"Suavie On" ver 2.14 - extension in Chrome OTL incld [Solved]

Hi guys,

I am being hit with the brower extension "Suavie On". This program does a little pop up by the toolbar occasionally. But worst of all, the permissions allow it to have access to all my history, passwords etc.

I can only disable it. When deleting via Chrome delete trash can, it just reappears when Chrome is relaunched.

Spybot, malwarebytes both cannot find it.

The strangest to me, is that I get zero finds for a internet search for ""malware" "suavie on"". Could I be the only one? Any assistance would be greatly appreciated.

Thanks!

OTL

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2013/08/22 17:45:17 | 000,483,840 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2014/05/12 17:08:33 | 000,000,000 | ---D | M] -- C:\Users\michael\AppData\Roaming\AnvSoft

[2014/04/07 17:17:26 | 000,000,000 | ---D | M] -- C:\Users\michael\AppData\Roaming\AVAST Software

[2014/06/08 09:47:18 | 000,000,000 | ---D | M] -- C:\Users\michael\AppData\Roaming\Battle.net

[2014/07/07 21:40:21 | 000,000,000 | ---D | M] -- C:\Users\michael\AppData\Roaming\BitTorrent

[2014/06/07 23:03:48 | 000,000,000 | ---D | M] -- C:\Users\michael\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

[2014/04/13 19:43:28 | 000,000,000 | ---D | M] -- C:\Users\michael\AppData\Roaming\SlimCleaner

[2014/07/04 09:15:33 | 000,000,000 | ---D | M] -- C:\Users\michael\AppData\Roaming\TS3Client

[2014/04/08 00:04:26 | 000,000,000 | ---D | M] -- C:\Users\michael\AppData\Roaming\Wargaming.net

[2014/04/27 09:37:45 | 000,000,000 | ---D | M] -- C:\Users\michael\AppData\Roaming\Wise Registry Cleaner

[2014/05/12 16:17:54 | 000,000,000 | ---D | M] -- C:\Users\michael\AppData\Roaming\WiseUpdate

[2014/05/02 21:43:48 | 000,000,000 | ---D | M] -- C:\Users\michael\AppData\Roaming\Xilisoft

========== Purity Check ==========

========== Files - Unicode (All) ==========

[2014/07/08 16:18:41 | 000,038,912 | ---- | C] ()(C:\Users\michael\Desktop\????????.doc) -- C:\Users\michael\Desktop\国宝档案视频资料.doc

[2014/07/08 16:18:40 | 000,038,912 | ---- | M] ()(C:\Users\michael\Desktop\????????.doc) -- C:\Users\michael\Desktop\国宝档案视频资料.doc

========== Alternate Data Streams ==========

@Alternate Data Stream - 237 bytes -> C:\Users\michael\SkyDrive:ms-properties

< End of report >

OTL Extras

OTL Extras logfile created on: 7/9/2014 11:31:56 AM - Run 1

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\michael\Desktop\tools

64bit- Professional (Version = 6.2.9200) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17126)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

15.94 Gb Total Physical Memory | 14.16 Gb Available Physical Memory | 88.85% Memory free

18.31 Gb Paging File | 16.20 Gb Available in Paging File | 88.44% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 223.57 Gb Total Space | 116.30 Gb Free Space | 52.02% Space Free | Partition Type: NTFS

Drive D: | 931.51 Gb Total Space | 636.72 Gb Free Space | 68.35% Space Free | Partition Type: NTFS

Drive E: | 220.31 Gb Total Space | 51.40 Gb Free Space | 23.33% Space Free | Partition Type: NTFS

Drive F: | 4.26 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS

Drive G: | 12.58 Gb Total Space | 1.92 Gb Free Space | 15.27% Space Free | Partition Type: NTFS

Drive H: | 14.91 Gb Total Space | 0.52 Gb Free Space | 3.45% Space Free | Partition Type: FAT32

Computer Name: HAL-9000 | User Name: michael | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

.url[@ = InternetShortcut] -- C:\WINDOWS\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\WINDOWS\SysWow64\control.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)

Directory [Bridge] -- C:\Program Files (x86)\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)

Directory [Bridge] -- C:\Program Files (x86)\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = AC 1C AE C5 46 9F CE 01 [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]

"UpgradeTime" = [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]

"UpgradeTime" = Reg Error: Unknown registry data type -- File not found

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot - Search & Destroy tray access -- (Safer-Networking Ltd.)

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.)

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)

"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0074698E-F315-4635-91CC-904B6CC26BC0}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |

"{0DC9D633-5AD7-46BE-B65A-89343D3C6CC6}" = lport=139 | protocol=6 | dir=in | app=system |

"{17374C44-1B79-4FAB-88A5-A8AAF152D75D}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{22523919-1903-46FB-BA42-EE9018C14ED8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{2A64A810-A104-4A82-AE7B-6C3A4C5CCBFB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{39F2693C-75BC-4D92-B6E0-41E2EEE49ED7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |

"{3C0F3EFF-B497-40B5-BDC1-F722A261915B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{4B779C7D-82D7-4CD5-96E5-EBA6846DA654}" = rport=137 | protocol=17 | dir=out | app=system |

"{4E1D04E4-C40F-4044-89E6-63DB5DD0E2CC}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

"{4F27FE97-48A4-4064-BD2E-3B615F41F5E4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

"{55FA5FD5-1B86-4B6D-8F2E-430E7DAF0E27}" = rport=138 | protocol=17 | dir=out | app=system |

"{56328DCD-EEE6-4D0A-997E-2BBA2333BBFF}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\dashost.exe |

"{57CDECF5-8BFC-4A30-B549-997C4BAD7CFB}" = rport=139 | protocol=6 | dir=out | app=system |

"{5B6D8CFB-BFBD-4590-8F47-E0BF2D3661A3}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |

"{6B8862CA-7A10-4E33-94DC-3B063363BE1F}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |

"{6D527E5E-E720-4DAF-AD99-A31C9FD2E2B8}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |

"{762B47D7-9A61-4ABF-8D3A-E900737DEF35}" = rport=2869 | protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |

"{7A5E7504-0629-441A-A96A-6F3C946BF973}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service v4\intuitupdateservice.exe |

"{86617716-3578-4351-89DE-14FF6569F878}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{926D64F1-6D28-4757-83C7-F6F408B11785}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |

"{9339CD0F-13D6-4251-B6C0-E56D7A7728B1}" = lport=2869 | protocol=6 | dir=in | app=system |

"{A3616EC3-0062-492E-B8C6-8B1167C541D9}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service v4\intuitupdater.exe |

"{ADC5F421-946D-49FA-A43B-B153E0E6A8A8}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{B2245420-C2AA-4A17-9429-F476E727648A}" = lport=10243 | protocol=6 | dir=in | app=system |

"{C3A52487-FF23-49A1-98CD-82F83DBE8422}" = lport=137 | protocol=17 | dir=in | app=system |

"{CD997635-BD71-44C4-BCFF-292B91917198}" = lport=138 | protocol=17 | dir=in | app=system |

"{D4FDA9A0-7EBD-41F7-B1A5-F7E6C872CB98}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{D8C2C689-6311-438D-9314-1A729E403D9D}" = rport=10243 | protocol=6 | dir=out | app=system |

"{DEE98CDD-495C-4D0D-82F3-917E47EC7618}" = lport=445 | protocol=6 | dir=in | app=system |

"{DF9CC92A-5797-4C75-8822-55DF06AD73F3}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{E4311205-4361-4EE8-AC71-5A8754526F83}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |

"{E600ABBF-5627-473E-811F-CC6EAEF17329}" = rport=445 | protocol=6 | dir=out | app=system |

"{ED86C915-C6D5-450E-B55A-56BDECA962D9}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{032B7435-84BA-475B-97A6-E59C16FEFC35}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |

"{0BA59D13-7E3B-4A71-B237-E24099906325}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dayz\dayz.exe |

"{0E46C3FC-3171-459C-A0AF-B99F263CC711}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |

"{2332E199-6604-448C-9A9A-40B55454BF96}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |

"{4442C001-6F59-433B-8D86-93714C5EC245}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |

"{44F2F3DC-1DF1-4054-826F-0AB1EA206D3F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |

"{4DE99BBD-F1D7-4CA0-874D-741D7667C8FB}" = protocol=6 | dir=in | app=c:\program files (x86)\battle.net\battle.net.exe |

"{51B39ACB-7ECF-464E-B137-B19256B4451F}" = protocol=6 | dir=in | app=c:\program files (x86)\hearthstone\hearthstone.exe |

"{51DFFA59-5C1D-4F7F-825C-580A1BF47E02}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |

"{59C6C93E-6B4C-4FB7-9B33-4C683D5FA41D}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.2880\agent.exe |

"{6239D1BF-2AFA-4AFB-8761-34BE40CB8346}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.3023\agent.exe |

"{64A4AAEB-37CB-4DB3-9AA8-77377DFB1634}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dayz\dayz.exe |

"{671982FC-415F-4BAD-9658-FAC0EAFD8661}" = protocol=17 | dir=in | app=c:\program files (x86)\battle.net\battle.net.exe |

"{68C9812B-643D-4C3C-886E-EBD1922B87FD}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |

"{6D886865-4380-4BF6-A28A-6EF9A606596D}" = dir=out | name=@{microsoft.zunevideo_2.2.902.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/ids_manifest_video_app_name} |

"{7582C4DB-1F60-486D-8EF0-63CF3B75D6A3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |

"{76698B13-31DE-4819-92A3-DEF45B849373}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.2880\agent.exe |

"{815A21E6-6BF1-4888-9183-071631CAD120}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{8597D7E6-086C-43C7-9D80-CB0D0A4259E2}" = protocol=6 | dir=out | app=system |

"{8A32D78B-81B6-4919-AC38-D2E2F40A7D56}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.2880\agent.exe |

"{8DB67CBE-4FD7-4443-8D76-4C94EC0AE523}" = protocol=17 | dir=in | app=c:\users\michael\appdata\roaming\bittorrent\bittorrent.exe |

"{98883FD3-06B6-47CC-A88E-624D8D2CA962}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |

"{9A159EBE-4DF9-4BB9-B9BB-29B2B40253AC}" = dir=out | name=@{microsoft.bingmaps_2.1.2922.2139_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} |

"{9B3D4992-B2E3-48FA-B5B6-F2B0942B52D8}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.3023\agent.exe |

"{9EDD910D-236E-44AF-BFA0-88B033C3B23E}" = protocol=1 | dir=in | [email protected],-28543 |

"{A08F8DDB-2319-4D7C-961D-A34AC6D9641F}" = protocol=1 | dir=out | [email protected],-28544 |

"{B58431D0-3F95-4760-8D66-10548B0496E6}" = protocol=58 | dir=out | [email protected],-28546 |

"{B8DF39C8-D811-4B22-8CAD-296070C9DCDB}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |

"{C673D67C-3902-439C-AB6A-C5FB0C65A108}" = protocol=17 | dir=in | app=c:\program files (x86)\hearthstone\hearthstone.exe |

"{C755D584-5AE0-43BF-966D-DFD789B22D7C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{D375E544-2061-460A-B4CA-299EF74CF284}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |

"{D6F6C98C-EBCF-4BCC-A727-92247596D1D2}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.3023\agent.exe |

"{E18147FD-575C-4CDF-84C9-63F0857179F9}" = protocol=58 | dir=in | [email protected],-28545 |

"{E81096CB-3AA3-4C66-A3AD-B4BA16EBAF34}" = dir=out | name=@{refrelentsoftwarelab.bookbazaarreader_2.20.42.471_neutral__ab25ztbpy2gyg?ms-resource://refrelentsoftwarelab.bookbazaarreader/resources/application_name} |

"{E9E3BEB1-2359-480B-9516-D6BD3CC3ADA9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{EA512994-788F-403D-BF53-FA3FC980A1E1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |

"{F51CFBD1-D3E0-455E-8B15-8A0AF2602966}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.3023\agent.exe |

"{F5EA5308-16F3-4E83-9533-FEBB32443E23}" = protocol=6 | dir=in | app=c:\users\michael\appdata\roaming\bittorrent\bittorrent.exe |

"{F66E6561-F0E2-46E8-99FF-7AC3E5DD534B}" = dir=out | name=@{microsoft.bingweather_3.0.2.258_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} |

"{F78D6FC8-78FB-409C-AEE5-9363412C3735}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{FADC3E79-3F62-4A86-AA9D-63FB9BE977F4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |

"{FD86E354-044D-4875-BAF6-9B1F16AEABE2}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.2880\agent.exe |

"TCP Query User{126B4363-DDA6-4114-BE2E-8A5D11439EC3}C:\games\world_of_tanks\worldoftanks.exe" = protocol=6 | dir=in | app=c:\games\world_of_tanks\worldoftanks.exe |

"TCP Query User{1B4BE9CB-9114-487E-9ED8-79E74CD0A02E}C:\program files (x86)\crysis 3\bin32\crysis3.exe" = protocol=6 | dir=in | app=c:\program files (x86)\crysis 3\bin32\crysis3.exe |

"TCP Query User{22B30109-03DA-44CC-AA6A-D7DE51EE8ACC}C:\games\world_of_tanks\wotlauncher.exe" = protocol=6 | dir=in | app=c:\games\world_of_tanks\wotlauncher.exe |

"TCP Query User{C69FA4A6-67E2-4390-8709-36D7DD35E2B1}C:\program files (x86)\google\chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\chrome\application\chrome.exe |

"UDP Query User{3A8E0C0F-C151-4F9B-9257-4479590DE3A2}C:\program files (x86)\crysis 3\bin32\crysis3.exe" = protocol=17 | dir=in | app=c:\program files (x86)\crysis 3\bin32\crysis3.exe |

"UDP Query User{CAA42F03-0691-4B9C-B451-55B94B6BE2B9}C:\program files (x86)\google\chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\chrome\application\chrome.exe |

"UDP Query User{DAB0C8DA-AF25-4298-90DE-3DCA449411CB}C:\games\world_of_tanks\wotlauncher.exe" = protocol=17 | dir=in | app=c:\games\world_of_tanks\wotlauncher.exe |

"UDP Query User{DDD31525-A610-4ACF-9DE4-9DC921BECFDB}C:\games\world_of_tanks\worldoftanks.exe" = protocol=17 | dir=in | app=c:\games\world_of_tanks\worldoftanks.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64

"{409CB30E-E457-4008-9B1A-ED1B9EA21140}" = Intel® Rapid Storage Technology

"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64

"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007

"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007

"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007

"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64

"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64

"{93F692D4-0C4D-4EED-9BFE-657C1D5959FE}" = Intel® Rapid Storage Technology

"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 335.23

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 335.23

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 335.23

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 10.4.0

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Update.Core" = NVIDIA Update Core

"{B5E06417-A4AC-4225-B36E-7E34C91616E7}" = Intel® Trusted Connect Service Client

"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86

"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86

"{0A7DD94B-B746-4FB0-8688-8598C22793A0}" = TurboTax 2013 WinPerFedFormset

"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help

"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86

"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5

"{1EAC1D02-C6AC-4FA6-9A44-96258C37C812NA}_is1" = World of Tanks

"{2A4EEB5C-3BA6-4299-A87F-783861B567D9}" = TurboTax 2013 WinPerReleaseEngine

"{358C44FD-6943-4CDD-B947-7F7C4ADC8A8F}" = TurboTax 2013 WinPerTaxSupport

"{606EB5EB-AADF-4E21-B715-1CAD291181D6}" = TurboTax 2013 wrapper

"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86

"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components

"{6B8D6199-EE44-4FD7-813A-6D8C62C9B384}" = SlimCleaner

"{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}" = Skype™ 6.14

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver

"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007

"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007

"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007

"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007

"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007

"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007

"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007

"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-002A-0409-1000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007

"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007

"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007

"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs

"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007

"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007

"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007

"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0116-0409-1000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007

"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy

"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86

"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86

"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player

"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics DiskDefrag

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"{FFA8548C-9BC2-427F-9F81-E64F620A30CB}_is1" = Mobi File Reader

"AP Tuner 3.08" = AP Tuner 3.08

"Battle.net" = Battle.net

"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help

"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player

"ENTERPRISE" = Microsoft Office Enterprise 2007

"Google Chrome" = Google Chrome

"Hearthstone" = Hearthstone

"HMA! Pro VPN" = HMA! Pro VPN 2.8.3.9

"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware version 2.0.2.1012

"Mozilla Firefox 28.0 (x86 en-US)" = Mozilla Firefox 28.0 (x86 en-US)

"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver

"ÖÐ¹úÒøÁªÃÔÄã¸¶¿Ø¼þ" = ÖÐ¹úÒøÁªÃÔÄã¸¶¿Ø¼þ 1.0.0.9

"ÒøÁªÔÚÏßÖ§¸¶°²È«¿Ø¼þ·ÇIE°æ" = ÒøÁªÔÚÏßÖ§¸¶°²È«¿Ø¼þ·ÇIE°æ 2.0.9.0

"Prism" = Prism Video File Converter

"Steam" = Steam

"Steam App 221100" = DayZ

"TeamSpeak 3 Client" = TeamSpeak 3 Client

"TurboTax 2013" = TurboTax 2013

"VLC media player" = VLC media player 2.1.3

"Wise Registry Cleaner_is1" = Wise Registry Cleaner 8.03

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"BitTorrent" = BitTorrent

========== Last 20 Event Log Errors ==========

[ Application Events ]

Error - 7/8/2014 12:49:00 AM | Computer Name = Hal-9000 | Source = SideBySide | ID = 16842785

Description = Activation context generation failed for "C:\Program Files (x86)\Common

Files\Adobe\OOBE\PDApp\DWA\resources\libraries\ARKCmdFS.dll". Dependent Assembly