | name=league of legends launcher |
"{4123F63E-518F-44D6-9FC0-26B13E00DE55}" = lport=8381 | protocol=17 | dir=in | name=league of legends launcher |
"{4B5BC6D3-2B13-409E-9961-CB3FF8DC41D0}" = lport=6974 | protocol=17 | dir=in | name=league of legends launcher |
"{4B63116D-6159-4513-8683-C96C7A9B77A3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{4C3E01F9-0B9B-413B-9F9C-A33FCFF9A961}" = lport=8390 | protocol=6 | dir=in | name=league of legends game client |
"{4F0CA595-57AA-450F-8049-87DD2D877E77}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{537E0972-C63B-4A65-816B-C6F4E1A045B1}" = lport=6928 | protocol=17 | dir=in | name=league of legends launcher |
"{56BE9F59-EDC0-40EA-92B8-60DCACB36837}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{59E9B8A5-335D-4665-A9DA-161C6E8B106C}" = lport=8383 | protocol=17 | dir=in | name=league of legends launcher |
"{5F6EDC2A-7E42-427D-846F-8DF2B5E4BD3C}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6BA3C2A6-7113-4D02-B7F3-ECEE28B57FB4}" = lport=6982 | protocol=6 | dir=in | name=league of legends launcher |
"{771E3148-8AD8-4613-8A59-7FDCAC6C1EAC}" = rport=445 | protocol=6 | dir=out | app=system |
"{7C62DA7A-71D7-43DC-9BCF-95909779D586}" = lport=6948 | protocol=17 | dir=in | name=league of legends launcher |
"{7DEE442E-A9DA-4E6C-A93C-D6CE97713651}" = rport=10243 | protocol=6 | dir=out | app=system |
"{826653FE-6AEB-4BBF-933A-BEF942472350}" = lport=6962 | protocol=17 | dir=in | name=league of legends launcher |
"{8362BD15-875D-4316-898D-7AD21BE04405}" = lport=8383 | protocol=17 | dir=in | name=league of legends launcher |
"{8406BDE8-B1DB-49E7-9B89-6FA19D94A1ED}" = lport=6974 | protocol=6 | dir=in | name=league of legends launcher |
"{8629E811-0BBA-4AFD-B3D8-69E6EF102E44}" = lport=137 | protocol=17 | dir=in | app=system |
"{8B318D7E-1824-4704-9378-3484FF203FAA}" = lport=8393 | protocol=6 | dir=in | name=league of legends lobby |
"{93CABA0A-4F4B-4856-B74D-EA42A419BBCC}" = lport=6962 | protocol=6 | dir=in | name=league of legends launcher |
"{95287EA9-A2FE-4486-A88E-7FBA0CA896E3}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
"{96230ECC-2617-43CD-A369-E01A2E2F1D70}" = lport=6935 | protocol=17 | dir=in | name=league of legends launcher |
"{A68AB544-234D-4BEF-991F-541E544B07B2}" = lport=8382 | protocol=17 | dir=in | name=league of legends launcher |
"{AABBF52C-F32A-4B60-91A2-742B04C4F230}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{ABA01222-1FA7-4C4B-B0CB-CC19629201ED}" = lport=6954 | protocol=6 | dir=in | name=league of legends launcher |
"{ABAFA263-DB26-4DBD-A45B-E6574D45014F}" = lport=138 | protocol=17 | dir=in | app=system |
"{B116B839-0F90-49D8-9575-94ECFB7C5C3D}" = lport=6954 | protocol=17 | dir=in | name=league of legends launcher |
"{B2795CFA-C9DC-4DD7-85C8-D17134A56144}" = lport=8383 | protocol=6 | dir=in | name=league of legends launcher |
"{B4DB8DDD-3E94-4A04-B63E-A9C222474092}" = lport=6942 | protocol=17 | dir=in | name=league of legends launcher |
"{C23DD4FC-22A2-4D24-ADA8-2B4A0EE0D247}" = lport=8390 | protocol=17 | dir=in | name=league of legends game client |
"{C5031224-5FFA-4D71-8105-C15E171CFF33}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{CCD1E8F0-3593-44E6-94C4-D788158FA740}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CF5E3159-1EA9-4B9D-B528-400DF6FDCA7D}" = lport=8383 | protocol=6 | dir=in | name=league of legends launcher |
"{D1C024B9-8E50-43AC-8D93-C1DB6F203906}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D3E5B124-1576-4248-908F-E78749178863}" = lport=8393 | protocol=17 | dir=in | name=league of legends lobby |
"{D4316315-475D-444A-8A58-A3EDC02B7056}" = lport=8382 | protocol=17 | dir=in | name=league of legends launcher |
"{DCEB712D-BEC9-4A62-BAAB-FA22B5AC200F}" = rport=137 | protocol=17 | dir=out | app=system |
"{DE8484EF-B898-47EB-B650-079F1C63ADA9}" = lport=2869 | protocol=6 | dir=in | app=system |
"{E70D636C-ACE7-41CC-A81D-F0EBEA09D3FD}" = lport=445 | protocol=6 | dir=in | app=system |
"{ED7BAA54-45FA-4F14-88D3-0626AE527125}" = lport=8381 | protocol=17 | dir=in | name=league of legends launcher |
"{F0A3B678-3A47-4090-9506-3258DA5BC393}" = lport=10243 | protocol=6 | dir=in | app=system |
"{F2143C8B-3066-4124-B9CF-C090C6B684A0}" = lport=6928 | protocol=6 | dir=in | name=league of legends launcher |
"{F2EBCA0F-86A4-46C0-B5A7-6CA264194255}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F89BC95C-B0DF-445C-AA9D-DC94649DBD8C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FB023244-7A52-4358-B002-9A756D935FD4}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{FC41D79F-D8B9-467B-BF7C-43A929864643}" = lport=6942 | protocol=6 | dir=in | name=league of legends launcher |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{051E695B-D353-4A52-A5A5-0EA8278FBA4F}" = protocol=6 | dir=in | app=c:\program files (x86)\expressfiles\expressfiles.exe |
"{071EBD91-D420-49B5-A7ED-D4AC0B36FF25}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{17EAE47F-1E0F-43AE-827A-A5DA167294AA}" = protocol=1 | dir=in | [email protected],-28543 |
"{1BF78D6C-32F3-4E90-A3B8-EF8C59A87333}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{1C93B134-26A0-405B-821C-FC5882A7DF26}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{255AF4B4-CBA5-489A-AA19-61849165A111}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{362ED2D2-9C37-4891-809D-D900881F0FB3}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{3E5CB9F7-657F-4611-A8EC-83D10BFA50EA}" = protocol=17 | dir=in | app=c:\program files (x86)\logmein hamachi\hamachi-2-ui.exe |
"{41AEC619-BB98-42FD-A927-E66DD661357E}" = protocol=6 | dir=in | app=c:\users\cameron cook\appdata\roaming\dropbox\bin\dropbox.exe |
"{49710DC3-83AF-4DDE-AB52-959FD501E572}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4F9551A6-1378-4450-8B2A-9EBE5F5533CF}" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"{5233489E-6026-4AEB-9F3A-210E2EF9C74F}" = protocol=17 | dir=in | app=c:\users\cameron cook\appdata\roaming\dropbox\bin\dropbox.exe |
"{539988E7-3691-4195-8374-424E814FFB68}" = protocol=6 | dir=in | app=c:\program files (x86)\expressfiles\expressdl.exe |
"{54239D57-9AFA-4553-98EE-245B7692C1DD}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{59D11093-CDDD-4C1D-B218-972E488DE9B3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5CECC78E-9E07-4CAB-AD59-7E3C3B0323FE}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{5EE26FD5-5A42-4B9F-B795-21520D2DF626}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{66611A68-40AB-41D4-B98B-1D43E107D7A5}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{6AE23817-7FC5-4795-8F05-0B5F2E22B94B}" = protocol=6 | dir=out | app=system |
"{6B07DF3C-74EF-4D65-A190-F775DA474904}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{6FE51A2F-B763-4B2B-B648-704C330F79B3}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sid meier's civilization iii complete\conquests\civ3conquests.exe |
"{7CB326CA-6C2C-49DB-B390-B97FD025966D}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{7ECBD451-D7C9-4F7C-BE63-D1424090183C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{805CA0C1-7CF1-4F23-A0C7-510E0F9DD512}" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"{82AD36A1-9D09-469E-9961-E83FDE4A40DC}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8320D41A-FF8F-4694-B876-F0999F2B04D5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{83D2316B-9902-4964-AC40-F8DE51342BBB}" = protocol=17 | dir=in | app=c:\riot games\league of legends\lol.launcher.exe |
"{842A34FB-9305-45C5-AE5F-876CAB9A645E}" = protocol=6 | dir=in | app=c:\program files (x86)\logmein hamachi\hamachi-2-ui.exe |
"{87D0FE3B-8BC0-4C91-BA7A-1F0D38645F25}" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"{8E04A547-E9B1-40A1-82CB-94EA90D8D083}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{934A95EF-B4D6-456C-9416-EC16C11C3B27}" = protocol=6 | dir=in | app=c:\program files (x86)\aim\aim.exe |
"{96B567FE-2504-4F15-A1AC-882D11114141}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{986ADBB4-7BED-435A-89CC-88B9B4B63D12}" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"{A12ED23D-C798-417C-A2DD-A4E25F65D79E}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{A8A5C1E3-3D7E-4FD2-971D-274F59E88D0A}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\darkspore\darksporebin\darkspore.exe |
"{A8F277D4-AAF6-4C98-883A-4961F9FD0F56}" = protocol=1 | dir=out | [email protected],-28544 |
"{A91767D8-C29D-4DD3-92F8-B1A31F048A2C}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\darkspore\darksporebin\darkspore.exe |
"{AC107289-E782-4945-94C1-553B9B1504A8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B002F0B5-6928-4DE2-96D9-F2B6F219001D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{B92629D4-54B0-4BBE-B366-97EF8CDD0CEC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{C1503FE8-7F8F-4728-AA64-C2017CBA7C09}" = protocol=17 | dir=in | app=c:\program files (x86)\expressfiles\expressdl.exe |
"{C29CB19B-EFB7-4CDF-BF5A-6740A1D7D5DA}" = protocol=58 | dir=in | [email protected],-28545 |
"{C3FE1B94-B692-4623-8C57-9110627691E3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{CABE3B8C-24E5-49CF-A473-4705CC866C58}" = protocol=17 | dir=in | app=c:\program files (x86)\aim\aim.exe |
"{CE08C8E1-340E-4A23-97B4-FE00E5F7187C}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3DE8BF9-1D1D-4D4D-BC88-C5BAC7413843}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{D55D094F-B485-4004-BB11-5CBBEBC9DD0F}" = protocol=58 | dir=out | [email protected],-28546 |
"{D7EC9B32-B33D-4DC3-91BD-F45551A178BF}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{DC6A482B-99C1-4DE5-8A89-10AEA9BF9F2B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sid meier's civilization iii complete\conquests\civ3conquests.exe |
"{E41F7B9B-5FBB-4A8B-8EF8-02247BEC0E52}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E70AA488-529F-49EE-886F-E0E3C32160E3}" = protocol=6 | dir=in | app=c:\riot games\league of legends\lol.launcher.exe |
"{E77233F8-0E38-473C-88DD-1741F4A56430}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{ECC8F0F5-80AD-4AED-AA4C-2EF16471EBD9}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{F4B8959B-4192-4423-91D1-AF79904F3EB2}" = protocol=17 | dir=in | app=c:\program files (x86)\expressfiles\expressfiles.exe |
"TCP Query User{11C93583-4E09-4A58-8923-D068C9CE933E}C:\windows\syswow64\dpnsvr.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\dpnsvr.exe |
"TCP Query User{14554EAA-CDD2-4CF1-888D-152E96C8D76C}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"TCP Query User{8DCB9C66-0C33-4FF0-99D9-4FFCBD1C1EED}C:\program files (x86)\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mirc\mirc.exe |
"TCP Query User{AAA02493-761A-447E-AE62-0F088D1AD595}C:\program files (x86)\steam\steamapps\common\sid meier's civilization iii complete\conquests\civ3conquests.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sid meier's civilization iii complete\conquests\civ3conquests.exe |
"TCP Query User{C3952989-E014-4829-B014-91EEEA9D9246}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{D2ACB0B6-8058-40DC-8926-01E8D38ADA14}C:\windows\syswow64\dpnsvr.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\dpnsvr.exe |
"TCP Query User{F025E9F0-DB58-4ED3-A8BB-AA17C2A4D1AE}C:\program files (x86)\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mirc\mirc.exe |
"TCP Query User{F6837A21-4990-4670-A9B4-508271F79A9F}C:\users\cameron cook\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\cameron cook\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{15871F27-2601-4A29-BFE9-5AFCF9533DAB}C:\program files (x86)\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mirc\mirc.exe |
"UDP Query User{415E2107-862F-4CD0-8F01-7AFC833D7F2E}C:\windows\syswow64\dpnsvr.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\dpnsvr.exe |
"UDP Query User{46843C6E-E6F6-47EF-8FC8-142E4EF68760}C:\program files (x86)\steam\steamapps\common\sid meier's civilization iii complete\conquests\civ3conquests.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sid meier's civilization iii complete\conquests\civ3conquests.exe |
"UDP Query User{5A10891F-4E1F-4609-A5A7-9B3DD80B5873}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{A8DAE068-10E8-49CC-A1CF-56201F0E32C5}C:\program files (x86)\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mirc\mirc.exe |
"UDP Query User{AB6BFCA3-8FB1-43E5-8F0D-BDCDFA2EC6E2}C:\users\cameron cook\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\cameron cook\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{CC6B9240-A924-4AA6-8F21-F990D92B50AE}C:\windows\syswow64\dpnsvr.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\dpnsvr.exe |
"UDP Query User{EEFBB0A9-09AB-49E3-8B55-10EFE6453098}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{031CB9CA-DF01-8DC6-0F8E-8E9887CA64C8}" = AMD Fuel
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{26A24AE4-039D-4CA4-87B4-2F86417000FF}" = Java™ 7 (64-bit)
"{446EE0D9-1F6B-42BF-8278-8D0B172BA15D}" = Microsoft IntelliType Pro 8.1
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{58EC015E-BA77-A331-0F49-C344EFF7A5D5}" = ccc-utility64
"{64A3A4F4-B792-11D6-A78A-00B0D0170000}" = Java™ SE Development Kit 7 (64-bit)
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{83D663BF-E9AF-0C6B-D278-BB8F90EDA304}" = ATI Catalyst Install Manager
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}" = Ventrilo Client for Windows x64
"{F0D50B6D-925D-D70A-DB07-1FB44C611789}" = AMD Media Foundation Decoders
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft IntelliType Pro 8.1" = Microsoft IntelliType Pro 8.1
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0E33EC53-22CE-426C-A88B-2AAC231BAC85}" = Catalyst Control Center - Branding
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{111DB3F0-0C58-4475-9954-1BD5B7B28618}" = League of Legends
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"{251C3815-7A55-4607-A82D-C3B98F0FBAB8}" = Sony Vegas 7.0
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java™ 7 Update 5
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{32A3A4F4-B792-11D6-A78A-00B0D0170000}" = Java™ SE Development Kit 7
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3832FA99-2EDD-41E0-94AD-FBF9FABAFEF9}" = Atheros WLAN Client
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51F026FA-5146-4232-A8BA-1364740BD053}" = Acer Crystal Eye webcam
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{57F8108C-886F-9424-DB1D-9A5E51ED13C4}" = Catalyst Control Center Graphics Previews Common
"{5B461E1D-1DB0-0BB2-132F-D77C56838FF3}" = Catalyst Control Center InstallProxy
"{61C25DE5-8236-62C2-795F-05DBA452B1B5}" = Catalyst Control Center Localization All
"{658BC6B8-549E-58B3-4FD1-56CF7E3094CB}" = AMD VISION Engine Control Center
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71A41426-C7A4-4DCF-A9ED-C5B4B105ED1D}" = Sony Media Manager 2.2
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0409-1000-0000000FF1CE}_Office14.PROPLUS_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUS_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUS_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUS_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0116-0409-1000-0000000FF1CE}_Office14.PROPLUS_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{907B4640-266B-4A21-92FB-CD1A86CD0F63}" = RollerCoaster Tycoon® 3
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.5.1 MUI
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B1AAE4BF-C98E-467E-94C7-4E1F51DD86E0}" = Darkspore™
"{B1CBB2A3-2797-6C12-5317-D100F3BD0A76}" = CCC Help English
"{B8ABD8C7-991E-4A70-B5A3-20C6FC680680}" = LogMeIn Hamachi
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}" = COWON Media Center - jetAudio Basic VX
"{E09B48B5-E141-427A-AB0C-D3605127224A}" = Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
"{EA926717-CE5A-4CB4-AB21-9E6E9565A458}" = RCT3 Soaked
"{EACCC042-848D-4166-9D97-B13D1D108722}" = Google Drive
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"AIM_7" = AIM 7
"AllToAVI" = AllToAVI v4 r5394
"avast" = avast! Free Antivirus
"Cisco Connect" = Cisco Connect
"Cisco Valet Connector" = Cisco Valet Connector
"CleanMem" = CleanMem
"DAEMON Tools Lite" = DAEMON Tools Lite
"HTC_WModemDriver" = WModem Driver Installer
"Identity Card" = Identity Card
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9
"LastFM_is1" = Last.fm 1.5.4.27091
"LManager" = Launch Manager
"LogMeIn Hamachi" = LogMeIn Hamachi
"mIRC" = mIRC
"Mozilla Firefox 15.0.1 (x86 en-US)" = Mozilla Firefox 15.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP4 to MP3 Converter" = MP4 to MP3 Converter
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"PokerStars.net" = PokerStars.net
"Rhye's of Civilization Expanded" = Rhye's of Civilization Expanded
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"Steam App 3910" = Sid Meier's Civilization III: Complete
"uTorrent" = µTorrent
"VLC media player" = VLC media player 2.0.3
"WhatPulse" = WhatPulse 1.7
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.01 (32-bit)
"WordWeb" = WordWeb

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"Thumbnail me 3.0" = Thumbnail me 3.0

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 5/21/2012 8:40:21 PM | Computer Name = Lammalord-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>
with error: The data is invalid. .

Error - 5/28/2012 6:46:58 PM | Computer Name = Lammalord-PC | Source = Microsoft-Windows-RestartManager | ID = 10006
Description = Application or service 'Windows Live Messenger' could not be shut
down.

Error - 5/28/2012 6:47:11 PM | Computer Name = Lammalord-PC | Source = Microsoft-Windows-RestartManager | ID = 10006
Description = Application or service 'Windows Search' could not be shut down.

Error - 6/5/2012 4:56:52 PM | Computer Name = Lammalord-PC | Source = Application Error | ID = 1000
Description = Faulting application name: LolClient.exe, version: 2.0.2.12610, time
stamp: 0x4c00573a Faulting module name: Adobe AIR.dll, version: 3.1.0.4880, time
stamp: 0x4eb75fb9 Exception code: 0xc0000005 Fault offset: 0x000781a4 Faulting process
id: 0x2dc Faulting application start time: 0x01cd429d4ec0d932 Faulting application
path: C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.0.147\deploy\LolClient.exe
Faulting
module path: C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.0.147\deploy\Adobe
AIR\Versions\1.0\Adobe AIR.dll Report Id: f9987fe8-af50-11e1-89c6-b753ccf6bddd

Error - 6/14/2012 4:43:48 PM | Computer Name = Lammalord-PC | Source = Application Error | ID = 1000
Description = Faulting application name: msnmsgr.exe, version: 15.4.3555.308, time
stamp: 0x4f596cbb Faulting module name: KERNELBASE.dll, version: 6.1.7601.17651,
time stamp: 0x4e211319 Exception code: 0xe06d7363 Fault offset: 0x0000b9bc Faulting
process id: 0x167c Faulting application start time: 0x01cd3d2e4c9aa4ce Faulting application
path: C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe Faulting module
path: C:\Windows\syswow64\KERNELBASE.dll Report Id: a416d740-b661-11e1-89c6-b753ccf6bddd

Error - 6/15/2012 10:44:06 PM | Computer Name = Lammalord-PC | Source = Application Hang | ID = 1002
Description = The program Explorer.EXE version 6.1.7601.17567 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 894 Start
Time: 01cd3cafdf3027c0 Termination Time: 45 Application Path: C:\Windows\Explorer.EXE

Report
Id: 21832270-b75d-11e1-89c6-b753ccf6bddd

Error - 6/28/2012 10:47:26 PM | Computer Name = Lammalord-PC | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 13.0.1.4548 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 468 Start
Time: 01cd4f8c1f30f139 Termination Time: 108 Application Path: C:\Program Files (x86)\Mozilla
Firefox\firefox.exe Report Id: bfa6c7c5-c194-11e1-89c6-b753ccf6bddd

Error - 6/28/2012 10:47:54 PM | Computer Name = Lammalord-PC | Source = Application Error | ID = 1000
Description = Faulting application name: FlashPlayerPlugin_11_3_300_262.exe, version:
11.3.300.262, time stamp: 0x4fe20fae Faulting module name: NPSWF32_11_3_300_262.dll,
version: 11.3.300.262, time stamp: 0x4fe21212 Exception code: 0xc0000005 Fault offset:
0x0066d2ff Faulting process id: 0x1174 Faulting application start time: 0x01cd55a18ea57718
Faulting
application path: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe
Faulting
module path: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll Report
Id: d2c626f3-c194-11e1-89c6-b753ccf6bddd

Error - 6/29/2012 7:10:57 PM | Computer Name = Lammalord-PC | Source = Application Error | ID = 1000
Description = Faulting application name: LolClient.exe, version: 2.0.2.12610, time
stamp: 0x4c00573a Faulting module name: Adobe AIR.dll, version: 3.1.0.4880, time
stamp: 0x4eb75fb9 Exception code: 0xc0000005 Fault offset: 0x000781a4 Faulting process
id: 0x28b4 Faulting application start time: 0x01cd5641a127e0cb Faulting application
path: C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.0.158\deploy\LolClient.exe
Faulting
module path: C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.0.158\deploy\Adobe
AIR\Versions\1.0\Adobe AIR.dll Report Id: ae554049-c23f-11e1-89c6-b753ccf6bddd

Error - 7/3/2012 6:06:56 PM | Computer Name = Lammalord-PC | Source = Application Hang | ID = 1002
Description = The program rads_user_kernel.exe version 0.0.0.0 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 11a0 Start
Time: 01cd59681c06c19d Termination Time: 5 Application Path: C:\Riot Games\League
of Legends\RADS\system\rads_user_kernel.exe Report Id: 64ab9876-c55b-11e1-89c6-b753ccf6bddd


[ System Events ]
Error - 1/30/2012 5:38:55 PM | Computer Name = Lammalord-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.1.105. The computer with the IP address 192.168.1.107 did
not allow the name to be claimed by this computer.

Error - 1/30/2012 5:44:05 PM | Computer Name = Lammalord-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.1.105. The computer with the IP address 192.168.1.107 did
not allow the name to be claimed by this computer.

Error - 1/30/2012 5:49:15 PM | Computer Name = Lammalord-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.1.105. The computer with the IP address 192.168.1.107 did
not allow the name to be claimed by this computer.

Error - 1/30/2012 5:54:25 PM | Computer Name = Lammalord-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.1.105. The computer with the IP address 192.168.1.107 did
not allow the name to be claimed by this computer.

Error - 1/30/2012 5:59:35 PM | Computer Name = Lammalord-PC | Source = BROWSER | ID = 8009
Description =

Error - 1/30/2012 5:59:35 PM | Computer Name = Lammalord-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.1.105. The computer with the IP address 192.168.1.107 did
not allow the name to be claimed by this computer.

Error - 1/31/2012 4:49:44 AM | Computer Name = Lammalord-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.

Error - 2/1/2012 12:16:16 AM | Computer Name = Lammalord-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.

Error - 2/2/2012 6:29:04 PM | Computer Name = Lammalord-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.

Error - 2/5/2012 6:56:06 AM | Computer Name = Lammalord-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.


< End of report >


Edited by Lammalord, 28 September 2012 - 08:03 AM.

  • 0

Advertisements

#2
Gammo
Posted 28 September 2012 - 06:25 AM

Gammo

    Member 2k

  • Malware Removal
  • 2,299 posts
Hello and welcome to Geekstogo!

We apologize for the delay in responding to your request for help.
If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

Please include a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.

If you haven't done so yet, please go to Malware and Spyware Cleaning Guide and follow the steps instructed there. If you have already done this, we still need a new log to see what has changed since you originally posted your problem.

We need to create an OTL Report
Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Check the box that says Scan All Users.
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.
  • Note: the Extras.txt file only gets created on OTL's first run.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.
  • 0

#3
Lammalord
Posted 28 September 2012 - 07:59 AM

Lammalord

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
other than updating windows I have not done anything since the report was first posted, and the problem has happened one more time (but before the windows update). It seems to happen most often when I have many tasks running, or with full-screen, 2 of the 4 times the computer went haywire was when watching Netflix for a long period of time and the other two were when I left the laptop on overnight (but closed) Could this be happening because of heating issue? I did noticed on the most recent time that the computer was hot on the bottom left side (the mouse pad and next to it) because I don't see any symptoms of malware, (no pop ups, fake virus programs, data or ram eating ect...) the computer just suddenly loses some of its functions like the internet, mouse, (anything connected to a USB) certain things won't open or run scans (OTL, Avast, Control Panel - or other interfaces) and the computer wont shut off when I try to turn it off, just freezes - though I seriously think the freezing may have been due to the updates, like maybe it wasn't really crashing, but taking 30 minutes to try to download and install updates (which it couldn't because the internet was down).

Even so since the exact same thing has happened four times now and right after I went to a few iffy websites (google...) I still decided to come and make sure - it may just be something viral that causing it. Since I've ran OTL before the .Extras didn't pop up - it should be the 2nd half of my first post. I also still have a hijackthis log from when the problem was happening - if you want that. OTL wouldn't run - but Hijackthis would.

OTL logfile created on: 9/28/2012 6:41:08 AM - Run 2
OTL by OldTimer - Version 3.2.66.2 Folder = C:\Users\Cameron Cook\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.75 Gb Total Physical Memory | 5.69 Gb Available Physical Memory | 73.52% Memory free
15.49 Gb Paging File | 13.31 Gb Available in Paging File | 85.93% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 217.79 Gb Total Space | 20.32 Gb Free Space | 9.33% Space Free | Partition Type: NTFS
Drive H: | 122.03 Mb Total Space | 88.88 Mb Free Space | 72.84% Space Free | Partition Type: FAT32

Computer Name: LAMMALORD-PC | User Name: Cameron Cook | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/09/23 19:06:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Cameron Cook\Desktop\OTL.exe
PRC - [2012/09/07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/09/06 15:51:54 | 015,668,432 | ---- | M] (Google) -- C:\Program Files (x86)\Google\Drive\googledrivesync.exe
PRC - [2012/08/21 02:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/08/21 02:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/07/27 13:51:28 | 001,498,552 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
PRC - [2012/07/24 19:08:10 | 026,909,544 | ---- | M] (Dropbox, Inc.) -- C:\Users\Cameron Cook\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012/06/18 00:48:58 | 003,268,216 | ---- | M] (mIRC Co. Ltd.) -- C:\Program Files (x86)\mIRC\mirc.exe
PRC - [2011/10/18 20:58:41 | 000,045,056 | ---- | M] () -- C:\Windows\SysWOW64\UTSCSI.EXE
PRC - [2010/08/10 02:06:16 | 000,975,952 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2010/08/10 02:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2010/08/10 02:06:16 | 000,305,744 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2010/08/09 10:45:42 | 002,922,496 | ---- | M] (WhatPulse.org) -- C:\Program Files (x86)\WhatPulse\WhatPulse.exe
PRC - [2010/06/28 16:23:12 | 000,265,984 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
PRC - [2010/06/28 16:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2010/04/14 19:17:30 | 000,529,024 | -H-- | M] (Cisco Consumer Products LLC) -- C:\Program Files (x86)\Cisco Systems\Cisco Valet Connector\CiscoAdapterSvc.exe
PRC - [2010/04/10 09:03:46 | 000,077,824 | ---- | M] () -- C:\Windows\KMService.exe
PRC - [2010/01/28 17:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe
PRC - [2010/01/08 06:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
PRC - [2009/11/09 00:18:00 | 000,065,216 | ---- | M] (WordWeb Software) -- C:\Program Files (x86)\WordWeb\wweb32.exe
PRC - [2003/04/18 19:06:26 | 000,008,192 | ---- | M] () -- C:\Windows\SysWOW64\srvany.exe


========== Modules (No Company Name) ==========

MOD - [2012/09/26 17:59:32 | 000,086,016 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\_elementtree.pyd
MOD - [2012/09/26 17:59:32 | 000,040,448 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\_socket.pyd
MOD - [2012/09/26 17:59:31 | 000,096,256 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\win32api.pyd
MOD - [2012/09/26 17:59:30 | 000,571,392 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\pysqlite2._sqlite.pyd
MOD - [2012/09/26 17:59:29 | 000,263,168 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\win32com.shell.shell.pyd
MOD - [2012/09/26 17:59:29 | 000,070,656 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\wx._html2.pyd
MOD - [2012/09/26 17:59:27 | 000,011,776 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\win32crypt.pyd
MOD - [2012/09/26 17:59:25 | 001,024,024 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\windows._cacheinvalidation.pyd
MOD - [2012/09/26 17:59:25 | 000,792,576 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\wx._gdi_.pyd
MOD - [2012/09/26 17:59:23 | 000,073,728 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\_ctypes.pyd
MOD - [2012/09/26 17:59:22 | 000,354,304 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\pythoncom26.dll
MOD - [2012/09/26 17:59:19 | 000,731,136 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\wx._misc_.pyd
MOD - [2012/09/26 17:59:17 | 000,110,592 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\win32security.pyd
MOD - [2012/09/26 17:59:15 | 000,645,120 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\_ssl.pyd
MOD - [2012/09/26 17:59:14 | 001,169,408 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\wx._core_.pyd
MOD - [2012/09/26 17:59:14 | 000,311,808 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\_hashlib.pyd
MOD - [2012/09/26 17:59:14 | 000,036,352 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\win32process.pyd
MOD - [2012/09/26 17:59:14 | 000,022,528 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\win32pdh.pyd
MOD - [2012/09/26 17:59:13 | 000,807,424 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\wx._windows_.pyd
MOD - [2012/09/26 17:59:13 | 000,121,856 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\wx._wizard.pyd
MOD - [2012/09/26 17:59:12 | 000,111,104 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\win32file.pyd
MOD - [2012/09/26 17:59:11 | 000,039,424 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\win32inet.pyd
MOD - [2012/09/26 17:59:10 | 000,110,592 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\pywintypes26.dll
MOD - [2012/09/26 17:59:08 | 001,056,256 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\wx._controls_.pyd
MOD - [2012/09/26 17:59:06 | 000,017,920 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\win32event.pyd
MOD - [2012/09/26 17:59:05 | 000,153,088 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\pyexpat.pyd
MOD - [2012/09/26 17:59:04 | 000,585,728 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\unicodedata.pyd
MOD - [2012/09/26 17:59:04 | 000,011,776 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\Temp\_MEI4802\select.pyd
MOD - [2012/07/27 13:51:28 | 000,249,272 | ---- | M] () -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\sqlite.dll
MOD - [2011/10/15 13:37:23 | 002,212,608 | ---- | M] () -- C:\Windows\wweb32.dll
MOD - [2011/10/10 19:50:32 | 000,022,800 | ---- | M] () -- C:\Program Files (x86)\WordWeb\WUCNT.dll
MOD - [2011/03/17 01:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2010/10/20 16:45:26 | 008,801,120 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
MOD - [2010/06/28 16:20:54 | 000,465,576 | ---- | M] () -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
MOD - [2009/05/19 23:02:04 | 000,072,200 | ---- | M] () -- C:\Program Files (x86)\Launch Manager\CdDirIo.dll


========== Services (SafeList) ==========

SRV:64bit: - [2012/08/21 02:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2011/07/07 23:36:06 | 000,365,568 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2011/07/07 20:25:02 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010/06/11 14:27:26 | 000,868,896 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV:64bit: - [2010/01/28 17:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV:64bit: - [2009/07/13 18:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/09/07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/09/07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/08/29 12:03:36 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012/07/27 13:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011/11/24 23:27:32 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/10/18 20:58:41 | 000,045,056 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\UTSCSI.EXE -- (UTSCSI)
SRV - [2011/04/12 23:02:07 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/10/12 10:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010/08/10 02:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010/06/28 16:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010/04/14 19:17:30 | 000,529,024 | -H-- | M] (Cisco Consumer Products LLC) [Auto | Running] -- C:\Program Files (x86)\Cisco Systems\Cisco Valet Connector\CiscoAdapterSvc.exe -- (RaAutoInstSrv_AM10)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/08 06:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009/06/10 14:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2003/04/18 19:06:26 | 000,008,192 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\srvany.exe -- (KMService)
SRV - [2002/12/17 17:26:22 | 007,520,337 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -- (MSSQL$SONY_MEDIAMGR)
SRV - [2002/12/17 17:23:30 | 000,311,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -- (SQLAgent$SONY_MEDIAMGR)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/09/07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012/08/21 02:13:13 | 000,969,200 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2012/08/21 02:13:13 | 000,359,464 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2012/08/21 02:13:13 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2012/08/21 02:13:12 | 000,071,600 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2012/08/21 02:13:12 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2012/08/21 02:13:11 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2012/02/29 23:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/07/07 21:15:50 | 009,884,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011/07/07 19:47:04 | 000,307,712 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011/03/10 23:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/10 23:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/12/15 00:08:06 | 000,153,600 | ---- | M] (HTC Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\htcusbnet.sys -- (htcusbnet)
DRV:64bit: - [2010/11/20 06:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 04:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 03:49:51 | 000,146,432 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rmcast.sys -- (RMCAST)
DRV:64bit: - [2010/09/23 17:46:32 | 000,116,752 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2010/07/08 20:51:50 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2010/06/17 02:18:28 | 000,246,376 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010/06/16 14:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie)
DRV:64bit: - [2010/05/14 14:48:28 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:64bit: - [2010/05/11 19:11:40 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010/04/28 14:43:20 | 000,038,528 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2010/04/19 19:35:14 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2010/03/23 14:53:16 | 001,101,600 | -H-- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\am10w7.sys -- (AM10)
DRV:64bit: - [2010/02/18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2009/12/10 04:25:10 | 000,301,104 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 17:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009/07/13 17:01:09 | 000,679,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xnacc.sys -- (xnacc)
DRV:64bit: - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/03/18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV - [2009/07/13 18:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://acer.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://acer.msn.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...rc=IE-SearchBox


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1647628775-2255411078-310753894-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
IE - HKU\S-1-5-21-1647628775-2255411078-310753894-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://acer.msn.com
IE - HKU\S-1-5-21-1647628775-2255411078-310753894-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1647628775-2255411078-310753894-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "YouTube Video Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.facebook.com/profile.php?id=740999791&ref=tn_tnmn|http://co114w.col114.mail.live.com/mail/InboxLight.aspx?n=992731797&fid=1&fav=1&mid=925f118f-9621-11e1-bbfa-00215ad9bcc2&fv=1#!/mail/InboxLight.aspx?n=566437276!n=1291749278&fid=1b8e76bf6ed04ac8a7c62a7d07324b4f|https://login.fictionpress.com/pm2/post.php?rid=375878#last|https://email.1and1.com/ox6/ox.html|http://webmail.darththebook.com/email/scripts/index.pl?EV1=1336506801364695|https://blackboard.sdsu.edu/webapps/portal/frameset.jsp?tab_tab_group_id=_2_1&url=%2Fwebapps%2Fblackboard%2Fexecute%2Flauncher%3Ftype%3DCourse%26id%3D_69859_1%26url%3D|http://my.deviantart.com/messages/#view=feedback|http://www.sea-o.net/ind.php|http://www.spaceo.net/ind.php|http://www.wattpad.com/user/Lammalord|http://www.wattpad.com/user/Mr_Aek|http://www.youtube.com/watch?v=4HSBWSoMna8&feature=BFa&list=PL3A8E1A8B5D75A87F"
FF - prefs.js..extensions.enabledAddons: [email protected]:0.1.3
FF - prefs.js..extensions.enabledAddons: [email protected]:5.0.1701
FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.1
FF - prefs.js..extensions.enabledAddons: [email protected]:7.0.1466


FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/09/17 18:53:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/09/09 18:14:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/09/26 23:11:46 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\WordWeb\WCaptureMoz [2011/10/26 23:49:13 | 000,000,000 | ---D | M]

[2011/07/24 18:24:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cameron Cook\AppData\Roaming\Mozilla\Extensions
[2012/09/16 20:38:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cameron Cook\AppData\Roaming\Mozilla\Firefox\Profiles\8h4jo96h.default\extensions
[2012/06/28 19:47:36 | 000,002,794 | ---- | M] () (No name found) -- C:\Users\Cameron Cook\AppData\Roaming\Mozilla\Firefox\Profiles\8h4jo96h.default\extensions\[email protected]
[2012/07/24 20:07:12 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Cameron Cook\AppData\Roaming\Mozilla\Firefox\Profiles\8h4jo96h.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/09/16 20:38:38 | 000,270,876 | ---- | M] () (No name found) -- C:\Users\Cameron Cook\AppData\Roaming\Mozilla\Firefox\Profiles\8h4jo96h.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2012/05/10 13:20:13 | 000,002,057 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Roaming\Mozilla\Firefox\Profiles\8h4jo96h.default\searchplugins\youtube-video-search.xml
[2012/09/09 18:14:34 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/10/26 23:49:13 | 000,000,000 | ---D | M] (WordWeb one-click lookup) -- C:\PROGRAM FILES (X86)\WORDWEB\WCAPTUREMOZ
[2012/09/17 18:53:39 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012/09/09 18:14:40 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/09/09 04:49:07 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/09/09 04:49:07 | 000,002,253 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms},
CHR - homepage:
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\Application\21.0.1180.83\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\Application\21.0.1180.83\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\Application\21.0.1180.83\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: downloadUpdater (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
CHR - plugin: downloadUpdater2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL
CHR - plugin: Java™ Platform SE 7 U5 (Enabled) = C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.50.255 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Cameron Cook\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: avast! WebRep = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1456_0\
CHR - Extension: Gmail = C:\Users\Cameron Cook\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2009/06/10 14:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [itype] c:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe File not found
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [VMM Mode Selection] C:\Program Files\HTC\ModeSelection\VMMModeSelection.exe ()
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1647628775-2255411078-310753894-1001..\Run: [GoogleDriveSync] C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Google)
O4 - HKU\S-1-5-21-1647628775-2255411078-310753894-1001..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O4 - HKU\S-1-5-21-1647628775-2255411078-310753894-1001..\Run: [WhatPulse] C:\Program Files (x86)\WhatPulse\WhatPulse.exe (WhatPulse.org)
O4 - HKU\S-1-5-21-1647628775-2255411078-310753894-1001..\Run: [WordWeb] C:\Program Files (x86)\WordWeb\wweb32.exe (WordWeb Software)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Cameron Cook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\Cameron Cook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Cameron Cook\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-1647628775-2255411078-310753894-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.0.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2963B38F-1281-4AF1-9BED-A86A4134E9D5}: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{92951286-D6C6-47A7-9076-AEF4E8A33846}: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{98C7DF9A-6D5D-4DF6-8087-3BE8A8DE16CF}: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0C3DEE0-B379-4910-9E51-022DF382F99F}: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F373EA46-BA3C-41FB-9E5E-76AF13E62314}: DhcpNameServer = 66.174.92.14 69.78.96.14
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA21DB47-8378-4211-817F-A53076043726}: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/15 07:51:04 | 000,000,240 | -H-- | M] () - H:\autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{033aba1a-a8a3-11e1-89c6-b753ccf6bddd}\Shell - "" = AutoRun
O33 - MountPoints2\{033aba1a-a8a3-11e1-89c6-b753ccf6bddd}\Shell\AutoRun\command - "" = F:\TL-Bootstrap.exe
O33 - MountPoints2\{033aba3d-a8a3-11e1-89c6-b753ccf6bddd}\Shell - "" = AutoRun
O33 - MountPoints2\{033aba3d-a8a3-11e1-89c6-b753ccf6bddd}\Shell\AutoRun\command - "" = F:\TL-Bootstrap.exe
O33 - MountPoints2\{cdf205e5-c7a0-11e0-9c75-b870f46f4988}\Shell - "" = AutoRun
O33 - MountPoints2\{cdf205e5-c7a0-11e0-9c75-b870f46f4988}\Shell\AutoRun\command - "" = E:\SETUP.EXE
O33 - MountPoints2\{cdf205e5-c7a0-11e0-9c75-b870f46f4988}\Shell\configure\command - "" = E:\SETUP.EXE
O33 - MountPoints2\{cdf205e5-c7a0-11e0-9c75-b870f46f4988}\Shell\install\command - "" = E:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/09/26 23:09:39 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/09/26 22:48:40 | 000,000,000 | ---D | C] -- C:\Users\Cameron Cook\Desktop\GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}
[2012/09/25 02:15:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVIcodec
[2012/09/24 03:54:09 | 000,000,000 | ---D | C] -- C:\Users\Cameron Cook\AppData\Roaming\Malwarebytes
[2012/09/24 03:54:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/09/24 03:53:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/09/24 03:53:58 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/09/24 03:53:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/09/23 19:06:15 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Cameron Cook\Desktop\OTL.exe
[2012/09/23 18:25:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2012/09/23 18:25:46 | 000,000,000 | ---D | C] -- C:\Users\Cameron Cook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012/09/21 19:10:16 | 000,000,000 | ---D | C] -- C:\trans
[2012/09/21 18:15:21 | 000,000,000 | ---D | C] -- C:\Users\Cameron Cook\AppData\Roaming\ExpressFiles
[2012/09/20 16:27:44 | 000,000,000 | ---D | C] -- C:\Users\Cameron Cook\AppData\Roaming\vlc
[2012/09/20 16:27:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012/09/20 16:26:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VideoLAN
[2012/09/19 16:52:06 | 000,000,000 | ---D | C] -- C:\Users\Cameron Cook\AppData\Roaming\Real
[2012/09/18 17:19:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2012/09/18 17:19:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi
[2012/09/18 13:55:01 | 000,000,000 | --SD | C] -- C:\Users\Cameron Cook\Google Drive
[2012/09/18 13:53:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
[2012/09/18 13:53:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2012/09/11 17:04:20 | 000,000,000 | ---D | C] -- C:\Users\Cameron Cook\AppData\Local\{05284F90-8437-4C96-B595-E6141BFE143E}
[2012/09/09 18:14:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

========== Files - Modified Within 30 Days ==========

[2012/09/28 05:58:00 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/09/27 17:25:33 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/09/27 17:18:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/09/26 23:11:46 | 000,001,983 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012/09/26 22:21:43 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/26 22:21:43 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/26 18:04:05 | 000,752,718 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/09/26 18:04:05 | 000,642,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/09/26 18:04:05 | 000,114,440 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/09/26 17:58:02 | 000,000,214 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job
[2012/09/26 17:56:59 | 000,417,920 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/09/26 17:56:17 | 1942,142,975 | -HS- | M] () -- C:\hiberfil.sys
[2012/09/24 03:54:00 | 000,001,073 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/09/24 03:33:00 | 000,001,256 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk
[2012/09/23 19:06:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Cameron Cook\Desktop\OTL.exe
[2012/09/23 18:25:46 | 000,003,007 | ---- | M] () -- C:\Users\Cameron Cook\Desktop\HiJackThis.lnk
[2012/09/20 16:27:12 | 000,001,030 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/09/19 16:57:48 | 000,006,144 | ---- | M] () -- C:\Users\Cameron Cook\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/18 13:55:03 | 000,001,710 | ---- | M] () -- C:\Users\Cameron Cook\Desktop\Google Drive.lnk
[2012/09/17 18:53:40 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012/09/07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2012/09/26 23:11:46 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012/09/26 23:11:46 | 000,001,983 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012/09/24 03:54:00 | 000,001,073 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/09/23 18:25:46 | 000,003,007 | ---- | C] () -- C:\Users\Cameron Cook\Desktop\HiJackThis.lnk
[2012/09/20 16:27:12 | 000,001,030 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/09/18 13:55:03 | 000,001,710 | ---- | C] () -- C:\Users\Cameron Cook\Desktop\Google Drive.lnk
[2012/09/18 13:53:40 | 000,000,910 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/09/18 13:53:38 | 000,000,906 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/05 23:55:08 | 000,000,020 | ---- | C] () -- C:\Windows\cmm.dat
[2012/07/26 19:27:40 | 000,000,262 | ---- | C] () -- C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2012/03/03 14:33:36 | 000,000,024 | ---- | C] () -- C:\Users\Cameron Cook\random.dat
[2012/03/03 14:33:35 | 000,000,051 | ---- | C] () -- C:\Users\Cameron Cook\jagex_cl_runescape_LIVE.dat
[2012/02/09 12:34:33 | 000,007,605 | ---- | C] () -- C:\Users\Cameron Cook\AppData\Local\Resmon.ResmonCfg
[2011/11/05 02:56:03 | 000,614,400 | ---- | C] () -- C:\Windows\AutoKMS.exe
[2011/11/05 02:56:03 | 000,000,135 | ---- | C] () -- C:\Windows\AutoKMS.ini
[2011/10/27 13:29:25 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2011/10/26 23:49:13 | 002,212,608 | ---- | C] () -- C:\Windows\wweb32.dll
[2011/10/18 20:58:40 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\UTSCSI.EXE
[2011/10/03 13:04:47 | 000,077,824 | ---- | C] () -- C:\Windows\KMService.exe
[2011/10/03 13:04:47 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe
[2011/09/28 03:45:51 | 000,006,144 | ---- | C] () -- C:\Users\Cameron Cook\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/09/28 02:56:54 | 000,743,534 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/09/20 18:29:03 | 000,186,844 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011/08/16 15:10:35 | 000,197,120 | ---- | C] () -- C:\Windows\patchw32.dll
[2011/07/25 12:52:37 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat
[2011/07/24 18:24:17 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011/07/07 23:37:28 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011/04/12 22:41:52 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011/03/17 10:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

========== ZeroAccess Check ==========

[2009/07/13 21:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/06/08 22:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 21:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 18:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/08/31 06:50:54 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\.minecraft
[2011/10/19 11:50:55 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\acccore
[2011/08/16 15:21:42 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Atari
[2011/11/06 00:47:41 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Azureus
[2011/08/15 16:52:21 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\BitTorrent
[2011/08/05 00:09:42 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\COWON
[2011/11/06 00:47:45 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\DAEMON Tools Lite
[2011/10/09 17:32:04 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\DarksporeData
[2012/09/26 18:00:27 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Dropbox
[2012/09/21 18:15:30 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\ExpressFiles
[2011/08/16 15:10:37 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Leadertech
[2011/08/10 07:23:34 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\LolClient
[2012/05/23 22:55:26 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\LolClient2
[2011/09/28 02:58:27 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Publish Providers
[2011/09/28 02:58:13 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Sony
[2011/10/26 14:55:15 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\TheSage
[2012/04/21 01:33:23 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Thumbnail me
[2012/09/28 06:33:55 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\uTorrent
[2011/10/24 18:22:53 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\WhatPulse
[2011/10/11 21:06:41 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\Windows Live Writer
[2012/08/07 14:11:35 | 000,000,000 | ---D | M] -- C:\Users\Cameron Cook\AppData\Roaming\WordWeb

========== Purity Check ==========



< End of report >


  • 0

#4
Lammalord
Posted 28 September 2012 - 07:07 PM

Lammalord

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Hey, uh, not sure if its related but I woke up this morning and tried to delete an empty folder to get an error something like "The Recycle Bin on C:\ is Corrupted. Do you want to empty the Recycle Bin for this drive? YES or NO"

I deleted the $Recycle.Bin folder on the C drive and reset the computer, which seemed to fix that problem. I also get the feeling I have 10 gigs more space than last night - so something went with the corruption. Guess I'll find out eventually...

Oh and my desktop.ini are showing up everywhere (on the desktop, in all the folders) and I don't remember checking to show protected files, though I do have it to show extensions and hidden files - even so the desktop.ini never showed up before...

Edited by Lammalord, 28 September 2012 - 07:12 PM.

  • 0

#5
Gammo
Posted 29 September 2012 - 05:41 AM

Gammo

    Member 2k

  • Malware Removal
  • 2,299 posts
Your OTL log appears to be clean, so I'm not sure malware is the cause of your problems. I'll take a close look at your PC with another tool. If that log file is clean as well, I'll redirect you to one of geekstogo's other forums.


Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
  • Accept the disclaimer and allow to update if it asks

    Posted Image

    Posted Image
  • When finished, it shall produce a log for you.
  • Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
  • 0

#6
Lammalord
Posted 29 September 2012 - 07:13 AM

Lammalord

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Yeah, I'm starting to think the problem was because of overheating, mainly closing the laptop but leaving it on or running too many processes at once (keeping the computer at 90% CPU for a long time). I haven't overworked it for about 4 days now and haven't seen a problem other than the corrupted recycle bin I mentioned last post (and fixed..) Loss of USB ports, loss of access to core directories (my computer, control panel, documents ect), the only thing that had me suspecting foul play was when the antivirus and OTL wouldn't scan - but who knows maybe the computer was just "clocked out" to protect itself from overheating and the process were taking up too much cpu so they wouldn't run... [bleep], what if its my cpu going out O.O

Oh snap, I just realized a connection - every time the crash happened it was within a few hours of running "All to AVI" which takes 90% + of the CPU for hours to convert files. I use it to convert those super-huge AVI files Sony Vegas makes to reasonable sized files I can later upload to youtube. Maybe its that that's been overheating the computer :S

ComboFix 12-09-27.03 - Cameron Cook 09/29/2012 5:40.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.7931.4779 [GMT -7:00]
Running from: c:\users\Cameron Cook\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\_ctypes.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\_elementtree.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\_hashlib.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\_socket.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\_ssl.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\pyexpat.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\pysqlite2._sqlite.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\python26.dll
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\pythoncom26.dll
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\pywintypes26.dll
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\select.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\unicodedata.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\win32api.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\win32com.shell.shell.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\win32crypt.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\win32event.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\win32file.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\win32inet.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\win32pdh.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\win32process.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\win32security.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\windows._cacheinvalidation.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\wx._controls_.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\wx._core_.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\wx._gdi_.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\wx._html2.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\wx._misc_.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\wx._windows_.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\wx._wizard.pyd
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\wxbase293u_net_vc.dll
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\wxbase293u_vc.dll
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\wxmsw293u_adv_vc.dll
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\wxmsw293u_core_vc.dll
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\wxmsw293u_html_vc.dll
c:\users\CAMERO~1\AppData\Local\Temp\_MEI35282\wxmsw293u_webview_vc.dll
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\_ctypes.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\_elementtree.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\_hashlib.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\_socket.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\_ssl.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\pyexpat.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\pysqlite2._sqlite.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\python26.dll
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\pythoncom26.dll
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\pywintypes26.dll
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\select.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\unicodedata.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\win32api.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\win32com.shell.shell.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\win32crypt.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\win32event.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\win32file.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\win32inet.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\win32pdh.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\win32process.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\win32security.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\windows._cacheinvalidation.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\wx._controls_.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\wx._core_.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\wx._gdi_.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\wx._html2.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\wx._misc_.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\wx._windows_.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\wx._wizard.pyd
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\wxbase293u_net_vc.dll
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\wxbase293u_vc.dll
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\wxmsw293u_adv_vc.dll
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\wxmsw293u_core_vc.dll
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\wxmsw293u_html_vc.dll
c:\users\Cameron Cook\AppData\Local\Temp\_MEI35282\wxmsw293u_webview_vc.dll
c:\users\Cameron Cook\AppData\Roaming\mIRC\logs\status.log
.
.
((((((((((((((((((((((((( Files Created from 2012-08-28 to 2012-09-29 )))))))))))))))))))))))))))))))
.
.
2012-09-29 12:49 . 2012-09-29 12:49 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-27 00:26 . 2012-09-19 07:58 9308616 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{22BA5801-8C83-4D71-8052-94E9A9072020}\mpengine.dll
2012-09-26 23:54 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-09-26 23:54 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-09-26 23:54 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-09-26 23:54 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-09-26 23:54 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-09-26 23:54 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-09-26 23:54 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-09-25 19:10 . 2012-08-21 21:01 245760 ----a-w- c:\windows\system32\OxpsConverter.exe
2012-09-24 10:54 . 2012-09-24 10:54 -------- d-----w- c:\users\Cameron Cook\AppData\Roaming\Malwarebytes
2012-09-24 10:53 . 2012-09-24 10:53 -------- d-----w- c:\programdata\Malwarebytes
2012-09-24 10:53 . 2012-09-24 10:54 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-09-24 10:53 . 2012-09-08 00:04 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-09-24 01:25 . 2012-09-24 01:25 388096 ----a-r- c:\users\Cameron Cook\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-09-24 01:25 . 2012-09-24 01:25 -------- d-----w- c:\program files (x86)\Trend Micro
2012-09-22 02:10 . 2012-09-22 02:10 -------- dc----w- C:\trans
2012-09-22 01:15 . 2012-09-22 01:15 -------- d-----w- c:\users\Cameron Cook\AppData\Roaming\ExpressFiles
2012-09-20 23:27 . 2012-09-26 11:26 -------- d-----w- c:\users\Cameron Cook\AppData\Roaming\vlc
2012-09-20 23:26 . 2012-09-20 23:26 -------- d-----w- c:\program files (x86)\VideoLAN
2012-09-19 00:19 . 2012-09-19 00:19 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2012-09-18 20:55 . 2012-09-29 01:02 -------- d-s---w- c:\users\Cameron Cook\Google Drive
2012-09-18 20:53 . 2012-09-18 20:53 -------- d-----w- c:\program files (x86)\Google
2012-09-12 20:29 . 2012-08-22 18:12 950128 ----a-w- c:\windows\system32\drivers\ndis.sys
2012-09-12 20:29 . 2012-07-04 20:26 41472 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2012-09-12 20:29 . 2012-08-02 17:58 574464 ----a-w- c:\windows\system32\d3d10level9.dll
2012-09-12 20:29 . 2012-08-02 16:57 490496 ----a-w- c:\windows\SysWow64\d3d10level9.dll
2012-09-12 20:29 . 2012-08-22 18:12 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-09-12 20:29 . 2012-08-22 18:12 376688 ----a-w- c:\windows\system32\drivers\netio.sys
2012-09-12 20:29 . 2012-08-22 18:12 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-29 12:53 . 2012-09-29 12:53 77824 ----a-w- c:\windows\KMSEmulator.exe
2012-08-31 07:43 . 2011-07-28 22:38 64462936 ----a-w- c:\windows\system32\MRT.exe
2012-08-21 09:13 . 2011-07-25 01:34 359464 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-08-21 09:13 . 2011-07-25 01:34 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-08-21 09:13 . 2011-07-25 01:34 969200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-08-21 09:13 . 2012-04-30 19:56 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2012-08-21 09:13 . 2011-07-25 01:34 71600 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-08-21 09:13 . 2011-07-25 01:34 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-08-21 09:12 . 2011-07-25 01:33 41224 ----a-w- c:\windows\avastSS.scr
2012-08-21 09:12 . 2011-07-25 01:33 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe
2012-08-21 09:12 . 2011-07-25 01:34 285328 ----a-w- c:\windows\system32\aswBoot.exe
2012-07-30 13:19 . 2012-07-30 13:19 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-18 18:15 . 2012-08-15 02:55 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-07-04 22:16 . 2012-08-15 02:55 73216 ----a-w- c:\windows\system32\netapi32.dll
2012-07-04 22:13 . 2012-08-15 02:55 59392 ----a-w- c:\windows\system32\browcli.dll
2012-07-04 22:13 . 2012-08-15 02:55 136704 ----a-w- c:\windows\system32\browser.dll
2012-07-04 21:14 . 2012-08-15 02:55 41984 ----a-w- c:\windows\SysWow64\browcli.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19 94208 ----a-w- c:\users\Cameron Cook\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19 94208 ----a-w- c:\users\Cameron Cook\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19 94208 ----a-w- c:\users\Cameron Cook\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19 94208 ----a-w- c:\users\Cameron Cook\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WhatPulse"="c:\program files (x86)\WhatPulse\WhatPulse.exe" [2010-08-09 2922496]
"WordWeb"="c:\program files (x86)\WordWeb\wweb32.exe" [2009-11-09 65216]
"Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-08-04 1353080]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17418928]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2012-09-06 15668432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-06-28 265984]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-08-10 975952]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-08-21 4282728]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-08 336384]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-30 421888]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"VMM Mode Selection"="c:\program files\HTC\ModeSelection\VMMModeSelection.exe" [2011-02-14 43520]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-08-29 1996200]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
.
c:\users\Cameron Cook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Dropbox.lnk - c:\users\Cameron Cook\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-7-24 26909544]
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2011-9-2 227712]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-15 116648]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-08 676936]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-15 116648]
R3 htcusbnet;HTC USB-NDIS miniport;c:\windows\system32\DRIVERS\htcusbnet.sys [2010-12-15 153600]
R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2010-05-14 384040]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-06-17 246376]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-07-26 1255736]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-07-08 204288]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-08 365568]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-08-21 71600]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-08-10 321104]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-06-11 868896]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-08-29 2369960]
S2 KMService;KMService;c:\windows\system32\srvany.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-08 399432]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-06-28 255744]
S2 RaAutoInstSrv_AM10;Cisco Valet Connector Service;c:\program files (x86)\Cisco Systems\Cisco Valet Connector\CiscoAdapterSvc.exe [2010-04-15 529024]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-29 243232]
S3 AM10;Cisco AM10 Driver;c:\windows\system32\DRIVERS\am10w7.sys [2010-03-23 1101600]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-07-08 9884672]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-07-08 307712]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-09-24 116752]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-08 25928]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2010-04-28 38528]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-29 c:\windows\Tasks\AutoKMS.job
- c:\windows\AutoKMS.exe [2011-11-05 09:56]
.
2012-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-18 01:00]
.
2012-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-18 01:00]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-08-21 09:11 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19 97792 ----a-w- c:\users\Cameron Cook\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19 97792 ----a-w- c:\users\Cameron Cook\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19 97792 ----a-w- c:\users\Cameron Cook\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19 97792 ----a-w- c:\users\Cameron Cook\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2012-09-06 22:51 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2012-09-06 22:51 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2012-09-06 22:51 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2012-09-06 22:51 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-06-11 861216]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-04-13 1860496]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-12-13 13374568]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://acer.msn.com
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://acer.msn.com
mStart Page = hxxp://acer.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
FF - ProfilePath - c:\users\Cameron Cook\AppData\Roaming\Mozilla\Firefox\Profiles\8h4jo96h.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/profile.php?id=740999791&ref=tn_tnmn|http://co114w.col114.mail.live.com/mail/InboxLight.aspx?n=992731797&fid=1&fav=1&mid=925f118f-9621-11e1-bbfa-00215ad9bcc2&fv=1#!/mail/InboxLight.aspx?n=566437276!n=1291749278&fid=1b8e76bf6ed04ac8a7c62a7d07324b4f|https://login.fictionpress.com/pm2/post.php?rid=375878#last|https://email.1and1.com/ox6/ox.html|http://webmail.darththebook.com/email/scripts/index.pl?EV1=1336506801364695|https://blackboard.sdsu.edu/webapps/portal/frameset.jsp?tab_tab_group_id=_2_1&url=%2Fwebapps%2Fblackboard%2Fexecute%2Flauncher%3Ftype%3DCourse%26id%3D_69859_1%26url%3D|http://my.deviantart.com/messages/#view=feedback|http://www.sea-o.net/ind.php|http://www.spaceo.net/ind.php|http://www.wattpad.com/user/Lammalord|http://www.wattpad.com/user/Mr_Aek|http://www.youtube.com/watch?v=4HSBWSoMna8&feature=BFa&list=PL3A8E1A8B5D75A87F
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
HKLM-Run-mwlDaemon - c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-WildTangentGDF-acer-clubpenguin - c:\program files (x86)\Acer Games\Web Link - Club Penguin\Uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@Allowed: (B 1 4 5 6) (S-1-5-5-0-129173)
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@Allowed: (B 1 4 5 6) (S-1-5-5-0-129173)
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\SysWOW64\srvany.exe
c:\windows\KMService.exe
c:\windows\SysWOW64\UTSCSI.EXE
.
**************************************************************************
.
Completion time: 2012-09-29 06:01:16 - machine was rebooted
ComboFix-quarantined-files.txt 2012-09-29 13:01
.
Pre-Run: 32,855,494,656 bytes free
Post-Run: 34,109,882,368 bytes free
.
- - End Of File - - 318CAFEFB0FBD2BA9631B7EE3FBA525F


Edited by Lammalord, 29 September 2012 - 07:18 AM.

  • 0

#7
Gammo
Posted 30 September 2012 - 05:53 AM

Gammo

    Member 2k

  • Malware Removal
  • 2,299 posts
Your logs appear to be clean now. There is only a bit of cleanup that we will deal with in this post, as well as prevention from future infections. ^_^

If the problem comes back, I suggest you start a new topic here: http://www.geekstogo...-and-windows-7/ , since it's probably not caused by malware then.

Remove Combofix now that we're done with it.
  • Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
  • Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
    Posted Image
  • Please follow the prompts to uninstall Combofix.
  • You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Keep a backup of your important files
Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Make proper use of your anti-virus and firewall
You should keep your anti-virus and firewall guard enabled at all times, don't shut them off unless there's a specific reason to do so.

Also, regularly performing a full system scan with your anti-virus program is a good idea to make sure nothing has slipped through your protection. Once every two weeks works well for many people. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.

Keep in mind that anti-virus programs are far from perfect. They don't protect you against every piece of malware that's out there, so don't trust them blindly. If an anti-virus reports a file as 'clean' then it's doesn't necessarily has to mean it is.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Keep all your software updated
It is important to keep up on system updates from Microsoft by regularly checking their website at: http://windowsupdate.microsoft.com/, as these patch critical security vulnerabilities and help to keep you safe.

It's also important to keep programs up to date so that malware doesn't exploit any old security flaws. FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Java and Adobe Reader are two of the main security vulnerabilities. You can find the latest version of Java here, you will want the Java SE Runtime Environment (JRE) one. You can find the latest version of Adobe Reader here.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Use a safer web browser
Internet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a couple good free alternatives: Google Chrome and Opera. Both are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these.

The WOT add-on will nicely help to enhance your security, no matter which web browser you use. This add-on tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Some other security programs

It is wise these days to have a few security programs installed and running on your machine except from just an anti-virus and a firewall. I will list some of them.
  • A good anti-spyware program installed on your pc is very important to help remove any spyware that may have gotten on your computer. I highly recommend Malwarebytes' Anti-Malware.
  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. This prevents your computer from connecting to those sites in the future.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Be careful
Having security programs installed is very helpful to you, but none of them have the gift of human thought. The best way to make sure you don't get infected is to exercise common sense. Be careful of what websites you visit - if a site looks suspicious, trust your instincts and get out of there. Be careful of what attachments you open in emails and files you download from websites - check them over carefully to make sure that you know what you're getting.

Using peer-to-peer programs (eg: LimeWire, BitTorrent, uTorrent, Kazaa) or downloading cracks and keygens is something else to avoid. These are the most common way to get infected. Malware writers use these programs to spread infections as it is the easiest way for them. The majority of infections we see in the Malware Removal forum are due to people using p2p programs to download cracks/keygens/warez. These are not only illegal, but will always contain some form of malware. You have no way of verifying that the things you download are legitimate or that they don't contain malware. Even with an up to date anti-virus and firewall, some of these things will still infect you. It is highly recommend that you uninstall all peer-to-peer programs. It just isn't worth it.

Other common ways of getting infected are dis-reputable sites forcing you to download and install a codec. Or viruses using Instant Messaging programs (Windows Live Messenger, MSN Messenger, AIM) to send a file claiming it to be "photos" from a friend, only for it to turn out to be a virus.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Slow computer?
If your computer begins to slow down in the future for no particular reason, your first step should not be to come to the malware forum. As your computer ages and is used, it's parts wear, files and programs accumulate, and its performance can decrease. To restore your computer's performance to its best possible level, follow the steps in this page written by malware expert Miekiemoes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I'll leave this thread open for a couple days in case you come across any lingering problems that need fixing, then I'll close it up. If you need it reopened for any reason just shoot me a PM. It's been a pleasure working with you, now best of luck!

Cheers,
Gammo :cool:
  • 0

#8
Lammalord
Posted 30 September 2012 - 06:19 AM

Lammalord

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Thank you so much for the help - do you think it was even malware? I get the feeling it was overheating due to the video converter - maybe the CPU going out... I mean I didn't see anything in the scans and the clean up cleared a few broken reg keys and deleted the temp files....
  • 0

#9
Gammo
Posted 30 September 2012 - 10:29 AM

Gammo

    Member 2k

  • Malware Removal
  • 2,299 posts
I didn't see malware in any of your logs, so I don't think malware was the cause. :)
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP