[mej_jeff]

I am having issues where sites that I normally visit have   been showing alternating warnings for McAffee Security and Phishing .  I am also having extreme lag between when I type and when the text appears on the screen, which is causing even more frustration.   I ran OTL and have copeid the log.    Can anyone help me?

 

 Please

Attached Files

•  OTL.Txt   123.08KB   113 downloads

Edited by mej_jeff, 27 December 2014 - 09:36 PM.

[Advertisements]

Hello mej_jeff and welcome to GeeksToGo .

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run Junkware Removal Tool

Please download Junkware Removal Tool to your desktop.

• shut down your protection software now to avoid potential conflicts.
• run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
• the tool will open and start scanning your system
• please be patient as this can take a while to complete depending on your system's specifications
• on completion, a log (JRT.txt) is saved to your desktop and will automatically open
• post the contents of JRT.txt into your next message.

Please run OTL again and send a new log, plus Extras.txt which was produced the first time you ran OTL: it can be found on your desktop.

Logs to include with next post:

AdwCleaner log
JRT.txt
New OTL log
Extras.txt

Thanks

Satchfan

 

[Satchfan]

Hello mej_jeff and welcome to GeeksToGo .

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run Junkware Removal Tool

Please download Junkware Removal Tool to your desktop.

• shut down your protection software now to avoid potential conflicts.
• run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
• the tool will open and start scanning your system
• please be patient as this can take a while to complete depending on your system's specifications
• on completion, a log (JRT.txt) is saved to your desktop and will automatically open
• post the contents of JRT.txt into your next message.

Please run OTL again and send a new log, plus Extras.txt which was produced the first time you ran OTL: it can be found on your desktop.

Logs to include with next post:

AdwCleaner log
JRT.txt
New OTL log
Extras.txt

Thanks

Satchfan

 

[Satchfan]

Hi Mel_jeff

 

It has been a couple of days since I replied to your request for help with your computer problems.

 

Please let me know if you are having problems and still need help.

 

Thanks

 

Satchfan

[mej_jeff]

Sorry for the delay.  I have copied my logs.

 

# AdwCleaner v4.106 - Report created 31/12/2014 at 06:28:23

# Updated 21/12/2014 by Xplode

# Database : 2014-12-30.1 [Live]

# Operating System : Windows 8.1  (64 bits)

# Username : family - LAPTOP

# Running from : C:\Users\family\Desktop\adwcleaner_4.106.exe

# Option : Scan

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

File Found : C:\Users\Public\Desktop\eBay.lnk

File Found : C:\Users\Public\Desktop\eBay.lnk

Folder Found : C:\ProgramData\4297798477922099085

Folder Found : C:\Users\family\AppData\Roaming\SkypEmoticons

 

***** [ Scheduled Tasks ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Key Found : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

Key Found : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}

Key Found : HKCU\Software\Classes\pokki

Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\websearch.searchoholic.info

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6fbf2ac2-fcde-4c26-9bd8-bf221f6af8ea}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{e1c596ad-28db-4919-ada7-b5660814f56a}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fbf2ac2-fcde-4c26-9bd8-bf221f6af8ea}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{e1c596ad-28db-4919-ada7-b5660814f56a}

Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}

Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}

Key Found : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

Key Found : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Key Found : HKLM\SOFTWARE\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}

Key Found : HKLM\SOFTWARE\Classes\.

Key Found : HKLM\SOFTWARE\Classes\..9

Key Found : HKLM\SOFTWARE\Classes\BuyNsave.BuyNsave

Key Found : HKLM\SOFTWARE\Classes\BuyNsave.BuyNsave.9

Key Found : HKLM\SOFTWARE\Classes\CLSID\{26B19FA4-E8A1-4A1B-A163-1A1E46F830DD}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{6fbf2ac2-fcde-4c26-9bd8-bf221f6af8ea}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{e1c596ad-28db-4919-ada7-b5660814f56a}

Key Found : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6fbf2ac2-fcde-4c26-9bd8-bf221f6af8ea}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e1c596ad-28db-4919-ada7-b5660814f56a}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6fbf2ac2-fcde-4c26-9bd8-bf221f6af8ea}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e1c596ad-28db-4919-ada7-b5660814f56a}

Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{6fbf2ac2-fcde-4c26-9bd8-bf221f6af8ea}

Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{e1c596ad-28db-4919-ada7-b5660814f56a}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6fbf2ac2-fcde-4c26-9bd8-bf221f6af8ea}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e1c596ad-28db-4919-ada7-b5660814f56a}

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17416

 

 

-\\ Google Chrome v39.0.2171.95

 

[C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\preferences] - Found [Startup_URLs] : hxxp://www.search.ask.com/?tpid=ORJ-V7C&o=APN11412&pf=V7&trgb=CR&p2=%5EBBK%5EOSJ000%5EYY%5ECA&gct=hp&apn_ptnrs=BBK&apn_dtid=%5EOSJ000%5EYY%5ECA&apn_dbr=cr_34.0.1847.116&apn_uid=DEE1657A-50E1-42FF-94FD-A8F717F050DD&itbv=12.10.6.48&doi=2014-04-21&psv=

[C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\preferences] - Found [Homepage] : hxxp://search.conduit.com/?ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP69DF9F64-527A-4EB0-B0C7-AEED3ED4D308&SSPV=

[C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\preferences] - Found [Startup_URLs] : hxxp://search.conduit.com/?ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP69DF9F64-527A-4EB0-B0C7-AEED3ED4D308&SSPV=

[C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\preferences] - Found [Homepage] : hxxp://search.conduit.com/?ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP69DF9F64-527A-4EB0-B0C7-AEED3ED4D308&SSPV=

[C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\preferences] - Found [Startup_URLs] : hxxp://search.conduit.com/?ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP69DF9F64-527A-4EB0-B0C7-AEED3ED4D308&SSPV=

[C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\preferences] - Found [Startup_URLs] : hxxp://isearch.avg.com/?cid={49A5ED93-EFF0-4CDC-B4F7-E1CC71514C82}&mid=fda35c24e47247d3b959d158d3fa0b96-b602d594afd2b0b327e07a06f36ca6a7e42546d0&lang=en&ds=AVG&pr=pr&d=2013-05-01%2011:29:23&v=14.2.0.1&pid=avg&sg=&sap=hp

[C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\preferences] - Found [Startup_URLs] : hxxp://websearch.searchoholic.info/?pid=21062&r=2014/12/23&hid=11016300719269760997&lg=EN&cc=CA&unqvl=72

 

*************************

 

AdwCleaner[R0].txt - [5820 octets] - [31/12/2014 06:28:23]

 

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [5880 octets] ##########

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.1 (12.28.2014:1)

OS: Windows 8.1 x64

Ran by family on 2014-12-31 at  6:35:13.03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Registry Values

 

 

 

~~~ Registry Keys

 

 

 

~~~ Files

 

 

 

~~~ Folders

 

 

 

~~~ Event Viewer Logs were cleared

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 2014-12-31 at  6:39:09.94

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

OTL logfile created on: 2014-12-31 6:43:06 AM - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\family\Desktop

64bit- An unknown product  (Version = 6.2.9200) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17498)

Locale: 00001009 | Country: Canada | Language: ENC | Date Format: yyyy-MM-dd

 

7.89 Gb Total Physical Memory | 6.40 Gb Available Physical Memory | 81.18% Memory free

9.14 Gb Paging File | 7.66 Gb Available in Paging File | 83.88% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 448.69 Gb Total Space | 413.07 Gb Free Space | 92.06% Space Free | Partition Type: NTFS

 

Computer Name: LAPTOP | User Name: family | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - [2014-12-27 20:01:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\family\Desktop\OTL.exe

PRC - [2014-12-05 19:50:53 | 000,856,904 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

PRC - [2014-09-12 13:27:40 | 000,342,312 | ---- | M] (Smilebox, Inc.) -- C:\Users\family\AppData\Roaming\Smilebox\SmileboxTray.exe

PRC - [2013-07-26 22:57:38 | 002,650,696 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer Portal\CCDMonitorService.exe

PRC - [2012-07-13 18:27:00 | 000,769,432 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe

PRC - [2011-11-23 20:21:24 | 000,025,704 | R--- | M] (Amazon.com) -- C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe

 

 

========== Modules (No Company Name) ==========

 

MOD - [2014-12-05 19:50:50 | 009,009,480 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\pdf.dll

MOD - [2014-12-05 19:50:46 | 001,077,064 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libglesv2.dll

MOD - [2014-12-05 19:50:45 | 000,211,272 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libegl.dll

MOD - [2014-12-05 19:50:44 | 001,677,128 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll

MOD - [2014-04-23 15:05:12 | 000,073,544 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2014-04-23 15:04:54 | 001,044,808 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2013-07-30 19:11:44 | 000,088,648 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi plug-in\Clearfishellext.dll

 

 

========== Services (SafeList) ==========

 

SRV:64bit: - File not found [Auto | Stopped] -- C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe /McCoreSvc -- (McMPFSvc)

SRV:64bit: - File not found [Auto | Stopped] -- C:\Program Files\McAfee\MSC\McAPExe.exe -- (McAPExe)

SRV:64bit: - [2014-10-30 22:51:25 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)

SRV:64bit: - [2014-10-06 19:54:27 | 000,226,304 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)

SRV:64bit: - [2014-09-21 21:05:56 | 000,368,632 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\NisSrv.exe -- (WdNisSvc)

SRV:64bit: - [2014-09-21 21:05:56 | 000,023,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)

SRV:64bit: - [2014-08-15 21:29:38 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)

SRV:64bit: - [2014-08-15 18:58:35 | 000,287,744 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\SystemEventsBrokerServer.dll -- (SystemEventsBroker)

SRV:64bit: - [2014-08-15 18:45:51 | 000,267,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\bisrv.dll -- (BrokerInfrastructure)

SRV:64bit: - [2014-07-24 01:28:58 | 001,600,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\workfolderssvc.dll -- (workfolderssvc)

SRV:64bit: - [2014-04-03 16:15:34 | 000,189,912 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Windows\SysNative\mfevtps.exe -- (mfevtp)

SRV:64bit: - [2014-04-03 16:07:34 | 000,219,752 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)

SRV:64bit: - [2014-03-14 00:26:25 | 000,491,520 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\GeofenceMonitorService.dll -- (lfsvc)

SRV:64bit: - [2014-03-07 23:41:25 | 001,306,624 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\AppXDeploymentServer.dll -- (AppXSvc)

SRV:64bit: - [2014-03-06 01:02:13 | 000,834,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netlogon.dll -- (Netlogon)

SRV:64bit: - [2014-02-22 09:53:10 | 003,394,384 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\WSService.dll -- (WSService)

SRV:64bit: - [2014-02-22 03:57:16 | 000,710,656 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsm.dll -- (LSM)

SRV:64bit: - [2014-02-22 03:26:58 | 000,366,080 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wcmsvc.dll -- (Wcmsvc)

SRV:64bit: - [2014-02-22 03:25:39 | 000,399,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\das.dll -- (DeviceAssociationService)

SRV:64bit: - [2014-02-22 03:23:58 | 001,576,960 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\wlidsvc.dll -- (wlidsvc)

SRV:64bit: - [2013-12-10 01:35:18 | 000,530,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppReadiness.dll -- (AppReadiness)

SRV:64bit: - [2013-10-01 19:31:06 | 000,101,192 | ---- | M] (ELAN Microelectronics Corp.) [Auto | Running] -- C:\Program Files\Elantech\ETDService.exe -- (ETDService)

SRV:64bit: - [2013-08-22 05:32:02 | 000,024,576 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wephostsvc.dll -- (WEPHOSTSVC)

SRV:64bit: - [2013-08-22 05:31:43 | 000,040,448 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\efssvc.dll -- (EFS)

SRV:64bit: - [2013-08-22 05:22:45 | 000,066,048 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wiarpc.dll -- (WiaRpc)

SRV:64bit: - [2013-08-22 05:21:15 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svsvc.dll -- (svsvc)

SRV:64bit: - [2013-08-22 05:16:57 | 000,118,272 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fhsvc.dll -- (fhsvc)

SRV:64bit: - [2013-08-22 04:25:28 | 000,164,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcaSvc.dll -- (NcaSvc)

SRV:64bit: - [2013-08-22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicvss)

SRV:64bit: - [2013-08-22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmictimesync)

SRV:64bit: - [2013-08-22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicshutdown)

SRV:64bit: - [2013-08-22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicrdv)

SRV:64bit: - [2013-08-22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmickvpexchange)

SRV:64bit: - [2013-08-22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicheartbeat)

SRV:64bit: - [2013-08-22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicguestinterface)

SRV:64bit: - [2013-08-22 04:02:47 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\smphost.dll -- (smphost)

SRV:64bit: - [2013-08-22 03:57:25 | 000,130,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\ScDeviceEnum.dll -- (ScDeviceEnum)

SRV:64bit: - [2013-08-22 03:54:59 | 000,059,392 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso)

SRV:64bit: - [2013-08-22 03:50:59 | 000,245,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\TimeBrokerServer.dll -- (TimeBroker)

SRV:64bit: - [2013-08-22 03:50:00 | 000,525,312 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm)

SRV:64bit: - [2013-08-22 03:45:59 | 000,151,040 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\ncbservice.dll -- (NcbService)

SRV:64bit: - [2013-08-22 03:40:49 | 000,248,832 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\vaultsvc.dll -- (VaultSvc)

SRV:64bit: - [2013-08-22 03:31:03 | 000,201,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\DeviceSetupManager.dll -- (DsmSvc)

SRV:64bit: - [2013-08-22 03:15:54 | 000,073,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcdAutoSetup.dll -- (NcdAutoSetup)

SRV:64bit: - [2013-08-02 19:47:44 | 000,457,768 | ---- | M] (Acer Incorporate) [Auto | Running] -- C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe -- (LMSvc)

SRV:64bit: - [2013-08-02 19:33:16 | 000,448,040 | ---- | M] (Acer Incorporate) [On_Demand | Running] -- C:\Program Files\Acer\Acer Quick Access\RMSvc.exe -- (RMSvc)

SRV:64bit: - [2013-08-02 19:33:14 | 000,457,768 | ---- | M] (Acer Incorporate) [On_Demand | Running] -- C:\Program Files\Acer\Acer Quick Access\QASvc.exe -- (QASvc)

SRV:64bit: - [2013-07-05 17:19:04 | 000,663,592 | ---- | M] (Acer Incorporated) [On_Demand | Running] -- C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe -- (ePowerSvc)

SRV:64bit: - [2013-07-01 21:08:48 | 000,822,232 | ---- | M] (Intel® Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe -- (Intel®

SRV:64bit: - [2013-07-01 21:08:32 | 000,733,696 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe -- (Intel®

SRV - [2014-08-15 21:29:38 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)

SRV - [2014-04-03 20:21:48 | 000,315,008 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2014-03-14 00:10:16 | 000,357,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GeofenceMonitorService.dll -- (lfsvc)

SRV - [2013-11-24 19:49:06 | 000,279,024 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)

SRV - [2013-09-07 02:52:20 | 000,312,448 | ---- | M] (Windows ® Win 7 DDK provider) [Auto | Running] -- C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe -- (AtherosSvc)

SRV - [2013-08-21 21:55:35 | 000,018,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\StorSvc.dll -- (StorSvc)

SRV - [2013-08-21 20:53:34 | 000,011,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\smphost.dll -- (smphost)

SRV - [2013-08-01 23:31:10 | 004,278,112 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)

SRV - [2013-07-26 22:57:38 | 002,650,696 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Acer Portal\CCDMonitorService.exe -- (CCDMonitorService)

SRV - [2012-07-13 18:27:00 | 000,769,432 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)

SRV - [2012-04-24 15:37:56 | 000,169,752 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe -- (ICCS)

SRV - [2011-11-23 20:21:24 | 000,025,704 | R--- | M] (Amazon.com) [Auto | Running] -- C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe -- (ADVService)

 

 

========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2014-10-12 20:43:17 | 000,238,912 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)

DRV:64bit: - [2014-10-12 20:43:17 | 000,086,336 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\pdc.sys -- (pdc)

DRV:64bit: - [2014-10-12 20:43:17 | 000,039,744 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\intelpep.sys -- (intelpep)

DRV:64bit: - [2014-10-09 19:58:57 | 000,027,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2014-09-21 21:06:16 | 000,258,368 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdFilter.sys -- (WdFilter)

DRV:64bit: - [2014-09-21 21:06:16 | 000,114,496 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdNisDrv.sys -- (WdNisDrv)

DRV:64bit: - [2014-09-21 20:49:43 | 000,035,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdBoot.sys -- (WdBoot)

DRV:64bit: - [2014-08-14 18:36:55 | 000,146,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpioclx.sys -- (GPIOClx0101)

DRV:64bit: - [2014-07-24 09:28:38 | 000,468,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBHUB3.SYS -- (USBHUB3)

DRV:64bit: - [2014-07-24 09:28:38 | 000,412,992 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\spaceport.sys -- (spaceport)

DRV:64bit: - [2014-07-24 05:42:22 | 000,126,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NdisImPlatform.sys -- (NdisImPlatform)

DRV:64bit: - [2014-05-01 07:31:39 | 000,055,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wpcfltr.sys -- (wpcfltr)

DRV:64bit: - [2014-04-03 16:23:54 | 000,070,592 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cfwids.sys -- (cfwids)

DRV:64bit: - [2014-04-03 16:16:04 | 000,346,760 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfewfpk.sys -- (mfewfpk)

DRV:64bit: - [2014-04-03 16:10:34 | 000,784,760 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk)

DRV:64bit: - [2014-04-03 16:08:04 | 000,522,360 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfefirek.sys -- (mfefirek)

DRV:64bit: - [2014-04-03 16:06:04 | 000,311,856 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk)

DRV:64bit: - [2014-04-03 16:03:32 | 000,177,544 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk)

DRV:64bit: - [2014-04-03 15:43:16 | 000,069,352 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\mfeelamk.sys -- (mfeelamk)

DRV:64bit: - [2014-03-19 21:41:20 | 000,376,152 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\clfs.sys -- (CLFS)

DRV:64bit: - [2014-03-13 06:35:24 | 000,157,016 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\wof.sys -- (Wof)

DRV:64bit: - [2014-03-08 14:40:16 | 000,136,024 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\wfplwfs.sys -- (WFPLWFS)

DRV:64bit: - [2014-02-22 09:49:51 | 000,325,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBXHCI.SYS -- (USBXHCI)

DRV:64bit: - [2014-02-22 09:49:49 | 000,189,784 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UCX01000.SYS -- (UCX01000)

DRV:64bit: - [2014-02-22 09:49:49 | 000,079,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdstor.sys -- (sdstor)

DRV:64bit: - [2014-02-22 09:44:13 | 000,924,504 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\refs.sys -- (ReFS)

DRV:64bit: - [2014-02-22 06:14:02 | 000,033,280 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicRender.sys -- (BasicRender)

DRV:64bit: - [2013-12-04 12:41:54 | 000,226,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthLEEnum.sys -- (BthLEEnum)

DRV:64bit: - [2013-11-01 19:26:42 | 000,449,496 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)

DRV:64bit: - [2013-11-01 19:21:34 | 004,207,104 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2013-10-28 19:08:35 | 000,039,320 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\intelaud.sys -- (intaud_WaveExtensible)

DRV:64bit: - [2013-10-28 19:08:35 | 000,027,032 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iwdbus.sys -- (iwdbus)

DRV:64bit: - [2013-10-25 19:54:32 | 000,146,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx2.sys -- (SerCx2)

DRV:64bit: - [2013-10-05 09:25:54 | 000,057,176 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stornvme.sys -- (stornvme)

DRV:64bit: - [2013-10-01 19:31:08 | 000,370,504 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)

DRV:64bit: - [2013-09-14 08:06:57 | 000,175,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VerifierExt.sys -- (VerifierExt)

DRV:64bit: - [2013-09-07 02:29:14 | 000,594,120 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter)

DRV:64bit: - [2013-09-07 02:29:14 | 000,338,120 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_a2dp.sys -- (BTATH_A2DP)

DRV:64bit: - [2013-09-07 02:29:14 | 000,179,432 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_hcrp.sys -- (BTATH_HCRP)

DRV:64bit: - [2013-09-07 02:29:14 | 000,137,928 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_rcp.sys -- (BTATH_RCP)

DRV:64bit: - [2013-09-07 02:29:14 | 000,116,424 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_avdt.sys -- (btath_avdt)

DRV:64bit: - [2013-09-07 02:29:14 | 000,089,800 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_flt.sys -- (AthBTPort)

DRV:64bit: - [2013-09-07 02:29:14 | 000,077,464 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_lwflt.sys -- (BTATH_LWFLT)

DRV:64bit: - [2013-09-07 02:29:14 | 000,034,384 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_bus.sys -- (BTATH_BUS)

DRV:64bit: - [2013-09-04 03:37:00 | 000,309,976 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsBaStor.sys -- (RSBASTOR)

DRV:64bit: - [2013-08-22 13:11:03 | 000,037,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)

DRV:64bit: - [2013-08-22 07:25:40 | 000,043,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\condrv.sys -- (condrv)

DRV:64bit: - [2013-08-22 07:25:40 | 000,030,048 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2013-08-22 06:50:19 | 000,057,696 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\dam.sys -- (dam)

DRV:64bit: - [2013-08-22 06:49:54 | 000,079,712 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\acpiex.sys -- (acpiex)

DRV:64bit: - [2013-08-22 06:49:33 | 000,159,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)

DRV:64bit: - [2013-08-22 06:43:49 | 000,063,840 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\mvumis.sys -- (mvumis)

DRV:64bit: - [2013-08-22 06:43:48 | 000,041,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpiowin32.sys -- (msgpiowin32)

DRV:64bit: - [2013-08-22 06:43:45 | 003,357,024 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2013-08-22 06:43:45 | 000,093,536 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2013-08-22 06:43:45 | 000,082,784 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sss.sys -- (LSI_SSS)

DRV:64bit: - [2013-08-22 06:43:45 | 000,064,352 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2013-08-22 06:43:44 | 000,081,760 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas3.sys -- (LSI_SAS3)

DRV:64bit: - [2013-08-22 06:43:41 | 000,782,176 | ---- | M] (PMC-Sierra) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\adp80xx.sys -- (ADP80XX)

DRV:64bit: - [2013-08-22 06:43:41 | 000,531,296 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2013-08-22 06:43:41 | 000,259,424 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2013-08-22 06:43:41 | 000,108,896 | ---- | M] (LSI) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\3ware.sys -- (3ware)

DRV:64bit: - [2013-08-22 06:43:41 | 000,079,200 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2013-08-22 06:43:40 | 000,114,016 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\EhStorTcgDrv.sys -- (EhStorTcgDrv)

DRV:64bit: - [2013-08-22 06:43:40 | 000,082,784 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\EhStorClass.sys -- (EhStorClass)

DRV:64bit: - [2013-08-22 06:43:40 | 000,025,952 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2013-08-22 06:43:34 | 000,305,504 | ---- | M] (VIA Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\VSTXRAID.SYS -- (VSTXRAID)

DRV:64bit: - [2013-08-22 06:43:33 | 000,074,080 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\uaspstor.sys -- (UASPStor)

DRV:64bit: - [2013-08-22 06:43:32 | 000,031,072 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2013-08-22 06:43:31 | 000,107,872 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\storahci.sys -- (storahci)

DRV:64bit: - [2013-08-22 06:43:31 | 000,072,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SpbCx.sys -- (SpbCx)

DRV:64bit: - [2013-08-22 06:43:31 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx.sys -- (SerCx)

DRV:64bit: - [2013-08-22 06:39:15 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\uefi.sys -- (UEFI)

DRV:64bit: - [2013-08-22 06:37:27 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpci.sys -- (vpci)

DRV:64bit: - [2013-08-22 06:36:12 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WpdUpFltr.sys -- (WpdUpFltr)

DRV:64bit: - [2013-08-22 05:39:54 | 000,076,800 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ahcache.sys -- (ahcache)

DRV:64bit: - [2013-08-22 05:39:31 | 000,050,688 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicDisplay.sys -- (BasicDisplay)

DRV:64bit: - [2013-08-22 05:39:20 | 000,022,016 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HyperVideo.sys -- (HyperVideo)

DRV:64bit: - [2013-08-22 05:39:06 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mshidumdf.sys -- (mshidumdf)

DRV:64bit: - [2013-08-22 05:38:58 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpitime.sys -- (acpitime)

DRV:64bit: - [2013-08-22 05:38:48 | 000,010,240 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpipagr.sys -- (acpipagr)

DRV:64bit: - [2013-08-22 05:38:39 | 000,036,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthAvrcpTg.sys -- (BthAvrcpTg)

DRV:64bit: - [2013-08-22 05:38:26 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kdnic.sys -- (kdnic)

DRV:64bit: - [2013-08-22 05:38:23 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmgencounter.sys -- (gencounter)

DRV:64bit: - [2013-08-22 05:38:22 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\npsvctrig.sys -- (npsvctrig)

DRV:64bit: - [2013-08-22 05:38:16 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthhfHid.sys -- (bthhfhid)

DRV:64bit: - [2013-08-22 05:37:49 | 000,013,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hyperkbd.sys -- (hyperkbd)

DRV:64bit: - [2013-08-22 05:37:46 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2013-08-22 05:37:42 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bthhfenum.sys -- (BthHFEnum)

DRV:64bit: - [2013-08-22 05:37:28 | 000,056,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2013-08-22 05:37:28 | 000,041,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidi2c.sys -- (hidi2c)

DRV:64bit: - [2013-08-22 05:37:14 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)

DRV:64bit: - [2013-08-22 05:36:43 | 000,087,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netvsc63.sys -- (netvsc)

DRV:64bit: - [2013-08-22 05:36:25 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NdisVirtualBus.sys -- (NdisVirtualBus)

DRV:64bit: - [2013-08-22 05:36:07 | 000,066,560 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mslldp.sys -- (MsLldp)

DRV:64bit: - [2013-08-22 05:35:42 | 000,103,424 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\Ndu.sys -- (Ndu)

DRV:64bit: - [2013-08-22 02:46:33 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fxppm.sys -- (FxPPM)

DRV:64bit: - [2013-08-15 21:13:30 | 003,859,968 | ---- | M] (Qualcomm Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athwbx.sys -- (athr)

DRV:64bit: - [2013-08-15 00:28:42 | 000,830,680 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt630x64.sys -- (RTL8168)

DRV:64bit: - [2013-08-12 17:25:46 | 000,017,624 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bcmfn2.sys -- (bcmfn2)

DRV:64bit: - [2013-08-09 18:39:30 | 000,651,248 | ---- | M] (Intel Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\iaStorAV.sys -- (iaStorAV)

DRV:64bit: - [2013-07-30 12:47:35 | 000,024,568 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_GPIO.sys -- (iaLPSSi_GPIO)

DRV:64bit: - [2013-07-29 19:24:22 | 000,150,104 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NARAx64\0405000.009\ccSetx64.sys -- (ccSet_NARA)

DRV:64bit: - [2013-07-25 13:05:39 | 000,099,320 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_I2C.sys -- (iaLPSSi_I2C)

DRV:64bit: - [2013-07-17 03:59:00 | 000,021,360 | ---- | M] (Acer Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMDriver.sys -- (LMDriver)

DRV:64bit: - [2013-07-17 03:59:00 | 000,014,680 | ---- | M] (Acer Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RadioShim.sys -- (RadioShim)

DRV:64bit: - [2013-07-01 21:10:20 | 000,087,568 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\TXEIx64.sys -- (TXEIx64)

DRV:64bit: - [2013-07-01 10:50:06 | 008,536,752 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BCMWL63a.SYS -- (BCM43XX)

DRV:64bit: - [2012-08-21 12:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE:64bit: - HKLM\..\SearchScopes\{C380737C-A9B1-4D88-B232-C2664B0259CA}: "URL" = http://www.bing.com/...=IE10TR&pc=ACJB

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.com

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{C380737C-A9B1-4D88-B232-C2664B0259CA}: "URL" = http://www.bing.com/...=IE10TR&pc=ACJB

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer13.msn.com/?pc=ACJB

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.com

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{8EE2AF2D-7DD0-4FE5-9113-6C9A0BCB3EA6}: "URL" = https://ca.search.ya...p={SearchTerms}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 

========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

 

 

 

========== Chrome  ==========

 

CHR - default_search_provider:  ()

CHR - default_search_provider: search_url = 

CHR - default_search_provider: suggest_url = 

CHR - homepage: http://search.condui...D3ED4D308&SSPV=

CHR - plugin: Error reading preferences file

CHR - Extension: Google Drive = C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\

CHR - Extension: YouTube = C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\

CHR - Extension: Google Search = C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\

CHR - Extension: Power Twitter for Google Chromeâ„¢ = C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\Extensions\iieehhjfejnoljbnnhfnhibcjhmifffo\1.80_0\

CHR - Extension: Thin Scroll Bar = C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojmmnceaidnmminjjffpndcbdibelgam\153\

CHR - Extension: Gmail = C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

 

O1 HOSTS File: ([2013-08-22 07:25:41 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4 - HKCU..\Run: [GoogleChromeAutoLaunch_CBF5B9A4E61DA0A95CF8323399CBDB0A] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

O4 - HKCU..\Run: [SmileboxTray] C:\Users\family\AppData\Roaming\Smilebox\SmileboxTray.exe (Smilebox, Inc.)

O4 - HKCU..\Run: [Spotify Web Helper] C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)

O4 - HKCU..\RunOnce: [Application Restart #1] C:\Users\family\AppData\Local\Pokki\Engine\HostAppService.exe  --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side-phishing-detection --enable-file-cookies --disable-sync --disable-breakpad --disable-bundled-ppapi-flash --disable-sync-tabs --disable-speech-input --disable-custom-jumplist --process-per-tab --debug-devtools-frontend="C:\Users\family\AppData\Local\Pokki\Engine\inspector" --no-first-run --lang=en-US --disable-component-update --disable-prompt-on-repost --no-startup-window --disable-translate --disable-logging --disable-desktop-notifications --disable-gpu-process-prelaunch --flag-switches-begin --flag-switches-end --restore-last-session File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: BtvStack = "C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe" (Qualcomm®Atheros®)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{185EC8B2-5E28-4E3C-B650-2D63C81D3AEE}: DhcpNameServer = 10.0.0.1

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

========== Files/Folders - Created Within 30 Days ==========

 

[2014-12-31 06:35:11 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT

[2014-12-31 06:34:52 | 001,707,939 | ---- | C] (Thisisu) -- C:\Users\family\Desktop\JRT.exe

[2014-12-31 06:28:19 | 000,000,000 | ---D | C] -- C:\AdwCleaner

[2014-12-28 16:50:02 | 000,129,752 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2014-12-28 16:49:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

[2014-12-28 16:49:52 | 000,093,400 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys

[2014-12-28 16:49:52 | 000,064,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys

[2014-12-28 16:49:52 | 000,025,816 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2014-12-28 16:49:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware

[2014-12-28 16:47:16 | 020,447,072 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\family\Desktop\mbam-setup-2.0.4.1028 (1).exe

[2014-12-28 12:19:38 | 020,447,072 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\family\Desktop\mbam-setup-2.0.4.1028.exe

[2014-12-27 20:39:35 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee

[2014-12-27 20:01:07 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\family\Desktop\OTL.exe

[2014-12-22 18:42:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2014-12-22 18:36:11 | 000,000,000 | ---D | C] -- C:\Users\family\AppData\Local\Diagnostics

[2014-12-22 18:33:20 | 000,000,000 | ---D | C] -- C:\Users\family\AppData\Local\Programs

[2014-12-22 18:32:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Thin Scroll Bar

[2014-12-22 18:31:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\YYoutubeAdBloccke

[2014-12-22 18:30:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BeuyNsave

[2014-12-22 18:30:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BBuuYNNsiave

[2014-12-22 18:28:50 | 000,000,000 | ---D | C] -- C:\ProgramData\lodmibcapnliapmbjlhgabpgfllgoeab

[2014-12-19 04:58:46 | 000,000,000 | ---D | C] -- C:\Users\family\Desktop\s_files

[2014-12-13 21:11:02 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appraiser

[2014-12-07 16:00:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

[2014-12-07 16:00:25 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight

[2014-12-07 16:00:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight

[2014-12-04 09:00:57 | 000,000,000 | ---D | C] -- C:\Users\family\AppData\Local\Skype

[2014-12-04 09:00:41 | 000,000,000 | ---D | C] -- C:\Users\family\AppData\Roaming\Skype

[2014-12-02 19:25:30 | 000,000,000 | -HSD | C] -- C:\Users\family\AppData\Local\EmieBrowserModeList

[2014-12-01 16:30:30 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2014-12-01 16:30:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2014-12-01 16:30:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2014-12-01 16:30:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype

 

========== Files - Modified Within 30 Days ==========

 

[2021-10-21 07:36:56 | 000,000,852 | ---- | M] () -- C:\Windows\SysNative\drivers\RTKHDRC.dat

[2021-10-04 01:34:42 | 000,000,712 | ---- | M] () -- C:\Windows\SysNative\drivers\RTMICEQ0.dat

[2014-12-31 06:38:52 | 000,863,592 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2014-12-31 06:38:52 | 000,735,932 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2014-12-31 06:38:52 | 000,139,816 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2014-12-31 06:34:53 | 001,707,939 | ---- | M] (Thisisu) -- C:\Users\family\Desktop\JRT.exe

[2014-12-31 06:33:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2014-12-31 06:32:20 | 000,000,916 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2014-12-31 06:31:28 | 268,435,456 | -HS- | M] () -- C:\swapfile.sys

[2014-12-31 06:31:24 | 2479,112,191 | -HS- | M] () -- C:\hiberfil.sys

[2014-12-31 06:26:58 | 002,173,952 | ---- | M] () -- C:\Users\family\Desktop\adwcleaner_4.106.exe

[2014-12-31 05:52:00 | 000,000,920 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2014-12-28 16:50:55 | 000,129,752 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2014-12-28 16:49:56 | 000,001,078 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2014-12-28 16:49:13 | 020,447,072 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\family\Desktop\mbam-setup-2.0.4.1028 (1).exe

[2014-12-28 12:20:31 | 020,447,072 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\family\Desktop\mbam-setup-2.0.4.1028.exe

[2014-12-27 20:01:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\family\Desktop\OTL.exe

[2014-12-26 22:03:06 | 000,337,808 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2014-12-23 08:46:00 | 000,002,268 | -H-- | M] () -- C:\Users\family\Documents\Default.rdp

[2014-12-22 18:15:03 | 000,008,735 | ---- | M] () -- C:\Users\family\Desktop\Qu'Appelle Valley Sk winter.jpg

[2014-12-22 09:17:33 | 000,116,869 | ---- | M] () -- C:\Users\family\Desktop\DOC.PDF

[2014-12-19 04:58:46 | 000,014,134 | ---- | M] () -- C:\Users\family\Desktop\s.html

[2014-12-12 04:53:47 | 000,002,167 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2014-12-09 06:11:54 | 001,616,879 | ---- | M] () -- C:\Users\family\Desktop\Scan0004.pdf

[2014-12-09 06:11:45 | 000,823,079 | ---- | M] () -- C:\Users\family\Desktop\Scan.pdf

[2014-12-09 06:11:00 | 001,064,773 | ---- | M] () -- C:\Users\family\Desktop\Scan0005.pdf

[2014-12-09 06:09:36 | 001,375,682 | ---- | M] () -- C:\Users\family\Desktop\Scan0003.pdf

[2014-12-09 06:09:30 | 001,750,452 | ---- | M] () -- C:\Users\family\Desktop\Scan0002 (1).pdf

[2014-12-09 05:15:37 | 001,235,712 | ---- | M] () -- C:\Users\family\Desktop\Scan0006.pdf

[2014-12-09 05:11:04 | 001,750,452 | ---- | M] () -- C:\Users\family\Desktop\Scan0002.pdf

[2014-12-09 05:10:56 | 001,400,125 | ---- | M] () -- C:\Users\family\Desktop\Scan0001.pdf

[2014-12-01 16:30:30 | 000,002,531 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

 

========== Files Created - No Company Name ==========

 

[2014-12-31 06:26:58 | 002,173,952 | ---- | C] () -- C:\Users\family\Desktop\adwcleaner_4.106.exe

[2014-12-28 16:49:56 | 000,001,078 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2014-12-22 18:15:02 | 000,008,735 | ---- | C] () -- C:\Users\family\Desktop\Qu'Appelle Valley Sk winter.jpg

[2014-12-22 09:17:32 | 000,116,869 | ---- | C] () -- C:\Users\family\Desktop\DOC.PDF

[2014-12-19 04:58:45 | 000,014,134 | ---- | C] () -- C:\Users\family\Desktop\s.html

[2014-12-09 06:11:53 | 001,616,879 | ---- | C] () -- C:\Users\family\Desktop\Scan0004.pdf

[2014-12-09 06:11:44 | 000,823,079 | ---- | C] () -- C:\Users\family\Desktop\Scan.pdf

[2014-12-09 06:10:59 | 001,064,773 | ---- | C] () -- C:\Users\family\Desktop\Scan0005.pdf

[2014-12-09 06:09:35 | 001,375,682 | ---- | C] () -- C:\Users\family\Desktop\Scan0003.pdf

[2014-12-09 06:09:30 | 001,750,452 | ---- | C] () -- C:\Users\family\Desktop\Scan0002 (1).pdf

[2014-12-09 05:15:36 | 001,235,712 | ---- | C] () -- C:\Users\family\Desktop\Scan0006.pdf

[2014-12-09 05:11:03 | 001,750,452 | ---- | C] () -- C:\Users\family\Desktop\Scan0002.pdf

[2014-12-09 05:10:55 | 001,400,125 | ---- | C] () -- C:\Users\family\Desktop\Scan0001.pdf

[2014-12-01 16:30:30 | 000,002,531 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2014-06-25 08:00:28 | 000,002,255 | ---- | C] () -- C:\Windows\SysWow64\WimBootCompress.ini

[2014-06-15 07:06:04 | 000,103,936 | ---- | C] () -- C:\Windows\SysWow64\OEMLicense.dll

[2014-03-12 11:37:33 | 000,000,000 | -H-- | C] () -- C:\ProgramData\DP45977C.lfl

[2013-11-27 20:29:10 | 000,317,440 | ---- | C] () -- C:\Windows\SysWow64\igdmd32.dll

[2013-11-27 20:29:10 | 000,182,272 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll

[2013-11-27 20:29:09 | 000,142,848 | ---- | C] () -- C:\Windows\SysWow64\igdail32.dll

[2013-08-22 09:36:43 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2013-08-22 09:36:42 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2013-08-22 08:46:23 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2013-08-22 01:01:23 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2013-08-21 21:32:36 | 000,046,080 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2013-08-21 17:55:20 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2013-08-21 17:52:39 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

[2013-07-01 20:44:46 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll

 

========== ZeroAccess Check ==========

 

[2014-03-12 12:03:11 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2014-08-30 18:15:33 | 021,197,152 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2014-08-30 16:59:13 | 018,723,112 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2013-08-22 03:49:49 | 000,921,088 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2013-08-21 20:45:10 | 000,691,712 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2013-08-22 03:45:17 | 000,483,840 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 

========== LOP Check ==========

 

[2014-06-19 15:15:23 | 000,000,000 | ---D | M] -- C:\Users\family\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

[2014-11-14 17:55:49 | 000,000,000 | ---D | M] -- C:\Users\family\AppData\Roaming\com.adobe.formscentral.FormsCentralForAcrobat

[2014-08-22 13:47:26 | 000,000,000 | ---D | M] -- C:\Users\family\AppData\Roaming\PDAppFlex

[2014-12-22 18:09:00 | 000,000,000 | ---D | M] -- C:\Users\family\AppData\Roaming\Smilebox

[2014-06-13 09:49:51 | 000,000,000 | ---D | M] -- C:\Users\family\AppData\Roaming\Spotify

[2014-11-15 21:07:32 | 000,000,000 | ---D | M] -- C:\Users\family\AppData\Roaming\WildTangent

 

========== Purity Check ==========

 

 

 

========== Alternate Data Streams ==========

 

@Alternate Data Stream - 237 bytes -> C:\Users\family\SkyDrive:ms-properties

 

< End of report >

 

 

OTL Extras logfile created on: 2014-12-27 8:01:37 PM - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\family\Desktop

64bit- An unknown product  (Version = 6.2.9200) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17498)

Locale: 00001009 | Country: Canada | Language: ENC | Date Format: yyyy-MM-dd

 

7.89 Gb Total Physical Memory | 5.94 Gb Available Physical Memory | 75.34% Memory free

9.14 Gb Paging File | 6.92 Gb Available in Paging File | 75.80% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 448.69 Gb Total Space | 413.68 Gb Free Space | 92.20% Space Free | Partition Type: NTFS

 

Computer Name: LAPTOP | User Name: family | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Extra Registry (SafeList) ==========

 

 

========== File Associations ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 

========== Shell Spawning ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

 

========== Security Center Settings ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = AC 1C AE C5 46 9F CE 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]

"UpgradeTime" =  [binary data]

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]

"UpgradeTime" = Reg Error: Unknown registry data type -- File not found

 

========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

========== Authorized Applications List ==========

 

 

========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{1334C44A-7F71-43CB-97AB-ECC330D383B5}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{1FA80F45-B3F0-4745-B628-65F998122BE9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{2B6C44C0-484A-4C05-AE3E-A119E31AB953}" = rport=139 | protocol=6 | dir=out | app=system | 

"{4EF5FF2F-B568-49D5-B2F8-DEACDD066916}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{510DC6F3-BCED-4700-9CCE-842F573B17B8}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{5964B821-2BCA-4AF1-852E-9E5FA9DCCC8F}" = lport=137 | protocol=17 | dir=in | app=system | 

"{6E4F23F4-F8AE-4360-A309-74F9C9F1353F}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{723AB6D9-797D-4DDA-B084-495304E8A057}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{725D2857-7F82-4512-9398-2E71D7CEAFBD}" = rport=137 | protocol=17 | dir=out | app=system | 

"{785A3C00-E083-4CE1-990C-993317281434}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 | 

"{87F9877E-CFF2-4412-8C9B-832DE10F817E}" = lport=445 | protocol=6 | dir=in | app=system | 

"{8EF1F411-A860-4134-87BA-0C43CDB90A29}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{8FFF7379-CBD9-4271-92DA-0CF2AFD75554}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{9084C73C-50CA-4C31-91D3-8BB86D728B54}" = lport=5353 | protocol=17 | dir=in | app=c:\program files (x86)\google\chrome\application\chrome.exe | 

"{B8949D2F-39D0-4184-9F79-5206B295C240}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{BDEA604F-1EC8-4628-B857-092AE40EE161}" = rport=138 | protocol=17 | dir=out | app=system | 

"{C07E730F-A7F8-4782-AAEC-44053CF77EA3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{D34FB268-7642-4CD4-8E05-FD8B70733335}" = lport=139 | protocol=6 | dir=in | app=system | 

"{DAEDCD27-F880-414D-BC92-581D671FF2BD}" = lport=138 | protocol=17 | dir=in | app=system | 

"{DB04616C-0C13-46C6-AD21-23756DFBEC25}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{E0718E8F-E080-4B07-9EE3-137DB3F547C0}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{E15908D0-C982-49EC-B97A-0E8A2E45120B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{E9DC5CA0-444B-4CE4-991A-56ECC4F76048}" = rport=445 | protocol=6 | dir=out | app=system | 

"{F728D625-82C2-498D-801A-FAE542CD8876}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

 

========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{012F9F4B-F261-4A03-BB76-5F98404D1E72}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{05046329-4974-43B9-BB0A-E7795C4DA4B1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{09D1B71C-C730-415F-BBEF-58C1728C3649}" = dir=in | name=@{magix.musicmakerjam_2.1.1032.2_x64__a2t3txkz9j1jw?ms-resource://magix.musicmakerjam/resources/app_name} | 

"{0C4C6182-2BEA-4D76-A3F0-E4011AD8CC62}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{0E809B5A-5F88-4864-A4AD-21B798B9BFE2}" = dir=out | name=acer explorer | 

"{115F3D40-65B8-46C8-B6B6-C4BFF44EF6FA}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\acer photo\dmcdaemon.exe | 

"{120BEF27-BAB5-4749-BE59-2BC0F91F6192}" = protocol=6 | dir=in | app=c:\program files (x86)\nero\nero 12\nero backitup\backitup.exe | 

"{1317D1B9-940B-4E3C-88EE-4DDC9DAE7AF9}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\acer portal\sdd.exe | 

"{186BB5E8-49CF-41B8-8247-F39EB4AD35DA}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\acer media\dmcdaemon.exe | 

"{1A992EE1-81C9-4D77-A497-B8E93E14E20E}" = dir=out | name=icookbook se | 

"{1AEF45D8-713E-4EF9-9BBC-8B00EA27AD85}" = dir=out | name=@{microsoft.bingmaps_2.1.3230.2048_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} | 

"{1C12BDFC-8A4B-4A92-A466-377CA8E4FDE9}" = dir=out | name=@{microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} | 

"{1E8DD498-4E40-4427-8245-DAC96ACF56CC}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{1F8C16E0-DA3A-43EF-8E33-CEF7152D3EC4}" = dir=in | name=@{microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} | 

"{225A6527-47C8-4B17-B9A5-8EC6804BDD7F}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{248B294B-2DB2-43D9-85A9-6C8D37D1378D}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\acer portal\ccd.exe | 

"{2606DA6B-FAB5-4693-9726-9D9D27AAB9F8}" = protocol=6 | dir=in | app=c:\program files (x86)\spotify\data\spotifywebhelper.exe | 

"{29DB0289-2B50-408A-819F-7801E75A872C}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\acer photo\windowsupnp.exe | 

"{2AB01BF7-673F-4B1E-AD70-E2F75A4C53A7}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 

"{2F6C1BD4-BECB-44A2-B03B-391106F9F02A}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{3082778C-1FC5-4255-A00D-C561ABECCB3C}" = dir=out | name=- games app - | 

"{312B67E0-4DC7-4DFE-97CA-4223CF835ABD}" = dir=out | name=windows_ie_ac_001 | 

"{32E01C86-2EB7-469C-B500-1EF905D25761}" = protocol=58 | dir=out | [email protected],-28546 | 

"{3437C7F5-AB12-4F59-B41A-79755241D18D}" = dir=out | name=@{microsoft.bingsports_3.0.4.244_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/brandedapptitle} | 

"{34645F1F-BBE0-4215-8444-5000A5111ECD}" = dir=out | name=stumbleupon | 

"{35665715-7C4C-4BE9-89DD-44D8CA11010C}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\acer photo\dmcdaemon.exe | 

"{38EAC81C-8107-4ED3-A3DF-3283D60735F3}" = dir=in | name=@{microsoft.windowsreadinglist_6.3.9654.20540_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsreadinglist/resources/apppackagename} | 

"{3CEBEE26-90B4-46FD-8340-BD02EF8BFE95}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{3D10A029-B66D-4D78-B392-8D834D125CA2}" = dir=out | name=@{microsoft.binghealthandfitness_3.0.4.254_x64__8wekyb3d8bbwe?ms-resource://microsoft.binghealthandfitness/resources/apptitle} | 

"{3EE927CB-0850-4E2B-AFAA-5CDDDAC4CD89}" = dir=out | name=@{microsoft.bingfinance_3.0.4.253_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfinance/resources/brandedapptitle} | 

"{417C0149-B63D-4CB1-B52C-3054C93F2659}" = protocol=6 | dir=out | app=system | 

"{4282FE99-8560-4BC7-9576-5F3ED84E263F}" = dir=in | name=checkpoint.vpn | 

"{44459B69-23FF-4207-A679-A5C6A03B5BBA}" = dir=out | name=@{magix.musicmakerjam_2.1.1032.2_x64__a2t3txkz9j1jw?ms-resource://magix.musicmakerjam/resources/app_name} | 

"{4AA09E83-2EF4-4441-8064-16C18948A005}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | 

"{4BBED96C-3C24-49AA-B05A-A8722962F1D2}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\acer portal\virtualdrive.exe | 

"{4C090117-047E-4300-983A-E5F199DC3AEE}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | 

"{548DCF8C-BFF2-4BA4-AA88-FBAF9AC8BCC6}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} | 

"{560448D6-095C-4907-B046-AC7F710701A7}" = dir=in | name=sonicwall.mobileconnect | 

"{56BC41F3-3800-4CE6-88FE-7BF45BB1CB18}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{5CCA031F-21FB-4A85-A5C8-8C39D4A68978}" = dir=out | name=@{microsoft.bingnews_3.0.4.213_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/brandedapptitle} | 

"{5D9F7A81-9A73-47E5-B1B0-AE855EF2CFAD}" = dir=in | name=evernote touch | 

"{5F4632C0-D5B1-40C3-B0D9-E3A759C81B9E}" = dir=out | name=sonicwall.mobileconnect | 

"{62650F94-BF9C-41A7-8A8B-94098FCF5333}" = dir=out | name=amazon | 

"{635FF12C-8DE0-40D4-91C9-A9085C76ABD3}" = dir=out | name=7digital music store | 

"{649F1F62-6158-48DB-8647-986046A20606}" = dir=out | name=@{microsoft.bingweather_3.0.4.249_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/brandedapptitle} | 

"{66C8732A-401F-4DCB-8DC5-376771CF713A}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\acer photo\dmcdaemon.exe | 

"{672056A9-9D94-4C8A-889B-872BD36EB99C}" = protocol=17 | dir=in | app=c:\program files (x86)\spotify\data\spotifywebhelper.exe | 

"{68105F8E-3ADF-49BC-93F8-2E5108EBDDA8}" = dir=out | name=evernote touch | 

"{68414986-03A6-45AE-AADC-9DD0B675946B}" = dir=in | name=skype | 

"{684FB9F5-0875-44C7-A038-E5AE6E759083}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{6C137179-9F7F-4579-B736-CB273C464AA5}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\acer media\windowsupnpmv.exe | 

"{6C2B74D0-E276-4543-8633-ECB144FEDEBA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{6E441910-EEAC-4B61-B94D-210744AA6F67}" = protocol=1 | dir=out | [email protected],-28544 | 

"{6FCC6C7D-C6AA-4B27-AF65-6FD318C2167B}" = dir=out | name=ebay | 

"{6FCF82B4-BF0B-4EAE-A030-57ABC4677B62}" = protocol=17 | dir=in | app=c:\program files (x86)\spotify\spotify.exe | 

"{6FF5A852-016F-4CC0-B597-701D17E5D2D2}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\acer media\windowsupnpmv.exe | 

"{707397C8-D2BA-4C0F-A834-2A79397E412D}" = dir=in | name=newsxpresso | 

"{71437866-A348-4D9E-991E-D2D8A0041663}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{71A54AFF-AEC6-409F-A641-87092B93F83C}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{7AA7A492-213B-48ED-B5D2-1275B70B031E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{7B010470-D76A-4D8E-A922-BAE14498A183}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\acer photo\dmcdaemon.exe | 

"{7F130E86-B44A-4DE6-B4DC-01980B1D06C4}" = dir=out | name=didlr | 

"{7F3F6393-3368-4CCC-BF73-416730AFE886}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\acer portal\sdd.exe | 

"{836EE6F4-723F-4D4A-BB7C-71E54FCE7B2A}" = protocol=6 | dir=in | app=c:\program files (x86)\spotify\spotify.exe | 

"{84FAD1EF-995A-40BF-B20B-B785067F03F0}" = dir=out | name=booking.com partner edition | 

"{8748D1C1-9935-4350-A4A4-2A6809256259}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\acer photo\windowsupnp.exe | 

"{87BA9903-AA29-423A-9C46-AE81EA592207}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\acer photo\windowsupnp.exe | 

"{9002B4AA-6174-4CF6-BC71-A4FE05D6E0C6}" = protocol=17 | dir=in | app=c:\program files (x86)\nero\nero 12\nero backitup\backitup.exe | 

"{9766EBF8-4694-4949-875C-304AE9DC89AA}" = dir=out | name=chacha | 

"{97D3C71D-DDEC-44C8-B165-3E29BD22500B}" = dir=out | name=@{microsoft.zunevideo_2.6.432.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/ids_manifest_video_app_name} | 

"{9A49B547-1479-4D68-B5DC-FC2B82DC0A0E}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{9B14CAAA-B6CF-49EE-8D34-CC2B2373ECB0}" = protocol=58 | dir=in | [email protected],-28545 | 

"{9BA5A1B4-58D3-46E6-8350-FE5B7A3C7ED7}" = dir=out | name=@{microsoft.bingtravel_3.0.4.212_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/brandedapptitle} | 

"{9DD2423A-6007-4DDB-8404-FB8023B2773D}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\acer media\windowsupnpmv.exe | 

"{9E3D57FC-7C37-4424-9352-4831E97D029D}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} | 

"{A5F0F486-34F8-4506-87DA-9497BED1EBB6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{A7CF5B62-147E-49BF-8F2D-CC4A5EC2EC14}" = dir=out | name=@{microsoft.xboxlivegames_2.0.139.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} | 

"{A858213B-5268-47BD-8C1F-35637B78D3DB}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\acer photo\windowsupnp.exe | 

"{ABE23533-67B5-4670-A7C5-B4DD0DD04AC7}" = dir=out | name=@{microsoft.bingfoodanddrink_3.0.4.253_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfoodanddrink/resources/apptitlewithbranding} | 

"{AD88F00D-DDC6-41CF-AF57-84C95F362BE7}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\acer media\windowsupnpmv.exe | 

"{B31526FB-F8A6-4A4E-8E14-1CA93FCD2E37}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\acer portal\ccd.exe | 

"{B330267A-4642-4D9E-8A46-0EF3A402AE64}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\acer portal\virtualdrive.exe | 

"{B43C0CD9-0FAE-4DB8-9F08-C8DFE1241475}" = dir=out | name=skype | 

"{B59D845A-E6EB-411F-98F4-E7D7635A40A4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{C911928C-0D03-476B-9EB4-3E6A921C67E2}" = protocol=1 | dir=in | [email protected],-28543 | 

"{CA4B2E68-F1D4-4630-94A6-A82425A58324}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\acer media\dmcdaemon.exe | 

"{CD3E3D5B-2D80-43EB-B737-35AE650D8017}" = dir=out | name=zinio | 

"{CF30B4B2-D335-458F-837F-DF9C0CD5B05A}" = dir=out | name=@{microsoft.zunemusic_2.6.649.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/ids_manifest_music_app_name} | 

"{D3ACDE23-5A94-47B6-B8F4-21F6B82A36C5}" = dir=out | name=newsxpresso | 

"{D5F9C8DE-94D6-4F96-BB64-2E702CDC944C}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\acer media\dmcdaemon.exe | 

"{D6980480-941A-4DF6-AB81-3734ECD3D779}" = dir=out | name=junipernetworks.junospulsevpn | 

"{D9267322-E92B-4CBE-B122-8160CC0DA937}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\acer portal\ccd.exe | 

"{D9710FA0-DB0A-492D-890B-F8512E20A265}" = dir=out | name=accuweather for windows 8 | 

"{DB59588E-ED90-4C47-A7B5-7929DD0C0BD2}" = dir=out | name=checkpoint.vpn | 

"{E4B5E865-E72F-44F4-B49D-7535E31345D5}" = dir=out | name=netflix | 

"{E4B76D94-13A4-4D5D-8D3B-B20894F9E8AC}" = dir=in | name=accuweather for windows 8 | 

"{E60E4DD7-C0EC-405A-A29F-E26AC9EE3C5C}" = protocol=6 | dir=in | app=c:\program files (x86)\acer\acer media\dmcdaemon.exe | 

"{EC799E33-72BA-42D7-9127-DEFE68F9799D}" = dir=in | name=junipernetworks.junospulsevpn | 

"{F18FE2FD-6576-454A-A32A-170ACD6A8B74}" = dir=out | name=@{microsoft.windowsreadinglist_6.3.9654.20540_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsreadinglist/resources/apppackagename} | 

"{F24F7032-190C-4414-ACE7-2C2A3EB6F757}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{F2EA8F4B-9EAC-4F56-AD50-0E37917AE033}" = dir=out | name=kindle | 

"{F64300AD-D559-4000-BD45-0997BCC8E70A}" = dir=out | name=f5.vpn.client | 

"{F77E5446-4378-4E99-8B7A-7061AAAEA193}" = dir=in | name=f5.vpn.client | 

"{F91E88EF-F6D2-4F29-88B3-1CB402500A49}" = dir=in | name=acer explorer | 

"{FBD0D12E-1AF3-4DF0-BAD0-65573321B12C}" = protocol=17 | dir=in | app=c:\program files (x86)\acer\acer portal\ccd.exe | 

"{FBF6045A-C07D-4DCC-BB4A-8160298D1610}" = dir=in | name=zinio | 

"{FC169DB2-00A5-434F-9448-9DC2D501105C}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}" = Acer Recovery Management

"{13885028-098C-4799-9B71-27DAC96502D5}" = Acer Remote Files

"{176E2755-0A17-42C6-88E2-192AB2131278}" = Intel® Trusted Execution Engine

"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219

"{3685B5E8-A0A8-494B-B035-B221547A4B63}" = Intel® Trusted Execution Engine Driver

"{5A68A656-979F-4168-8795-E2E368AA4DC2}" = iTunes

"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour

"{787136D2-F0F8-4625-AA3F-72D7795AC842}" = Apple Mobile Device Support

"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{91F52DE4-B789-42B0-9311-A349F10E5479}" = Acer Power Management

"{A84A4FB1-D703-48DB-89E0-68B6499D2801}" = Qualcomm Atheros Bluetooth Suite (64)

"{BCCACFE6-91A0-4F32-80A0-ADC0CA048C7B}" = Intel® Trusted Execution Engine

"{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}" = Acer Launch Manager

"{C1FA525F-D701-4B31-9D32-504FC0CF0B98}" = Acer Quick Access

"Elantech" = ETDWare PS/2-X64 11.6.28.201_WHQL

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}" = Amazon 1Button App

"{0B311221-05A5-4766-8D03-7A6446794156}" = Nero RescueAgent Help (CHM)

"{0E4630AF-0AB7-440E-A978-1A78FC4F43B9}" = Nero Launcher

"{1FCC073B-CC01-4443-AD20-E559F66E6E83}" = Office Addin 2003

"{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}" = Skype™ 6.21

"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Qualcomm Atheros WLAN and Bluetooth Client Installation Program

"{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor

"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime

"{3AAB08A3-F129-4BD5-B409-AE674F93759D}" = Prerequisite installer

"{3D9CB654-99AD-4301-89C6-0D12A790767C}" = Identity Card

"{54A4839E-87F8-4BD1-9682-A349E9943F0A}" = Amazon Unbox Video

"{551AC8F2-FEA2-4B45-ACF7-C98681233CC9}" = Nero BackItUp 12 Essentials OEM.a01

"{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}" = Realtek Card Reader

"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update

"{6D2BBE1D-E600-4695-BA37-0B0E605542CC}" = Office Addin

"{77D28FF5-242F-488A-8215-937D6A4D69E0}" = Adobe AIR

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver

"{8FB53850-246A-3507-8ADE-0060093FFEA6}" = Visual Studio Tools for the Office system 3.0 Runtime

"{90150000-0138-0409-0000-0000000FF1CE}" = Microsoft Office

"{91589413-6675-4C27-8AFC-EFB9103B90A5}" = eBay Worldwide

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{A2D43081-CF7B-4637-A9F3-E2651AA5C4A8}" = Nero RescueAgent

"{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}" = Acer Portal

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{ABC88553-8770-4B97-B43E-5A90647A5B63}" = Nero ControlCenter

"{B5AD89F2-03D3-4206-8487-018298007DD0}" = Acer Photo

"{B8B7838E-449E-B187-57E1-1AA686F225DC}" = Adobe Download Assistant

"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components

"{C994C746-C6D0-4EBA-B09E-DF7B18381B69}" = Nero ControlCenter Help (CHM)

"{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}" = Acer Docs

"{D9DAD0FF-495A-472B-9F10-BAE430A26682}" = Apple Application Support

"{DA2D3078-A58C-45E8-8EE0-18B8BE6B34F7}" = Nero BackItUp

"{E625FCA0-E43E-4D3B-92FF-4851308A0366}" = Norton Online Backup

"{E9AF1707-3F3A-49E2-8345-4F2D629D0876}" = Acer Media

"{EE26E302-876A-48D9-9058-3129E5B99999}" = Live Updater

"{EF0D1292-8FC1-41BE-9740-DBC134F66415}" = Nero BackItUp Help (CHM)

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"Adobe AIR" = Adobe AIR

"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant

"Google Chrome" = Google Chrome

"InstallShield_{54A4839E-87F8-4BD1-9682-A349E9943F0A}" = Amazon Unbox Video

"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware version 2.0.4.1028

"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime

"NARA" = Norton Online Backup

"Spotify" = Spotify

"Visual Studio Tools for the Office system 3.0 Runtime" = Visual Studio Tools for the Office system 3.0 Runtime

 

========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Smilebox" = Smilebox

 

========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 2014-12-20 9:33:52 AM | Computer Name = laptop | Source = Application Hang | ID = 1002

Description = The program LiveComm.exe version 17.5.9600.20689 stopped interacting

 with Windows and was closed. To see if more information about the problem is available,

 check the problem history in the Action Center control panel.    Process ID: 1458    Start

 Time: 01d01bf97bd0c7a6    Termination Time: 4294967295    Application Path: C:\Program 

Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exe

 

Report

 Id: d23b1a18-884c-11e4-8273-f8a963019f11    Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe

 

Faulting

 package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1  

 

Error - 2014-12-20 9:33:52 AM | Computer Name = laptop | Source = Microsoft-Windows-Immersive-Shell | ID = 5973

Description = Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1

 failed with error: -2147023174 See the Microsoft-Windows-TWinUI/Operational log

 for additional information.

 

Error - 2014-12-20 9:33:52 AM | Computer Name = laptop | Source = Microsoft-Windows-Immersive-Shell | ID = 5973

Description = Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1

 failed with error: -2147023174 See the Microsoft-Windows-TWinUI/Operational log

 for additional information.

 

Error - 2014-12-20 9:33:52 AM | Computer Name = laptop | Source = Microsoft-Windows-Immersive-Shell | ID = 5973

Description = Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1

 failed with error: -2147023174 See the Microsoft-Windows-TWinUI/Operational log

 for additional information.

 

Error - 2014-12-20 9:33:52 AM | Computer Name = laptop | Source = Microsoft-Windows-Immersive-Shell | ID = 5973

Description = Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1

 failed with error: -2147023174 See the Microsoft-Windows-TWinUI/Operational log

 for additional information.

 

Error - 2014-12-20 9:33:52 AM | Computer Name = laptop | Source = Microsoft-Windows-Immersive-Shell | ID = 5973

Description = Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1

 failed with error: -2147023174 See the Microsoft-Windows-TWinUI/Operational log

 for additional information.

 

Error - 2014-12-20 9:33:52 AM | Computer Name = laptop | Source = Microsoft-Windows-Immersive-Shell | ID = 5973

Description = Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1

 failed with error: -2147023174 See the Microsoft-Windows-TWinUI/Operational log

 for additional information.

 

Error - 2014-12-20 9:33:52 AM | Computer Name = laptop | Source = Microsoft-Windows-Immersive-Shell | ID = 5973

Description = Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1

 failed with error: -2147023174 See the Microsoft-Windows-TWinUI/Operational log

 for additional information.

 

Error - 2014-12-20 9:33:52 AM | Computer Name = laptop | Source = Microsoft-Windows-Immersive-Shell | ID = 5973

Description = Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1

 failed with error: -2147023174 See the Microsoft-Windows-TWinUI/Operational log

 for additional information.

 

Error - 2014-12-20 9:33:52 AM | Computer Name = laptop | Source = Microsoft-Windows-Immersive-Shell | ID = 5973

Description = Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1

 failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log

 for additional information.

 

[ System Events ]

Error - 2014-12-10 10:22:39 PM | Computer Name = laptop | Source = Tcpip | ID = 4199

Description = The system detected an address conflict for IP address 192.168.2.4

 with the system  having network hardware address B8-EE-65-F5-9F-A2. Network operations

 on this system may  be disrupted as a result.

 

Error - 2014-12-10 10:26:49 PM | Computer Name = laptop | Source = Service Control Manager | ID = 7000

Description = The McAfee AP Service service failed to start due to the following

 error:   %%2

 

Error - 2014-12-10 10:26:49 PM | Computer Name = laptop | Source = Service Control Manager | ID = 7000

Description = The McAfee Personal Firewall Service service failed to start due to

 the following error:   %%2

 

Error - 2014-12-12 7:33:34 AM | Computer Name = laptop | Source = Tcpip | ID = 4199

Description = The system detected an address conflict for IP address 192.168.2.2

 with the system  having network hardware address 00-D9-D1-6F-6D-0E. Network operations

 on this system may  be disrupted as a result.

 

Error - 2014-12-13 11:12:52 PM | Computer Name = laptop | Source = Service Control Manager | ID = 7000

Description = The McAfee AP Service service failed to start due to the following

 error:   %%2

 

Error - 2014-12-13 11:12:52 PM | Computer Name = laptop | Source = Service Control Manager | ID = 7000

Description = The McAfee Personal Firewall Service service failed to start due to

 the following error:   %%2

 

Error - 2014-12-14 9:40:14 AM | Computer Name = laptop | Source = Tcpip | ID = 4199

Description = The system detected an address conflict for IP address 192.168.2.2

 with the system  having network hardware address 00-D9-D1-6F-6D-0E. Network operations

 on this system may  be disrupted as a result.

 

Error - 2014-12-14 3:25:55 PM | Computer Name = laptop | Source = EventLog | ID = 6008

Description = The previous system shutdown at 1:14:42 PM on ?2014-?12-?14 was unexpected.

 

Error - 2014-12-14 3:26:12 PM | Computer Name = laptop | Source = Service Control Manager | ID = 7000

Description = The McAfee AP Service service failed to start due to the following

 error:   %%2

 

Error - 2014-12-14 3:26:16 PM | Computer Name = laptop | Source = Service Control Manager | ID = 7000

Description = The McAfee Personal Firewall Service service failed to start due to

 the following error:   %%2

 

 

< End of report >

 

 

[Satchfan]

I need you to run AdwCleaner again and this time, please follow the instructions.

when it has finished, select Clean

Please post the resulting log.

===================================================

Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download RogueKiller to your desktop

• close all running programs
• for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
• when the pre-scan is finished, click on Scan
• click on Report and copy/paste the content in your next post
• NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

If the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe.
Please post the contents of the RKreport.txt in your next reply.

======================================================

Run TDSSKiller

Please download TDSSKiller.zip

• extract it to your desktop
• double click TDSSKiller.exe
• press Start Scan

  
  only if Malicious objects are found then ensure Cure is selected -  Note: If Cure is not available, please choose Skip instead : do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly
   

• click Continue > Reboot now
• copy and paste the log in your next reply
• a copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)

Additional information:

If you get the warning about a file “UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ([color="#FF0000”]TDSS File System([/color]) - please choose [color="#FF0000”]Skip[/color].

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue and then reboot to finish the cleaning process.

[color="#FF0000”]Remember[/color], if Cure is not available, choose Skip instead; [color="#FF0000”]do not choose “Delete” unless instructed[/color].

Logs to include with next post:

AdwCleaner log
RKreport.txt
TDSSKiller log

Thanks

Satchfan

 

[Satchfan]

Hi Mel_jeff

It has been several days since I replied and asked you to run a couple of scans.

Please let me know if you are having problems and still need help.

Thanks

Satchfan

[Satchfan]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.