Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Trojan? SysWOW64/rundll32 impersonator?

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Zynthiel » June 28th, 2014, 1:20 pm

Yeah, the link leads to BleepingComputer xD and I cant access it.
Zynthiel
Regular Member
 
Posts: 19
Joined: June 24th, 2014, 11:04 pm
Advertisement
Register to Remove

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Gary R » June 28th, 2014, 1:29 pm

OK.

Download OTL by OldTimer to your Desktop.

If you already have a copy of OTL delete it and use this version.

  • Double click OTL.exe to launch the programme.
  • Check the following.
    • Scan all users.
    • Standard Output.
    • Lop check.
    • Purity check.
  • Under Extra Registry section, select Use SafeList
  • Click the Run Scan button and wait for the scan to finish (usually about 10-15 mins).
  • When finished it will produce two logs.
    • OTL.txt (open on your desktop).
    • Extras.txt (minimised in your taskbar)
  • Please post me both logs.

Also ...

Please download SystemLook from the link below and save it to your Desktop.

For 64 bit Systems

  • Double-click SystemLook.exe to run it.
  • Copy and paste the contents of the following codebox into the main textfield:
    Code: Select all
    :filefind
    *Fun4IM*
    *Bandoo*
    *Searchnu*
    *Searchqu*
    *iLivid*
    *whitesmoke*
    *datamngr*
    *trolltech*
    *babylon*
    *conduit*
    
    :folderfind
    *Fun4IM*
    *Bandoo*
    *Searchnu*
    *Searchqu*
    *iLivid*
    *whitesmoke*
    *datamngr*
    *trolltech*
    *babylon*
    *conduit*
    
    :Regfind
    Fun4IM
    Bandoo
    Searchnu
    Searchqu
    iLivid
    whitesmoke
    datamngr
    kelkoopartners
    trolltech
    babylon
    conduit
    
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan.
  • Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt


Summary of the logs I need from you in your next post:
  • OTL.txt
  • Extras.txt
  • StstemLook.txt


Please post each log separately to prevent it being cut off by the forum post size limiter. Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections.
User avatar
Gary R
Administrator
Administrator
 
Posts: 25888
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Zynthiel » June 29th, 2014, 4:10 pm

Is it normal for SystemLook to be taking very long?
Zynthiel
Regular Member
 
Posts: 19
Joined: June 24th, 2014, 11:04 pm

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Gary R » June 29th, 2014, 4:27 pm

Depends on what it's searching for and how many files and registry keys it needs to search through, longest I've ever known it take is about half an hour, but conceivably it could take a little longer.
User avatar
Gary R
Administrator
Administrator
 
Posts: 25888
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Zynthiel » June 29th, 2014, 4:50 pm

Oh boy, Its been running for a good an hour and a half, its the only thing left I still need to post.
Zynthiel
Regular Member
 
Posts: 19
Joined: June 24th, 2014, 11:04 pm

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Gary R » June 29th, 2014, 5:06 pm

If its been running for over an hour, terminate it with Task Manager.

It may still have produced a log, so run a search for Systemlook.txt and if present please post its contents.

If not, do you have access to another computer ?
User avatar
Gary R
Administrator
Administrator
 
Posts: 25888
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Zynthiel » June 29th, 2014, 7:53 pm

The log isnt completely finished and yes, I have access to another computer.
Zynthiel
Regular Member
 
Posts: 19
Joined: June 24th, 2014, 11:04 pm

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Zynthiel » June 29th, 2014, 10:35 pm

Okay so, I have returned with the logs. The rest are via attachment.
OTL logfile created on: 6/29/2014 11:09:33 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\jack\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17126)
Locale: 00000409 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

2.75 Gb Total Physical Memory | 0.76 Gb Available Physical Memory | 27.82% Memory free
5.50 Gb Paging File | 3.13 Gb Available in Paging File | 56.95% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 451.99 Gb Total Space | 209.40 Gb Free Space | 46.33% Space Free | Partition Type: NTFS

Computer Name: JACK-PC | User Name: jack | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found --
PRC - [2014/06/29 11:07:25 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\jack\Downloads\OTL.exe
PRC - [2014/06/05 06:58:39 | 000,860,488 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2014/05/13 14:29:30 | 003,814,736 | ---- | M] (LogMeIn Inc.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
PRC - [2014/04/17 21:07:28 | 004,672,920 | ---- | M] (Akamai Technologies, Inc.) -- C:\Users\jack\AppData\Local\Akamai\netsession_win.exe
PRC - [2014/04/17 16:37:00 | 000,585,048 | ---- | M] (Razer Inc.) -- C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
PRC - [2014/04/11 19:45:50 | 001,764,992 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
PRC - [2014/04/11 19:45:42 | 001,390,720 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
PRC - [2013/11/08 13:46:18 | 001,028,384 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
PRC - [2013/10/03 00:11:04 | 002,990,304 | ---- | M] (Nota Inc.) -- C:\Program Files (x86)\Gyazo\GyStation.exe
PRC - [2013/05/23 15:16:56 | 000,311,152 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2013/03/06 08:30:43 | 003,560,288 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
PRC - [2012/08/04 10:21:19 | 000,296,096 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
PRC - [2012/05/28 18:50:40 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2010/01/28 16:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe
PRC - [2009/12/24 18:45:16 | 000,401,192 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
PRC - [2009/12/24 18:44:48 | 000,201,512 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
PRC - [2009/12/10 11:13:56 | 004,562,944 | ---- | M] () -- C:\Program Files (x86)\NETGEAR\WNA1100\WNA1100.exe
PRC - [2009/11/27 12:04:44 | 000,278,528 | ---- | M] () -- C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe
PRC - [2009/08/28 02:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe


========== Modules (No Company Name) ==========

MOD - [2014/06/26 11:39:28 | 004,125,696 | ---- | M] () -- c:\ProgramData\Fast And Safe\FastAndSafe.dll
MOD - [2014/06/05 06:58:38 | 000,414,536 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppgooglenaclpluginchrome.dll
MOD - [2014/06/05 06:58:37 | 014,612,296 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll
MOD - [2014/06/05 06:58:36 | 004,217,672 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll
MOD - [2014/06/05 06:58:30 | 001,732,424 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll
MOD - [2014/05/14 08:15:22 | 008,890,536 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll
MOD - [2014/02/28 19:27:12 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio4b37ff64#\0d3cb1df8b6af32cebdc6e2cc4948c69\PresentationFramework-SystemXmlLinq.ni.dll
MOD - [2014/02/28 19:27:11 | 000,018,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe#\47e7fc401facd4a5d3f2237f16948f36\PresentationFramework-SystemXml.ni.dll
MOD - [2014/02/28 17:06:57 | 000,190,976 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationTypes\75b6a68103e1b76063d9f69b8275ae61\UIAutomationTypes.ni.dll
MOD - [2014/02/28 17:06:54 | 000,399,872 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\b6c7a1ca929c1b10f36b683c9f1a0517\System.Xml.Linq.ni.dll
MOD - [2014/02/26 23:54:43 | 001,889,792 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\3fe705796c6a41d4889d9001d1c56af8\System.Xaml.ni.dll
MOD - [2014/02/26 23:54:41 | 001,180,672 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\0893e0e7137e3b2da905da6216b75344\System.Management.ni.dll
MOD - [2014/02/26 23:54:35 | 018,813,440 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\a4b45c44490c75bc2fb22780e7ef087d\PresentationFramework.ni.dll
MOD - [2014/02/26 23:54:30 | 012,894,208 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\f4f6ee0df2aa4189bf36e6335cb92761\System.Windows.Forms.ni.dll
MOD - [2014/02/26 23:54:23 | 011,025,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\a74542efbeb46445949a39026c501132\PresentationCore.ni.dll
MOD - [2014/02/26 23:54:23 | 001,644,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\5cd2aee5e7c07227c694d89219688ab3\System.Drawing.ni.dll
MOD - [2014/02/26 23:54:21 | 002,825,216 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\f6d7bb59f318c130d68816a89335d05e\System.Runtime.Serialization.ni.dll
MOD - [2014/02/26 23:54:21 | 000,806,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\34b53ecafa1d7ccc7ca961d722b5d983\System.ServiceModel.Internals.ni.dll
MOD - [2014/02/26 23:54:21 | 000,122,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\78652b7fa68ee058bff6a118c657f565\SMDiagnostics.ni.dll
MOD - [2014/02/26 23:54:15 | 003,950,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\acf97bfe2a931d4a47253b26b7218991\WindowsBase.ni.dll
MOD - [2014/02/26 23:54:15 | 000,470,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c9175f8#\75f8bc4cf08030c4a53b6d5e0ae20046\PresentationFramework.Aero.ni.dll
MOD - [2014/02/26 23:54:10 | 007,662,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\bada32953bb6b16a53d653eae23d78dc\System.Xml.ni.dll
MOD - [2014/02/26 23:54:09 | 006,990,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\dce99d8de14d8a015313db98c72552ee\System.Core.ni.dll
MOD - [2014/02/26 23:54:05 | 000,976,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\bbc48ec4245e502ae19b0601d3799c9e\System.Configuration.ni.dll
MOD - [2014/02/26 23:54:04 | 010,060,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ff26cc03e6d57d8abd13b990332e67c6\System.ni.dll
MOD - [2014/02/26 23:53:58 | 016,953,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\ce5f61c5754789df97be8dc991c47d07\mscorlib.ni.dll
MOD - [2009/12/10 11:13:56 | 004,562,944 | ---- | M] () -- C:\Program Files (x86)\NETGEAR\WNA1100\WNA1100.exe
MOD - [2009/08/28 16:50:18 | 000,282,624 | ---- | M] () -- C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvcLib.dll


========== Services (SafeList) ==========

SRV:64bit: - [2014/05/30 02:21:05 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2014/03/11 12:34:10 | 000,347,872 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2014/03/11 12:34:10 | 000,023,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2013/11/08 13:47:21 | 015,125,280 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)
SRV:64bit: - [2013/05/26 22:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2010/09/22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010/01/28 16:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV:64bit: - [2009/07/13 18:39:31 | 000,045,568 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\rundll32.exe -- (64af91bf)
SRV - [2014/05/29 10:36:52 | 000,543,424 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2014/05/13 20:10:04 | 000,257,712 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014/05/13 14:29:26 | 002,228,048 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2014/04/15 16:07:54 | 000,377,616 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe -- (LMIGuardianSvc)
SRV - [2014/04/11 19:45:50 | 001,764,992 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe -- (c2cpnrsvc)
SRV - [2014/04/11 19:45:42 | 001,390,720 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe -- (c2cautoupdatesvc)
SRV - [2013/10/23 08:15:08 | 000,172,192 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/09/11 22:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2013/04/11 20:20:10 | 000,115,608 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013/03/06 08:30:43 | 003,560,288 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe -- (TeamViewer8)
SRV - [2013/03/05 16:47:00 | 000,018,360 | ---- | M] (Overwolf Ltd) [On_Demand | Stopped] -- C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe -- (OverwolfUpdaterService)
SRV - [2012/09/23 14:35:04 | 000,666,720 | ---- | M] (Wellbia.com Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\xsherlock.xem -- (xsherlock)
SRV - [2012/06/24 09:32:43 | 004,035,008 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2012/05/28 18:50:40 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2010/02/01 11:04:40 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)
SRV - [2010/01/26 13:41:08 | 000,652,800 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010/01/25 08:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Browny02\BrYNSvc.exe -- (BrYNSvc)
SRV - [2010/01/15 14:08:38 | 000,935,208 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009/11/27 12:04:44 | 000,278,528 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe -- (WSWNA1100)
SRV - [2009/11/05 16:10:22 | 000,954,368 | ---- | M] (Atheros Communications, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\NETGEAR\WNA1100\jswpsapi.exe -- (jswpsapi)
SRV - [2009/08/28 02:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009/06/10 14:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2002/12/17 17:26:22 | 007,520,337 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -- (MSSQL$SONY_MEDIAMGR)
SRV - [2002/12/17 17:23:30 | 000,311,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -- (SQLAgent$SONY_MEDIAMGR)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2014/03/11 09:52:30 | 000,133,928 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2013/11/21 02:59:28 | 000,040,696 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RzMaelstromVAD.sys -- (RZMAELSTROMVADService)
DRV:64bit: - [2013/09/27 16:01:44 | 000,039,200 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvvad64v.sys -- (nvvad_WaveExtensible)
DRV:64bit: - [2013/06/16 05:38:15 | 000,196,384 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2013/06/04 09:15:02 | 000,103,448 | ---- | M] (DEVGURU Co., LTD.(http://www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)
DRV:64bit: - [2013/06/04 09:15:00 | 000,203,672 | ---- | M] (DEVGURU Co., LTD.(http://www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)
DRV:64bit: - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2013/03/07 12:21:28 | 000,038,664 | ---- | M] (Spotflux, Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tapSF0901.sys -- (tapSF0901)
DRV:64bit: - [2012/12/19 08:42:10 | 000,006,144 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\t_mouse.sys -- (t_mouse.sys)
DRV:64bit: - [2012/12/13 13:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012/11/02 16:38:36 | 000,050,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2012/08/23 07:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012/08/23 07:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012/04/10 09:30:06 | 000,031,232 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)
DRV:64bit: - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2012/02/29 23:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/03/10 23:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/10 23:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 06:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/08/12 12:07:50 | 000,350,952 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2009/11/10 03:04:00 | 001,827,328 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athurx.sys -- (athur)
DRV:64bit: - [2009/10/20 11:19:54 | 000,047,632 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF)
DRV:64bit: - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 13:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/06/02 19:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009/06/02 19:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009/06/02 19:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009/03/18 18:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2008/08/28 12:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2008/05/15 02:28:00 | 000,026,624 | ---- | M] (Atheros Communications, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\jswpslwfx.sys -- (JSWPSLWF)
DRV:64bit: - [2007/05/09 22:50:48 | 000,050,208 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64)
DRV:64bit: - [2007/05/09 22:46:36 | 000,016,032 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lv302a64.sys -- (lvpepf64)
DRV:64bit: - [2007/05/09 21:46:48 | 001,127,328 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI)
DRV:64bit: - [2007/01/19 18:24:24 | 000,025,312 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SCMNdisP.sys -- (SCMNdisP)
DRV - [2009/07/13 18:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2005/05/10 06:23:12 | 000,004,524 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\p2pover\p2pfilter.sys -- (p2pfilter)
DRV - [2005/01/02 05:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD21}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}: "URL" = http://slirsredirect.search.aol.com/red ... 706&query={searchTerms}&invocationType=tb50-ie-aim-chromesbox-en-us&tb_uuid=20110623125424494&tb_oid=23-06-2011&tb_mrud=03-07-2011
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7


IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory =
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACA ... 5w4701v356
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\URLSearchHook: {9565115d-c7d6-46d3-bd63-b67b481a4368} - No CLSID value found
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\SearchScopes\{0499BC2B-7A6A-4571-BDEB-53A451B5E889}: "URL" = http://websearch.shaw.ca/shaw/ws/results/Web/{SearchTerms}/1/417/TopNavigation/Relevance/iq=true/zoom=off/_iceUrlFlag=7?_IceUrl=true&ua=ie-tb-cd
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}: "URL" = http://slirsredirect.search.aol.com/red ... 706&query={searchTerms}&invocationType=tb50-ie-aim-chromesbox-en-us&tb_uuid=20110623125424494&tb_oid=23-06-2011&tb_mrud=03-07-2011
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\SearchScopes\{231A4F75-65E6-4868-A1A8-1516B3DE3490}: "URL" = https://isearch.avg.com/search?cid={2356DEE6-C607-45A0-BDE3-EDC63787956E}&mid=27379ee0297d47d695c0d16f6ba4ff70-8d4a4225eb15855ef04d98bc824f4d80314a2b8d&lang=en&ds=AVG&pr=pr&d=2011-10-21 21:21:41&v=12.2.5.32&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\SearchScopes\{5C24658C-C0C1-48A2-B24F-923D4D423FBE}: "URL" = http://websearch.ask.com/redirect?clien ... src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=^A4F&apn_dtid=^ADK004^YY^CA&apn_uid=BB02C798-52DC-4300-968A-2220CFB37D93&apn_sauid=EFEC4535-2B30-4EC3-97AB-92ECD8E32995&
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_enCA406
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\SearchScopes\{E814839C-A6F8-4A07-81A3-75E6C1C82937}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2260173&CUI=UN11748477090511752
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;localhost;*.local

========== FireFox ==========

FF - prefs.js..browser.search.order.3: "Bing "
FF - prefs.js..extensions.enabledAddons: stefanvandamme%40stefanvd.net:2.2.0.20
FF - prefs.js..extensions.enabledAddons: %7B8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94%7D:10.16.9.506
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@ogplanet.com/npOGPPlugin: C:\Windows\system32\npOGPPlugin.dll (OGPlanet)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@raidcall.en/RCplugin: C:\Users\jack\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.6.14: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.6.14: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.6.14: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\jack\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\jack\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\jack\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\jack\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\jack\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\thehappycloud.com/HappyCloudPlugin: C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2014/06/24 20:46:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/04/11 20:20:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014/02/19 00:19:22 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/04/11 20:20:15 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014/02/19 00:19:22 | 000,000,000 | ---D | M]

[2012/09/22 12:33:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\jack\AppData\Roaming\mozilla\Extensions
[2014/06/27 10:12:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions
[2014/06/24 20:46:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}
[2013/04/20 17:35:36 | 000,000,000 | ---D | M] (FT GraphiteGlow) -- C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{99e34760-2754-11e0-91fa-0800200c9a66}
[2014/06/26 12:17:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\staged
[2013/08/15 13:01:19 | 000,724,133 | ---- | M] () (No name found) -- C:\Users\jack\AppData\Roaming\mozilla\firefox\profiles\jztv8gxs.default\extensions\stefanvandamme@stefanvd.net.xpi
[2013/08/06 22:12:31 | 000,824,302 | ---- | M] () (No name found) -- C:\Users\jack\AppData\Roaming\mozilla\firefox\profiles\jztv8gxs.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/04/11 20:19:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/12/16 18:27:45 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2014/04/21 18:24:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/12/16 18:27:45 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/04/11 20:20:14 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013/11/15 04:32:00 | 000,034,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll
[2012/08/04 10:21:24 | 000,129,176 | ---- | M] (RealPlayer) -- C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll
[2011/07/03 12:37:50 | 000,002,242 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\AOL Search.xml
[2012/09/05 18:26:22 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013/02/19 21:19:36 | 000,002,086 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.searchgol.com/?babsrc=HP_ss& ... 7&tsp=5022
CHR - plugin: Error reading preferences file
CHR - Extension: Google Docs = C:\Users\jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\
CHR - Extension: Google Drive = C:\Users\jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_1\
CHR - Extension: Google Voice Search Hotword (Beta) = C:\Users\jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5019_0\
CHR - Extension: YouTube = C:\Users\jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1\
CHR - Extension: Google Search = C:\Users\jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1\
CHR - Extension: ZenMate = C:\Users\jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme\3.7_0\
CHR - Extension: Word Online = C:\Users\jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\fiombgjlkfpdpkbhfioofeeinbehmajg\2.0_0\
CHR - Extension: AdBlock = C:\Users\jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.7.5_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Reddit Enhancement Suite = C:\Users\jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb\4.3.2.1_0\
CHR - Extension: Totoro Rainy Day = C:\Users\jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmiagjknjjfockcklibjlfdojojaffff\1.15_0\
CHR - Extension: Google Wallet = C:\Users\jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_1\
CHR - Extension: Gmail = C:\Users\jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2009/06/10 14:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)
O2:64bit: - BHO: (ApptoU) - {EB71F93F-0076-208A-530B-BE7CE0C53717} - C:\ProgramData\ApptoU\ccCYiqF1Z9.x64.dll File not found
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O2 - BHO: (no name) - {CD292324-974F-4224-D074-CACA427AA030} - No CLSID value found.
O2 - BHO: (ApptoU) - {EB71F93F-0076-208A-530B-BE7CE0C53717} - C:\ProgramData\ApptoU\ccCYiqF1Z9.dll File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {CD292324-974F-4224-D074-CACA427AA030} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\Toolbar\WebBrowser: (no name) - {51A86BB3-6602-4C85-92A5-130EE4864F13} - No CLSID value found.
O3 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\Toolbar\WebBrowser: (no name) - {9565115D-C7D6-46D3-BD63-B67B481A4368} - No CLSID value found.
O3 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\Toolbar\WebBrowser: (no name) - {CD292324-974F-4224-D074-CACA427AA030} - No CLSID value found.
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [IntelliType Pro] c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [MouseDriver] C:\Windows\SysNative\TiltWheelMouse.exe (Pixart Imaging Inc)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Nvtmru] C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [Razer Synapse] C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe (Razer Inc.)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001..\Run: [Akamai NetSession Interface] C:\Users\jack\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001..\Run: [GoogleChromeAutoLaunch_790AC30E8F2B478C5DE05AA86194D867] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
O4 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001..\Run: [GoogleChromeAutoLaunch_855D992E5E0301D5902D627292A8C69B] C:\Users\jack\AppData\Local\Google\Chrome SxS\Application\chrome.exe (Google Inc.)
O4 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001..\Run: [Gyazo] C:\Program Files (x86)\Gyazo\GyStation.exe (Nota Inc.)
O4 - HKU\.DEFAULT..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O4 - HKU\S-1-5-18..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Reg Error: Key error.)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Me ... b56907.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Reg Error: Key error.)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/Mi ... b56986.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 75.153.176.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AC236C49-CE18-4971-B79F-1BBBFD0262C5}: DhcpNameServer = 192.168.1.254 75.153.176.9
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~3\FASTAN~1\FASTAN~2.DLL) - C:\ProgramData\Fast And Safe\FastAndSafe_x64.dll ()
O20 - AppInit_DLLs: (c:\progra~3\fastan~1\fastan~1.dll) - c:\ProgramData\Fast And Safe\FastAndSafe.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/09/18 15:33:35 | 000,012,292 | ---- | M] () - C:\autoupdate.log -- [ NTFS ]
O33 - MountPoints2\{b97035ab-6ad3-11de-a743-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{b97035ab-6ad3-11de-a743-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe
O33 - MountPoints2\{b97035ab-6ad3-11de-a743-806e6f6e6963}\Shell\LVIPCAP\command - "" = D:\techsupt\CaptureTest\LVidCap.exe
O33 - MountPoints2\{fc8bc5a5-1e8a-11e1-a2c9-00262d401683}\Shell - "" = AutoRun
O33 - MountPoints2\{fc8bc5a5-1e8a-11e1-a2c9-00262d401683}\Shell\AutoRun\command - "" = G:\NokiaPCIA_Autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2014/06/26 21:32:01 | 000,000,000 | ---D | C] -- C:\RegBackup
[2014/06/26 21:31:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
[2014/06/26 21:30:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Tweaking.com
[2014/06/26 19:50:50 | 000,536,576 | ---- | C] (SQLite Development Team) -- C:\Windows\SysWow64\sqlite3.dll
[2014/06/26 11:40:37 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\AVG
[2014/06/26 11:39:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Fast And Safe
[2014/06/26 11:28:25 | 000,000,000 | --SD | C] -- C:\Windows\SysWow64\Microsoft
[2014/06/26 11:10:41 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014/06/25 11:58:57 | 000,000,000 | ---D | C] -- C:\Users\jack\AppData\Roaming\DropboxMaster
[2014/06/25 11:58:31 | 000,000,000 | ---D | C] -- C:\Users\jack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2014/06/25 11:56:28 | 000,000,000 | ---D | C] -- C:\Users\jack\AppData\Roaming\Dropbox
[2014/06/24 20:25:19 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\catroot
[2014/06/24 20:21:34 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0409
[2014/06/24 20:09:39 | 000,000,000 | ---D | C] -- C:\Users\jack\AppData\Roaming\dll-files.com
[2014/06/24 20:09:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Logs
[2014/06/24 20:09:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dll-Files Fixer
[2014/06/24 20:09:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Dll-Files.com Fixer
[2014/06/24 19:24:09 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2014/06/24 17:11:04 | 000,000,000 | ---D | C] -- C:\Qoobox
[2014/06/24 17:09:38 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2014/06/24 17:08:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
[2014/06/24 17:07:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware
[2014/06/24 16:55:08 | 000,000,000 | ---D | C] -- C:\ProgramData\RogueKiller
[2014/06/23 15:38:46 | 000,000,000 | -HSD | C] -- C:\Users\jack\AppData\Local\EmieUserList
[2014/06/23 15:38:46 | 000,000,000 | -HSD | C] -- C:\Users\jack\AppData\Local\EmieSiteList
[2014/06/22 14:59:28 | 000,000,000 | ---D | C] -- C:\Users\jack\AppData\Local\Packages
[2014/06/20 23:40:26 | 000,000,000 | ---D | C] -- C:\ProgramData\d7eb12423d4129ba
[2014/06/14 09:51:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2014/06/11 10:22:17 | 000,801,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\usp10.dll
[2014/06/11 10:22:15 | 000,288,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[2014/06/11 10:22:08 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml6r.dll
[2014/06/11 10:22:08 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml6r.dll
[2014/06/11 10:22:08 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2014/06/11 10:22:08 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2014/06/11 10:22:01 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RdpGroupPolicyExtension.dll
[2014/06/11 10:22:00 | 003,178,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorets.dll
[2014/06/11 10:21:54 | 000,592,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2014/06/11 10:21:54 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2014/06/11 10:21:54 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2014/06/11 10:21:52 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
[2014/06/11 10:21:52 | 000,038,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2014/06/11 10:21:52 | 000,032,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2014/06/11 10:21:49 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2014/06/11 10:21:48 | 001,964,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2014/06/11 10:21:47 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
[2014/06/11 10:21:46 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2014/06/11 10:21:45 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
[2014/06/11 10:21:44 | 000,452,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2014/06/11 10:21:43 | 000,631,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2014/06/11 10:21:43 | 000,440,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2014/06/11 10:21:41 | 000,608,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2014/06/11 10:21:40 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2014/06/11 10:21:39 | 002,040,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2014/06/11 10:21:38 | 001,068,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2014/06/11 10:21:38 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2014/06/11 10:21:37 | 000,704,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2014/06/11 10:21:36 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2014/06/11 10:21:36 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2014/06/11 10:21:34 | 000,295,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2014/06/11 10:21:33 | 000,574,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2014/06/11 10:21:32 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2014/06/11 10:21:31 | 005,782,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2014/06/11 10:21:31 | 001,249,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2014/06/11 10:21:31 | 000,752,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
[2014/06/11 10:21:31 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2014/06/11 10:21:30 | 000,846,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2014/06/11 10:21:30 | 000,548,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2014/06/11 10:21:27 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2014/06/11 10:21:23 | 000,940,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2014/06/11 10:20:14 | 000,506,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll
[2014/06/11 10:20:10 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll
[2014/06/10 19:38:44 | 000,000,000 | ---D | C] -- C:\Users\jack\Desktop\HawtMS
[2014/06/03 17:38:30 | 000,000,000 | ---D | C] -- C:\Users\jack\Desktop\wallpaper
[2014/06/03 15:44:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2014/06/03 15:44:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi
[2014/05/31 18:48:28 | 000,000,000 | ---D | C] -- C:\Users\jack\AppData\Local\DeSmuME
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[18 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014/06/29 11:18:03 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/06/29 11:09:18 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014/06/29 11:09:18 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014/06/29 11:09:03 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/06/29 10:58:55 | 000,000,374 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.ics
[2014/06/29 10:58:49 | 000,000,372 | ---- | M] () -- C:\Windows\tasks\RNUpgradeHelperLogonPrompt_jack.job
[2014/06/29 10:58:41 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/06/29 10:56:25 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
[2014/06/29 10:55:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/06/29 01:40:01 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4233458944-2344748423-862420031-1001UA.job
[2014/06/28 23:54:13 | 000,000,362 | ---- | M] () -- C:\Windows\tasks\ReclaimerUpdateXML_jack.job
[2014/06/28 23:47:17 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4233458944-2344748423-862420031-1001UA.job
[2014/06/28 20:51:30 | 000,000,366 | ---- | M] () -- C:\Windows\tasks\ReclaimerUpdateFiles_jack.job
[2014/06/28 20:46:04 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4233458944-2344748423-862420031-1001Core.job
[2014/06/28 15:39:01 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4233458944-2344748423-862420031-1001Core.job
[2014/06/26 21:34:16 | 000,000,207 | ---- | M] () -- C:\Windows\tweaking.com-regbackup-JACK-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
[2014/06/26 21:31:10 | 000,002,199 | ---- | M] () -- C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
[2014/06/26 19:46:53 | 000,189,172 | ---- | M] () -- C:\Users\jack\Desktop\screenshot.png
[2014/06/26 11:40:37 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\iavifw.avm
[2014/06/20 20:52:10 | 000,002,414 | ---- | M] () -- C:\Users\jack\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome Canary.lnk
[2014/06/20 20:52:05 | 000,002,412 | ---- | M] () -- C:\Users\jack\Desktop\Google Chrome Canary.lnk
[2014/06/14 10:16:34 | 000,002,147 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2014/06/08 02:13:05 | 000,506,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll
[2014/06/08 02:08:04 | 000,424,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll
[2014/05/31 19:35:04 | 000,000,043 | ---- | M] () -- C:\Users\jack\AppData\Roaming\WB.CFG
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[18 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014/06/26 21:34:16 | 000,000,207 | ---- | C] () -- C:\Windows\tweaking.com-regbackup-JACK-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
[2014/06/26 21:31:09 | 000,002,199 | ---- | C] () -- C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
[2014/06/26 19:46:53 | 000,189,172 | ---- | C] () -- C:\Users\jack\Desktop\screenshot.png
[2014/06/26 11:40:37 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\iavifw.avm
[2014/06/21 23:48:14 | 000,000,372 | ---- | C] () -- C:\Windows\tasks\RNUpgradeHelperLogonPrompt_jack.job
[2014/06/21 23:48:12 | 000,000,366 | ---- | C] () -- C:\Windows\tasks\ReclaimerUpdateFiles_jack.job
[2014/06/21 23:48:10 | 000,000,362 | ---- | C] () -- C:\Windows\tasks\ReclaimerUpdateXML_jack.job
[2014/06/10 21:38:49 | 033,124,732 | ---- | C] () -- C:\Users\jack\Desktop\Quest.wz
[2014/06/10 21:33:37 | 050,003,559 | ---- | C] () -- C:\Users\jack\Desktop\Etc.wz
[2014/05/31 19:35:04 | 000,000,043 | ---- | C] () -- C:\Users\jack\AppData\Roaming\WB.CFG
[2013/09/26 23:48:59 | 000,000,037 | -HS- | C] () -- C:\Users\jack\AppData\Local\70149b02515b3bb20dd492.47983420
[2013/08/26 18:30:59 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2013/07/20 19:45:53 | 000,000,040 | ---- | C] () -- C:\Users\jack\AppData\Roaming\mbam.context.scan
[2013/05/22 20:43:52 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2013/05/22 20:43:48 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2013/05/22 20:43:48 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2013/05/22 20:43:48 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2013/05/22 20:43:48 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2013/04/27 18:47:23 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll
[2013/04/17 21:37:29 | 000,000,023 | ---- | C] () -- C:\Windows\SysWow64\CleanGenius3Free.dll
[2012/12/06 17:59:16 | 000,000,012 | ---- | C] () -- C:\Users\jack\jagexappletviewer.preferences
[2012/11/10 18:00:02 | 004,446,016 | ---- | C] () -- C:\Users\jack\AppData\Local\Tempmusic.ogg
[2012/10/13 14:17:44 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2012/10/13 13:45:26 | 000,000,241 | ---- | C] () -- C:\Windows\QSync.INI
[2012/10/13 13:42:18 | 000,001,056 | ---- | C] () -- C:\Windows\_delis32.ini
[2012/10/13 13:40:02 | 000,081,920 | R--- | C] () -- C:\Windows\bwUnin-6.1.4.36-8876480L.exe
[2012/10/13 13:11:26 | 000,081,920 | R--- | C] () -- C:\Windows\bwUnin-6.1.4.68-8876480L.exe
[2012/10/07 22:33:45 | 003,130,440 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_blr.exe
[2012/09/08 00:34:03 | 000,000,017 | ---- | C] () -- C:\Windows\SysWow64\shortcut_ex.dat
[2012/06/01 17:36:11 | 000,010,382 | ---- | C] () -- C:\Program Files (x86)\Common Files\71096_179210638919_4129432_n.jpg
[2011/12/10 16:25:19 | 000,000,044 | ---- | C] () -- C:\Users\jack\jagex_cl_runescape_LIVE1.dat
[2011/12/10 16:10:17 | 000,000,040 | ---- | C] () -- C:\Users\jack\jagex_cl_runescape_LIVE.dat
[2011/10/11 17:19:55 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat
[2011/05/17 06:14:06 | 000,000,000 | ---- | C] () -- C:\Users\jack\AppData\Local\{53F6F362-CE82-44E3-BCA3-A56FDCCCEBCD}
[2011/02/19 20:29:51 | 000,000,129 | ---- | C] () -- C:\Users\jack\jagex_runescape_preferences2.dat
[2011/02/19 20:28:06 | 000,000,035 | ---- | C] () -- C:\Users\jack\jagex_runescape_preferences.dat
[2010/12/01 19:00:26 | 000,005,120 | ---- | C] () -- C:\Users\jack\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2009/07/13 21:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2014/03/24 19:43:12 | 014,175,744 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2014/03/24 19:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 18:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 05:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 18:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/06/01 15:32:30 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\IObit
[2013/01/30 09:12:22 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software
[2012/06/01 15:32:30 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\IObit
[2013/01/30 09:12:22 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software
[2014/05/23 22:22:59 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\.minecraft
[2013/04/24 16:49:16 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\.spotflux
[2014/05/03 18:28:05 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\.technic
[2013/07/16 18:55:27 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\.techniclauncher
[2013/04/12 20:14:48 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\.voidswrath
[2011/06/18 08:37:33 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\acccore
[2013/02/16 17:47:54 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\AVG
[2013/06/14 23:44:28 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Awesomium
[2013/12/04 23:55:00 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Battle.net
[2011/12/29 15:05:24 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Crayon Physics Deluxe
[2014/04/28 15:58:43 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Curse
[2014/04/28 16:03:48 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Curse Advertising
[2012/02/20 23:04:35 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\DarknessIIDemo
[2013/04/20 17:13:12 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Dashlane
[2014/06/24 20:09:39 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\dll-files.com
[2013/05/08 19:29:25 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Downloaded Installations
[2014/06/25 11:58:58 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Dropbox
[2014/06/25 11:58:58 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\DropboxMaster
[2013/07/06 22:51:59 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Dwarfs
[2012/10/13 13:14:01 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\FotoWire
[2013/07/13 13:05:50 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\ftblauncher
[2012/01/22 14:14:35 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\GetRightToGo
[2013/07/27 00:06:47 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Gyazo
[2012/08/24 16:45:29 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\ijjigame
[2012/04/17 15:40:46 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\IObit
[2011/07/20 16:28:00 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\LolClient
[2012/08/04 15:32:27 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Mumble
[2011/03/21 14:18:00 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Neopets Toolbar
[2010/12/25 19:01:31 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\NeopleLauncherDFO
[2010/11/26 07:32:39 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Nexon
[2014/06/21 11:17:38 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Nokia
[2012/09/03 15:07:06 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\NPLUTO Corporation
[2010/11/20 15:00:12 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\OEM
[2010/12/22 15:31:48 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\OpenOffice.org
[2013/12/26 23:10:36 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\openvr
[2011/04/23 14:55:28 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Opera
[2014/04/21 18:03:19 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Oracle
[2014/02/05 19:18:29 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Origin
[2011/12/16 22:05:09 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\PC Suite
[2010/11/30 15:25:30 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Publish Providers
[2013/01/12 14:08:17 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\raidcall
[2012/11/13 19:16:21 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\RCKR
[2013/11/22 14:27:24 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Riot Games
[2013/12/26 11:35:41 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Rogue Legacy
[2013/06/26 17:15:20 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\RSBot
[2013/08/01 21:00:07 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Samsung
[2014/02/11 22:45:21 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\SoftGrid Client
[2011/08/27 09:00:56 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Sony
[2013/09/24 17:46:34 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\SplitMediaLabs
[2013/04/17 20:51:38 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Spotflux
[2013/08/26 16:27:48 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\TalesRunner
[2011/10/07 21:23:21 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\TeamViewer
[2010/11/30 13:23:40 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\TP
[2014/03/17 23:46:24 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\TS3Client
[2013/06/14 22:16:23 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\TuneUp Software
[2014/01/27 15:08:38 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\TunkDesign
[2011/11/20 22:36:29 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Unity
[2014/06/26 11:19:47 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\uTorrent
[2011/07/22 12:39:23 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\Windows Live Writer

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:0B4227B4
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:373E1720

< End of report >
You do not have the required permissions to view the files attached to this post.
Zynthiel
Regular Member
 
Posts: 19
Joined: June 24th, 2014, 11:04 pm

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Gary R » June 30th, 2014, 12:21 am

OK, lets take care of the stuff found by OTL ....

  • Double click OTL.exe to launch the programme.
  • Copy/Paste the contents of the code box below into the Custom Scans/Fixes box.
Code: Select all
:OTL
IE - HKLM\..\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}: "URL" = http://slirsredirect.search.aol.com/red ... 706&query= {searchTerms}&invocationType=tb50-ie-aim-chromesbox-en-us&tb_uuid=20110623125424494&tb_oid=23-06-2011&tb_mrud=03-07-2011
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\URLSearchHook: {9565115d-c7d6-46d3-bd63-b67b481a4368} - No CLSID value found
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\SearchScopes\{0499BC2B-7A6A-4571-BDEB-53A451B5E889}: "URL" = http://websearch.shaw.ca/shaw/ws/results/Web/ {SearchTerms}/1/417/TopNavigation/Relevance/iq=true/zoom=off/_iceUrlFlag=7?_IceUrl=true&ua=ie-tb-cd
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}: "URL" = http://slirsredirect.search.aol.com/red ... 706&query= {searchTerms}&invocationType=tb50-ie-aim-chromesbox-en-us&tb_uuid=20110623125424494&tb_oid=23-06-2011&tb_mrud=03-07-2011
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\SearchScopes\{5C24658C-C0C1-48A2-B24F-923D4D423FBE}: "URL" = http://websearch.ask.com/redirect?clien ... src=crm&q= {searchTerms}&locale=en_US&apn_ptnrs=^A4F&apn_dtid=^ADK004^YY^CA&apn_uid=BB02C798-52DC-4300-968A-2220CFB37D93&apn_sauid=EFEC4535-2B30-4EC3-97AB-92ECD8E32995&
IE - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\SearchScopes\{E814839C-A6F8-4A07-81A3-75E6C1C82937}: "URL" = http://search.conduit.com/ResultsExt.aspx?q= {searchTerms}&SearchSource=4&ctid=CT2260173&CUI=UN11748477090511752
FF - HKCU\Software\MozillaPlugins\thehappycloud.com/HappyCloudPlugin: C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
[2014/06/24 20:46:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}
[2013/04/20 17:35:36 | 000,000,000 | ---D | M] (FT GraphiteGlow) -- C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{99e34760-2754-11e0-91fa-0800200c9a66}
O2:64bit: - BHO: (ApptoU) - {EB71F93F-0076-208A-530B-BE7CE0C53717} - C:\ProgramData\ApptoU\ccCYiqF1Z9.x64.dll File not found
O2 - BHO: (no name) - {CD292324-974F-4224-D074-CACA427AA030} - No CLSID value found.
O2 - BHO: (ApptoU) - {EB71F93F-0076-208A-530B-BE7CE0C53717} - C:\ProgramData\ApptoU\ccCYiqF1Z9.dll File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {CD292324-974F-4224-D074-CACA427AA030} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\Toolbar\WebBrowser: (no name) - {51A86BB3-6602-4C85-92A5-130EE4864F13} - No CLSID value found.
O3 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\Toolbar\WebBrowser: (no name) - {9565115D-C7D6-46D3-BD63-B67B481A4368} - No CLSID value found.
O3 - HKU\S-1-5-21-4233458944-2344748423-862420031-1001\..\Toolbar\WebBrowser: (no name) - {CD292324-974F-4224-D074-CACA427AA030} - No CLSID value found.
O4 - HKU\.DEFAULT..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O4 - HKU\S-1-5-18..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Reg Error: Key error.)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/Mi ... b56986.cab (Reg Error: Key error.)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~3\FASTAN~1\FASTAN~2.DLL) - C:\ProgramData\Fast And Safe\FastAndSafe_x64.dll ()
O20 - AppInit_DLLs: (c:\progra~3\fastan~1\fastan~1.dll) - c:\ProgramData\Fast And Safe\FastAndSafe.dll ()
O33 - MountPoints2\{b97035ab-6ad3-11de-a743-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{b97035ab-6ad3-11de-a743-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe
O33 - MountPoints2\{b97035ab-6ad3-11de-a743-806e6f6e6963}\Shell\LVIPCAP\command - "" = D:\techsupt\CaptureTest\LVidCap.exe
O33 - MountPoints2\{fc8bc5a5-1e8a-11e1-a2c9-00262d401683}\Shell - "" = AutoRun
O33 - MountPoints2\{fc8bc5a5-1e8a-11e1-a2c9-00262d401683}\Shell\AutoRun\command - "" = G:\NokiaPCIA_Autorun.exe
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[18 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2012/06/01 15:32:30 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\IObit
[2012/06/01 15:32:30 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\IObit
[2012/04/17 15:40:46 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\IObit
[2014/06/26 11:19:47 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\uTorrent
[2013/06/14 22:16:23 | 000,000,000 | ---D | M] -- C:\Users\jack\AppData\Roaming\TuneUp Software
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:0B4227B4
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:373E1720

:Files
ipconfig /flushdns /c
C:\PROGRA~2\IMESHA~1\MediaBar

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3B76D3C4689583949AEBC713D4ABB15F]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9B367BD5-680D-4257-8CB3-9E6AD6D1453F}]
[-HKEY_CURRENT_USER\Software\Trolltech]
[-HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Trolltech]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4233458944-2344748423-862420031-1001\Software\BabylonToolbar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Babylon Client]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
[-HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4233458944-2344748423-862420031-1001\Software\BabylonToolbar]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E814839C-A6F8-4A07-81A3-75E6C1C82937}]
[-HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\SearchScopes\{E814839C-A6F8-4A07-81A3-75E6C1C82937}]

:Commands
[emptytemp]
[resethosts]

  • Click the Run Fix button.
  • OTL will now process the instructions.
  • When finished a box will open asking you to open the fix log, click OK.
  • The fix log will open.
  • Copy/Paste the log in your next reply please.

Note: If necessary, OTL may re-boot your computer, or request that you do so, if it does, re-boot your computer. A log will be produced upon re-boot.
User avatar
Gary R
Administrator
Administrator
 
Posts: 25888
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Zynthiel » July 1st, 2014, 1:56 pm

Okay, here we go.

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}\ not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
Registry value HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{51a86bb3-6602-4c85-92a5-130ee4864f13} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51a86bb3-6602-4c85-92a5-130ee4864f13}\ not found.
Registry value HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{9565115d-c7d6-46d3-bd63-b67b481a4368} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9565115d-c7d6-46d3-bd63-b67b481a4368}\ not found.
HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0499BC2B-7A6A-4571-BDEB-53A451B5E889}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0499BC2B-7A6A-4571-BDEB-53A451B5E889}\ not found.
Registry key HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}\ not found.
Registry key HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\SearchScopes\{5C24658C-C0C1-48A2-B24F-923D4D423FBE}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C24658C-C0C1-48A2-B24F-923D4D423FBE}\ not found.
Registry key HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\SearchScopes\{E814839C-A6F8-4A07-81A3-75E6C1C82937}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E814839C-A6F8-4A07-81A3-75E6C1C82937}\ not found.
Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\thehappycloud.com/HappyCloudPlugin\ deleted successfully.
C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\Plugins folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\defaults\preferences folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\defaults folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\sl folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\lib\jquery.alerts folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\lib folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\core folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\WEATHER\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\WEATHER folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\TWITTER\resources folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\TWITTER\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\TWITTER folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\SEARCH\view\script folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\SEARCH\view folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\SEARCH\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\SEARCH folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\RADIO_PLAYER\js\resources folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\RADIO_PLAYER\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\RADIO_PLAYER folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\PRICE_GONG\agreement folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\PRICE_GONG folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\Optimizer\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\Optimizer folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\NOTIFICATION\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\NOTIFICATION folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\MULTI_RSS\js\resources folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\MULTI_RSS\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\MULTI_RSS folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\HIGHLIGHTER\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\HIGHLIGHTER folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\EMAIL_NOTIFIER\js\plugins folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\EMAIL_NOTIFIER\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\EMAIL_NOTIFIER folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\APPLICATION_BUTTON\Js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa\APPLICATION_BUTTON folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\wa folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\ui\menu\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\ui\menu folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\ui\gf\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\ui\gf folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\ui\dlg\ftd folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\ui\dlg folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\ui folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\sp\spsd folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\sp\spbd folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\sp\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\sp folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\options\js\resources folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\options\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\options folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\msd folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\api folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\ac\res folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\ac folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\aboutBox\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al\aboutBox folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb\al folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\tb folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\logic\uninstall\dialog\js folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\logic\uninstall\dialog folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\logic\uninstall folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content\logic folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173\content folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\CT2260173 folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{99e34760-2754-11e0-91fa-0800200c9a66}\chrome folder moved successfully.
C:\Users\jack\AppData\Roaming\mozilla\Firefox\Profiles\jztv8gxs.default\extensions\{99e34760-2754-11e0-91fa-0800200c9a66} folder moved successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EB71F93F-0076-208A-530B-BE7CE0C53717}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EB71F93F-0076-208A-530B-BE7CE0C53717}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CD292324-974F-4224-D074-CACA427AA030}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CD292324-974F-4224-D074-CACA427AA030}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EB71F93F-0076-208A-530B-BE7CE0C53717}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EB71F93F-0076-208A-530B-BE7CE0C53717}\ deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{669695BC-A811-4A9D-8CDF-BA8C795F261C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{669695BC-A811-4A9D-8CDF-BA8C795F261C}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CD292324-974F-4224-D074-CACA427AA030} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CD292324-974F-4224-D074-CACA427AA030}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{51A86BB3-6602-4C85-92A5-130EE4864F13} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51A86BB3-6602-4C85-92A5-130EE4864F13}\ not found.
Registry value HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{9565115D-C7D6-46D3-BD63-B67B481A4368} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9565115D-C7D6-46D3-BD63-B67B481A4368}\ not found.
Registry value HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CD292324-974F-4224-D074-CACA427AA030} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CD292324-974F-4224-D074-CACA427AA030}\ not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SPReview deleted successfully.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SPReview not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{F5A7706B-B9C0-4C89-A715-7A0C6B05DD48}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{F5A7706B-B9C0-4C89-A715-7A0C6B05DD48}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5A7706B-B9C0-4C89-A715-7A0C6B05DD48}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{F5A7706B-B9C0-4C89-A715-7A0C6B05DD48}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5A7706B-B9C0-4C89-A715-7A0C6B05DD48}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~3\FASTAN~1\FASTAN~2.DLL deleted successfully.
C:\ProgramData\Fast And Safe\FastAndSafe_x64.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\progra~3\fastan~1\fastan~1.dll deleted successfully.
c:\ProgramData\Fast And Safe\FastAndSafe.dll moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b97035ab-6ad3-11de-a743-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b97035ab-6ad3-11de-a743-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b97035ab-6ad3-11de-a743-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b97035ab-6ad3-11de-a743-806e6f6e6963}\ not found.
File D:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b97035ab-6ad3-11de-a743-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b97035ab-6ad3-11de-a743-806e6f6e6963}\ not found.
File D:\techsupt\CaptureTest\LVidCap.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fc8bc5a5-1e8a-11e1-a2c9-00262d401683}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fc8bc5a5-1e8a-11e1-a2c9-00262d401683}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fc8bc5a5-1e8a-11e1-a2c9-00262d401683}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fc8bc5a5-1e8a-11e1-a2c9-00262d401683}\ not found.
File G:\NokiaPCIA_Autorun.exe not found.
C:\Windows\3F5C371F8EA24F259D3DD0B4526E3AEA.TMP\WiseCustomCalla.dll deleted successfully.
C:\Windows\3F5C371F8EA24F259D3DD0B4526E3AEA.TMP folder deleted successfully.
C:\Windows\DEA314C409294250BC9298E4C105F28D.TMP\WiseCustomCalla.dll deleted successfully.
C:\Windows\DEA314C409294250BC9298E4C105F28D.TMP folder deleted successfully.
C:\Windows\msdownld.tmp folder deleted successfully.
C:\Windows\SysWow64\SET6770.tmp deleted successfully.
C:\Windows\SysWow64\sho2099.tmp deleted successfully.
C:\Windows\SysWow64\sho2588.tmp deleted successfully.
C:\Windows\SysWow64\sho2FEE.tmp deleted successfully.
C:\Windows\SysWow64\sho3588.tmp deleted successfully.
C:\Windows\SysWow64\sho4347.tmp deleted successfully.
C:\Windows\SysWow64\sho4B0F.tmp deleted successfully.
C:\Windows\SysWow64\sho6C73.tmp deleted successfully.
C:\Windows\SysWow64\sho845C.tmp deleted successfully.
C:\Windows\SysWow64\sho8900.tmp deleted successfully.
C:\Windows\SysWow64\sho8EB1.tmp deleted successfully.
C:\Windows\SysWow64\shoAB8E.tmp deleted successfully.
C:\Windows\SysWow64\shoB59A.tmp deleted successfully.
C:\Windows\SysWow64\shoD9E.tmp deleted successfully.
C:\Windows\SysWow64\shoDF46.tmp deleted successfully.
C:\Windows\SysWow64\shoF99B.tmp deleted successfully.
C:\Windows\SysWow64\shoF9BC.tmp deleted successfully.
C:\Windows\SysWow64\shoFCF1.tmp deleted successfully.
C:\Users\Default\AppData\Roaming\IObit\Smart Defrag 2 folder moved successfully.
C:\Users\Default\AppData\Roaming\IObit folder moved successfully.
Folder C:\Users\Default User\AppData\Roaming\IObit\ not found.
C:\Users\jack\AppData\Roaming\IObit\Smart Defrag 2 folder moved successfully.
C:\Users\jack\AppData\Roaming\IObit\IObit Malware Fighter folder moved successfully.
C:\Users\jack\AppData\Roaming\IObit\Advanced SystemCare V5\Toolbox folder moved successfully.
C:\Users\jack\AppData\Roaming\IObit\Advanced SystemCare V5\Smart RAM folder moved successfully.
C:\Users\jack\AppData\Roaming\IObit\Advanced SystemCare V5\Log folder moved successfully.
C:\Users\jack\AppData\Roaming\IObit\Advanced SystemCare V5\Boottime folder moved successfully.
C:\Users\jack\AppData\Roaming\IObit\Advanced SystemCare V5\Backup folder moved successfully.
C:\Users\jack\AppData\Roaming\IObit\Advanced SystemCare V5 folder moved successfully.
C:\Users\jack\AppData\Roaming\IObit folder moved successfully.
C:\Users\jack\AppData\Roaming\uTorrent folder moved successfully.
C:\Users\jack\AppData\Roaming\TuneUp Software\TU2012\Backups folder moved successfully.
C:\Users\jack\AppData\Roaming\TuneUp Software\TU2012 folder moved successfully.
C:\Users\jack\AppData\Roaming\TuneUp Software folder moved successfully.
ADS C:\ProgramData\Temp:0B4227B4 deleted successfully.
ADS C:\ProgramData\Temp:373E1720 deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\jack\Downloads\cmd.bat deleted successfully.
C:\Users\jack\Downloads\cmd.txt deleted successfully.
File\Folder C:\PROGRA~2\IMESHA~1\MediaBar not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3B76D3C4689583949AEBC713D4ABB15F\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9B367BD5-680D-4257-8CB3-9E6AD6D1453F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9B367BD5-680D-4257-8CB3-9E6AD6D1453F}\ not found.
Registry key HKEY_CURRENT_USER\Software\Trolltech\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Trolltech\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4233458944-2344748423-862420031-1001\Software\BabylonToolbar\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Babylon Client\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}\ not found.
Registry key HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4233458944-2344748423-862420031-1001\Software\BabylonToolbar\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E814839C-A6F8-4A07-81A3-75E6C1C82937}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E814839C-A6F8-4A07-81A3-75E6C1C82937}\ not found.
Registry key HKEY_USERS\S-1-5-21-4233458944-2344748423-862420031-1001\Software\Microsoft\Internet Explorer\SearchScopes\{E814839C-A6F8-4A07-81A3-75E6C1C82937}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E814839C-A6F8-4A07-81A3-75E6C1C82937}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: jack
->Temp folder emptied: 3303250 bytes
->Temporary Internet Files folder emptied: 6038936 bytes
->Java cache emptied: 13192601 bytes
->FireFox cache emptied: 68787221 bytes
->Google Chrome cache emptied: 371476172 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 4789 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 81692 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 84543379 bytes
RecycleBin emptied: 4598178 bytes

Total Files Cleaned = 526.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.69.0 log created on 07012014_104257

Files\Folders moved on Reboot...
C:\Users\jack\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\Low\SkypeClickToCall\Logs\AutoUpdateSvc.log scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
Zynthiel
Regular Member
 
Posts: 19
Joined: June 24th, 2014, 11:04 pm

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Gary R » July 2nd, 2014, 12:25 am

OK, that looks to have gone successfully, so lets have a general look around to see if we've missed anything .....

Please run a scan with ESET Online Scanner, this will take a few hours to run but it's very thorough and doesn't miss much.

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.
  • Please go HERE then click on Run ESET Online Scanner
Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: Image
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: Image
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed click on Start to start the scan.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed you will be presented with a list of found threats ....
    • Click on the List of found threats link
    • Click on Export to text file
    • Save as ESET.txt to your Desktop
  • Exit out of ESET Online Scanner.
  • Post me the contents of ESET.txt please.

Also let me know how your computer is behaving now please.



.
User avatar
Gary R
Administrator
Administrator
 
Posts: 25888
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Zynthiel » July 2nd, 2014, 12:20 pm

Er, The link that leads to how to disable anti-viruses doesnt work, cause BleepingComputer haha. and I noticed my computer doesnt have the same problems as before, like the cpu usage going up.
Zynthiel
Regular Member
 
Posts: 19
Joined: June 24th, 2014, 11:04 pm

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Gary R » July 2nd, 2014, 12:50 pm

Since you're using Microsoft Security Essentials as your AV, there's probably no need to disable it for the E-Set scan, so just run the scan as directed in my last post.

If a problem does arise, then to disable MSE ...

  • Click on the MSE icon in your taskbar (bottom right of screen) and select Open
  • Click the Settings tab, and then Real time protection
  • Uncheck turn on real time protection
  • Click Save Changes
  • Exit out of MSE.

If you do disable MSE, don't forget to re-enable it after you've run the E-Set scan.
User avatar
Gary R
Administrator
Administrator
 
Posts: 25888
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Zynthiel » July 2nd, 2014, 5:39 pm

Does chrome work for the scan?
Zynthiel
Regular Member
 
Posts: 19
Joined: June 24th, 2014, 11:04 pm

Re: Trojan? SysWOW64/rundll32 impersonator?

Unread postby Gary R » July 2nd, 2014, 6:16 pm

No idea, but since your logs say you have Firefox installed I don't see why you'd ask, just use that since the scan is known to work with it.

Personally I wouldn't allow Chrome within a mile of any computer I owned, I've read Google's EULA, and that ensures I'll never use it.
User avatar
Gary R
Administrator
Administrator
 
Posts: 25888
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire
Advertisement
Register to Remove

PreviousNext

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 291 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware