Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

the sound is stuttering and sometimes its lagging [Solved]

Started by frichieny , Dec 08 2013 07:23 AM

This topic is locked

#1
frichieny

Posted 08 December 2013 - 07:23 AM

Member

Member
192 posts

Most of the the time this laptop is lagging

and its sound is stuttering

OTL logfile created on: 12/8/2013 9:15:13 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ACER\Desktop\Fix
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16721)
Locale: 00003409 | Country: Republic of the Philippines | Language: ENP | Date Format: M/d/yyyy

3.84 Gb Total Physical Memory | 2.18 Gb Available Physical Memory | 56.82% Memory free
15.49 Gb Paging File | 13.59 Gb Available in Paging File | 87.71% Paging File free
Paging file location(s): c:\pagefile.sys 8000 8000d:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 226.28 Gb Total Space | 67.04 Gb Free Space | 29.63% Space Free | Partition Type: NTFS
Drive D: | 226.38 Gb Total Space | 107.74 Gb Free Space | 47.59% Space Free | Partition Type: NTFS

Computer Name: ACER-PC | User Name: ACER | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/12/08 21:14:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ACER\Desktop\Fix\OTL.exe
PRC - [2013/12/04 14:12:03 | 005,830,960 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\BBTalk.exe
PRC - [2013/11/21 19:27:38 | 009,890,608 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe
PRC - [2013/10/09 10:58:16 | 003,275,136 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2013/09/18 12:51:02 | 000,106,472 | ---- | M] (Razer Inc.) -- D:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe
PRC - [2013/08/07 17:42:30 | 004,308,320 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
PRC - [2013/07/26 14:17:46 | 000,049,456 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\ggdllhost.exe
PRC - [2012/07/26 19:40:56 | 000,794,560 | ---- | M] (Spigot, Inc.) -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
PRC - [2012/03/23 17:33:48 | 000,419,408 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMutilps32.exe
PRC - [2012/03/23 17:33:46 | 000,355,920 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2012/03/23 17:33:46 | 000,343,632 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2012/02/29 21:49:06 | 000,028,264 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
PRC - [2012/02/07 18:03:36 | 000,363,800 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2012/02/07 18:03:34 | 000,277,784 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2012/02/07 18:03:28 | 000,128,280 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
PRC - [2012/02/07 18:03:16 | 000,161,560 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
PRC - [2012/02/07 08:54:04 | 000,255,376 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe
PRC - [2012/01/18 19:37:32 | 000,072,864 | ---- | M] (Atheros) -- C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe
PRC - [2012/01/06 05:22:10 | 000,256,536 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
PRC - [2011/11/30 11:04:56 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2009/12/02 22:23:38 | 000,209,768 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2009/12/02 22:23:32 | 000,483,688 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

========== Modules (No Company Name) ==========

MOD - [2013/12/04 14:23:27 | 000,027,952 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\VersionModule.dll
MOD - [2013/12/04 14:12:14 | 000,022,832 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\VersionModule.dll
MOD - [2013/12/04 14:12:03 | 005,830,960 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\BBTalk.exe
MOD - [2013/11/21 19:28:19 | 000,896,304 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\Plugins\ggplugin.dll
MOD - [2013/11/21 19:27:38 | 009,890,608 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe
MOD - [2013/11/21 18:56:11 | 000,864,048 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\UILib.dll
MOD - [2013/11/21 18:55:59 | 002,363,696 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\Overlay.dll
MOD - [2013/11/21 18:55:59 | 000,041,776 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lollauncher.dll
MOD - [2013/11/21 18:55:56 | 000,382,256 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\ImageModule.dll
MOD - [2013/11/21 18:55:55 | 000,799,024 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\gagmhook.dll
MOD - [2013/11/21 18:55:54 | 000,033,072 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\DibModule.dll
MOD - [2013/11/07 16:00:32 | 000,110,896 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\UILayout.dll
MOD - [2013/10/13 05:59:33 | 013,584,776 | ---- | M] () -- C:\Users\ACER\AppData\Local\Google\Chrome\User Data\PepperFlash\11.9.900.117\pepflashplayer.dll
MOD - [2013/10/03 14:03:05 | 000,415,184 | ---- | M] () -- C:\Users\ACER\AppData\Local\Google\Chrome\Application\30.0.1599.69\ppGoogleNaClPluginChrome.dll
MOD - [2013/10/03 14:03:03 | 004,055,504 | ---- | M] () -- C:\Users\ACER\AppData\Local\Google\Chrome\Application\30.0.1599.69\pdf.dll
MOD - [2013/10/03 14:02:12 | 000,698,832 | ---- | M] () -- C:\Users\ACER\AppData\Local\Google\Chrome\Application\30.0.1599.69\libglesv2.dll
MOD - [2013/10/03 14:02:11 | 000,099,792 | ---- | M] () -- C:\Users\ACER\AppData\Local\Google\Chrome\Application\30.0.1599.69\libegl.dll
MOD - [2013/10/03 14:02:09 | 001,604,560 | ---- | M] () -- C:\Users\ACER\AppData\Local\Google\Chrome\Application\30.0.1599.69\ffmpegsumo.dll
MOD - [2013/09/20 19:12:15 | 000,956,208 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\delay_load\GaFileTransfer.dll
MOD - [2013/09/20 19:11:57 | 000,397,104 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\Plugins\GarenaTalkPlugin.dll
MOD - [2013/09/05 17:12:02 | 000,215,856 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\Plugins\GameSalePlugin.dll
MOD - [2013/09/05 17:01:17 | 000,046,896 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\InputHookLib.dll
MOD - [2013/09/05 17:01:14 | 000,108,848 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\AudioMixerLib.dll
MOD - [2013/09/05 17:01:08 | 000,066,864 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\InputHook.dll
MOD - [2013/08/23 17:10:18 | 000,553,776 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\ggspawn.dll
MOD - [2013/08/23 16:24:48 | 000,089,904 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\audiohost.dll
MOD - [2013/08/06 19:01:23 | 000,236,848 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\Plugins\PluginNews.dll
MOD - [2013/08/06 19:01:19 | 000,287,024 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\Plugins\DailyTaskPlugin.dll
MOD - [2013/08/06 18:27:51 | 000,055,600 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\XmlUIModule.dll
MOD - [2013/08/06 18:27:44 | 000,077,104 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\FileManager.dll
MOD - [2013/07/26 14:18:44 | 000,194,864 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\xim\plugin_yahoo.dll
MOD - [2013/07/26 14:18:42 | 000,460,592 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\xim\plugin_xmpp.dll
MOD - [2013/07/26 14:18:40 | 000,587,400 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\xim\plugin_msn.dll
MOD - [2013/07/26 14:18:40 | 000,170,800 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\fs\YYFileSystem.dll
MOD - [2013/07/26 14:18:40 | 000,068,400 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\delay_load\UdtLib.dll
MOD - [2013/07/26 14:18:38 | 000,516,912 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\delay_load\RSALib.dll
MOD - [2013/07/26 14:18:38 | 000,245,040 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\delay_load\MediaEngine.dll
MOD - [2013/07/26 14:18:36 | 001,545,520 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\delay_load\FileSender.dll
MOD - [2013/07/26 14:18:32 | 000,065,840 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\delay_load\AudioMixerLib.dll
MOD - [2013/07/26 14:18:32 | 000,055,088 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\XmlUIModule.dll
MOD - [2013/07/26 14:18:32 | 000,013,960 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\delay_load\ClientTcp.dll
MOD - [2013/07/26 14:18:30 | 000,957,232 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\XLL.dll
MOD - [2013/07/26 14:18:30 | 000,106,288 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\UILayout.dll
MOD - [2013/07/26 14:18:28 | 000,219,952 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\TaskManagerLib.dll
MOD - [2013/07/26 14:18:18 | 000,184,624 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\MP3Module.dll
MOD - [2013/07/26 14:18:16 | 000,374,064 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lib\Http.dll
MOD - [2013/07/26 14:18:14 | 000,224,560 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\Plugins\StatsPlugin.dll
MOD - [2013/07/26 14:18:14 | 000,098,608 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\Plugins\PlatformPlugin.dll
MOD - [2013/07/26 14:18:08 | 000,133,936 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\Plugins\ClanBoxPlugin.dll
MOD - [2013/07/26 14:18:06 | 000,147,248 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\xIM.dll
MOD - [2013/07/26 14:18:04 | 000,087,344 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\PluginKernel.dll
MOD - [2013/07/26 14:18:04 | 000,025,392 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\PluginModule.dll
MOD - [2013/07/26 14:18:04 | 000,023,688 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\ServerMemAlloc.dll
MOD - [2013/07/26 14:18:02 | 000,155,440 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\libmpg123.dll
MOD - [2013/07/26 14:18:00 | 000,192,816 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\ImageModule.dll
MOD - [2013/07/26 14:17:54 | 002,941,232 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\ggdownloader.dll
MOD - [2013/07/26 14:17:52 | 000,051,504 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\FileLoader.dll
MOD - [2013/07/26 14:17:50 | 000,487,216 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\CxImage.dll
MOD - [2013/07/26 14:17:50 | 000,033,584 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\DibModule.dll
MOD - [2013/07/26 14:17:48 | 000,104,752 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\CommonLib.dll
MOD - [2013/07/26 14:17:46 | 000,049,456 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\ggdllhost.exe
MOD - [2013/07/26 13:55:42 | 000,137,520 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\UdpClient.dll
MOD - [2013/07/26 13:55:42 | 000,134,960 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\MessagePumpLib.dll
MOD - [2013/07/26 13:55:42 | 000,127,792 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\TcpClient.dll
MOD - [2013/07/26 13:55:42 | 000,056,112 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\ResLib.dll
MOD - [2013/07/26 13:55:42 | 000,030,512 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\MP3Saver.dll
MOD - [2013/07/26 13:55:40 | 000,055,600 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\LangLib.dll
MOD - [2013/07/26 13:55:40 | 000,041,776 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\IPCLib.dll
MOD - [2013/07/26 13:55:38 | 000,424,752 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\exchndl.dll
MOD - [2013/07/26 13:55:38 | 000,374,064 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\Http.dll
MOD - [2013/07/26 13:55:38 | 000,030,000 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\lib\ChannelUrlDll.dll
MOD - [2013/07/26 13:55:34 | 000,448,160 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\sqlite3.dll
MOD - [2013/07/26 13:55:34 | 000,099,120 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\PngModule.dll
MOD - [2013/07/26 13:55:34 | 000,063,280 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\PluginKernel.dll
MOD - [2013/07/26 13:55:32 | 000,238,384 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\libmp3lame.dll
MOD - [2013/07/26 13:55:30 | 000,053,040 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\FileSystem.dll
MOD - [2013/07/26 13:55:28 | 000,104,240 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\bbtalk\CommonLib.dll
MOD - [2013/02/01 13:42:28 | 000,153,088 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\libzmq.dll
MOD - [2012/02/22 16:52:18 | 000,162,304 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\lame_enc.dll
MOD - [2012/02/22 16:52:16 | 000,573,100 | ---- | M] () -- C:\Program Files (x86)\Garena Plus\sqlite3.dll
MOD - [2011/03/17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2010/10/20 15:45:26 | 008,801,120 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll

========== Services (SafeList) ==========

SRV:64bit: - [2013/05/27 13:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2012/10/30 19:10:50 | 000,230,416 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe -- (NitroReaderDriverReadSpool3)
SRV:64bit: - [2012/02/08 08:53:48 | 000,871,296 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV:64bit: - [2012/02/07 08:54:04 | 000,255,376 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Live Updater Service)
SRV:64bit: - [2012/02/03 13:29:52 | 000,628,448 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel®
SRV:64bit: - [2010/09/23 09:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2013/10/09 10:58:16 | 003,275,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2013/10/09 05:06:59 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/09/18 12:51:02 | 000,106,472 | ---- | M] (Razer Inc.) [Auto | Running] -- D:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe -- (RzKLService)
SRV - [2013/09/07 04:55:40 | 000,565,672 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013/09/05 10:34:30 | 000,171,680 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/09/03 02:38:28 | 000,759,192 | ---- | M] (Tunngle.net GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe -- (TunngleService)
SRV - [2013/08/13 01:36:14 | 005,728,920 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2013/08/07 17:42:30 | 004,308,320 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe -- (TeamViewer8)
SRV - [2013/05/23 19:32:08 | 000,632,352 | ---- | M] (Disc Soft Ltd) [On_Demand | Stopped] -- D:\DAEMON Tools Ultra\DiscSoftBusService.exe -- (Disc Soft Bus Service)
SRV - [2013/04/18 11:06:42 | 000,737,616 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2013/03/22 10:14:30 | 000,279,024 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)
SRV - [2013/01/18 17:10:18 | 000,577,536 | ---- | M] (Research In Motion Limited) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe -- (Blackberry Device Manager)
SRV - [2012/09/11 21:24:17 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/07/26 19:40:56 | 000,794,560 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2012/07/09 00:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2012/05/18 19:38:59 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2012/04/24 14:37:56 | 000,169,752 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe -- (ICCS)
SRV - [2012/03/23 17:33:46 | 000,355,920 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2012/02/29 21:49:06 | 000,028,264 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2012/02/07 18:03:36 | 000,363,800 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2012/02/07 18:03:34 | 000,277,784 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2012/02/07 18:03:28 | 000,128,280 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe -- (Intel®
SRV - [2012/02/07 18:03:16 | 000,161,560 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe -- (jhi_service)
SRV - [2012/01/18 19:37:32 | 000,072,864 | ---- | M] (Atheros) [Auto | Running] -- C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe -- (ZAtheros Wlan Agent)
SRV - [2012/01/06 05:22:10 | 000,256,536 | ---- | M] (NTI Corporation) [Auto | Running] -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2011/11/30 11:04:56 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2011/06/07 03:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2009/12/02 22:23:38 | 000,209,768 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2009/12/02 22:23:32 | 000,483,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2009/06/11 05:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2013/08/29 09:29:52 | 000,033,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2013/06/18 17:53:56 | 000,029,696 | ---- | M] (Disc Soft Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dtscsibus.sys -- (dtscsibus)
DRV:64bit: - [2013/03/12 15:10:52 | 000,342,528 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2013/03/08 19:10:18 | 005,358,016 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2013/01/23 10:31:52 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys -- (nmwcdnsux64)
DRV:64bit: - [2013/01/23 10:31:52 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)
DRV:64bit: - [2013/01/23 10:31:52 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)
DRV:64bit: - [2013/01/23 10:31:52 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdnsucx64.sys -- (nmwcdnsucx64)
DRV:64bit: - [2013/01/23 10:31:52 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)
DRV:64bit: - [2013/01/23 10:31:52 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev)
DRV:64bit: - [2013/01/11 03:44:02 | 000,042,184 | ---- | M] (Anchorfree Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss6.sys -- (taphss6)
DRV:64bit: - [2012/12/10 15:48:02 | 000,044,544 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2012/12/09 17:51:20 | 000,126,944 | ---- | M] (Power Software Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\scdemu.sys -- (SCDEmu)
DRV:64bit: - [2012/10/17 14:53:46 | 000,026,112 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2012/09/28 10:32:56 | 000,053,760 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012/08/23 22:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012/08/23 22:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012/08/23 22:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012/08/02 02:13:40 | 000,038,632 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2012/07/17 18:12:08 | 000,062,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2012/03/16 21:02:54 | 000,685,672 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2012/03/01 14:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/02/14 12:33:08 | 000,412,944 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2012/02/14 12:33:02 | 000,022,800 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Smb_driver.sys -- (SmbDrv)
DRV:64bit: - [2012/02/07 14:03:06 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2012/02/07 14:03:06 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2012/02/01 17:06:18 | 000,292,968 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsBaStor.sys -- (RSBASTOR)
DRV:64bit: - [2012/01/20 15:31:14 | 002,801,664 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2011/11/30 10:40:32 | 000,568,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011/07/14 13:35:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/07/14 13:35:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/03/31 19:36:18 | 000,257,672 | ---- | M] (SHADOWDEFENDER.COM) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\diskpt.sys -- (diskpt)
DRV:64bit: - [2011/02/12 05:23:34 | 000,035,344 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\npf.sys -- (npf)
DRV:64bit: - [2010/11/21 11:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/12/02 22:23:38 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2009/12/02 22:23:34 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2009/12/02 22:23:32 | 000,269,672 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2009/12/02 22:23:26 | 000,721,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2009/09/16 07:02:42 | 000,031,232 | ---- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901t.sys -- (tap0901t)
DRV:64bit: - [2009/07/14 09:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 09:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 09:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/14 09:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\svchost.exe -- (1394hub)
DRV:64bit: - [2009/07/14 08:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009/06/11 04:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/11 04:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/11 04:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/11 04:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008/09/26 18:02:36 | 000,115,328 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009/07/14 09:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {7F4EFF06-7032-458e-AE16-1C1D8255C28A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}: "URL" = http://search.speedb...q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
IE - HKCU\..\SearchScopes,DefaultScope = {CF739809-1C6C-47C0-85B9-569DBB141420}
IE - HKCU\..\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}: "URL" = http://search.speedb...q={searchTerms}
IE - HKCU\..\SearchScopes\{952E4CB2-FD69-49DF-B1AE-449C2FA85DB2}: "URL" = http://ph.search.yah...p={searchTerms}
IE - HKCU\..\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}: "URL" = http://toolbar.ask.c...rm=1&toolbar=PD
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaultenginename,S: S", ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: "http://search.speedb...spx?s=CAMe0&q="
FF - prefs.js..browser.search.order.1: "Speedbit Search"
FF - prefs.js..browser.search.order.1,S: S", ""
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&ilc=12&type=937811"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.selectedEngine,S: S", ""
FF - prefs.js..extensions.enabledAddons: [email protected]:6.2
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: ""

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF - HKLM\Software\MozillaPlugins\@nokia.com/EnablerPlugin: C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF - HKLM\Software\MozillaPlugins\@nullsoft.com/winampDetector;version=1: C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.6.14: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.6.14: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.6.14: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@t.garena.com/garenatalk: C:\Program Files (x86)\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll ( Garena)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\ACER\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ACER\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ACER\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\ACER\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Trials Evolution Gold Edition\datapack\orbit\npuplaypc.dll (Ubisoft)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\PROGRAM FILES\ESET\ESET SMART SECURITY\MOZILLA THUNDERBIRD
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\SearchPredict\PRFireFox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}: C:\Program Files (x86)\SPEEDbit Video Downloader\SPFireFox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/10/22 22:11:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/07/23 00:40:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

[2012/08/19 01:49:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ACER\AppData\Roaming\mozilla\Extensions
[2013/11/06 09:48:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\sjehkmhg.default\extensions
[2013/02/09 19:34:16 | 000,000,000 | ---D | M] (Browse2save) -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\sjehkmhg.default\extensions\[email protected]
[2012/10/22 22:11:28 | 000,002,543 | ---- | M] () -- C:\Users\ACER\AppData\Roaming\mozilla\firefox\profiles\sjehkmhg.default\searchplugins\speedbit.xml
[2013/09/16 11:07:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/10/15 13:15:46 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/09/16 11:07:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/10/15 13:15:46 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/01/30 16:28:16 | 000,000,000 | ---D | M] (Widgi Toolbar Platform) -- C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT\WTXPCOM
[2012/09/11 21:24:17 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/09/01 02:30:11 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/09/01 02:30:11 | 000,002,253 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\ACER\AppData\Local\Google\Chrome\Application\30.0.1599.69\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\ACER\AppData\Local\Google\Chrome\Application\30.0.1599.69\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\ACER\AppData\Local\Google\Chrome\Application\30.0.1599.69\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL
CHR - plugin: RIM Handheld Application Loader (Enabled) = C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll
CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll
CHR - plugin: Java™ Platform SE 7 U9 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll
CHR - plugin: Nitro PDF plugin for Firefox and Chrome (Enabled) = C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: RealPlayer Download Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\ACER\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\ACER\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll
CHR - plugin: Java Deployment Toolkit 7.0.90.5 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - plugin: Garena Talk Plugin (Enabled) = D:\GarenaLoLPH\GameData\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll
CHR - Extension: Google Docs = C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: AdBlock = C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.16_0\
CHR - Extension: Domain Error Assistant = C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Default\Extensions\icdlfehblmklkikfigmjhbmmpmkmpooj\1.1_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Skype Click to Call = C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.13.0.13771_0\
CHR - Extension: Savings-Slider = C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk\2.1_0\
CHR - Extension: Google Wallet = C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\
CHR - Extension: Gmail = C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/10/10 04:51:12 | 000,000,975 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 genuine.microsoft.com
O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com
O1 - Hosts: 127.0.0.1 sls.microsoft.com
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (no name) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (YTD Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - Reg Error: Value error. File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (YTD Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Driver Genius] File not found
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [f.lux] C:\Users\ACER\AppData\Local\FluxSoftware\Flux\flux.exe (Flux Software LLC)
O4 - HKCU..\Run: [GarenaPlus] C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe ()
O4 - HKCU..\Run: [iFunBoxConnector] C:\Users\ACER\Desktop\ifunbox.2.1\ifunbox.win\ifb_conn.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun: NoDriveTypeAutoRun = 177
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 177
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: facebook.com ([www] https in Trusted sites)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.25.2)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A566B065-6785-4CB3-8B6E-34F5EF2637B9}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FE06C52A-CEDA-4C18-A715-C4FF2CBE9174}: DhcpNameServer = 7.254.254.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0d829048-f81a-11e1-8c9c-047d7b9db037}\Shell - "" = AutoRun
O33 - MountPoints2\{0d829048-f81a-11e1-8c9c-047d7b9db037}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{0d82904c-f81a-11e1-8c9c-047d7b9db037}\Shell - "" = AutoRun
O33 - MountPoints2\{0d82904c-f81a-11e1-8c9c-047d7b9db037}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{636eef1a-d7d0-11e2-a32d-047d7b9db037}\Shell - "" = AutoRun
O33 - MountPoints2\{636eef1a-d7d0-11e2-a32d-047d7b9db037}\Shell\AutoRun\command - "" = G:\Setup.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/12/08 21:14:40 | 000,000,000 | ---D | C] -- C:\Users\ACER\Desktop\Fix
[2013/12/05 04:02:10 | 000,000,000 | ---D | C] -- C:\Users\ACER\Documents\SavedGames
[2013/12/05 04:02:10 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Roaming\Rogue Legacy
[2013/12/05 03:55:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\(Default)
[2013/12/03 13:05:16 | 000,000,000 | ---D | C] -- C:\Users\ACER\Desktop\MicroCraft_v1.0.1.1
[2013/12/01 10:13:26 | 000,000,000 | ---D | C] -- C:\Users\ACER\Desktop\Attachments_2013121
[2013/11/24 21:27:49 | 000,000,000 | ---D | C] -- C:\Users\ACER\Desktop\Terraria Halloween Patch
[2013/11/22 09:05:27 | 000,000,000 | ---D | C] -- C:\ProgramData\VirtualizedApplications
[2013/11/21 20:00:25 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Local\SoftGrid Client
[2013/11/21 20:00:24 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Roaming\SoftGrid Client
[2013/11/21 20:00:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Starter (English)
[2013/11/21 19:59:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Application Virtualization Client
[2013/11/21 19:59:19 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Roaming\TP
[2013/11/14 14:12:17 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Flux
[2013/11/14 14:12:15 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Local\FluxSoftware
[2013/11/14 04:52:10 | 000,000,000 | ---D | C] -- C:\Users\ACER\Desktop\NVC

========== Files - Modified Within 30 Days ==========

[2013/12/08 20:50:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/12/08 20:50:33 | 3092,533,248 | -HS- | M] () -- C:\hiberfil.sys
[2013/12/08 14:21:52 | 000,431,928 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/12/05 03:55:31 | 000,000,577 | ---- | M] () -- C:\Users\ACER\Desktop\Rogue Legacy.lnk
[2013/12/02 14:13:57 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/12/02 14:13:57 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/12/02 09:21:56 | 000,785,826 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/12/02 09:21:56 | 000,669,400 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/12/02 09:21:56 | 000,127,256 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/12/01 22:29:41 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/12/01 22:29:41 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/11/28 07:22:42 | 000,058,198 | ---- | M] () -- C:\Users\ACER\Desktop\559359_474476339238342_71720370_n.jpg
[2013/11/27 20:08:41 | 000,045,270 | ---- | M] () -- C:\Users\ACER\AppData\Roaming\room_v3.dat
[2013/11/24 21:37:22 | 000,001,216 | ---- | M] () -- C:\Users\ACER\Desktop\Terraria.lnk
[2013/11/22 05:37:47 | 000,011,342 | ---- | M] () -- C:\Users\ACER\AppData\Local\recently-used.xbel
[2013/11/21 19:59:59 | 000,794,218 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013/11/21 07:18:02 | 000,901,655 | ---- | M] () -- C:\Users\ACER\Desktop\Chia-Hung_Chen_Thesis.pdf
[2013/11/20 18:45:34 | 000,189,916 | -H-- | M] () -- C:\Windows\SysWow64\mlfcache.dat
[2013/11/19 03:23:45 | 000,000,606 | ---- | M] () -- C:\Users\Public\Desktop\LOL Recorder.lnk
[2013/11/13 07:54:14 | 000,090,831 | ---- | M] () -- C:\Users\ACER\Desktop\mnl2013644011 - std p4 app (24jun2013).pdf

========== Files Created - No Company Name ==========

[2013/12/08 14:21:23 | 000,431,928 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/12/05 03:55:31 | 000,000,577 | ---- | C] () -- C:\Users\ACER\Desktop\Rogue Legacy.lnk
[2013/11/28 07:22:41 | 000,058,198 | ---- | C] () -- C:\Users\ACER\Desktop\559359_474476339238342_71720370_n.jpg
[2013/11/27 20:08:41 | 000,045,270 | ---- | C] () -- C:\Users\ACER\AppData\Roaming\room_v3.dat
[2013/11/24 21:37:22 | 000,001,216 | ---- | C] () -- C:\Users\ACER\Desktop\Terraria.lnk
[2013/11/22 05:37:47 | 000,011,342 | ---- | C] () -- C:\Users\ACER\AppData\Local\recently-used.xbel
[2013/11/21 07:18:02 | 000,901,655 | ---- | C] () -- C:\Users\ACER\Desktop\Chia-Hung_Chen_Thesis.pdf
[2013/11/13 08:02:33 | 000,090,831 | ---- | C] () -- C:\Users\ACER\Desktop\mnl2013644011 - std p4 app (24jun2013).pdf
[2013/10/30 21:51:13 | 000,189,916 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2013/10/10 04:51:14 | 000,002,048 | ---- | C] () -- C:\Windows\SysWow64\winver.exe
[2013/09/12 08:23:31 | 000,000,037 | -HS- | C] () -- C:\Users\ACER\AppData\Local\20986331705021ca58edc424.96250074
[2013/06/23 12:17:40 | 000,007,603 | ---- | C] () -- C:\Users\ACER\AppData\Local\resmon.resmoncfg
[2013/03/08 19:10:10 | 000,064,512 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2013/03/08 19:06:46 | 000,963,452 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng600.bin
[2013/03/08 19:06:46 | 000,272,928 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng600.bin
[2013/01/28 22:54:53 | 000,000,034 | ---- | C] () -- C:\Windows\userini.ini
[2013/01/16 19:53:22 | 000,707,354 | ---- | C] () -- C:\Windows\unins000.exe
[2013/01/16 19:53:22 | 000,001,529 | ---- | C] () -- C:\Windows\unins000.dat
[2013/01/12 23:14:38 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2012/11/02 22:00:18 | 000,000,173 | ---- | C] () -- C:\Users\ACER\.bastetrc
[2012/11/02 19:16:28 | 000,000,927 | ---- | C] () -- C:\Users\ACER\.bastetscores
[2012/10/22 22:06:42 | 000,109,256 | ---- | C] () -- C:\Windows\SysWow64\EasyHook64.dll
[2012/10/22 22:06:42 | 000,090,824 | ---- | C] () -- C:\Windows\SysWow64\EasyHook32.dll
[2012/09/06 20:36:02 | 000,794,218 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/08/18 16:58:13 | 000,000,000 | ---- | C] () -- C:\Windows\diskpt.dat
[2012/05/03 06:02:22 | 000,963,912 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2012/05/03 06:02:21 | 000,261,208 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2012/05/03 06:02:18 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2012/02/03 13:08:26 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll

========== ZeroAccess Check ==========

[2009/07/14 12:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/07/26 10:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/07/26 09:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 09:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 11:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 09:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2013/08/15 02:01:04 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\.minecraft
[2013/01/27 12:37:21 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\asoftech
[2013/06/18 17:54:54 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\DAEMON Tools Ultra
[2012/11/21 22:59:21 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\DMCache
[2013/01/26 12:48:46 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\Doublefine
[2013/07/23 00:42:41 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\DRPSu
[2013/06/16 19:50:19 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\ESET
[2013/01/04 17:28:32 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\FileOpen
[2013/01/03 18:42:16 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\FreemakeVideoDownloader
[2012/11/08 10:17:26 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\Garena
[2013/12/08 20:53:50 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\GarenaPlus
[2012/11/23 15:42:31 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\IDM
[2013/08/28 21:16:00 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\iFunbox_UserCache
[2013/09/12 08:23:31 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\Letasoft
[2012/08/18 15:44:29 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\LolClient
[2013/01/04 17:28:32 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\Nitro
[2013/12/08 08:34:55 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\Nitro PDF
[2013/01/28 23:06:21 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\Nokia
[2013/01/03 18:39:57 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\OpenCandy
[2013/02/08 21:08:06 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\Optimizer Pro
[2013/01/27 14:40:18 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\PandoraRecovery
[2013/11/02 01:54:14 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\PC Suite
[2013/03/16 23:48:24 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\PhotoScape
[2013/01/15 16:37:18 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\PowerISO
[2013/06/15 01:37:25 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\Research In Motion
[2013/12/07 12:35:31 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\Rogue Legacy
[2012/10/22 22:19:11 | 000,000,000 | -H-D | M] -- C:\Users\ACER\AppData\Roaming\RPPrivate
[2012/08/05 14:52:22 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\Screensaver
[2012/08/18 17:02:37 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\Shadow Defender
[2013/12/08 10:09:29 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\SoftGrid Client
[2013/10/13 13:30:16 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\TeamViewer
[2013/11/21 20:00:36 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\TP
[2013/09/16 01:00:39 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\Tunngle
[2013/05/02 23:48:00 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\Unity
[2013/12/08 11:56:58 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\uTorrent
[2013/08/18 13:41:07 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\WindSolutions
[2012/12/07 19:37:19 | 000,000,000 | ---D | M] -- C:\Users\ACER\AppData\Roaming\xim

========== Purity Check ==========

========== Files - Unicode (All) ==========
[2013/01/03 19:13:20 | 013,958,731 | ---- | M] ()(C:\Users\ACER\Desktop\PSY - GANGNAM STYLE (?????) M_V.3gp) -- C:\Users\ACER\Desktop\PSY - GANGNAM STYLE (강남스타일) M_V.3gp
[2013/01/03 19:10:47 | 013,958,731 | ---- | C] ()(C:\Users\ACER\Desktop\PSY - GANGNAM STYLE (?????) M_V.3gp) -- C:\Users\ACER\Desktop\PSY - GANGNAM STYLE (강남스타일) M_V.3gp

========== Alternate Data Streams ==========

@Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:373E1720
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:862BDB1A

< End of report >

#2
godawgs

Posted 08 December 2013 - 01:49 PM

Teacher

Retired Staff
8,228 posts

Hello frichieny, :wave:

Welcome to the forums!
:welcome:

. My name is godawgs and I will be assisting you with your Virus / Malware issues.
I will start working on your Malware issues. This may, or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for this issue on this machine!

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.
If you have not, please adhere to the guidelines below and then carefully follow all future instructions:

You must reply to posts within four days. If you haven't replied within that time, the topic will be closed! If you need additional time to complete things, just let me know.
If you're not sure, or if something unexpected happens, Do NOT continue! Stop and ask!

This board can notify you when a new reply is added to a topic. Please read this topic to find out how to do that.

Please do not run any tools unless instructed to do so.

We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability. Do as the instructions ask, nothing extra. Do Not run things twice unless instructed.
Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
If I ask a Question just answer it, don't run anything unless directed to.

Please read every post completely before doing anything.

Pay special attention to the NOTE: lines, or anything in red. These entries identify an individual issue or important step in the cleanup process.
Please make sure you are saving and printing the instructions out prior to each fix, this way you will have them on hand just in case you are unable to access this site. Some of the steps I will be asking you to do may require you to boot into Safe Mode and this process will be much easier for you to perform if the instructions are printed out for you to follow.
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post unless directed otherwise.

Logs from malware diagnostic or removal programs (OTL is one of them) can take some time to analyze.

I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forum, (sometimes )
Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.

Lastly, Please be aware that removing Malware is a hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. Some infections are so severe that we might encounter situations where the only recourse is to re-format and re-install your operating system. Don't worry, this only happens in severe cases, but, sadly, it does happen.
In light of this be prepared to back up your data. Have means of backing up your data available.

IMPORTANT:Change your browser(s) to download any tools to the desktop.
Follow the directions here
For FireFox check the dot beside "Always ask me where to save files."
For Chrome, check the box beside "Ask where to save each file before downloading"
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

When OTL runs the first time it creates a file named Extras.txt. It should be in the same directory you ran OTL from. Please post the contents of that file.

Do you have an antivirus program installed and running on the system? If so which one?

Step-1.

MGA Diagnostic Tool

Download the MGADiag Tool and save it to the desktop.
Right Click the MGADiag.exe file and click Run as Administrator to run the program. OK and UAC warnings
Click the Continue button
Wait for the to finish loading with your system information
Click the Copy button to copy the MGA Diagnostic Report to the Windows clipboard.
Paste the MGA Diagnostic Report in your next reply.

Step-2.

Run CKScanner

Please click here to download CKScanner.
Important : Save it to your desktop.
NOTE:Please DO NOT run the program more than once.

Right click the CKScanner.exe file and click Run as Administrator and OK any UAC prompts to run the program.
Click Search For Files
After a very short time, when the cursor hourglass disappears, click Save List To File.
A message box will verify that the file is saved.
Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.

Step-3.

Things For Your Next Post:
Please post the logs in the order requested. Do Not attach the logs unless I request it.
1. The MGADiagnostic log
2. The CKFiles.txt log
3. The Extras.txt log

#3
frichieny

Posted 08 December 2013 - 09:18 PM

Member

Topic Starter
Member
192 posts

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
Windows Product ID: 00359-OEM-8992687-00006
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {B5BF98B1-FE27-4FFD-9933-2D43F7810636}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\ACER\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\sppcomapi.dll[6.1.7600.16384], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16384], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\user32.dll[6.1.7600.16384], Hr = 0x800b0100

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{B5BF98B1-FE27-4FFD-9933-2D43F7810636}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-559359422-3810118987-1361560690</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire E1-471</Model></SYSTEM><BIOS><Manufacturer>Insyde Corp.</Manufacturer><Version>V1.17</Version><SMBIOSVersion major="2" minor="7"/><Date>20120425000000.000000+000</Date></BIOS><HWID>B2283007018400FE</HWID><UserLCID>3409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>China Standard Time(GMT+08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows® 7, HomePremium edition
Description: Windows Operating System - Windows® 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800006-02-13321-7601.0000-2312012
Installation ID: 019581937381430864315816150923148805745674441550501951
Partial Product Key: 7QJB7
License Status: Licensed

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: N/A
HealthStatus: 0x0000000000000000
Event Time Stamp: N/A
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Not Registered - 0x80070005
HealthStatus Bitmask Output:

HWID Data-->
HWID Hash Current: MgAAAAEAAQABAAEAAQACAAAAAwABAAEA6GEUlrBpUNgsStZeRMScruraPE7YlgJeLnM=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ACRSYS ACRPRDCT
FACP ACRSYS ACRPRDCT
HPET ACRSYS ACRPRDCT
BOOT ACRSYS ACRPRDCT
MCFG ACRSYS ACRPRDCT
WDAT ACRSYS ACRPRDCT
UEFI ACRSYS ACRPRDCT
ASF! ACRSYS ACRPRDCT
SLIC ACRSYS ACRPRDCT
SSDT ACRSYS ACRPRDCT
ASPT ACRSYS ACRPRDCT
MSDM ACRSYS ACRPRDCT
FPDT ACRSYS ACRPRDCT
SSDT ACRSYS ACRPRDCT
SSDT ACRSYS ACRPRDCT

#4
frichieny

Posted 08 December 2013 - 09:22 PM

Member

Topic Starter
Member
192 posts

CKScanner 2.4 - Additional Security Risks - These are not necessarily bad
c:\program files (x86)\nti\acer backup manager\outlookmsgnet32.exe
c:\program files (x86)\nti\acer backup manager\outlookmsgnet64.exe
c:\program files (x86)\nti\acer backup manager\migrate\outlookmsgnet32.exe
c:\program files (x86)\nti\acer backup manager\migrate\outlookmsgnet64.exe
c:\users\acer\desktop\don't starve\data\inventoryimages\tallbirdegg_cracked.tex
c:\users\acer\desktop\don't starve\data\levels\textures\noise_cracked.tex
c:\users\acer\desktop\don't starve\data\scripts\components\wisecracker.lua
c:\users\acer\downloads\terraria 1.2 cracked.zip
c:\users\acer\downloads\[kat.ph]borderlands.2.sir.hammerlock.s.big.game.hunt.dlc.incl.update.v1.3.1.hotfix.cracked.torrent
c:\users\acer\downloads\driver genius professional edition v11.0.0.1136 including crack + keys [h33t][iahq76]\drivergenius pro readme!.txt
c:\users\acer\downloads\driver genius professional edition v11.0.0.1136 including crack + keys [h33t][iahq76]\drvgenpro.exe
c:\users\acer\downloads\driver genius professional edition v11.0.0.1136 including crack + keys [h33t][iahq76]\keys.txt
c:\users\acer\downloads\driver genius professional edition v11.0.0.1136 including crack + keys [h33t][iahq76]\crack\drivers.dat
c:\users\acer\downloads\movies\borderlands.2.sir.hammerlock's.big.game.hunt.dlc.incl.update.v1.3.1.hotfix.cracked\borderlands.2.sir.hammerlock's.big.game.hunt.dlc.incl.update.v1.3.1.hotfix.cracked.part1.rar
c:\users\acer\downloads\movies\borderlands.2.sir.hammerlock's.big.game.hunt.dlc.incl.update.v1.3.1.hotfix.cracked\borderlands.2.sir.hammerlock's.big.game.hunt.dlc.incl.update.v1.3.1.hotfix.cracked.part2.rar
c:\users\acer\downloads\movies\borderlands.2.sir.hammerlock's.big.game.hunt.dlc.incl.update.v1.3.1.hotfix.cracked\borderlands.2.sir.hammerlock's.big.game.hunt.dlc.incl.update.v1.3.1.hotfix.cracked.part3.rar
c:\users\acer\downloads\movies\borderlands.2.sir.hammerlock's.big.game.hunt.dlc.incl.update.v1.3.1.hotfix.cracked\borderlands.2.sir.hammerlock's.big.game.hunt.dlc.incl.update.v1.3.1.hotfix.cracked.part4.rar
c:\users\acer\downloads\movies\borderlands.2.sir.hammerlock's.big.game.hunt.dlc.incl.update.v1.3.1.hotfix.cracked\borderlands.2.sir.hammerlock's.big.game.hunt.dlc.incl.update.v1.3.1.hotfix.cracked.part5.rar
c:\users\acer\downloads\yeah men\dead island\crack\curllib.dll
c:\users\acer\downloads\yeah men\dead island\crack\dbghelp.dll
c:\users\acer\downloads\yeah men\dead island\crack\deadislandgame.exe
c:\users\acer\downloads\yeah men\dead island\crack\engine_x86_rwdi.dll
c:\users\acer\downloads\yeah men\dead island\crack\filesystem_x86_rwdi.dll
c:\users\acer\downloads\yeah men\dead island\crack\games.ini
c:\users\acer\downloads\yeah men\dead island\crack\game_x86_rwdi.dll
c:\users\acer\downloads\yeah men\dead island\crack\imagelib_x86_rwdi.dll
c:\users\acer\downloads\yeah men\dead island\crack\jsoncpp_vs2008_x86_rwdi.dll
c:\users\acer\downloads\yeah men\dead island\crack\language.txt
c:\users\acer\downloads\yeah men\dead island\crack\libeay32.dll
c:\users\acer\downloads\yeah men\dead island\crack\libssl32.dll
c:\users\acer\downloads\yeah men\dead island\crack\libxml2.dll
c:\users\acer\downloads\yeah men\dead island\crack\memdump_x86_rwdi.dll
c:\users\acer\downloads\yeah men\dead island\crack\ogg_vs2008_x86_rwdi.dll
c:\users\acer\downloads\yeah men\dead island\crack\ogg_x86_rwdi.dll
c:\users\acer\downloads\yeah men\dead island\crack\ssleay32.dll
c:\users\acer\downloads\yeah men\dead island\crack\steam_api.dll
c:\users\acer\downloads\yeah men\dead island\crack\vorbisfile_vs2008_x86_rwdi.dll
c:\users\acer\downloads\yeah men\dead island\crack\vorbisfile_x86_rwdi.dll
c:\users\acer\downloads\yeah men\dead island\crack\vorbis_vs2008_x86_rwdi.dll
c:\users\acer\downloads\yeah men\dead island\crack\vorbis_x86_rwdi.dll
c:\users\public\new folder\dead island\crack\curllib.dll
c:\users\public\new folder\dead island\crack\dbghelp.dll
c:\users\public\new folder\dead island\crack\deadislandgame.exe
c:\users\public\new folder\dead island\crack\engine_x86_rwdi.dll
c:\users\public\new folder\dead island\crack\filesystem_x86_rwdi.dll
c:\users\public\new folder\dead island\crack\games.ini
c:\users\public\new folder\dead island\crack\game_x86_rwdi.dll
c:\users\public\new folder\dead island\crack\imagelib_x86_rwdi.dll
c:\users\public\new folder\dead island\crack\jsoncpp_vs2008_x86_rwdi.dll
c:\users\public\new folder\dead island\crack\language.txt
c:\users\public\new folder\dead island\crack\libeay32.dll
c:\users\public\new folder\dead island\crack\libssl32.dll
c:\users\public\new folder\dead island\crack\libxml2.dll
c:\users\public\new folder\dead island\crack\memdump_x86_rwdi.dll
c:\users\public\new folder\dead island\crack\ogg_vs2008_x86_rwdi.dll
c:\users\public\new folder\dead island\crack\ogg_x86_rwdi.dll
c:\users\public\new folder\dead island\crack\ssleay32.dll
c:\users\public\new folder\dead island\crack\steam_api.dll
c:\users\public\new folder\dead island\crack\vorbisfile_vs2008_x86_rwdi.dll
c:\users\public\new folder\dead island\crack\vorbisfile_x86_rwdi.dll
c:\users\public\new folder\dead island\crack\vorbis_vs2008_x86_rwdi.dll
c:\users\public\new folder\dead island\crack\vorbis_x86_rwdi.dll
c:\users\public\xd\cube world + crack.rar
c:\windows\system32\slmgr.vbs.removewat
c:\windows\syswow64\slmgr.vbs.removewat
scanner sequence 3.ZZ.11.SRAPF0
----- EOF -----

#5
frichieny

Posted 08 December 2013 - 09:24 PM

Member

Topic Starter
Member
192 posts

I cant find the extra log sir

#6
godawgs

Posted 09 December 2013 - 02:09 AM

Teacher

Retired Staff
8,228 posts

Hello,

Let's get a Extras.txt log

Posted Image

OTL Scan

Please re-open Posted Image

on the desktop. To do that:

Vista /7 users: right click the icon and click Run as Administrator.

Make sure all other windows are closed .

You will see a console like the one below:
At the top of the console click the greyed out None button<---Very Important
At the top of the console, click the box beside Scan All Users and Include 64bit Scans
Make sure the Output box at the top is set to Standard Output.
In the Extra Registry section click the circle beside Use Safelist.<---Very Important
Click the button. Do not change any settings unless otherwise told to do so.
Let the scan run uninterrupted.
When the scan completes, it will produce two notepad files, OTL.Txt will open on the desktop and Extras.txt will be minimized on the taskbar. These are saved in the same location as OTL.
Please close the OTL.txt file as I do not need it. Copy and Paste the contents of the Extras.txt file into your reply. To do that:
On the .txt file Menu Bar click Edit then click Select All. This will highlight the contents of the file. Then click Copy.
Right-click inside the forum post window then click Paste. This will paste the contents of the .txt file in the in the post window.

#7
frichieny

Posted 09 December 2013 - 02:24 AM

Member

Topic Starter
Member
192 posts

OTL Extras logfile created on: 12/9/2013 4:16:19 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ACER\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16721)
Locale: 00003409 | Country: Republic of the Philippines | Language: ENP | Date Format: M/d/yyyy

3.84 Gb Total Physical Memory | 2.43 Gb Available Physical Memory | 63.25% Memory free
15.49 Gb Paging File | 13.30 Gb Available in Paging File | 85.83% Paging File free
Paging file location(s): c:\pagefile.sys 8000 8000d:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 226.28 Gb Total Space | 66.27 Gb Free Space | 29.29% Space Free | Partition Type: NTFS
Drive D: | 226.38 Gb Total Space | 107.74 Gb Free Space | 47.59% Space Free | Partition Type: NTFS

Computer Name: ACER-PC | User Name: ACER | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-559359422-3810118987-1361560690-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML.F74JE7UHLXBAIAGRTXBCLEWKJE] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00A9FF18-E004-4E6E-9717-79A5B9ABE27A}" = lport=6980 | protocol=17 | dir=in | name=league of legends launcher |
"{00CD1824-6CB5-4AE2-9E6C-C90188A929B6}" = rport=138 | protocol=17 | dir=out | app=system |
"{05E5A2D2-5400-4D24-AA67-940A368C6EA1}" = rport=10243 | protocol=6 | dir=out | app=system |
"{063A4E3D-1F4B-4759-A2D8-DA63BAC75450}" = lport=6939 | protocol=6 | dir=in | name=league of legends launcher |
"{066CDEEF-0C6E-4118-B732-7BCEED34E389}" = lport=6956 | protocol=17 | dir=in | name=league of legends launcher |
"{07D4CFEE-9B23-47D6-BFD3-3F771773DE36}" = lport=8370 | protocol=6 | dir=in | name=league of legends launcher |
"{0AE3B328-E910-4878-A751-8021924B839B}" = lport=6967 | protocol=6 | dir=in | name=league of legends launcher |
"{0E0A1494-FFCB-40EB-AF2F-2D080EDC27B3}" = lport=6978 | protocol=17 | dir=in | name=league of legends launcher |
"{0F98958D-CD03-4A85-81D5-ADF00D890FB3}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{1141E597-4944-47F7-AA65-E6ABFE633B98}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{12210DC9-96E8-4DE5-88C4-FD0C4E0F2C07}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{13445CA8-3D4E-4175-94C4-D3ECCC5E7C10}" = lport=6920 | protocol=6 | dir=in | name=league of legends launcher |
"{144E5C26-B8FC-4C74-834A-F67609372BC7}" = lport=6953 | protocol=17 | dir=in | name=league of legends launcher |
"{14C684AC-3BDE-4869-86DC-6AD3A42B6121}" = lport=6997 | protocol=17 | dir=in | name=league of legends launcher |
"{15532FC0-065B-48EA-9E1A-5EC1E307F3D7}" = lport=6887 | protocol=6 | dir=in | name=league of legends launcher |
"{16D7BC30-CDD9-4B51-AC46-5AF9EA3A67A1}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{17C4BF8A-76B3-4B04-8B33-8655554A182C}" = lport=139 | protocol=6 | dir=in | app=system |
"{17ECD855-A7D2-43E6-A082-A70AB11FD11E}" = lport=6939 | protocol=17 | dir=in | name=league of legends launcher |
"{1A4951B8-8DED-45B7-B2F1-4149CD3DFB05}" = lport=6986 | protocol=6 | dir=in | name=league of legends launcher |
"{1EFCF899-B3AB-4563-8E31-4CC64F3E0DC6}" = lport=6929 | protocol=6 | dir=in | name=league of legends launcher |
"{1F15DC72-6E88-4EB1-80C3-F027BA22C746}" = lport=6973 | protocol=6 | dir=in | name=league of legends launcher |
"{21B1A646-27A9-4CFA-B67D-CB506CF97D65}" = lport=6949 | protocol=17 | dir=in | name=league of legends launcher |
"{233350DA-31C6-478A-BB8D-D2310B3560F8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{27702C72-FBA9-4DF9-A4D3-E12E5A76124A}" = lport=6929 | protocol=17 | dir=in | name=league of legends launcher |
"{278ABC3A-E919-4762-AD2A-61F85681F2C4}" = lport=6895 | protocol=17 | dir=in | name=league of legends launcher |
"{29E11EE0-E6B1-4F6B-9011-10A7EC3C3483}" = lport=6941 | protocol=17 | dir=in | name=league of legends launcher |
"{29E800AB-F069-47AC-8AB6-6D40827D253F}" = lport=6991 | protocol=6 | dir=in | name=league of legends launcher |
"{2B853076-6268-4637-A511-3292FFC9F02C}" = lport=6996 | protocol=6 | dir=in | name=league of legends launcher |
"{2B8CC03B-0E45-41F3-A3B8-59092C58C33B}" = lport=6975 | protocol=6 | dir=in | name=league of legends launcher |
"{2DD0F3CA-34E1-48EE-BE48-AFDABB34F8FC}" = lport=6915 | protocol=6 | dir=in | name=league of legends launcher |
"{2E473CE6-CB9D-403D-980A-1C2480A685EF}" = lport=6893 | protocol=6 | dir=in | name=league of legends launcher |
"{30844C72-3DC2-43A9-B921-278B21CB40C5}" = lport=6980 | protocol=6 | dir=in | name=league of legends launcher |
"{35783237-8DE6-4C4A-9515-BF9C7AC1A7EB}" = rport=139 | protocol=6 | dir=out | app=system |
"{360BB036-4EB0-4753-ABF9-3D11BCCC1FA1}" = lport=6972 | protocol=6 | dir=in | name=league of legends launcher |
"{36429E78-9C6E-4D81-8817-2A1987B3DC9C}" = lport=6881 | protocol=6 | dir=in | name=league of legends launcher |
"{38C99B91-90C6-4E78-820E-83EBA3C7F7B0}" = lport=6972 | protocol=17 | dir=in | name=league of legends launcher |
"{39D6017A-A632-41C0-8E49-0511A1782A35}" = lport=6907 | protocol=6 | dir=in | name=league of legends launcher |
"{3A027F07-CB3E-4E9F-95FB-08E92879D603}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{3B2142A5-2A34-486E-976D-B6D9078A9D15}" = lport=6921 | protocol=17 | dir=in | name=league of legends launcher |
"{3C3111DF-E1D7-4A74-8D71-95C0349FF8BD}" = lport=6882 | protocol=17 | dir=in | name=league of legends launcher |
"{3D159177-06FD-4191-8322-2C689E88F18B}" = lport=6966 | protocol=17 | dir=in | name=league of legends launcher |
"{3E51D3D1-88F7-4278-B95D-A9E680E3EE2E}" = lport=6916 | protocol=6 | dir=in | name=league of legends launcher |
"{3E9DF007-AAED-4ACE-80B7-A99356ADC92D}" = lport=6996 | protocol=17 | dir=in | name=league of legends launcher |
"{420057AA-1EAE-4A57-AF20-BC7B36C8F4D0}" = lport=6993 | protocol=17 | dir=in | name=league of legends launcher |
"{430B5A72-EAFE-4F16-9F7D-2B4FD2E0D7EC}" = lport=6912 | protocol=17 | dir=in | name=league of legends launcher |
"{44664D86-1043-4366-85D8-E3368AB25E0C}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{466C0D84-F201-4064-A7B3-441F6111CFC3}" = lport=6986 | protocol=17 | dir=in | name=league of legends launcher |
"{4A01DB44-BCE6-4A96-9D7A-21C2E603FDCB}" = lport=6902 | protocol=6 | dir=in | name=league of legends launcher |
"{4C311C5A-5251-42AA-B58D-970E2E2C2558}" = lport=6968 | protocol=17 | dir=in | name=league of legends launcher |
"{4FA25BE3-5343-4D81-B3B0-3FAEA257A758}" = lport=6959 | protocol=6 | dir=in | name=league of legends launcher |
"{506F49ED-1224-40C6-9750-725B3C8DB5FB}" = lport=6958 | protocol=6 | dir=in | name=league of legends launcher |
"{528A3E06-081C-49D9-BEAC-E948C113C10A}" = lport=6993 | protocol=6 | dir=in | name=league of legends launcher |
"{564FB7EF-0F74-4EAE-A73D-C83ED4815E76}" = lport=6958 | protocol=17 | dir=in | name=league of legends launcher |
"{5B33D320-921D-436C-BDF6-AF3409109360}" = lport=6968 | protocol=6 | dir=in | name=league of legends launcher |
"{5BA212D9-8B33-4B50-A3DF-1A66F134E6BA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5EE9C9ED-EE04-4385-974F-9C70EBB96E0A}" = lport=4482 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery |
"{61294088-1915-4E28-9A3B-CA283DFA6CC3}" = lport=4481 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer |
"{62C6F833-0314-4123-849B-D1E8A0D31651}" = lport=6962 | protocol=6 | dir=in | name=league of legends launcher |
"{66FBF833-C887-4177-84E8-FCDBE2508CFA}" = lport=6974 | protocol=17 | dir=in | name=league of legends launcher |
"{6899E03D-9BE9-4C4F-961F-9763976C5698}" = lport=6946 | protocol=17 | dir=in | name=league of legends launcher |
"{6AA505E9-E07D-403C-98D3-CCF94B05B9B6}" = lport=6946 | protocol=6 | dir=in | name=league of legends launcher |
"{6AD7B11D-0D7D-418D-AD76-433573F73384}" = lport=4481 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery |
"{6D1FB574-30E5-47DC-AAAC-F41D2C942CAB}" = lport=6887 | protocol=17 | dir=in | name=league of legends launcher |
"{6EC4F05D-33A4-44FA-9706-524C7220325C}" = lport=6995 | protocol=17 | dir=in | name=league of legends launcher |
"{7070EB84-0B25-4ED6-ABCB-26DEA5B23170}" = lport=6974 | protocol=17 | dir=in | name=league of legends launcher |
"{75281679-77EB-439C-B094-BBA414D6B3A5}" = lport=6904 | protocol=6 | dir=in | name=league of legends launcher |
"{75C1299D-1E1F-42A7-98F0-BE11D56727C3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{769F43AB-2EFC-4FC7-B3F4-3DE8FD3B53C3}" = lport=6889 | protocol=17 | dir=in | name=league of legends launcher |
"{76AFD2CA-000D-4B33-ABDD-188992909F86}" = lport=137 | protocol=17 | dir=in | app=system |
"{781EA23A-DF7B-4334-8560-B0D07BB8E630}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7916BD57-E64B-4B06-A211-7790884ED89B}" = lport=6922 | protocol=6 | dir=in | name=league of legends launcher |
"{798E3418-B92D-4D44-AA13-5EC9468D9C25}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{79DCC0BA-C91A-4064-8F49-A42FEAB68AD4}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{7B5B16CA-F4C8-40A4-8F69-772D76B029F8}" = lport=445 | protocol=6 | dir=in | app=system |
"{7C26555B-BD29-424A-886B-13343D006075}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{81E415CC-EC8D-4F15-9804-A10AD4188731}" = lport=6974 | protocol=6 | dir=in | name=league of legends launcher |
"{847F00A4-BEAF-43C1-96D0-2E9F8EB4C7F5}" = lport=6952 | protocol=6 | dir=in | name=league of legends launcher |
"{8624620F-065E-4D6D-9AB7-E43F20BB02F2}" = lport=6990 | protocol=6 | dir=in | name=league of legends launcher |
"{88719AA3-CF83-4704-ADD0-6FEA5D9F70D9}" = lport=6895 | protocol=6 | dir=in | name=league of legends launcher |
"{8A9FA8BA-1851-4279-A41D-6D24DEF97454}" = lport=6953 | protocol=6 | dir=in | name=league of legends launcher |
"{8F61E475-ED33-4D4F-B046-D7A979C204BB}" = lport=6915 | protocol=17 | dir=in | name=league of legends launcher |
"{91280714-B1C1-4D54-856A-0950AE37C4BD}" = lport=6904 | protocol=17 | dir=in | name=league of legends launcher |
"{951EAFE0-86AF-4A48-B211-AB69523DAEC1}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{979783D3-7253-4796-B8F6-A16E0D745713}" = lport=6959 | protocol=17 | dir=in | name=league of legends launcher |
"{9D6E2FDE-B80F-45D7-B3FB-2C457FA1C5D0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{9DB71C50-457B-4CE7-A22D-3EAF2CD348A8}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
"{9FF87459-2AD2-4E0C-9996-5A13DDBAB29D}" = lport=6920 | protocol=17 | dir=in | name=league of legends launcher |
"{A1128DEA-1501-4E2D-B85C-62933788F49D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A6BE2B96-ADAD-4D3C-BAA0-35412B3E4EA2}" = lport=6948 | protocol=17 | dir=in | name=league of legends launcher |
"{A99E573D-68C4-4A70-A6E2-A7A2E8B113B3}" = lport=6974 | protocol=6 | dir=in | name=league of legends launcher |
"{A9E89530-A352-4895-902F-D0E849C3B456}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{ACA21DC2-EE70-4AC6-89BE-B45FE9F1DAE1}" = lport=6924 | protocol=17 | dir=in | name=league of legends launcher |
"{AFF5B47F-4CD7-4776-8A76-5CAE30CC2B02}" = rport=137 | protocol=17 | dir=out | app=system |
"{B1EF4E2B-9AF3-49CB-9310-D09C094D04C7}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{B2F0B60C-9B16-48C9-AF5D-DF1FE7DD07C9}" = lport=8370 | protocol=17 | dir=in | name=league of legends launcher |
"{B5EA5BC2-80B4-41D8-A65D-42BA755241E1}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BA6AE65C-9CB4-4473-946E-AAC7AA748F9E}" = lport=6977 | protocol=17 | dir=in | name=league of legends launcher |
"{BB338CD7-5380-4D10-A06D-C486F3EEEB01}" = lport=8370 | protocol=6 | dir=in | name=league of legends launcher |
"{BDA0D68C-A584-4F62-8452-59E7F10DDF0D}" = lport=6882 | protocol=6 | dir=in | name=league of legends launcher |
"{BDB54490-9CFC-4E34-9156-BAD332B022A8}" = lport=6902 | protocol=17 | dir=in | name=league of legends launcher |
"{BF209383-677F-478F-800A-AFD3D0B44F44}" = lport=6924 | protocol=6 | dir=in | name=league of legends launcher |
"{BF9564E5-A66F-4CDC-924E-A3639F5C4EE5}" = lport=6967 | protocol=17 | dir=in | name=league of legends launcher |
"{C050DE37-8476-4A28-98EA-1B0FBAA553F5}" = lport=4482 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer |
"{C56FAF79-B45B-4638-A3A3-59AF7340C87B}" = lport=6977 | protocol=6 | dir=in | name=league of legends launcher |
"{C8A65044-C129-4283-9D16-EDBDBCA9AA82}" = lport=138 | protocol=17 | dir=in | app=system |
"{C90F8A9F-427C-444F-982E-1207971FFF09}" = lport=6995 | protocol=6 | dir=in | name=league of legends launcher |
"{CB63AA1E-0FEF-446E-910D-20A86509A35F}" = lport=6907 | protocol=17 | dir=in | name=league of legends launcher |
"{CE4B5B83-82EF-4FED-88FA-4BC81C6E5539}" = lport=6962 | protocol=17 | dir=in | name=league of legends launcher |
"{CF839D8D-504C-420B-AB3F-F2E46013B699}" = lport=6978 | protocol=6 | dir=in | name=league of legends launcher |
"{CF85C910-36D9-42A6-AC79-F03B2F4067E1}" = lport=6889 | protocol=6 | dir=in | name=league of legends launcher |
"{D515A40E-D738-4982-A471-92AFDC596A66}" = lport=6973 | protocol=17 | dir=in | name=league of legends launcher |
"{D548161C-5BFF-4F38-8ED3-96F7C0228E1F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D5A38ADE-2DBB-444F-B283-7CEEEB01A29F}" = rport=445 | protocol=6 | dir=out | app=system |
"{D5C49553-059E-4348-A694-EED2DC1F4E94}" = lport=6941 | protocol=6 | dir=in | name=league of legends launcher |
"{D5E1C104-CCB9-4B85-B39D-00D27CDAC149}" = lport=6922 | protocol=17 | dir=in | name=league of legends launcher |
"{D67A8D26-3471-4C14-A933-7CD78CB8B32D}" = lport=6975 | protocol=17 | dir=in | name=league of legends launcher |
"{DB363C39-DC2E-496E-AA79-4133A22E1A0D}" = lport=6982 | protocol=17 | dir=in | name=league of legends launcher |
"{DB7BAB0F-BB85-442F-AFC0-3E9E16560EC8}" = lport=6982 | protocol=6 | dir=in | name=league of legends launcher |
"{DDAC2B4F-EE33-4C6A-9DD5-14EF13DE5E64}" = lport=6990 | protocol=17 | dir=in | name=league of legends launcher |
"{DDB6A1AC-100D-4F63-AE2E-2DF3BF520984}" = lport=6956 | protocol=6 | dir=in | name=league of legends launcher |
"{E051406E-B004-4980-BFBE-2202F5418306}" = lport=6966 | protocol=6 | dir=in | name=league of legends launcher |
"{E1BC73B3-238D-4BD3-9355-02E601C3CCA9}" = lport=8370 | protocol=17 | dir=in | name=league of legends launcher |
"{E26ABB04-2DF0-42D0-A4C1-0D3104336470}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{E2C4E10B-20D3-4C5B-958C-DE17FDBBA19D}" = lport=6948 | protocol=6 | dir=in | name=league of legends launcher |
"{E4AE6ED9-38AF-4024-BCD1-8BAB0C915063}" = lport=6997 | protocol=6 | dir=in | name=league of legends launcher |
"{E500DEF2-CCF7-4B6F-AE41-3910AC36CDA4}" = lport=10243 | protocol=6 | dir=in | app=system |
"{E55520C8-3613-49BD-90DC-B57E637B4DE2}" = lport=6952 | protocol=17 | dir=in | name=league of legends launcher |
"{E99FC1EA-4D78-4A2D-B83F-07DAF93F7B44}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{EDA149BF-CFA0-4CEF-9F41-BBBE9AE27EC5}" = lport=6893 | protocol=17 | dir=in | name=league of legends launcher |
"{EE159C71-EEB5-4652-8D38-9B10248E745A}" = lport=6949 | protocol=6 | dir=in | name=league of legends launcher |
"{F0100E40-F55D-4ADB-AE60-CB458125A24F}" = lport=6881 | protocol=17 | dir=in | name=league of legends launcher |
"{F17B7150-5A9A-48F7-84A1-CBB3D74A5A57}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{F41C8922-8838-49D3-9481-8D7963F0D1B6}" = lport=6991 | protocol=17 | dir=in | name=league of legends launcher |
"{F9B4F9D2-9BAE-4118-8A9F-02A0EFD64DD8}" = lport=6921 | protocol=6 | dir=in | name=league of legends launcher |
"{FDDAE7F9-FDE1-4B6A-900C-338225F33DA1}" = lport=6916 | protocol=17 | dir=in | name=league of legends launcher |
"{FE29D95C-5D47-4EDD-9CD4-DFED769E9144}" = lport=6912 | protocol=6 | dir=in | name=league of legends launcher |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02CED495-7B30-4771-83C2-78B478E6F354}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{03C51AA4-99EC-46F8-8CF9-41F48DA54A11}" = protocol=17 | dir=in | app=c:\program files (x86)\tunngle\launcher.exe |
"{06BE0F1C-61A3-43C7-8FFB-F15558DD669F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{07ACC848-C187-466A-9DEC-E6BA6FB702D6}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{07D2D219-A862-481F-B4AF-AB6AEE56ABDB}" = protocol=6 | dir=in | app=c:\program files (x86)\tunngle\tnglctrl.exe |
"{0C750D5F-7958-4874-BDDF-E415992744AB}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\clear.fi media\windowsupnpmv.exe |
"{12D80A72-4749-4D39-87F6-FEA728579CC5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{12F36E2A-7DC5-40C6-9586-70C906692FF2}" = protocol=6 | dir=in | app=c:\program files (x86)\tunngle\tunngle.exe |
"{1B5A5EEA-35E5-42E3-9772-05EE3FE76932}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{200555B8-7B47-4899-9A15-FC92374D287F}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{2023212F-05FC-4744-B252-A1FF2298AC57}" = protocol=17 | dir=in | app=c:\program files (x86)\tunngle\tnglctrl.exe |
"{21C26A88-2FCD-44C2-AB7B-6E15B4DE5D9F}" = protocol=6 | dir=in | app=d:\program files (x86)\league of legends ph\gamedata\apps\lolph\game\league of legends.exe |
"{23969739-BEBC-4B94-93CB-85588E80F693}" = protocol=17 | dir=in | app=c:\program files (x86)\tunngle\tnglctrl.exe |
"{26DE5B63-AB60-442C-A133-BD9C36CE9A56}" = protocol=1 | dir=in | [email protected],-28543 |
"{27F8E064-FC79-4CDE-9C06-39E9A827826E}" = dir=in | app=c:\program files (x86)\garena plus\ggdllhost.exe |
"{28E2B39A-CEA5-4611-BFC1-B14D355B7714}" = protocol=6 | dir=in | app=c:\users\acer\downloads\elsphinstaller.exe |
"{2A4BE2D3-8E7E-4295-BBA9-02BBFAA42CAC}" = protocol=6 | dir=in | app=d:\program files (x86)\elsword ph\gamedata\apps\elsph\data\x2.exe |
"{3383BA2E-134D-4486-A19A-D0160E793028}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\clear.fi photo\dmcdaemon.exe |
"{3A8A8FBC-618B-49CC-87FC-4C16963A47A9}" = protocol=6 | dir=in | app=c:\program files (x86)\tunngle\launcher.exe |
"{3DB9CDE9-04A8-47C4-8DE5-BB038FBABC03}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{48C510B7-06F7-4E7D-B9EC-7393A6ED08AD}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4A122C4F-0427-4F49-ACDD-C5E9152EC676}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{59A909EE-E707-45F3-ABA5-F4EE0FBB21F1}" = protocol=1 | dir=out | [email protected],-28544 |
"{5CC17F1D-79FC-4F19-9BA5-E29BBBA1C3E4}" = dir=in | app=c:\program files (x86)\garena plus\room\garena_room.exe |
"{63CEBCC0-9C3A-49F1-AFEB-005D77F94B50}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{65D583E3-21E9-4583-9ED4-5F18406282B1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{66CBEAE2-0CA7-453F-AED4-B4021CFA5496}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{67741C7C-A06C-475D-83A1-06B3FA08D8EB}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{6F7DF193-B5D8-43A9-AB07-EAA9FE256C51}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{778BFB84-3BF3-402F-B28D-382ECA826EE5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7AAF8B4A-290F-4805-9F7E-906A7B0EBA9D}" = protocol=17 | dir=in | app=c:\program files (x86)\tunngle\tunngle.exe |
"{7C5985E2-A367-4A75-9739-8CADD0DA04D2}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{7D6AC9DF-26A0-4D3C-9848-82BABA3B81BF}" = protocol=17 | dir=in | app=d:\program files (x86)\elsword ph\gamedata\apps\elsph\data\x2.exe |
"{7FB3BDB3-957E-4199-AB83-EA24C251F153}" = protocol=17 | dir=in | app=c:\users\acer\downloads\elsphinstaller.exe |
"{82F959A6-2E4A-4261-9D94-F8E82D2F5E50}" = protocol=6 | dir=in | app=c:\program files (x86)\tunngle\tnglctrl.exe |
"{8379C005-AAD1-4D38-AC6F-A36CEC17810A}" = protocol=17 | dir=in | app=d:\program files (x86)\league of legends ph\gamedata\apps\lolph\air\lolclient.exe |
"{8D0492C0-2B21-4612-A007-B596E6EDA650}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{9096F0D2-DED9-4AA4-AB48-B3DCDFE96006}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{949C600F-E92A-4918-B946-DDE8DD6DFBB4}" = dir=in | app=c:\program files (x86)\acer\clear.fi sdk20\mvp\musicplayer.exe |
"{9C2A4C43-0DE2-4448-9B31-BDFC2D9049F2}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{A1A1C93D-2C83-4E2E-869F-2346A6F59C7F}" = dir=in | app=c:\users\acer\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{A4689B09-5DC6-48E0-BE55-BD861A532B55}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\clear.fi photo\windowsupnp.exe |
"{ACEE2070-A3CC-4029-ACC9-A0670B8F6F57}" = protocol=58 | dir=in | [email protected],-28545 |
"{ADCB4E29-6F0A-47F2-8ABF-4B4F8F76E755}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{AEE5DB5E-3429-4105-B886-B2D28FB43F3F}" = protocol=6 | dir=in | app=c:\program files (x86)\tunngle\tunngle.exe |
"{B640E2E4-58B4-47B4-8AB3-CA680F984709}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{B70507D4-6165-4BC7-A82A-726D42837D4D}" = protocol=17 | dir=in | app=c:\program files (x86)\research in motion\blackberry desktop\rim.desktop.exe |
"{B7634DF5-C4CD-471D-A940-E4EE9CC4AC81}" = dir=in | app=c:\program files (x86)\acer\clear.fi sdk20\mvp\videoplayer.exe |
"{BA117C98-8457-422A-AD49-97F700064DC6}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{BCBDC551-6C78-4BE6-9014-5BCBBA20E62C}" = dir=in | app=c:\program files (x86)\nokia\nokia suite\nokiasuite.exe |
"{BF01628D-7AC7-4D02-8B88-80FD5886D1B5}" = protocol=6 | dir=in | app=d:\program files (x86)\league of legends ph\gamedata\apps\lolph\air\lolclient.exe |
"{BF44AF4C-6294-4689-B678-EDED3939EA81}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{C09070BA-56DE-47A5-832D-440CA15BAB9D}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\clear.fi media\dmcdaemon.exe |
"{C147FE3F-1F06-4CB3-ACD4-6FC5AC26AF80}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C4674AEA-DC31-4708-BA49-BF973C902AF5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{C7152B89-BDD0-4D3E-ADCA-6B6E34C9C5A9}" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"{C762DB56-2B93-40D0-B319-6C38D11CB2F5}" = protocol=17 | dir=in | app=c:\users\acer\downloads\lolinstaller.exe |
"{C8AD3B5C-A54B-40E5-8AA1-FC7E1619471A}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{CFDECC85-3724-4784-80A9-BB495C88A366}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{D21CB2D6-DE92-4D1F-87F2-F7250E0616BB}" = protocol=58 | dir=out | [email protected],-28546 |
"{D5640878-34BB-4B68-A8CD-8ABDBD4842D7}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{D59C7BC5-216D-4F1E-847B-A63B4AD51752}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{D5F5C002-B58A-43F8-816F-84A01D11D94B}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{D60947AA-2530-4656-A18B-168B5C48B68E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D6EA9C2D-27DC-494C-8392-9CD4359EB936}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D6F5B0A8-A5EA-44ED-ABBC-1EB5454321DA}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\clear.fi media\dmcdaemon.exe |
"{D7E9ADB8-6FF8-4E1D-9003-584343D9ED7D}" = protocol=17 | dir=in | app=c:\program files (x86)\tunngle\tunngle.exe |
"{D827C6F9-8550-4006-B147-3C04993713A2}" = protocol=17 | dir=in | app=d:\program files (x86)\league of legends ph\gamedata\apps\lolph\game\league of legends.exe |
"{DD503EAF-EC3D-433D-A759-81DA8909826A}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{E36EC218-5936-49A3-B641-3576238ED068}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{E43C76B4-9B8E-4F5F-98A1-10BED787B6C3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{E688C54E-DBFD-46EC-8EA4-091CB2EDFC2B}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\clear.fi media\windowsupnpmv.exe |
"{E7C00E90-7122-4AA9-81F6-C0A0472A5618}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{E888C66C-071A-4196-BF43-85B23F05E181}" = protocol=6 | dir=in | app=c:\users\acer\downloads\lolinstaller.exe |
"{EB40A11D-44AB-4FF9-8981-1D3535227955}" = protocol=6 | dir=out | app=system |
"{EF12A1D7-83F6-484D-826B-FABCBBEA3F42}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{F69338A2-F992-41DF-AD5E-FCB40A076384}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\clear.fi photo\windowsupnp.exe |
"{F8BD7770-0E14-40DC-8DEB-AA9DAA2F3B1F}" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"{F921F520-BD88-4AD3-A21F-74B1CE26546B}" = protocol=6 | dir=in | app=c:\program files (x86)\research in motion\blackberry desktop\rim.desktop.exe |
"{FF077B1E-7214-45EA-BDB7-B08728D97CCF}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\clear.fi photo\dmcdaemon.exe |
"TCP Query User{110E58B8-DFEE-446E-943D-3F304933B7C2}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"TCP Query User{1226EC0C-D5DE-4646-8970-C2ACEE9B6FC8}D:\program files (x86)\counter-strike 1.6\hl.exe" = protocol=6 | dir=in | app=d:\program files (x86)\counter-strike 1.6\hl.exe |
"TCP Query User{18AAACFF-637B-4488-AF61-1E79C1273A48}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"TCP Query User{41B59353-1733-4D2B-8FF5-DA97B1CBAD6E}\\acer-pc\users\public\sacred citadel\sacredcitadel.exe" = protocol=6 | dir=in | app=\\acer-pc\users\public\sacred citadel\sacredcitadel.exe |
"TCP Query User{4B0DED37-13BD-4D92-8C97-74E6968A49CD}C:\program files (x86)\garena plus\garenamessenger.exe" = protocol=6 | dir=in | app=c:\program files (x86)\garena plus\garenamessenger.exe |
"TCP Query User{97F7713A-3027-4963-9B24-C69B5444DBA7}C:\users\acer\downloads\yeah men\dead island\deadislandgame.exe" = protocol=6 | dir=in | app=c:\users\acer\downloads\yeah men\dead island\deadislandgame.exe |
"TCP Query User{A3D02377-8BF3-4C01-941A-6704FD6CA8CA}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe |
"TCP Query User{A832D2E7-1831-473E-99F5-FB191D2D2846}D:\program files (x86)\counter-strike 1.6\hl.exe" = protocol=6 | dir=in | app=d:\program files (x86)\counter-strike 1.6\hl.exe |
"TCP Query User{B0E3C7D4-7002-4AFC-BF2A-D8F8A4453BAF}D:\lolreplay\lolreplay.exe" = protocol=6 | dir=in | app=d:\lolreplay\lolreplay.exe |
"TCP Query User{EBFF7BAD-2002-427A-96CE-BC09840792A3}D:\program files (x86)\activision\rome - total war\rometw.exe" = protocol=6 | dir=in | app=d:\program files (x86)\activision\rome - total war\rometw.exe |
"TCP Query User{FFD7FD68-C238-43BB-9CA6-D6EA3FF4EEF8}C:\program files (x86)\garena plus\bbtalk\bbtalk.exe" = protocol=6 | dir=in | app=c:\program files (x86)\garena plus\bbtalk\bbtalk.exe |
"UDP Query User{0065CD28-7C94-4098-BA39-F184F9F35D90}D:\program files (x86)\activision\rome - total war\rometw.exe" = protocol=17 | dir=in | app=d:\program files (x86)\activision\rome - total war\rometw.exe |
"UDP Query User{3BC461E2-5E17-4043-921C-97BAF20519E2}C:\program files (x86)\garena plus\garenamessenger.exe" = protocol=17 | dir=in | app=c:\program files (x86)\garena plus\garenamessenger.exe |
"UDP Query User{4D7F0D06-3631-419E-AF36-3887D82B48B0}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"UDP Query User{5D5E0196-62F8-4F01-A919-AC0C82914131}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe |
"UDP Query User{7F9C9C5F-E1F5-4A01-BFEF-62733B462325}C:\program files (x86)\garena plus\bbtalk\bbtalk.exe" = protocol=17 | dir=in | app=c:\program files (x86)\garena plus\bbtalk\bbtalk.exe |
"UDP Query User{AA83C035-82F4-458A-925B-E77C5F22CE1C}D:\program files (x86)\counter-strike 1.6\hl.exe" = protocol=17 | dir=in | app=d:\program files (x86)\counter-strike 1.6\hl.exe |
"UDP Query User{CAEE377A-2179-4476-93E9-726FC8DA7A5E}C:\users\acer\downloads\yeah men\dead island\deadislandgame.exe" = protocol=17 | dir=in | app=c:\users\acer\downloads\yeah men\dead island\deadislandgame.exe |
"UDP Query User{EC90F3FE-7016-4B57-9502-B9DFC3BC0D26}D:\lolreplay\lolreplay.exe" = protocol=17 | dir=in | app=d:\lolreplay\lolreplay.exe |
"UDP Query User{FA48E647-10BB-4446-8682-48482ECD0261}D:\program files (x86)\counter-strike 1.6\hl.exe" = protocol=17 | dir=in | app=d:\program files (x86)\counter-strike 1.6\hl.exe |
"UDP Query User{FC2A9D47-FEDE-456C-96E3-A8078D584738}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"UDP Query User{FEB5E624-9D90-4449-BD7F-0632D11408B7}\\acer-pc\users\public\sacred citadel\sacredcitadel.exe" = protocol=17 | dir=in | app=\\acer-pc\users\public\sacred citadel\sacredcitadel.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{09536BA1-E498-4CC3-B834-D884A67D7E34}" = Intel® Trusted Connect Service Client
"{0E5D76AD-A3FB-48D5-8400-8903B10317D3}" = iTunes
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}" = Microsoft .NET Framework 4.5
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{206BD2C5-DE08-4577-A0D7-D441A79D5A3A}" = Windows Live Remote Client Resources
"{26A24AE4-039D-4CA4-87B4-2F86416021FF}" = Java™ 6 Update 21 (64-bit)
"{26A24AE4-039D-4CA4-87B4-2F86417025FF}" = Java 7 Update 25 (64-bit)
"{3C1F302A-CC25-488D-9C24-A76B95BC916F}" = Nitro Reader 3
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{680EDA59-9266-44B4-949E-0C24F65DFF82}" = Microsoft_VC100_CRT_SP1_x64
"{6D3B2650-6767-49B6-A63E-CD410C653B05}" = Intel Processor Diagnostic Tool 64Bit
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-006D-0409-1000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5
"{93A07A0D-454E-43d1-86A9-5DE9C5F4411A}" = Shadow Defender
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{AE91E0F3-C49A-4EF4-8B98-A07BD409EB90}" = Windows Live Remote Service Resources
"{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}" = Apple Mobile Device Support
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources
"62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F" = Windows Driver Package - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0)
"72A50F48CC5601190B9C4E74D81161693133E7F7" = Windows Driver Package - Nokia Modem (02/25/2011 7.01.0.9)
"CCleaner" = CCleaner
"E0AC723A3DE3A04256288CADBBB011B112AED454" = Windows Driver Package - Nokia Modem (02/25/2011 4.7)
"GIMP-2_is1" = GIMP 2.8.6
"Recuva" = Recuva
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VLC media player 2.0.2
"WinRAR archiver" = WinRAR 4.20 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000F2A10-9CDF-47BF-9CF2-9AC87567B433}" = Windows Live Photo Common
"{03241D8D-2217-42F7-9FCB-6A68D141C14D}" = Windows Live 软件包
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}" = Backup Manager V3
"{10B9C608-BF7C-4CCF-A658-C01D969DCA21}_is1" = gpedt.msc 1.0
"{192A227B-A8C8-4C6D-B939-21FAEB007E1E}" = Google Drive
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YTD Video Downloader 3.9
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 45
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Qualcomm Atheros WiFi Driver Installation
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{29373274-977E-413C-A4DE-DC0F8E80C429}" = Nokia Connectivity Cable Driver
"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh
"{2D49C296-BCCA-4800-BAF6-A0269EBDCF74}" = Windows Live Messenger
"{317D56AC-0DB3-48F5-929A-42032DAC9AD7}" = Windows Live Writer
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{368BEC2C-B7A2-4762-9213-2D8465D533CA}" = Windows Live UX Platform Language Pack
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.11
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{588CE0C0-860B-49A8-AFCF-3C69465B345F}" = Windows Live Mesh
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6B0DC474-A5F0-4091-8913-25E9DA2E7F53}" = Asoftech Photo Recovery
"{6C772996-BFF3-3C8C-860B-B3D48FF05D65}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106
"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker
"{6D01D1B1-17BD-4F10-BB11-F08F0C47D42B}" = PC Connectivity Solution
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7115EEBC-DA7B-434C-B81C-EA5B26EA9A94}" = Windows Live Writer Resources
"{72199E33-4F2A-4B7F-8E25-95DDDD50A678}" = Acer System Information
"{753F0A72-59C3-41CE-A36A-F2DF2079275C}" = Windows Live Mail
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B982EBD-D017-4527-BF1A-FC489EC6B100}" = Windows Live 照片库
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{866C4563-ED53-43F3-A29D-8BEE2BD1BA3C}" = Nokia PC Suite
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8e70e4e1-06d7-470b-9f74-a51bef21088e}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0409-1000-0000000FF1CE}_Office14.PROPLUS_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUS_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUS_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUS_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0116-0409-1000-0000000FF1CE}_Office14.PROPLUS_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140011-0066-0409-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - English
"{903EDF14-4E28-4463-AA5E-4AEE71C0263B}" = Windows Live Movie Maker
"{913F5509-372B-4796-980B-D1687F76B489}" = Asoftech Video Converter
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0382E3C-7384-429A-9BFA-AF5888E5A193}" = Acer Crystal Eye Webcam
"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A3AD65CC-B2CE-49da-AE4E-CC2ECF4EC0F8}" = clear.fi SDK - MVP 2
"{A6C48A9F-694A-4234-B3AA-62590B668927}" = Intel® Manageability Engine Firmware Recovery Agent
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" = Adobe Reader X (10.1.0) MUI
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B1C2398C-6FAB-46D1-806C-5942F0829994}" = ParetoLogic Data Recovery
"{B5AD89F2-03D3-4206-8487-018298007DD0}" = clear.fi Photo
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{BAEE89D5-6E87-4F89-9603-A1C100479181}" = Windows Live Messenger
"{BCC315E7-2E8F-4EFD-8A0B-F8F276FE73F2}" = YTD Toolbar v6.2
"{BE5B0450-DCCB-4FE9-93E2-3B38D88A745B}" = BlackBerry Desktop Software 7.1
"{C1594429-8296-4652-BF54-9DBE4932A44C}" = Realtek PCIE Card Reader
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D299197D-CDEA-41A6-A363-F532DE4114FD}" = Windows Live UX Platform Language Pack
"{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DAF7BB88-6392-40aa-A714-8392C4BDBD2C}" = clear.fi SDK- Movie 2
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso
"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer
"{E824E81C-80A4-3DFF-B5F9-4842A9FF5F7F}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106
"{E9AF1707-3F3A-49E2-8345-4F2D629D0876}" = clear.fi Media
"{EDB188F5-D8E8-42EE-89E0-F212DA48CB81}" = Nokia Suite
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心
"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F77EF646-19EB-11E1-9A9E-984BE15F174E}" = Evernote v. 4.5.2
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center
"{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel® SDK for OpenCL - CPU Only Runtime Package
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"BlackBerry_Desktop" = BlackBerry Desktop Software 7.1
"Counter-Strike 1.6" = Counter-Strike 1.6
"DAEMON Tools Ultra" = DAEMON Tools Ultra
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"ELSWORD" = Garena - ELSWORD
"Fallout New Vegas_is1" = Fallout New Vegas
"Faster Than Light_is1" = Faster Than Light
"Identity Card" = Identity Card
"im" = Garena Plus
"InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}" = Acer Backup Manager
"InstallShield_{A0382E3C-7384-429A-9BFA-AF5888E5A193}" = Acer Crystal Eye Webcam
"InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9
"InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso
"LManager" = Launch Manager
"LoLPH" = Garena - League of Legends
"LOLReplay" = LOLReplay
"Mozilla Firefox 15.0.1 (x86 en-US)" = Mozilla Firefox 15.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Nokia PC Suite" = Nokia PC Suite
"Nokia Suite" = Nokia Suite
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"Optimizer Pro_is1" = Optimizer Pro v3.0
"PandoraRecovery" = PandoraRecovery (Remove Only)
"PhotoScape" = PhotoScape
"PowerISO" = PowerISO
"Razer Game Booster_is1" = Razer Game Booster
"RealPlayer 15.0" = RealPlayer
"Recettear: An Item Shop's Tale_is1" = Recettear: An Item Shop's Tale
"Rogue Legacy_is1" = Rogue Legacy version 0.0.0.9
"Smart Bro" = Smart Bro
"Steam App 206980" = War of the Roses Beta
"TeamViewer 8" = TeamViewer 8
"TechPowerUp GPU-Z" = TechPowerUp GPU-Z
"Tunngle beta_is1" = Tunngle beta
"Uplay" = Uplay
"uTorrent" = µTorrent
"Winamp" = Winamp
"WinLiveSuite" = Windows Live 程式集
"WinPcapInst" = WinPcap 4.1.2
"Zero Assumption Recovery_is1" = Zero Assumption Recovery Version 9

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-559359422-3810118987-1361560690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"CopyTrans Suite" = CopyTrans Suite Remove Only
"Flux" = f.lux
"Google Chrome" = Google Chrome
"UnityWebPlayer" = Unity Web Player
"Winamp Detect" = Winamp Detector Plug-in

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 12/9/2013 1:44:07 AM | Computer Name = ACER-PC | Source = Bonjour Service | ID = 100
Description = ERROR: handle_resolve_request bad interfaceIndex 16

Error - 12/9/2013 1:44:07 AM | Computer Name = ACER-PC | Source = Bonjour Service | ID = 100
Description = ERROR: handle_resolve_request bad interfaceIndex 17

Error - 12/9/2013 1:44:07 AM | Computer Name = ACER-PC | Source = Bonjour Service | ID = 100
Description = ERROR: handle_resolve_request bad interfaceIndex 18

Error - 12/9/2013 1:44:07 AM | Computer Name = ACER-PC | Source = Bonjour Service | ID = 100
Description = ERROR: handle_resolve_request bad interfaceIndex 19

Error - 12/9/2013 1:44:07 AM | Computer Name = ACER-PC | Source = Bonjour Service | ID = 100
Description = ERROR: handle_resolve_request bad interfaceIndex 20

Error - 12/9/2013 1:44:07 AM | Computer Name = ACER-PC | Source = Bonjour Service | ID = 100
Description = ERROR: handle_resolve_request bad interfaceIndex 21

Error - 12/9/2013 1:44:07 AM | Computer Name = ACER-PC | Source = Bonjour Service | ID = 100
Description = ERROR: handle_resolve_request bad interfaceIndex 22

Error - 12/9/2013 1:44:07 AM | Computer Name = ACER-PC | Source = Bonjour Service | ID = 100
Description = ERROR: handle_resolve_request bad interfaceIndex 23

Error - 12/9/2013 1:44:07 AM | Computer Name = ACER-PC | Source = Bonjour Service | ID = 100
Description = ERROR: handle_resolve_request bad interfaceIndex 24

Error - 12/9/2013 1:45:03 AM | Computer Name = ACER-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 12/8/2013 12:46:31 AM | Computer Name = ACER-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 12:44:32 PM on ?12/?8/?2013 was unexpected.

Error - 12/8/2013 12:47:30 AM | Computer Name = ACER-PC | Source = Service Control Manager | ID = 7024
Description = The Windows Search service terminated with service-specific error
%%-1073473535.

Error - 12/8/2013 12:47:30 AM | Computer Name = ACER-PC | Source = Service Control Manager | ID = 7031
Description = The Windows Search service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 30000 milliseconds:
Restart the service.

Error - 12/8/2013 3:20:57 AM | Computer Name = ACER-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 3:18:17 PM on ?12/?8/?2013 was unexpected.

Error - 12/8/2013 1:44:25 PM | Computer Name = ACER-PC | Source = DCOM | ID = 10010
Description =

Error - 12/8/2013 11:18:06 PM | Computer Name = ACER-PC | Source = DCOM | ID = 10005
Description =

Error - 12/8/2013 11:18:06 PM | Computer Name = ACER-PC | Source = Service Control Manager | ID = 7000
Description = The Windows Activation Technologies Service service failed to start
due to the following error: %%5

Error - 12/8/2013 11:18:27 PM | Computer Name = ACER-PC | Source = Service Control Manager | ID = 7000
Description = The Windows Activation Technologies Service service failed to start
due to the following error: %%5

Error - 12/8/2013 11:18:30 PM | Computer Name = ACER-PC | Source = Service Control Manager | ID = 7000
Description = The Windows Activation Technologies Service service failed to start
due to the following error: %%5

Error - 12/8/2013 11:18:33 PM | Computer Name = ACER-PC | Source = Service Control Manager | ID = 7000
Description = The Windows Activation Technologies Service service failed to start
due to the following error: %%5

< End of report >

#8
frichieny

Posted 09 December 2013 - 02:25 AM

Member

Topic Starter
Member
192 posts

Good day sir

#9
godawgs

Posted 09 December 2013 - 03:45 AM

Teacher

Retired Staff
8,228 posts

Thanks for the log. You didn't answer my question about which antivirus program, if any, you have.
If you don't have an antivirus program I would advise you to disconnect this computer from the internet and only use the internet to come to this site and read / respond to my posts. We will get an antivirus program an the system once we have it cleaned.

You have the following Peer-to-Peer program(s) installed:

uTottent

GeeksToGo does not recommend using such programs, but you should read the description of Peer-to-Peer programs below before deciding for yourself.

Description of Peer-to-Peer (P2P) software.
P2P(Peer-to-Peer) may be a great way to get lots of seemingly freeware, but it is a great way to get infected as well. The program(s) may be safe, but there's no way to tell if the file being shared is infected. P2P programs, more often than not, install adware and/or spyware and worse still, some worms spread via P2P networks, infecting you as well.
Once upon a time, P2P file sharing was fairly safe. This is no longer true. P2P programs form a direct conduit inside your computer, their security measures are easily circumvented, and malware writers are increasingly exploiting them to spread their wares on to your computer. If your P2P program is not configured correctly, your computer may also be sharing more files than you realize. There have been cases where people's passwords, address books and other personal, private, and financial details have been exposed to a file sharing network by a badly configured program.

If you need convincing, please read these short reports on the dangers of peer-2-peer programs and file sharing.

We advise removing any P2P programs you have now and avoiding this type of software application. Whether you remove them or not is your decision. But if you decide to keep and use Peer-to-Peer programs I can guarantee that you will be coming back to this forum or another malware forum. If you do choose to keep the program(s), please do not use it / them until the computer is clean and I give the all clear.

All programs, folders and files listed below in this color are optional removals, but if you uninstall the program(s) you must delete the folders and files in the corresponding colors. All programs in black must be deleted, along with the corresponding folders and files in red.

Step-1.

Program uninstalls and Optional Removals

1. Please click the Start Orb

, click Control Panel. Under the Programs or Programs and Features heading click Uninstall a program
2. In the list of programs installed, locate the following program(s):

Java™ 6 Update 21 (64-bit)
Java 7 Update 25 (64-bit)
uTorrent

3. Right click each program and click Uninstall
4. After the programs have been uninstalled, close the Installed Programs window and the Control Panel.
5. Reboot the computer.

Delete the folders associated with the uninstalled programs.(Only do this if you uninstalled the program)

1. Using Windows Explorer (to get there right-click your Start button and click "Explore"), please delete the following folders(s) (if present):

C:\Program Files (x86)\uTorrent

2. Close Windows Explorer

Step-2.

Posted Image

OTL Fix

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

1. Please copy all of the text in the quote box below (Do Not copy the word Quote. To do this, highlight everything
inside the quote box (except the word Quote) , right click and click Copy.

:COMMANDS
[createrestorepoint]

:OTL
PRC - [2012/07/26 19:40:56 | 000,794,560 | ---- | M] (Spigot, Inc.) -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
SRV - [2012/07/26 19:40:56 | 000,794,560 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe -- (Application Updater)
IE - HKLM\..\SearchScopes,DefaultScope = {7F4EFF06-7032-458e-AE16-1C1D8255C28A}
IE - HKLM\..\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}: "URL" = http://search.speedb...q={searchTerms}
IE - HKCU\..\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}: "URL" = http://search.speedb...q={searchTerms}
FF - prefs.js..browser.search.defaultenginename,S: S", ""
FF - prefs.js..browser.search.defaulturl: "http://search.speedb...spx?s=CAMe0&q="
FF - prefs.js..browser.search.order.1: "Speedbit Search"
FF - prefs.js..browser.search.order.1,S: S", ""
FF - prefs.js..browser.search.selectedEngine,S: S", ""
FF - prefs.js..extensions.enabledAddons: [email protected]:6.2
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\SearchPredict\PRFireFox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}: C:\Program Files (x86)\SPEEDbit Video Downloader\SPFireFox
[2013/02/09 19:34:16 | 000,000,000 | ---D | M] (Browse2save) -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\sjehkmhg.default\extensions\[email protected]
[2012/10/22 22:11:28 | 000,002,543 | ---- | M] () -- C:\Users\ACER\AppData\Roaming\mozilla\firefox\profiles\sjehkmhg.default\searchplugins\speedbit.xml
[2013/01/30 16:28:16 | 000,000,000 | ---D | M] (Widgi Toolbar Platform) -- C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT\WTXPCOM
O2:64bit: - BHO: (no name) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No CLSID value found.
O2 - BHO: (YTD Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - Reg Error: Value error. File not found
O4 - HKLM..\Run: [Driver Genius] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.25.2)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O33 - MountPoints2\{0d829048-f81a-11e1-8c9c-047d7b9db037}\Shell - "" = AutoRun
O33 - MountPoints2\{0d829048-f81a-11e1-8c9c-047d7b9db037}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{0d82904c-f81a-11e1-8c9c-047d7b9db037}\Shell - "" = AutoRun
O33 - MountPoints2\{0d82904c-f81a-11e1-8c9c-047d7b9db037}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{636eef1a-d7d0-11e2-a32d-047d7b9db037}\Shell - "" = AutoRun
O33 - MountPoints2\{636eef1a-d7d0-11e2-a32d-047d7b9db037}\Shell\AutoRun\command - "" = G:\Setup.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\Setup.exe

:FILES
C:\Program Files (x86)\Application Updater
C:\Program Files (x86)\SearchPredict
C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT
ipconfig /flushdns /c
netsh advfirewall reset
netsh advfirewall set allprofiles state on

:COMMANDS
[emptytemp]

Warning: This fix is relevant for this system and no other. If you are not this user, DO NOT follow these directions as they could damage the workings of your system.

2. Please re-open Posted Image

on your desktop. To do that:

Vista and 7 users: Right click the icon and click Run as Administrator

3. Place the mouse pointer inside the Posted Image

textbox, right click and click Paste. This will put the above script inside the textbox.
4. Click the Posted Image

button.
5. Let the program run unhindered.
6. OTL may ask to reboot the machine. Please do so if asked.
7. Click the Posted Image

button.
8. A report will open. Copy and Paste that report in your next reply.
9. If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, (where mmddyyyy_hhmmss is the date of the tool run).

Step-3.

Run aswMBR

Download aswMBR.exe to your desktop.
Right click the aswMBR.exe file and click Run as Administrator. If you get a UAC window, allow the file to run.
If it asks you if you want to download the latest virus definitions, click Yes
Be sure the A/V Scan: is set to QuickScan
Click the "Scan" button to start the scan
On completion of the scan click save log. Save it to your desktop and post in your next reply.

NOTE: When you run aswMBR, if it is shutdown automatically, then it is most likely the infection detecting that aswMBR is running and terminating it. In this situation you should rename the executable (aswMBR.exe) to iexplore.exe and try it again.

Step-4.

AdwCleaner by Xplode

Download AdwCleaner. Click here and then click the Download Now @ BleepingComputer button. Save the file to the desktop.

NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
Click the Scan button and wait for the scan to finish.
After the Scan has finished the window may or may not show what it found and above the progress bar you will see Pending. Please uncheck elements you don't want to remove. Do Not delete anything at this time.
Click the Report button to get the log.
Copy and Paste it into your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[R0].txt.
Click the X in the upper right corner of the program or click the File menu and click Exit to close the program.

NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

Step-5.

Things For Your Next Post:
Please post the logs in the order requested. Do Not attach the logs unless I request it.
1. Let me know how the uninstalls went. and let me know what you decided about uTorrent
2. The OTL fixes log
3. The aswMBR.txt log
4. The AdwCleaner.[R0].txt log

#10
frichieny

Posted 09 December 2013 - 05:04 AM

Member

Topic Starter
Member
192 posts

Thank you for the information sir

I will delete Utorrent

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== OTL ==========
Process ApplicationUpdater.exe killed successfully!
Service Application Updater stopped successfully!
Service Application Updater deleted successfully!
C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}\ not found.
Prefs.js: S", "" removed from browser.search.defaultenginename,S
Prefs.js: "http://search.speedb...spx?s=CAMe0&q=" removed from browser.search.defaulturl
Prefs.js: "Speedbit Search" removed from browser.search.order.1
Prefs.js: S", "" removed from browser.search.order.1,S
Prefs.js: S", "" removed from browser.search.selectedEngine,S
Prefs.js: [email protected]:6.2 removed from extensions.enabledAddons
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected] deleted successfully.
File C:\Program Files (x86)\SearchPredict\PRFireFox not found.
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0329E7D6-6F54-462D-93F6-F5C3118BADF2} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}\ not found.
File C:\Program Files (x86)\SPEEDbit Video Downloader\SPFireFox not found.
C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\sjehkmhg.default\extensions\[email protected]\content folder moved successfully.
C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\sjehkmhg.default\extensions\[email protected] folder moved successfully.
C:\Users\ACER\AppData\Roaming\mozilla\firefox\profiles\sjehkmhg.default\searchplugins\speedbit.xml moved successfully.
C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT\WTXPCOM\components folder moved successfully.
C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT\WTXPCOM\chrome\content folder moved successfully.
C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT\WTXPCOM\chrome folder moved successfully.
C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT\WTXPCOM folder moved successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F3FEE66E-E034-436a-86E4-9690573BEE8A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3FEE66E-E034-436a-86E4-9690573BEE8A}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Driver Genius deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0d829048-f81a-11e1-8c9c-047d7b9db037}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0d829048-f81a-11e1-8c9c-047d7b9db037}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0d829048-f81a-11e1-8c9c-047d7b9db037}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0d829048-f81a-11e1-8c9c-047d7b9db037}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0d82904c-f81a-11e1-8c9c-047d7b9db037}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0d82904c-f81a-11e1-8c9c-047d7b9db037}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0d82904c-f81a-11e1-8c9c-047d7b9db037}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0d82904c-f81a-11e1-8c9c-047d7b9db037}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{636eef1a-d7d0-11e2-a32d-047d7b9db037}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{636eef1a-d7d0-11e2-a32d-047d7b9db037}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{636eef1a-d7d0-11e2-a32d-047d7b9db037}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{636eef1a-d7d0-11e2-a32d-047d7b9db037}\ not found.
File G:\Setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.
File F:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
File G:\Setup.exe not found.
========== FILES ==========
C:\Program Files (x86)\Application Updater folder moved successfully.
File\Folder C:\Program Files (x86)\SearchPredict not found.
C:\PROGRAM FILES (X86)\COMMON FILES\Spigot\Search Settings\Res folder moved successfully.
C:\PROGRAM FILES (X86)\COMMON FILES\Spigot\Search Settings\Lang folder moved successfully.
C:\PROGRAM FILES (X86)\COMMON FILES\Spigot\Search Settings folder moved successfully.
C:\PROGRAM FILES (X86)\COMMON FILES\Spigot\GC folder moved successfully.
C:\PROGRAM FILES (X86)\COMMON FILES\Spigot folder moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\ACER\Desktop\cmd.bat deleted successfully.
C:\Users\ACER\Desktop\cmd.txt deleted successfully.
File\Folder netsh advfirewall reset not found.
File\Folder netsh advfirewall set allprofiles state on not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: ACER
->Temp folder emptied: 4153831 bytes
->Temporary Internet Files folder emptied: 2931007 bytes
->Java cache emptied: 156788 bytes
->FireFox cache emptied: 41935314 bytes
->Google Chrome cache emptied: 409914537 bytes
->Flash cache emptied: 57230 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56466 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 151370 bytes
->Temporary Internet Files folder emptied: 66196 bytes
->FireFox cache emptied: 68982436 bytes
->Flash cache emptied: 57143 bytes

User: Ipad 2 wifi

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 781985 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 65536 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 95403 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 505.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 12092013_185923

Files\Folders moved on Reboot...
C:\Users\ACER\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\LMutilps32.log scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

#11
frichieny

Posted 09 December 2013 - 05:13 AM

Member

Topic Starter
Member
192 posts

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software
Run date: 2013-12-09 19:04:58
-----------------------------
19:04:58.002 OS Version: Windows x64 6.1.7601 Service Pack 1
19:04:58.002 Number of processors: 4 586 0x2A07
19:04:58.002 ComputerName: ACER-PC UserName: ACER
19:04:59.960 Initialize success
19:06:02.101 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
19:06:02.104 Disk 0 Vendor: TOSHIBA_ GN00 Size: 476940MB BusType: 3
19:06:02.335 Disk 0 MBR read successfully
19:06:02.339 Disk 0 MBR scan
19:06:02.342 Disk 0 Windows 7 default MBR code
19:06:02.360 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 13312 MB offset 2048
19:06:02.373 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 27265024
19:06:02.393 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 231710 MB offset 27469824
19:06:02.418 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 231816 MB offset 502011904
19:06:02.605 Disk 0 scanning C:\Windows\system32\drivers
19:06:09.107 Service scanning
19:06:39.750 Modules scanning
19:06:39.752 Disk 0 trace - called modules:
19:06:40.580 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
19:06:40.589 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007287060]
19:06:40.596 3 CLASSPNP.SYS[fffff8800185143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004c65050]
19:06:40.605 Scan finished successfully
19:07:15.648 Disk 0 MBR has been saved successfully to "C:\Users\ACER\Desktop\MBR.dat"
19:07:15.651 The log file has been saved successfully to "C:\Users\ACER\Desktop\aswMBR.txt"

#12
frichieny

Posted 09 December 2013 - 05:14 AM

Member

Topic Starter
Member
192 posts

# AdwCleaner v3.014 - Report created 09/12/2013 at 19:11:01
# Updated 01/12/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : ACER - ACER-PC
# Running from : C:\Users\ACER\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\Program Files (x86)\Mozilla Firefox\Components\AskSearch.js
File Found : C:\Users\ACER\AppData\Roaming\Mozilla\Firefox\Profiles\sjehkmhg.default\Extensions\[email protected]
File Found : C:\Users\ACER\AppData\Roaming\Mozilla\Firefox\Profiles\sjehkmhg.default\user.js
File Found : C:\Users\ACER\Desktop\Optimizer Pro.lnk
Folder Found C:\Program Files (x86)\Common Files\ParetoLogic
Folder Found C:\Program Files (x86)\driver-soft
Folder Found C:\Program Files (x86)\lucky leap
Folder Found C:\Program Files (x86)\MyPC Backup
Folder Found C:\Program Files (x86)\optimizer pro
Folder Found C:\Program Files (x86)\ParetoLogic
Folder Found C:\Program Files (x86)\YTD Toolbar
Folder Found C:\ProgramData\apn
Folder Found C:\ProgramData\boost_interprocess
Folder Found C:\ProgramData\Browse2save
Folder Found C:\ProgramData\Browse2Save
Folder Found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro
Folder Found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ParetoLogic
Folder Found C:\ProgramData\ParetoLogic
Folder Found C:\ProgramData\RightClick
Folder Found C:\Users\ACER\AppData\LocalLow\Search Settings
Folder Found C:\Users\ACER\AppData\LocalLow\Toolbar4
Folder Found C:\Users\ACER\AppData\Roaming\OpenCandy
Folder Found C:\Users\ACER\AppData\Roaming\optimizer pro
Folder Found C:\Windows\SysWOW64\hotspot shield

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\anchorfree
Key Found : HKCU\Software\AppDataLow\Software\Search Settings
Key Found : HKCU\Software\AppDataLow\SProtector
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Key Found : HKCU\Software\Optimizer Pro
Key Found : HKCU\Software\ParetoLogic
Key Found : HKCU\Software\Search Settings
Key Found : [x64] HKCU\Software\anchorfree
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
Key Found : [x64] HKCU\Software\Optimizer Pro
Key Found : [x64] HKCU\Software\ParetoLogic
Key Found : [x64] HKCU\Software\Search Settings
Key Found : HKLM\Software\Application Updater
Key Found : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Found : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}
Key Found : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Found : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
Key Found : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Key Found : HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Key Found : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6B458F62-592F-4B25-8967-E6A350A59328}
Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key Found : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Key Found : HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{3BCF582D-CA87-4C6F-AF3D-B3548A976AB3}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{AC329328-7EC4-4C34-B672-0A2B90CB9B00}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EC4085F2-8DB3-45A6-AD0B-CA289F3C5D7E}
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\icdlfehblmklkikfigmjhbmmpmkmpooj
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk
Key Found : HKLM\Software\lucky leap
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{603C4CC9-5DC6-4C44-873F-8281509DF953}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IM
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
Key Found : HKLM\Software\ParetoLogic
Key Found : HKLM\Software\Search Settings
Key Found : HKLM\Software\SP Global
Key Found : HKLM\Software\SProtector
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4634804A-F0B0-4A74-A550-FC0EEF8A4362}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4C07EA4F-5F52-4222-B170-4CD9ED33BAEA}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{6B458F62-592F-4B25-8967-E6A350A59328}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{C44FEFF4-EF0C-4CF7-83D0-92B4266A32B9}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{F131923C-381D-4E4C-A472-4A17118FD742}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{F3FEE66E-E034-436A-86E4-9690573BEE8A}]

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16720

Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs] - hxxp://search.speedbit.com//tab/?s=CAMe0

-\\ Mozilla Firefox v15.0.1 (en-US)

[ File : C:\Users\ACER\AppData\Roaming\Mozilla\Firefox\Profiles\sjehkmhg.default\prefs.js ]

Line Found : user_pref("aol_toolbar.default.homepage.check", false);
Line Found : user_pref("aol_toolbar.default.search.check", false);
Line Found : user_pref("browser.startup.homepage_override_url", "hxxp://search.speedbit.com/?s=CAMe0");
Line Found : user_pref("extensions.5114f58b4ac80.scode", "(function(){try{if('aol.com,mail.google.com,premiumreports.info,search.babylon.com,search.gboxapp.com'.indexOf(window.self.location.hostname)>-1) return;}c[...]
Line Found : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Line Found : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Line Found : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Line Found : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Line Found : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Line Found : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Line Found : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Line Found : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Line Found : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Line Found : user_pref("sweetim.toolbar.searchguard.enable", "");

-\\ Google Chrome v

[ File : C:\Users\ACER\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [11509 octets] - [09/12/2013 19:11:01]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [11570 octets] ##########

#13
frichieny

Posted 09 December 2013 - 05:15 AM

Member

Topic Starter
Member
192 posts

We haven't installed any antivirus because we think that's the reason why the laptop is lagging

#14
godawgs

Posted 09 December 2013 - 01:10 PM

Teacher

Retired Staff
8,228 posts

We haven't installed any antivirus because we think that's the reason why the laptop is lagging

It depends. Some antivirus programs use more system resources (RAM) than others, but you have 4GB of Ram so even the biggest resource hog shouldn't cause the system to lag noticeably during normal Windows operation. If the lagging is when you are playing games it is likely something else. It could be a audio or video driver. Or you may need a graphics (video) card with more ram. Or it could be the cracked files you are using for some of the games. I'm not normally concerned about cracked files for games. But the scans do show some cracked files for the Driver Genius Professional Edition program on the machine. This indicates that this is an illegal copy of the software. Please verify that the program was obtained legally or uninstall it.

If cleaning all of the adware and spyware and malicious toolbars and BHOs doesn't clear the problem with the system lagging then it is likely an operating system or device issue and you will need to post a topic in the appropriate forum when we are done.

But either way I can assure that not having an antivirus program, and using a torrent program, IS the reason you have so much rubbish on the system and you will need to install one before we are done. I will link you to our page that will help you choose a good one.

Step-1.

Re-run AdwCleaner

Close all open windows and browsers.

Re-open AdwCleaner

Right click the AdwCleaner icon, click Run as administrator and accept the UAC prompt to run AdwCleaner.
Click the Scan button and wait for the scan to complete.
When the Scan has finished the Scan button will be grayed out and the Clean button will be activated.
Click the Clean button.
Everything checked will be deleted.
When the program has finished cleaning a report appears.
Once done it will ask to reboot, allow this
On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[S0].txt

Step-2.

Scan with JRT:

Posted Image

Please download Junkware Removal Tool to your desktop.

NOTE: Temporarily shut down your protection software now to avoid potential conflicts, how to do so can be read here.

Right click the JRT icon and click Run as Administrator to run the application.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

NOTE: Reboot the machine and ensure that all security software is now enabled.

Please disable any screen saver you have running before completing Steps 3 and 4.

Step-3.

Posted Image

Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware from Here or Here

Once downloaded, close all programs and browsers on your computer and disable any screen saver you might have running.

Right Click the mbam-setup.exe file and click Run As Administrator, then click the Continue button on the UAC window to install the application.

When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings.
When the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
- MBAM will now automatically start and you will see a message stating that you should update the program before performing a scan.
- As MBAM will automatically update itself after the install, you can press the OK button to close that box and you will now be at the main program as shown below.
NOTE: When the program loads, Decline the Malwarebytes' Anti-Malware Trial (You can activate this when we've finished, if you so wish)
On the Scanner tab, make sure the the Perform full scan option is selected and then click on the Scan button to start scanning your computer.
MBAM will now start scanning your computer for malware. This process can take quite a while, so I suggest you go and do something else and periodically check on the status of the scan. When MBAM is scanning it will look like the image below.
When the scan is finished a message box will appear as shown in the image below.

You should click on the OK button to close the message box and continue with the removal process.
You will now be back at the main Scanner screen. At this point you should click on the Show Results button.
A screen displaying all the malware that the program found will be shown as seen in the image below. Please note that the infections found may be different than what is shown in the image.
Make sure that everything is checked EXCEPT items in System Restore (see the image below), and click Remove Selected<---Very Important.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

I would suggest that you keep this antimalware program. Run a Quick Scan frequently and a Full Scan every week or so. Update the definition files before running a scan. Click the Update tab and update from there.

Step-4.

Run ESET Online Scanner:

Note: Optimized for Internet Explorer but you can use Chrome or Mozilla FireFox for this scan.

Important! You will need to disable your currently installed Anti-Virus program, how to do so can be read here.

Vista / 7 users: You will need to to right-click on either the Internet Explorer or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on:

Note: If using Mozilla Firefox a window will open telling you that you will need to download the ESET Smart Installer. Click on esetsmartinstaller_enu.exe to download the Smart Installer. Save it to the desktop.
When prompted double click on the icon on the desktop. After successful installation of ESET Smart Installer ESET Online Scanner is launched in a new window.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
A new window will open:
Select the option YES, I accept the Terms of Use then click on:
When prompted allow the Add-On/Active X to install. The following window will open:
- Uncheck the box beside Remove Found Threats
- Check the box Scan archives.
Now click on Advanced Settings and select the following:
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on:
The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically. The scan may take several hours.
Wait for the scan to finish. Do not touch either the Mouse or keyboard during the scan. Otherwise it may stall.

When The Scan is Complete:

A.
If No Threats Were Found:

Put a checkmark in Uninstall application on close
Close the program
Report to me that nothing was found

B.
If Threats Were Found:

Click on list of threats found
Click on export to text file and save it to the desktop as ESET SCAN.txt
Click on Back
Put a checkmark in Uninstall application on close Be sure you have saved the file first
Click on Finish
Close the program

Don't forget to enable your Antivirus program and screen saver.

Step-5.

Things For Your Next Post:
Please post the logs in the order requested. Do Not attach the logs unless I request it.
1. Let me know about the Driver Genius Professional Edition program.
2. The AdwCleaner[S0].txt log
3. The JRT.txt log
4. The MalwareBytes log
5. The ESET scan log (IF it found anything. If it didn't just tell me.
6. How is the computer running now?