Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Blekko redirect all my browser (IE9, Chrome and Firefox)

Started by juanymerja, Sep 01 2012 01:00 PM

Browsers Redirect

This topic is locked

17 replies to this topic

#1 juanymerja

New Member

Members
9 posts

Posted 01 September 2012 - 01:00 PM

Hello,
Everytime I search something from home search screen I get redirected to some Blekko ssearch site. I do not find any toolbar installled in any of the browsers, neither I find any Blekko toolbar looking into Control Panel --> Programs and Feautures. I can't either find any solution changing browser settings. All my three browsers (Chrome, IE9 and Firefox) present the same problem.
Thanks for your help!

Attached Files

DDS.txt 34.17KB 9 downloads
Attach.txt 4.29KB 9 downloads

#2 Maniac

Forum Deity

Experts
17,441 posts

Gender:Male
Location:Bulgaria, EU

Posted 01 September 2012 - 01:20 PM

Hello juanymerja and :welcome:

! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

Step 1

Please uninstall the following application: µTorrent

Step 2

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

Step 3

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Please tick the Scan All users. Next, click the Quick Scan button. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.

In your next reply, post the following log files:

Malwarebytes' Anti-Malware log
OTL log with Extras.txt

My help is free, however, if you wish to make a small donation to show appreciation and to help me continue the fight against Malware, then click here

#3 juanymerja

New Member

Members
9 posts

Posted 01 September 2012 - 03:51 PM

Hello Maniac, here are the first two log files. I'll make a new post for the last log file since I received an error message saying the post was too long.
Thanks a lot!

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.09.01.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Juan :: JUAN-PC [administrator]

9/1/2012 4:20:36 PM
mbam-log-2012-09-01 (16-20-36).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 214022
Time elapsed: 1 minute(s), 24 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

OTL logfile created on: 9/1/2012 4:29:03 PM - Run 1
OTL by OldTimer - Version 3.2.59.1 Folder = C:\Users\Juan\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.93 Gb Total Physical Memory | 5.59 Gb Available Physical Memory | 70.56% Memory free
15.85 Gb Paging File | 13.39 Gb Available in Paging File | 84.47% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.66 Gb Total Space | 380.28 Gb Free Space | 81.67% Space Free | Partition Type: NTFS
Drive D: | 465.76 Gb Total Space | 413.29 Gb Free Space | 88.74% Space Free | Partition Type: NTFS

Computer Name: JUAN-PC | User Name: Juan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/09/01 16:26:42 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Juan\Desktop\OTL.exe
PRC - [2012/08/21 05:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/08/21 05:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/08/13 13:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/07/27 16:51:38 | 000,823,224 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
PRC - [2012/07/27 13:51:28 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/07/24 22:08:10 | 026,909,544 | ---- | M] (Dropbox, Inc.) -- C:\Users\Juan\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012/07/02 10:13:16 | 009,412,096 | ---- | M] (Celartem, Inc., doing business as Extensis.) -- C:\Program Files (x86)\Extensis\Suitcase Fusion 4\FMCore.exe
PRC - [2012/05/28 15:56:36 | 000,288,128 | ---- | M] (IObit) -- C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe
PRC - [2012/05/26 12:04:52 | 000,913,792 | ---- | M] (IObit) -- C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe
PRC - [2012/05/15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2011/01/23 19:47:44 | 000,148,280 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe
PRC - [2011/01/23 19:47:42 | 000,770,728 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe
PRC - [2010/10/07 14:05:14 | 000,170,624 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
PRC - [2010/10/07 09:43:00 | 000,182,912 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
PRC - [2010/08/17 14:55:42 | 005,732,992 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
PRC - [2009/12/15 10:39:38 | 000,096,896 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
PRC - [2009/06/19 10:29:42 | 000,105,016 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
PRC - [2009/06/19 10:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
PRC - [2009/06/15 17:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
PRC - [2008/12/22 17:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe

========== Modules (No Company Name) ==========

MOD - [2012/08/19 08:01:09 | 014,412,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll
MOD - [2012/07/02 10:03:48 | 001,007,616 | ---- | M] () -- C:\Program Files (x86)\Extensis\Suitcase Fusion 4\libxml2.2.6.24.dll
MOD - [2012/07/02 10:03:48 | 000,901,120 | ---- | M] () -- C:\Program Files (x86)\Extensis\Suitcase Fusion 4\iconv-1.9.2.dll
MOD - [2012/07/02 10:03:48 | 000,007,168 | ---- | M] () -- C:\Program Files (x86)\Extensis\Suitcase Fusion 4\libcharset.dll
MOD - [2011/01/23 19:47:44 | 000,148,280 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe
MOD - [2011/01/23 19:47:42 | 000,770,728 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe
MOD - [2010/04/05 05:56:20 | 000,094,359 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\epoemdll.dll
MOD - [2010/04/05 05:56:19 | 000,045,221 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\epstring.dll
MOD - [2010/04/05 05:56:17 | 002,203,803 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\epwizres.dll
MOD - [2010/04/05 05:56:07 | 000,716,954 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\epwizard.dll
MOD - [2010/04/05 05:55:15 | 000,159,890 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\customui.dll
MOD - [2010/04/05 05:55:04 | 000,061,604 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\epfunct.dll
MOD - [2010/04/05 05:54:59 | 000,123,033 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\eputil.dll
MOD - [2010/04/05 05:54:52 | 000,143,502 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\imagutil.dll
MOD - [2010/04/01 12:24:28 | 001,159,168 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecdrs.dll
MOD - [2010/04/01 12:23:27 | 000,389,120 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecscw.dll
MOD - [2009/05/27 07:16:50 | 000,192,512 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecdatr.dll
MOD - [2009/04/07 14:25:27 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\iptk.dll
MOD - [2009/03/10 00:43:49 | 000,155,648 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxeccaps.dll
MOD - [2009/03/02 09:25:47 | 000,151,552 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecptp.dll
MOD - [2009/02/20 04:48:43 | 000,023,552 | ---- | M] () -- C:\Windows\SysWOW64\LXECsmr.dll
MOD - [2009/02/20 04:48:03 | 000,299,008 | ---- | M] () -- C:\Windows\SysWOW64\LXECsm.dll

========== Services (SafeList) ==========

SRV:64bit: - [2012/08/21 05:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2012/03/11 21:13:24 | 002,815,496 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
SRV:64bit: - [2010/04/14 15:08:30 | 001,052,328 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxeccoms.exe -- (lxec_device)
SRV:64bit: - [2010/04/14 15:08:23 | 000,045,736 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxecserv.exe -- (lxecCATSCustConnectService)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 21:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012/09/01 09:07:30 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/08/13 13:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012/07/27 13:51:28 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/05/26 12:04:52 | 000,913,792 | ---- | M] (IObit) [Auto | Running] -- C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe -- (AdvancedSystemCareService5)
SRV - [2012/05/15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012/01/05 11:42:34 | 000,075,624 | ---- | M] (Alcohol Soft Development Team) [Auto | Stopped] -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe -- (AxAutoMntSrv)
SRV - [2010/04/14 15:08:23 | 000,045,736 | ---- | M] () [Auto | Stopped] -- C:\Windows\system32\spool\DRIVERS\x64\3\\lxecserv.exe -- (lxecCATSCustConnectService)
SRV - [2010/04/14 15:08:12 | 000,598,696 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxeccoms.exe -- (lxec_device)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/12/23 17:34:20 | 000,370,688 | ---- | M] (StarWind Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2009/12/15 10:39:38 | 000,096,896 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2009/06/15 17:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/08/21 05:13:13 | 000,969,200 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2012/08/21 05:13:13 | 000,359,464 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2012/08/21 05:13:13 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2012/08/21 05:13:12 | 000,071,600 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2012/08/21 05:13:12 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2012/08/21 05:13:11 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2012/08/18 19:46:23 | 000,560,184 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2012/04/18 13:08:03 | 000,188,736 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012/03/01 02:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/07/21 19:01:14 | 001,448,496 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011/03/11 02:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 02:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 09:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 07:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010/09/24 19:24:26 | 000,229,376 | ---- | M] (Fresco Logic) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\FLxHCIc.sys -- (FLxHCIc)
DRV:64bit: - [2010/09/24 19:24:26 | 000,069,120 | ---- | M] (Fresco Logic) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\FLxHCIh.sys -- (FLxHCIh)
DRV:64bit: - [2010/07/26 11:27:34 | 000,318,056 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsPStor.sys -- (RSPCIESTOR)
DRV:64bit: - [2010/04/21 15:47:50 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2010/01/11 16:36:32 | 000,011,520 | ---- | M] (Primax Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Asusgms.sys -- (AsusgmsFltr)
DRV:64bit: - [2009/11/18 07:12:00 | 000,032,344 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MBfilt64.sys -- (MBfilt)
DRV:64bit: - [2009/09/17 19:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009/08/20 10:41:38 | 001,800,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC)
DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/19 22:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/13 09:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2008/05/23 17:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009/07/02 17:36:14 | 000,015,416 | ---- | M] (ASUS) [Kernel | Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-742528787-374410395-3492436187-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-742528787-374410395-3492436187-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?...opt=0&ocid=iehp
IE - HKU\S-1-5-21-742528787-374410395-3492436187-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-742528787-374410395-3492436187-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 2D 08 4F 8F 0A 7C CD 01 [binary data]
IE - HKU\S-1-5-21-742528787-374410395-3492436187-1001\..\SearchScopes,DefaultScope = {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
IE - HKU\S-1-5-21-742528787-374410395-3492436187-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKU\S-1-5-21-742528787-374410395-3492436187-1001\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://blekko.com/ws...q={searchTerms}
IE - HKU\S-1-5-21-742528787-374410395-3492436187-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-742528787-374410395-3492436187-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Blekko"
FF - prefs.js..browser.search.order.1: "Blekko"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..keyword.URL: "http://www.google.com/search?btnI=I%27m+Feeling+Lucky&ie=UTF-8&oe=UTF-8&q="
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012/08/23 19:13:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/08/28 15:06:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/09/01 09:07:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/08/16 20:50:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Juan\AppData\Roaming\Mozilla\Extensions
[2012/08/24 16:40:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Juan\AppData\Roaming\Mozilla\Firefox\Profiles\s4zak23y.default\extensions
[2012/08/21 13:30:04 | 000,000,000 | ---D | M] (Diccionario español Argentina) -- C:\Users\Juan\AppData\Roaming\Mozilla\Firefox\Profiles\s4zak23y.default\extensions\es-AR@dictionaries.addons.mozilla.org
[2012/08/25 19:48:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/08/25 19:48:30 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/08/16 20:57:46 | 000,234,233 | ---- | M] () (No name found) -- C:\USERS\JUAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4ZAK23Y.DEFAULT\EXTENSIONS\{5C46D283-ABDE-4DCE-B83C-08881401921C}.XPI
[2012/08/16 21:38:13 | 000,109,964 | ---- | M] () (No name found) -- C:\USERS\JUAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4ZAK23Y.DEFAULT\EXTENSIONS\ADBLOCKPOPUPS@JESSEHAKANEN.NET.XPI
[2012/09/01 09:07:30 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/09/01 09:07:29 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/08/17 08:49:12 | 000,002,134 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\search.xml
[2012/09/01 09:07:29 | 000,002,253 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms},
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.79\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.83\gcswf32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.83\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.83\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - Extension: USA TODAY = C:\Users\Juan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aggljnipbdiebhbmadknfbjlhehbohbn\2.1_0\
CHR - Extension: Google Drive = C:\Users\Juan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.1_0\
CHR - Extension: NYTimes = C:\Users\Juan\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecmphppfkcfflgglcokcbdkofpfegoel\1.2.4_0\
CHR - Extension: Google Calendar = C:\Users\Juan\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn\4.5.3_0\
CHR - Extension: AdBlock = C:\Users\Juan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.41_0\
CHR - Extension: avast! WebRep = C:\Users\Juan\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1466_0\
CHR - Extension: BBC News = C:\Users\Juan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfogldomhibblicbcilfigcbigkjkhc\1.5.2_0\
CHR - Extension: Skype Click to Call = C:\Users\Juan\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.2.0.10687_0\
CHR - Extension: Star Gazer = C:\Users\Juan\AppData\Local\Google\Chrome\User Data\Default\Extensions\mblmlcbknbnfebdfjnolmcapmdofhmme\1.1_0\
CHR - Extension: Fox News = C:\Users\Juan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pamidlfalnpbkhdhbbepaibgehibgmna\2.3_0\
CHR - Extension: Gmail = C:\Users\Juan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/08/23 18:36:46 | 000,001,254 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 3dns.adobe.com 3dns-1.adobe.com 3dns-2.adobe.com 3dns-3.adobe.com 3dns-4.adobe.com activate.adobe.com activate-sea.adobe.com activate-sjc0.adobe.com activate.wip.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip1.adobe.com activate.wip2.adobe.com activate.wip3.adobe.com activate.wip4.adobe.com adobe-dns.adobe.com adobe-dns-1.adobe.com adobe-dns-2.adobe.com adobe-dns-3.adobe.com adobe-dns-4.adobe.com
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {8769adce-dba5-48e9-afb5-67b12cdf2e61} - No CLSID value found.
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - {8769adce-dba5-48e9-afb5-67b12cdf2e61} - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe ()
O4:64bit: - HKLM..\Run: [lxecmon.exe] C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [Lexmark Pro800-Pro900 Series] C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\fm3032.exe ()
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-742528787-374410395-3492436187-1001..\Run: [Advanced SystemCare 5] C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)
O4 - HKU\S-1-5-21-742528787-374410395-3492436187-1001..\Run: [AlcoholAutomount] C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe (Alcohol Soft Development Team)
O4 - HKU\S-1-5-21-742528787-374410395-3492436187-1001..\Run: [FMCore.exe] C:\Program Files (x86)\Extensis\Suitcase Fusion 4\FMCore.exe (Celartem, Inc., doing business as Extensis.)
O4 - HKU\S-1-5-21-742528787-374410395-3492436187-1001..\Run: [reg_utils_pro] C:\Program Files (x86)\Registry Utilities Pro\RegUtilsPro.exe (Avanquest)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Juan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Juan\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{838BD2C1-46EA-4145-ACFE-29244EC393D7}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\guard64.dll) - C:\Windows\SysNative\guard64.dll (COMODO)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\guard32.dll) - C:\Windows\SysWOW64\guard32.dll (COMODO)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/09/01 16:26:40 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Users\Juan\Desktop\OTL.exe
[2012/09/01 13:45:58 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[2012/09/01 13:42:49 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Juan\Desktop\dds.com
[2012/09/01 09:18:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012/09/01 09:11:15 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012/08/31 15:14:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\R.G. Mechanics
[2012/08/27 16:57:38 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\Wisdom-soft
[2012/08/27 16:56:55 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wisdom-soft ScreenHunter 6 Free
[2012/08/27 16:56:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wisdom-soft ScreenHunter 6 Free
[2012/08/27 16:56:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wisdom-soft ScreenHunter 6.0 Free
[2012/08/27 13:27:10 | 000,000,000 | ---D | C] -- C:\Users\Juan\Documents\My Games
[2012/08/27 13:26:38 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\SKIDROW
[2012/08/26 23:02:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Activision
[2012/08/25 22:28:02 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012/08/25 19:48:12 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Skype
[2012/08/25 19:48:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012/08/25 19:48:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012/08/25 19:48:06 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2012/08/25 19:48:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2012/08/24 15:20:09 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\ImgBurn
[2012/08/24 15:01:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
[2012/08/24 15:01:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ImgBurn
[2012/08/24 11:58:44 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/08/24 08:39:33 | 000,024,960 | ---- | C] (IObit) -- C:\Windows\SysNative\RegistryDefragBootTime.exe
[2012/08/23 20:52:58 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012/08/23 20:52:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012/08/23 20:51:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe Media Player
[2012/08/23 20:51:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
[2012/08/23 20:48:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR
[2012/08/23 18:42:38 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[2012/08/23 18:41:53 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\Adobe
[2012/08/23 18:41:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle ES2
[2012/08/23 18:39:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2012/08/23 18:39:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2012/08/23 16:58:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\MSSoap
[2012/08/23 16:57:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Serif Applications
[2012/08/23 16:57:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Serif
[2012/08/23 11:29:16 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\Extensis
[2012/08/23 11:28:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Extensis
[2012/08/23 11:28:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour
[2012/08/23 11:28:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Extensis
[2012/08/23 09:05:58 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Pro800-Pro900 Series
[2012/08/23 08:53:02 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2012/08/23 08:46:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Ezprint
[2012/08/23 08:40:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Lx_cats
[2012/08/23 08:40:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2012/08/23 08:33:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ABBYY FineReader 6.0 Sprint
[2012/08/23 08:33:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Abbyy FineReader 6.0 Sprint
[2012/08/23 08:32:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Pro800-Pro900 Series
[2012/08/23 08:32:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lexmark Toolbar
[2012/08/23 08:32:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lexmark
[2012/08/23 08:31:55 | 000,007,680 | ---- | C] (eaio) -- C:\Windows\SysWow64\NativeCall.dll
[2012/08/23 08:31:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series
[2012/08/23 08:04:10 | 000,000,000 | ---D | C] -- C:\Program Files\Lexmark
[2012/08/23 08:04:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lexmark
[2012/08/23 07:58:32 | 000,000,000 | ---D | C] -- C:\Program Files\Lexmark Pro800-Pro900 Series
[2012/08/22 15:51:37 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Thinstall
[2012/08/22 15:51:37 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\Thinstall
[2012/08/22 13:55:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012/08/22 10:25:01 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\NVIDIA
[2012/08/22 10:25:00 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Serif
[2012/08/22 08:53:38 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics
[2012/08/22 08:52:52 | 000,000,000 | ---D | C] -- C:\ProgramData\P4G
[2012/08/22 08:52:52 | 000,000,000 | ---D | C] -- C:\Program Files\P4G
[2012/08/22 08:52:06 | 001,448,496 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\drivers\SynTP.sys
[2012/08/22 08:52:06 | 000,226,600 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPAPI.dll
[2012/08/22 08:52:06 | 000,148,264 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPCo9.dll
[2012/08/22 08:52:06 | 000,107,816 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynTPCOM.dll
[2012/08/22 08:52:05 | 000,412,456 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynCOM.dll
[2012/08/22 08:52:05 | 000,276,264 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynCtrl.dll
[2012/08/22 08:52:05 | 000,222,504 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCtrl.dll
[2012/08/22 08:52:05 | 000,177,448 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCOM.dll
[2012/08/19 07:59:45 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Macromedia
[2012/08/19 07:59:45 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\Macromedia
[2012/08/19 07:59:45 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Adobe
[2012/08/19 07:59:10 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2012/08/19 07:59:08 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012/08/19 07:58:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012/08/18 21:17:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
[2012/08/18 21:17:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2012/08/18 21:17:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2012/08/18 21:17:09 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Synchronization Services
[2012/08/18 21:16:50 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2012/08/18 21:16:50 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Sync Framework
[2012/08/18 21:16:50 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server Compact Edition
[2012/08/18 21:15:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8
[2012/08/18 21:14:53 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Analysis Services
[2012/08/18 21:14:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
[2012/08/18 21:14:24 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\Microsoft Help
[2012/08/18 21:14:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2012/08/18 21:14:18 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012/08/18 21:14:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2012/08/18 21:14:04 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2012/08/18 20:29:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2012/08/18 19:49:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Alcohol 120%
[2012/08/18 19:48:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Alcohol Soft
[2012/08/18 19:46:23 | 000,560,184 | ---- | C] (Duplex Secure Ltd.) -- C:\Windows\SysNative\drivers\sptd.sys
[2012/08/18 12:25:36 | 000,000,000 | ---D | C] -- C:\Users\Juan\Documents\indesign-template-christian-church-brochure
[2012/08/18 12:24:44 | 000,000,000 | R--D | C] -- C:\Users\Juan\Libros
[2012/08/18 12:21:08 | 000,000,000 | ---D | C] -- C:\Users\Juan\Documents\Serif
[2012/08/18 11:10:01 | 000,000,000 | R--D | C] -- C:\Users\Juan\Dropbox
[2012/08/18 11:08:04 | 000,000,000 | R--D | C] -- C:\Users\Juan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012/08/18 11:07:54 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2012/08/18 11:07:16 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Dropbox
[2012/08/18 09:10:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
[2012/08/18 09:10:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\World of Warcraft
[2012/08/18 09:10:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Blizzard Entertainment
[2012/08/18 09:09:41 | 000,000,000 | ---D | C] -- C:\ProgramData\BVRP Software
[2012/08/17 21:06:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2012/08/17 20:56:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Registry Utilities Professional
[2012/08/17 20:56:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Registry Utilities Pro
[2012/08/17 15:19:10 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2012/08/17 15:18:26 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
[2012/08/17 15:13:19 | 000,116,224 | ---- | C] (Windows ® Codename Longhorn DDK provider) -- C:\Windows\SysNative\fms.dll
[2012/08/17 15:13:02 | 000,093,696 | ---- | C] (Windows ® Codename Longhorn DDK provider) -- C:\Windows\SysWow64\fms.dll
[2012/08/17 14:54:02 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Gaming Mouse
[2012/08/17 14:54:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gaming Mouse
[2012/08/17 14:54:00 | 000,011,520 | ---- | C] (Primax Ltd) -- C:\Windows\SysNative\drivers\Asusgms.sys
[2012/08/17 14:53:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Gaming Mouse
[2012/08/17 14:53:37 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\InstallShield
[2012/08/17 14:36:10 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat
[2012/08/17 14:36:10 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat
[2012/08/17 12:33:13 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\Diagnostics
[2012/08/17 11:51:43 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\ElevatedDiagnostics
[2012/08/17 09:31:14 | 000,375,808 | ---- | C] (Sonix) -- C:\Windows\SysNative\vsnp2uvc.dll
[2012/08/17 09:31:14 | 000,306,176 | ---- | C] (Sonix) -- C:\Windows\SysWow64\vsnp2uvc.dll
[2012/08/17 09:18:08 | 000,000,000 | ---D | C] -- C:\Program Files\Fresco Logic Inc
[2012/08/17 09:09:33 | 000,076,912 | ---- | C] (Atheros Communications, Inc.) -- C:\Windows\SysNative\drivers\L1C62x64.sys
[2012/08/17 09:03:34 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\SysWow64\CSVer.dll
[2012/08/17 09:03:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel
[2012/08/17 09:03:12 | 000,000,000 | ---D | C] -- C:\Intel
[2012/08/17 09:02:33 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\sda
[2012/08/17 08:57:41 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM
[2012/08/17 08:57:41 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2012/08/17 08:57:29 | 002,601,816 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll
[2012/08/17 08:57:29 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll
[2012/08/17 08:57:29 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll
[2012/08/17 08:57:29 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll
[2012/08/17 08:57:29 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll
[2012/08/17 08:57:28 | 000,372,936 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll
[2012/08/17 08:57:28 | 000,307,920 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll
[2012/08/17 08:57:28 | 000,307,920 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll
[2012/08/17 08:57:28 | 000,201,928 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll
[2012/08/17 08:57:28 | 000,099,016 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll
[2012/08/17 08:57:28 | 000,076,488 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll
[2012/08/17 08:57:27 | 002,197,264 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll
[2012/08/17 08:57:27 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll
[2012/08/17 08:57:26 | 000,330,656 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
[2012/08/17 08:57:26 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2012/08/17 08:57:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2012/08/17 08:57:21 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp
[2012/08/17 08:57:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2012/08/17 08:56:08 | 000,000,000 | ---D | C] -- C:\ProgramData\IObit
[2012/08/17 08:55:54 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\IObit
[2012/08/17 08:55:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 5
[2012/08/17 08:55:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IObit
[2012/08/17 08:49:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID
[2012/08/17 08:49:53 | 000,000,000 | ---D | C] -- C:\Program Files\CPUID
[2012/08/17 08:49:13 | 000,000,000 | ---D | C] -- C:\ProgramData\blekko toolbars
[2012/08/17 08:49:07 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\blekkotb_031
[2012/08/17 08:15:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility
[2012/08/17 08:15:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ASUS
[2012/08/16 23:45:18 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012/08/16 22:57:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\World of Warcraft.temp
[2012/08/16 22:57:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Blizzard Entertainment.temp
[2012/08/16 22:56:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment
[2012/08/16 22:52:40 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\WinRAR
[2012/08/16 22:52:40 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012/08/16 22:52:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012/08/16 22:52:25 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012/08/16 22:46:24 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2012/08/16 22:45:48 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2012/08/16 22:18:30 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Malwarebytes
[2012/08/16 22:18:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/08/16 22:18:18 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/08/16 22:18:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/08/16 22:18:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/08/16 21:14:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012/08/16 21:14:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2012/08/16 20:50:02 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Mozilla
[2012/08/16 20:50:02 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\Mozilla
[2012/08/16 20:49:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012/08/16 20:48:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012/08/16 20:48:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012/08/16 20:43:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012/08/16 20:41:57 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2012/08/16 20:41:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2012/08/16 20:40:46 | 000,068,928 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2012/08/16 20:40:46 | 000,061,248 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2012/08/16 20:40:38 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2012/08/16 20:39:38 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2012/08/16 20:39:11 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2012/08/16 20:26:49 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt
[2012/08/16 20:15:55 | 000,000,000 | ---D | C] -- C:\ProgramData\CPA_VA
[2012/08/16 20:13:05 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\COMODO
[2012/08/16 20:09:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\COMODO
[2012/08/16 20:09:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo
[2012/08/16 20:09:22 | 000,000,000 | ---D | C] -- C:\Program Files\COMODO
[2012/08/16 20:02:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012/08/16 20:00:31 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\Google
[2012/08/16 20:00:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2012/08/16 20:00:30 | 000,025,232 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2012/08/16 20:00:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2012/08/16 20:00:29 | 000,359,464 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2012/08/16 20:00:27 | 000,059,728 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2012/08/16 20:00:27 | 000,054,072 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2012/08/16 20:00:26 | 000,969,200 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2012/08/16 20:00:24 | 000,285,328 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2012/08/16 20:00:24 | 000,071,600 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2012/08/16 20:00:08 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012/08/16 19:59:59 | 000,227,648 | ---- | C] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2012/08/16 19:59:59 | 000,041,224 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2012/08/16 19:59:49 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2012/08/16 19:59:49 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012/08/16 19:53:39 | 000,000,000 | R--D | C] -- C:\Users\Juan\Searches
[2012/08/16 19:53:39 | 000,000,000 | R--D | C] -- C:\Users\Juan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012/08/16 19:53:39 | 000,000,000 | -H-D | C] -- C:\Users\Juan\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2012/08/16 19:53:25 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Identities
[2012/08/16 19:53:18 | 000,000,000 | R--D | C] -- C:\Users\Juan\Contacts
[2012/08/16 19:53:14 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\VirtualStore
[2012/08/16 19:53:00 | 000,000,000 | -HSD | C] -- C:\Users\Juan\AppData\Local\Temporary Internet Files
[2012/08/16 19:53:00 | 000,000,000 | -HSD | C] -- C:\Users\Juan\Templates
[2012/08/16 19:53:00 | 000,000,000 | -HSD | C] -- C:\Users\Juan\Start Menu
[2012/08/16 19:53:00 | 000,000,000 | -HSD | C] -- C:\Users\Juan\SendTo
[2012/08/16 19:53:00 | 000,000,000 | -HSD | C] -- C:\Users\Juan\Recent
[2012/08/16 19:53:00 | 000,000,000 | -HSD | C] -- C:\Users\Juan\PrintHood
[2012/08/16 19:53:00 | 000,000,000 | -HSD | C] -- C:\Users\Juan\NetHood
[2012/08/16 19:53:00 | 000,000,000 | -HSD | C] -- C:\Users\Juan\Local Settings
[2012/08/16 19:53:00 | 000,000,000 | -HSD | C] -- C:\Users\Juan\AppData\Local\History
[2012/08/16 19:53:00 | 000,000,000 | -HSD | C] -- C:\Users\Juan\Cookies
[2012/08/16 19:53:00 | 000,000,000 | -HSD | C] -- C:\Users\Juan\Application Data
[2012/08/16 19:53:00 | 000,000,000 | -HSD | C] -- C:\Users\Juan\AppData\Local\Application Data
[2012/08/16 19:52:59 | 000,000,000 | -HSD | C] -- C:\Users\Juan\Documents\My Videos
[2012/08/16 19:52:59 | 000,000,000 | -HSD | C] -- C:\Users\Juan\Documents\My Pictures
[2012/08/16 19:52:59 | 000,000,000 | -HSD | C] -- C:\Users\Juan\Documents\My Music
[2012/08/16 19:52:59 | 000,000,000 | -HSD | C] -- C:\Users\Juan\My Documents
[2012/08/16 19:52:57 | 000,000,000 | --SD | C] -- C:\Users\Juan\AppData\Roaming\Microsoft
[2012/08/16 19:52:57 | 000,000,000 | R--D | C] -- C:\Users\Juan\Videos
[2012/08/16 19:52:57 | 000,000,000 | R--D | C] -- C:\Users\Juan\Saved Games
[2012/08/16 19:52:57 | 000,000,000 | R--D | C] -- C:\Users\Juan\Pictures
[2012/08/16 19:52:57 | 000,000,000 | R--D | C] -- C:\Users\Juan\Music
[2012/08/16 19:52:57 | 000,000,000 | R--D | C] -- C:\Users\Juan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012/08/16 19:52:57 | 000,000,000 | R--D | C] -- C:\Users\Juan\Links
[2012/08/16 19:52:57 | 000,000,000 | R--D | C] -- C:\Users\Juan\Favorites
[2012/08/16 19:52:57 | 000,000,000 | R--D | C] -- C:\Users\Juan\Downloads
[2012/08/16 19:52:57 | 000,000,000 | R--D | C] -- C:\Users\Juan\Documents
[2012/08/16 19:52:57 | 000,000,000 | R--D | C] -- C:\Users\Juan\Desktop
[2012/08/16 19:52:57 | 000,000,000 | R--D | C] -- C:\Users\Juan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012/08/16 19:52:57 | 000,000,000 | -H-D | C] -- C:\Users\Juan\AppData
[2012/08/16 19:52:57 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\Temp
[2012/08/16 19:52:57 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\Microsoft
[2012/08/16 19:52:57 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Roaming\Media Center Programs
[2012/08/16 19:52:30 | 000,000,000 | -HSD | C] -- C:\Recovery
[2012/08/16 19:52:26 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012/08/16 13:58:35 | 000,000,000 | R--D | C] -- C:\Users\Juan\Documents\Scanned Documents
[2012/08/16 13:58:13 | 000,000,000 | --SD | C] -- C:\Users\Juan\Documents\My Shapes
[2012/08/16 13:58:13 | 000,000,000 | ---D | C] -- C:\Users\Juan\Documents\My PRSoft Files
[2012/08/16 13:56:05 | 000,000,000 | ---D | C] -- C:\Users\Juan\Documents\My Digital Editions
[2012/08/16 13:55:37 | 000,000,000 | ---D | C] -- C:\Users\Juan\Documents\MERJA
[2012/08/16 13:51:07 | 000,000,000 | ---D | C] -- C:\Users\Juan\Documents\Juan Alberto
[2012/08/16 13:51:02 | 000,000,000 | ---D | C] -- C:\Users\Juan\Documents\Images
[2012/08/16 13:50:06 | 000,000,000 | ---D | C] -- C:\Users\Juan\Documents\Documentos Oficiales
[2012/08/16 13:48:27 | 000,000,000 | ---D | C] -- C:\Users\Juan\Documents\CFC
[2012/08/16 13:37:10 | 000,000,000 | ---D | C] -- C:\Users\Juan\Documents\Adobe

========== Files - Modified Within 30 Days ==========

[2012/09/01 16:26:42 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Juan\Desktop\OTL.exe
[2012/09/01 16:10:00 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/09/01 13:42:57 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Juan\Desktop\dds.com
[2012/09/01 09:13:10 | 000,017,360 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/01 09:13:10 | 000,017,360 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/01 09:11:36 | 000,778,834 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/09/01 09:11:36 | 000,660,318 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/09/01 09:11:36 | 000,121,214 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/09/01 09:06:30 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/09/01 09:05:42 | 006,106,496 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/09/01 09:05:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/09/01 09:05:14 | 2087,989,247 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/31 15:40:54 | 000,000,298 | ---- | M] () -- C:\Users\Juan\Documents\ax_files.xml
[2012/08/28 15:06:32 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012/08/25 22:27:50 | 937,371,713 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/08/24 17:19:31 | 000,000,132 | ---- | M] () -- C:\Users\Juan\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012/08/24 11:58:49 | 000,246,604 | -H-- | M] () -- C:\Windows\SysWow64\mlfcache.dat
[2012/08/23 18:36:46 | 000,001,254 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/08/23 11:30:06 | 000,000,010 | ---- | M] () -- C:\Users\Juan\AppData\Local\.HG88C586-G30G-2HE2-DGDE-8H3E1D530D30
[2012/08/23 11:30:06 | 000,000,010 | ---- | M] () -- C:\ProgramData\.F464B91F-G49F-3G3D-CFCD-9G7D2C141C96
[2012/08/23 08:40:17 | 000,231,065 | ---- | M] () -- C:\Windows\SysNative\LexFiles.ulf
[2012/08/22 08:53:54 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf
[2012/08/21 05:13:13 | 000,969,200 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2012/08/21 05:13:13 | 000,359,464 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2012/08/21 05:13:13 | 000,059,728 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2012/08/21 05:13:12 | 000,071,600 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2012/08/21 05:13:12 | 000,054,072 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2012/08/21 05:13:11 | 000,025,232 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2012/08/21 05:12:33 | 000,041,224 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2012/08/21 05:12:23 | 000,227,648 | ---- | M] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2012/08/21 05:12:02 | 000,285,328 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2012/08/19 09:22:34 | 000,773,050 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/08/18 21:51:17 | 000,151,552 | ---- | M] () -- C:\Windows\KMSEmulator.exe
[2012/08/18 19:46:23 | 000,560,184 | ---- | M] (Duplex Secure Ltd.) -- C:\Windows\SysNative\drivers\sptd.sys
[2012/08/18 11:10:01 | 000,001,037 | ---- | M] () -- C:\Users\Juan\Desktop\Dropbox.lnk
[2012/08/18 11:08:04 | 000,001,047 | ---- | M] () -- C:\Users\Juan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/08/17 14:51:01 | 000,001,437 | ---- | M] () -- C:\Users\Juan\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/08/17 14:44:49 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2012/08/17 14:44:48 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2012/08/17 09:18:20 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_FLxHCIh_01009.Wdf
[2012/08/17 09:18:18 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_FLxHCIc_01009.Wdf
[2012/08/16 22:48:52 | 000,043,144 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2012/08/16 22:48:52 | 000,043,144 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2012/08/16 21:11:33 | 000,001,073 | ---- | M] () -- C:\Users\Juan\Desktop\Documents.lnk
[2012/08/16 20:50:11 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012/08/16 20:02:04 | 000,002,239 | ---- | M] () -- C:\Users\Juan\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

========== Files Created - No Company Name ==========

[2012/08/25 22:27:50 | 937,371,713 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012/08/24 15:01:22 | 000,001,877 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk
[2012/08/24 11:58:49 | 000,246,604 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2012/08/24 10:52:57 | 000,000,132 | ---- | C] () -- C:\Users\Juan\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012/08/23 20:53:18 | 000,001,075 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5 (64 Bit).lnk
[2012/08/23 20:52:15 | 000,001,169 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS5.lnk
[2012/08/23 20:51:58 | 000,001,262 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS5.lnk
[2012/08/23 20:49:27 | 000,001,353 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS5.lnk
[2012/08/23 20:49:20 | 000,001,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
[2012/08/23 20:48:53 | 000,000,997 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2012/08/23 18:41:14 | 000,002,465 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk
[2012/08/23 18:41:14 | 000,002,453 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Pro.lnk
[2012/08/23 16:58:41 | 000,002,473 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Serif PagePlus X6.lnk
[2012/08/23 11:30:06 | 000,000,010 | ---- | C] () -- C:\Users\Juan\AppData\Local\.HG88C586-G30G-2HE2-DGDE-8H3E1D530D30
[2012/08/23 11:30:06 | 000,000,010 | ---- | C] () -- C:\ProgramData\.F464B91F-G49F-3G3D-CFCD-9G7D2C141C96
[2012/08/23 08:34:05 | 000,109,056 | ---- | C] () -- C:\Windows\SysNative\lxecvs.dll
[2012/08/23 08:34:04 | 000,836,608 | ---- | C] ( ) -- C:\Windows\SysNative\lxeccoin.dll
[2012/08/23 08:34:03 | 000,065,106 | ---- | C] () -- C:\Windows\SysNative\lxecprpr.chm
[2012/08/23 08:34:02 | 000,399,360 | ---- | C] () -- C:\Windows\SysNative\lxeccui.dll
[2012/08/23 08:34:02 | 000,148,480 | ---- | C] () -- C:\Windows\SysNative\lxeccuir.dll
[2012/08/23 08:34:02 | 000,065,536 | ---- | C] () -- C:\Windows\SysNative\lxecgcfg.dll
[2012/08/23 08:34:02 | 000,008,694 | ---- | C] () -- C:\Windows\SysNative\lxeccommuilogo_rtl.bmp
[2012/08/23 08:34:02 | 000,008,694 | ---- | C] () -- C:\Windows\SysNative\lxeccommuilogo.bmp
[2012/08/23 08:32:45 | 000,053,760 | ---- | C] () -- C:\Windows\SysNative\LXECPMON.DLL
[2012/08/23 08:32:45 | 000,021,504 | ---- | C] () -- C:\Windows\SysNative\LXECFXPU.DLL
[2012/08/23 08:32:25 | 004,485,120 | ---- | C] () -- C:\Windows\SysNative\LXECoem.dll
[2012/08/23 08:32:25 | 000,003,584 | ---- | C] () -- C:\Windows\SysNative\LXECPMRC.DLL
[2012/08/23 08:31:53 | 001,048,576 | ---- | C] ( ) -- C:\Windows\SysWow64\lxecserv.dll
[2012/08/23 08:31:53 | 000,847,872 | ---- | C] ( ) -- C:\Windows\SysWow64\lxecusb1.dll
[2012/08/23 08:31:53 | 000,802,816 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeccomc.dll
[2012/08/23 08:31:53 | 000,688,128 | ---- | C] ( ) -- C:\Windows\SysWow64\lxechbn3.dll
[2012/08/23 08:31:53 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxecpmui.dll
[2012/08/23 08:31:53 | 000,598,696 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeccoms.exe
[2012/08/23 08:31:53 | 000,577,536 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeclmpm.dll
[2012/08/23 08:31:53 | 000,373,416 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeccfg.exe
[2012/08/23 08:31:53 | 000,372,736 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeccomm.dll
[2012/08/23 08:31:53 | 000,364,544 | ---- | C] ( ) -- C:\Windows\SysWow64\lxecinpa.dll
[2012/08/23 08:31:53 | 000,344,064 | ---- | C] () -- C:\Windows\SysWow64\lxeccomx.dll
[2012/08/23 08:31:53 | 000,344,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeciesc.dll
[2012/08/23 08:31:53 | 000,324,264 | ---- | C] ( ) -- C:\Windows\SysWow64\lxecih.exe
[2012/08/23 08:31:53 | 000,323,584 | ---- | C] () -- C:\Windows\SysWow64\lxecins.dll
[2012/08/23 08:31:53 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\lxecinsb.dll
[2012/08/23 08:31:53 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\lxeccu.dll
[2012/08/23 08:31:53 | 000,106,496 | ---- | C] () -- C:\Windows\SysWow64\lxecinsr.dll
[2012/08/23 08:31:53 | 000,090,112 | ---- | C] () -- C:\Windows\SysWow64\lxeccub.dll
[2012/08/23 08:31:53 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\lxecjswr.dll
[2012/08/23 08:31:53 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\lxeccur.dll
[2012/08/23 08:31:53 | 000,002,059 | ---- | C] () -- C:\Windows\SysWow64\lxec.loc
[2012/08/23 08:31:40 | 001,631,744 | ---- | C] ( ) -- C:\Windows\SysNative\lxecserv.dll
[2012/08/23 08:31:40 | 001,331,712 | ---- | C] ( ) -- C:\Windows\SysNative\lxecusb1.dll
[2012/08/23 08:31:40 | 000,557,568 | ---- | C] ( ) -- C:\Windows\SysNative\lxecinpa.dll
[2012/08/23 08:31:40 | 000,547,840 | ---- | C] ( ) -- C:\Windows\SysNative\LXEChcp.dll
[2012/08/23 08:31:40 | 000,515,584 | ---- | C] ( ) -- C:\Windows\SysNative\lxeciesc.dll
[2012/08/23 08:31:40 | 000,495,616 | ---- | C] () -- C:\Windows\SysNative\LXECinst.dll
[2012/08/23 08:31:40 | 000,231,065 | ---- | C] () -- C:\Windows\SysNative\LexFiles.ulf
[2012/08/23 08:31:39 | 001,371,648 | ---- | C] ( ) -- C:\Windows\SysNative\lxeccomc.dll
[2012/08/23 08:31:39 | 001,104,384 | ---- | C] ( ) -- C:\Windows\SysNative\lxechbn3.dll
[2012/08/23 08:31:39 | 001,052,328 | ---- | C] ( ) -- C:\Windows\SysNative\lxeccoms.exe
[2012/08/23 08:31:39 | 000,979,968 | ---- | C] ( ) -- C:\Windows\SysNative\lxecpmui.dll
[2012/08/23 08:31:39 | 000,892,416 | ---- | C] ( ) -- C:\Windows\SysNative\lxeclmpm.dll
[2012/08/23 08:31:39 | 000,612,008 | ---- | C] ( ) -- C:\Windows\SysNative\lxeccfg.exe
[2012/08/23 08:31:39 | 000,579,584 | ---- | C] ( ) -- C:\Windows\SysNative\lxeccomm.dll
[2012/08/23 08:31:39 | 000,520,872 | ---- | C] ( ) -- C:\Windows\SysNative\lxecih.exe
[2012/08/23 08:31:39 | 000,450,048 | ---- | C] () -- C:\Windows\SysNative\lxecins.dll
[2012/08/23 08:31:39 | 000,378,368 | ---- | C] () -- C:\Windows\SysNative\lxeccu.dll
[2012/08/23 08:31:39 | 000,298,496 | ---- | C] () -- C:\Windows\SysNative\lxecgrd.dll
[2012/08/23 08:31:39 | 000,245,248 | ---- | C] () -- C:\Windows\SysNative\lxecinsb.dll
[2012/08/23 08:31:39 | 000,090,624 | ---- | C] () -- C:\Windows\SysNative\lxecinsr.dll
[2012/08/23 08:31:39 | 000,073,216 | ---- | C] () -- C:\Windows\SysNative\lxeccub.dll
[2012/08/23 08:31:39 | 000,040,448 | ---- | C] () -- C:\Windows\SysNative\lxecjswr.dll
[2012/08/23 08:31:39 | 000,022,016 | ---- | C] () -- C:\Windows\SysNative\lxeccur.dll
[2012/08/23 08:31:39 | 000,002,059 | ---- | C] () -- C:\Windows\SysNative\lxec.loc
[2012/08/23 07:58:32 | 000,023,552 | ---- | C] () -- C:\Windows\SysWow64\LXECsmr.dll
[2012/08/23 07:58:31 | 000,299,008 | ---- | C] () -- C:\Windows\SysWow64\LXECsm.dll
[2012/08/23 07:58:31 | 000,023,552 | ---- | C] () -- C:\Windows\SysNative\lxecsmr.dll
[2012/08/23 07:58:30 | 000,381,440 | ---- | C] () -- C:\Windows\SysNative\lxecsm.dll
[2012/08/22 08:53:54 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf
[2012/08/22 08:52:06 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2012/08/18 21:38:48 | 000,151,552 | ---- | C] () -- C:\Windows\KMSEmulator.exe
[2012/08/18 20:33:11 | 000,773,050 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/08/18 19:55:24 | 000,000,298 | ---- | C] () -- C:\Users\Juan\Documents\ax_files.xml
[2012/08/18 11:10:01 | 000,001,037 | ---- | C] () -- C:\Users\Juan\Desktop\Dropbox.lnk
[2012/08/18 11:08:04 | 000,001,047 | ---- | C] () -- C:\Users\Juan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/08/17 15:14:29 | 000,095,744 | ---- | C] () -- C:\Windows\SysNative\RDVGHelper.exe
[2012/08/17 15:14:10 | 000,347,904 | ---- | C] () -- C:\Windows\SysNative\systemsf.ebd
[2012/08/17 15:12:46 | 000,010,429 | ---- | C] () -- C:\Windows\SysNative\ScavengeSpace.xml
[2012/08/17 15:12:29 | 000,105,559 | ---- | C] () -- C:\Windows\SysWow64\RacRules.xml
[2012/08/17 15:12:29 | 000,105,559 | ---- | C] () -- C:\Windows\SysNative\RacRules.xml
[2012/08/17 15:12:16 | 000,146,389 | ---- | C] () -- C:\Windows\SysWow64\printmanagement.msc
[2012/08/17 15:12:16 | 000,001,041 | ---- | C] () -- C:\Windows\SysWow64\tcpbidi.xml
[2012/08/17 14:44:49 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2012/08/17 14:44:48 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2012/08/17 09:31:14 | 001,800,192 | ---- | C] () -- C:\Windows\SysNative\drivers\snp2uvc.sys
[2012/08/17 09:31:14 | 000,306,176 | ---- | C] ( ) -- C:\Windows\SysNative\csnp2uvc.dll
[2012/08/17 09:31:14 | 000,035,456 | ---- | C] () -- C:\Windows\SysNative\drivers\sncduvc.sys
[2012/08/17 09:31:14 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini
[2012/08/17 09:31:14 | 000,013,021 | ---- | C] () -- C:\Windows\snp2uvc.src
[2012/08/17 09:18:20 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_FLxHCIh_01009.Wdf
[2012/08/17 09:18:18 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_FLxHCIc_01009.Wdf
[2012/08/17 08:57:31 | 000,000,520 | ---- | C] () -- C:\Windows\SysNative\drivers\SamSfPa.dat
[2012/08/17 08:15:25 | 000,003,116 | ---- | C] () -- C:\Windows\SysNative\wimfltr.inf
[2012/08/16 22:48:37 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012/08/16 22:45:48 | 2087,989,247 | -HS- | C] () -- C:\hiberfil.sys
[2012/08/16 21:11:33 | 000,001,073 | ---- | C] () -- C:\Users\Juan\Desktop\Documents.lnk
[2012/08/16 20:50:11 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012/08/16 20:49:02 | 000,001,142 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/08/16 20:40:07 | 000,014,324 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb
[2012/08/16 20:02:04 | 000,002,239 | ---- | C] () -- C:\Users\Juan\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/08/16 20:00:34 | 000,000,894 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/16 20:00:34 | 000,000,890 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/16 20:00:24 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt
[2012/08/16 19:55:00 | 000,001,437 | ---- | C] () -- C:\Users\Juan\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/08/16 19:53:55 | 000,001,409 | ---- | C] () -- C:\Users\Juan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2012/08/16 19:53:42 | 000,001,443 | ---- | C] () -- C:\Users\Juan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012/08/16 19:52:58 | 000,000,290 | ---- | C] () -- C:\Users\Juan\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2012/08/16 19:52:58 | 000,000,272 | ---- | C] () -- C:\Users\Juan\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/05/15 02:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe

========== LOP Check ==========

[2012/08/17 08:58:03 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\IObit
[2012/08/17 08:58:03 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\IObit
[2012/08/24 11:58:44 | 000,000,000 | ---D | M] -- C:\Users\Juan\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/09/01 16:15:51 | 000,000,000 | ---D | M] -- C:\Users\Juan\AppData\Roaming\Dropbox
[2012/08/17 14:54:02 | 000,000,000 | ---D | M] -- C:\Users\Juan\AppData\Roaming\Gaming Mouse
[2012/08/24 15:21:12 | 000,000,000 | ---D | M] -- C:\Users\Juan\AppData\Roaming\ImgBurn
[2012/08/17 23:08:29 | 000,000,000 | ---D | M] -- C:\Users\Juan\AppData\Roaming\IObit
[2012/08/23 09:05:58 | 000,000,000 | ---D | M] -- C:\Users\Juan\AppData\Roaming\Pro800-Pro900 Series
[2012/08/23 17:02:32 | 000,000,000 | ---D | M] -- C:\Users\Juan\AppData\Roaming\Serif
[2012/08/22 15:51:37 | 000,000,000 | ---D | M] -- C:\Users\Juan\AppData\Roaming\Thinstall
[2009/07/14 01:08:49 | 000,016,884 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

#4 juanymerja

New Member

Members
9 posts

Posted 01 September 2012 - 03:51 PM

OTL Extras logfile created on: 9/1/2012 4:29:03 PM - Run 1
OTL by OldTimer - Version 3.2.59.1 Folder = C:\Users\Juan\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.93 Gb Total Physical Memory | 5.59 Gb Available Physical Memory | 70.56% Memory free
15.85 Gb Paging File | 13.39 Gb Available in Paging File | 84.47% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.66 Gb Total Space | 380.28 Gb Free Space | 81.67% Space Free | Partition Type: NTFS
Drive D: | 465.76 Gb Total Space | 413.29 Gb Free Space | 88.74% Space Free | Partition Type: NTFS

Computer Name: JUAN-PC | User Name: Juan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_USERS\S-1-5-21-742528787-374410395-3492436187-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0DE5EF71-9D88-4BB2-8556-C13394E7D605}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0E58638E-4728-448B-A6B0-45D16BDB8DC3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{295A40FF-1DF0-48F8-9022-6C538C0F6F53}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{2D198556-B6EA-43DB-A9D0-A42706A2AA0C}" = rport=139 | protocol=6 | dir=out | app=system |
"{2DFEE35A-3399-43DE-AC00-A09F970D258B}" = rport=10243 | protocol=6 | dir=out | app=system |
"{40D287B8-AF66-4D69-954E-879081925AE1}" = lport=2869 | protocol=6 | dir=in | app=system |
"{494C70A1-300F-47A1-B18C-13A50D9ED380}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5A65A100-8596-49E4-8D33-23E6B04047F1}" = rport=137 | protocol=17 | dir=out | app=system |
"{71299558-CEC8-43D7-A1BF-7D6478D79E6D}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{7267427D-920C-4682-BBC6-E8C44C76D163}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{743D3C56-8DB8-433B-B3DF-3B15DF498B53}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{7DF5F9CD-31CA-4A41-AC02-ED96094F51B5}" = lport=139 | protocol=6 | dir=in | app=system |
"{7E37582E-23DF-4033-AF66-C72D54FBCCCC}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{809757AF-5D90-424A-82D6-E139D9B5AFC2}" = rport=445 | protocol=6 | dir=out | app=system |
"{81A99080-B237-45F9-BCE5-22D3783549DB}" = lport=138 | protocol=17 | dir=in | app=system |
"{8F83C47A-873E-421E-B9F0-120C980DCAFB}" = lport=137 | protocol=17 | dir=in | app=system |
"{A64B1581-72C4-4FCF-8BE5-4B9A03E05D24}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A65832B3-CD77-439B-AAF5-5C0F6A26866C}" = rport=138 | protocol=17 | dir=out | app=system |
"{B24793D1-0E78-4F0F-8E01-BC645E31F3F6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B52984C3-ABAB-4BEB-90F4-76A217EFD617}" = lport=10243 | protocol=6 | dir=in | app=system |
"{C5B19BE8-F4D8-4F8F-B9EF-DCD2C15AF966}" = lport=445 | protocol=6 | dir=in | app=system |
"{CE3C610E-F1BF-4DAC-9171-9E4480A12050}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03E54C4E-A35D-4123-AC2C-650547D97CA6}" = dir=in | app=c:\windows\system32\lxeccoms.exe |
"{0936123A-7974-4E74-B832-0D43B6BDD22A}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{0AC06B40-43FB-4243-8407-E513FAAE5A2A}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\comodo\tvnserver.exe |
"{1B0E37BB-840B-4829-8DDF-6B7543C3955D}" = protocol=17 | dir=in | app=c:\users\juan\appdata\roaming\dropbox\bin\dropbox.exe |
"{1B9DDD77-B0DD-411B-8468-35CAE3F7AB80}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{27E08F89-3501-448E-975E-D0B5956D6E05}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{2F08CE10-0F49-4C32-9A2B-09F079B2D8F6}" = dir=in | app=c:\windows\system32\lxeccoms.exe |
"{33307DF4-5E54-4500-96D7-998C9AD1DA6E}" = protocol=6 | dir=in | app=c:\users\juan\appdata\roaming\dropbox\bin\dropbox.exe |
"{41317763-B9C4-48AD-921D-EC10CC461D37}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{42A2157B-45E0-42C8-906D-74A486F12258}" = dir=in | app=c:\windows\system32\lxeccoms.exe |
"{43900A90-A98C-44F8-891F-7BF697446A82}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{468CB622-FE91-4FB1-B90E-63179951C604}" = protocol=6 | dir=in | app=c:\program files (x86)\lexmark pro800-pro900 series\lxecfax.exe |
"{4F296E91-26C4-444D-8C58-9BA5FC9FBE20}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{538B72CB-41E7-4970-B831-465E72075037}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{7BA84F79-1170-4487-AE34-7C145674358D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7C245BCE-9681-4E23-BC2E-1A1ED17A42DD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{829ED41C-7F0F-4BAD-A7BC-CB1ABDF471B2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8799736C-791F-403B-9B83-7E34CF41D20A}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8C8500CD-8C12-4EC0-A343-F0D64DED18B4}" = protocol=6 | dir=in | app=c:\program files (x86)\abbyy finereader 6.0 sprint\scan\scanman6.exe |
"{903CB4B0-D7B2-4DFB-AF43-79511F07F10E}" = protocol=17 | dir=in | app=c:\program files (x86)\lexmark pro800-pro900 series\lxecfax.exe |
"{9402E03A-6F37-4A1C-912F-75DF29DB492B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{954257E7-8BCC-4240-8D37-08B31FE80C0D}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{9932B21A-91A7-48FC-BECB-0EFD01600175}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{A418540A-3192-47AC-869A-3F82DB04C91E}" = protocol=6 | dir=out | app=system |
"{A93880FE-2A79-47B2-889D-8605DBC712AA}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\comodo\tvnserver.exe |
"{A951667B-7DD3-4C18-B953-40136149892C}" = protocol=17 | dir=in | app=c:\program files (x86)\abbyy finereader 6.0 sprint\scan\scanman6.exe |
"{AC0DF060-6C1A-4E7A-B900-461C72DA0110}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{C1935EC3-62D2-4B41-A74A-EF1C390D5229}" = dir=in | app=c:\windows\system32\lxeccoms.exe |
"{C9F9CD67-0205-469D-AFF3-FB674CD70718}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CE5E8542-90A3-4694-B334-C2056A33739E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E651AF64-F004-488E-A591-692A62EB03C7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E6EB21CF-1B6D-499C-B7AD-5BADA25AFE3E}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F3055418-B9C1-48B8-B0C2-CACE5CF33B11}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{FFC94810-777E-496F-9942-409415590363}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{26A24AE4-039D-4CA4-87B4-2F86417007FF}" = Java 7 Update 7 (64-bit)
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{7F2540AD-FD82-427A-8FDC-33EC53C8B17A}" = Fresco Logic USB3.0 Host Controller
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0409-1000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-1000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-1000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUS_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUS_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-1000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-1000-0000000FF1CE}_Office14.PROPLUS_{1779650B-2E44-4A19-8DF6-3866D645764A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-1000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-1000-0000000FF1CE}_Office14.PROPLUS_{270CA0B9-9881-44DB-BC3B-37C7E66A044A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010
"{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0409-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (English) 2010
"{90140000-0043-0409-1000-0000000FF1CE}_Office14.PROPLUS_{FCD1C311-8B02-4DBD-BA46-1079C629577E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0409-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-0044-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-1000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-1000-0000000FF1CE}_Office14.PROPLUS_{516CA4A9-98E6-4F77-A863-CBD8487368E4}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0409-1000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-00BA-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-1000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-1000-0000000FF1CE}_Office14.PROPLUS_{516CA4A9-98E6-4F77-A863-CBD8487368E4}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-1000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-1000-0000000FF1CE}_Office14.PROPLUS_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91EFE3A1-585E-4F66-B5F6-F118F56C4C47}" = ASUS Power4Gear Hybrid
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver 1.3.16.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{D6AB1F5B-FED6-49A9-9747-327BD28FB3C7}" = COMODO Internet Security
"{D93AC9C8-B6CF-391E-BD2F-48AF4727476C}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30411
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.61.3
"Lexmark Pro800-Pro900 Series" = Lexmark Pro800-Pro900 Series
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"USB2.0 UVC 2M WebCam" = USB2.0 UVC 2M WebCam
"WinRAR archiver" = WinRAR 4.20 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{36C265B4-36D3-49B7-82F4-B55C6BD0D978}" = Serif PagePlus: Brochure Template Pack 1
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{61221229-92E9-48F2-BEBE-73A31021FC48}" = PagePlus Content: Adolescent Counseling & Mental Health
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7BF67A61-BE7C-4806-B93C-97F299D6A6FE}" = ASUS AI Recovery
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A9DE396-133A-4466-9C92-4005C7E6390D}" = Extensis Suitcase Fusion 4
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package
"{AC76BA86-1033-F400-7760-000000000005}" = Adobe Acrobat X Pro - English, Français, Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{C1594429-8296-4652-BF54-9DBE4932A44C}" = Realtek PCIE Card Reader
"{C52DE33F-117A-4EC8-8A32-084E828D7B1E}" = Gaming Mouse
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E2B22002-9C8B-43CC-A75B-464B6ED4FF6B}" = Serif PagePlus X6
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced SystemCare 5_is1" = Advanced SystemCare 5
"avast" = avast! Free Antivirus
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Google Chrome" = Google Chrome
"ImgBurn" = ImgBurn
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"Mozilla Firefox 15.0 (x86 en-US)" = Mozilla Firefox 15.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Registry Utilities Pro" = Registry Utilities Pro
"Wisdom-soft ScreenHunter 6.0 Free" = Wisdom-soft ScreenHunter 6.0 Free
"World of Warcraft" = World of Warcraft

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-742528787-374410395-3492436187-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 8/22/2012 4:32:09 PM | Computer Name = Juan-PC | Source = MsiInstaller | ID = 10005
Description =

Error - 8/23/2012 7:46:19 AM | Computer Name = Juan-PC | Source = MsiInstaller | ID = 10005
Description =

Error - 8/23/2012 3:53:33 PM | Computer Name = Juan-PC | Source = Application Error | ID = 1000
Description = Faulting application name: PagePlus.exe, version: 16.0.0.19, time
stamp: 0x4eb91b0e Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception
code: 0xc0000005 Fault offset: 0x20126aa0 Faulting process id: 0x4688 Faulting application
start time: 0x01cd8168f49127b6 Faulting application path: C:\Program Files (x86)\Serif\PagePlus\PagePlus
X6 v16.0.0.19\PagePlus.exe Faulting module path: unknown Report Id: 37a250b6-ed5c-11e1-8dba-74f06dc27f0b

Error - 8/23/2012 3:53:37 PM | Computer Name = Juan-PC | Source = Application Error | ID = 1000
Description = Faulting application name: PagePlus.exe, version: 16.0.0.19, time
stamp: 0x4eb91b0e Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception
code: 0xc000041d Fault offset: 0x20126aa0 Faulting process id: 0x4688 Faulting application
start time: 0x01cd8168f49127b6 Faulting application path: C:\Program Files (x86)\Serif\PagePlus\PagePlus
X6 v16.0.0.19\PagePlus.exe Faulting module path: unknown Report Id: 3a16bbfe-ed5c-11e1-8dba-74f06dc27f0b

Error - 8/23/2012 6:14:46 PM | Computer Name = Juan-PC | Source = NtServicePack | ID = 921877
Description =

Error - 8/23/2012 6:16:09 PM | Computer Name = Juan-PC | Source = NtServicePack | ID = 921877
Description =

Error - 8/27/2012 1:29:54 PM | Computer Name = Juan-PC | Source = Application Hang | ID = 1002
Description = The program TFOC.exe version 0.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 48c Start Time:
01cd847917400300 Termination Time: 34 Application Path: C:\Program Files (x86)\Activision\Transformers
Fall of Cybertron\Binaries\TFOC.exe Report Id:

Error - 8/27/2012 1:31:46 PM | Computer Name = Juan-PC | Source = Application Hang | ID = 1002
Description = The program TFOC.exe version 0.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 113c Start Time:
01cd847997fe7acd Termination Time: 30 Application Path: C:\Program Files (x86)\Activision\Transformers
Fall of Cybertron\Binaries\TFOC.exe Report Id:

Error - 8/27/2012 1:35:55 PM | Computer Name = Juan-PC | Source = Application Hang | ID = 1002
Description = The program TFOC.exe version 0.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 14a4 Start Time:
01cd8479dc7b78da Termination Time: 42 Application Path: C:\Program Files (x86)\Activision\Transformers
Fall of Cybertron\Binaries\TFOC.exe Report Id:

Error - 8/27/2012 1:37:06 PM | Computer Name = Juan-PC | Source = Application Hang | ID = 1002
Description = The program TFOC.exe version 0.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 43c Start Time:
01cd847a6fe1d757 Termination Time: 27 Application Path: C:\Program Files (x86)\Activision\Transformers
Fall of Cybertron\Binaries\TFOC.exe Report Id:

[ System Events ]
Error - 8/28/2012 7:47:04 PM | Computer Name = Juan-PC | Source = ACPI | ID = 327690
Description = ACPI: ACPI BIOS is attempting to write to an illegal PCI Operation
Region (0x4), Please contact your system vendor for technical assistance.

Error - 8/28/2012 7:47:04 PM | Computer Name = Juan-PC | Source = ACPI | ID = 327690
Description = ACPI: ACPI BIOS is attempting to write to an illegal PCI Operation
Region (0x4), Please contact your system vendor for technical assistance.

Error - 8/29/2012 8:16:30 AM | Computer Name = Juan-PC | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the lxecCATSCustConnectService
service to connect.

Error - 8/29/2012 8:16:30 AM | Computer Name = Juan-PC | Source = Service Control Manager | ID = 7000
Description = The lxecCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 8/31/2012 7:11:14 AM | Computer Name = Juan-PC | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the lxecCATSCustConnectService
service to connect.

Error - 8/31/2012 7:11:14 AM | Computer Name = Juan-PC | Source = Service Control Manager | ID = 7000
Description = The lxecCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 9/1/2012 9:05:58 AM | Computer Name = Juan-PC | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the lxecCATSCustConnectService
service to connect.

Error - 9/1/2012 9:05:58 AM | Computer Name = Juan-PC | Source = Service Control Manager | ID = 7000
Description = The lxecCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 9/1/2012 1:33:37 PM | Computer Name = Juan-PC | Source = ACPI | ID = 327690
Description = ACPI: ACPI BIOS is attempting to write to an illegal PCI Operation
Region (0x4), Please contact your system vendor for technical assistance.

Error - 9/1/2012 1:33:37 PM | Computer Name = Juan-PC | Source = ACPI | ID = 327690
Description = ACPI: ACPI BIOS is attempting to write to an illegal PCI Operation
Region (0x4), Please contact your system vendor for technical assistance.

< End of report >

#5 Maniac

Forum Deity

Experts
17,441 posts

Gender:Male
Location:Bulgaria, EU

Posted 02 September 2012 - 05:28 AM

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
IE - HKU\S-1-5-21-742528787-374410395-3492436187-1001\..\SearchScopes,DefaultScope = {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
IE - HKU\S-1-5-21-742528787-374410395-3492436187-1001\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://blekko.com/ws/?source=c3348dd4&tbp=rbox&toolbarid=blekkotb_031&u=BFEC0877D2DCBD8DA1BB30502E3DC38F&q={searchTerms}
FF - prefs.js..browser.search.defaultenginename: "Blekko"
FF - prefs.js..browser.search.order.1: "Blekko"
[2012/08/17 08:49:12 | 000,002,134 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\search.xml
O3 - HKLM\..\Toolbar: (no name) - {8769adce-dba5-48e9-afb5-67b12cdf2e61} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
[2012/08/17 08:49:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID
[2012/08/17 08:49:53 | 000,000,000 | ---D | C] -- C:\Program Files\CPUID
[2012/08/17 08:49:13 | 000,000,000 | ---D | C] -- C:\ProgramData\blekko toolbars
[2012/08/17 08:49:07 | 000,000,000 | ---D | C] -- C:\Users\Juan\AppData\Local\blekkotb_031

:files
ipconfig /flushdns /c

:Commands
[emptytemp]
[resethosts]
[clearallrestorepoints]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Please post the OTL fix log in your next reply.

Note: A copy of an OTL fix log is saved in a text file at C:\_OTL\MovedFiles

My help is free, however, if you wish to make a small donation to show appreciation and to help me continue the fight against Malware, then click here

#6 juanymerja

New Member

Members
9 posts

Posted 02 September 2012 - 12:40 PM

Done! Here is the OTL fix log,

All processes killed
========== OTL ==========
HKEY_USERS\S-1-5-21-742528787-374410395-3492436187-1001\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-742528787-374410395-3492436187-1001\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}\ not found.
Prefs.js: "Blekko" removed from browser.search.defaultenginename
Prefs.js: "Blekko" removed from browser.search.order.1
C:\Program Files (x86)\Mozilla Firefox\searchplugins\search.xml moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{8769adce-dba5-48e9-afb5-67b12cdf2e61} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8769adce-dba5-48e9-afb5-67b12cdf2e61}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID\CPU-Z folder moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID folder moved successfully.
C:\Program Files\CPUID\CPU-Z folder moved successfully.
C:\Program Files\CPUID folder moved successfully.
C:\ProgramData\blekko toolbars folder moved successfully.
C:\Users\Juan\AppData\Local\blekkotb_031\data folder moved successfully.
C:\Users\Juan\AppData\Local\blekkotb_031 folder moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Juan\Desktop\cmd.bat deleted successfully.
C:\Users\Juan\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 113715 bytes
->Temporary Internet Files folder emptied: 40836 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 41620 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Juan
->Temp folder emptied: 234192851 bytes
->Temporary Internet Files folder emptied: 3878681 bytes
->Java cache emptied: 928094 bytes
->FireFox cache emptied: 95397889 bytes
->Google Chrome cache emptied: 23788117 bytes
->Flash cache emptied: 42382 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2859800 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 46565173 bytes
RecycleBin emptied: 8139912 bytes

Total Files Cleaned = 397.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.59.1 log created on 09022012_133117

Files\Folders moved on Reboot...
C:\Users\Juan\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

#7 Maniac

Forum Deity

Experts
17,441 posts

Gender:Male
Location:Bulgaria, EU

Posted 03 September 2012 - 06:19 AM

How are things now?

My help is free, however, if you wish to make a small donation to show appreciation and to help me continue the fight against Malware, then click here

#8 juanymerja

New Member

Members
9 posts

Posted 03 September 2012 - 07:38 AM

I still have the same problem. All browsers still being redirected everytime I do a search...

#9 Maniac

Forum Deity

Experts
17,441 posts

Gender:Male
Location:Bulgaria, EU

Posted 03 September 2012 - 07:41 AM

Uninstall Mozilla FireFox:
http://support.mozil...m-your-computer

Then download and install it again:
http://www.mozilla.o...US/firefox/new/

Let me know.

My help is free, however, if you wish to make a small donation to show appreciation and to help me continue the fight against Malware, then click here

#10 juanymerja

New Member

Members
9 posts

Posted 03 September 2012 - 08:42 AM

What abou chrome, do I unsinstall it?

#11 Maniac

Forum Deity

Experts
17,441 posts

Gender:Male
Location:Bulgaria, EU

Posted 03 September 2012 - 08:44 AM

Just tell me if there is a progress with FireFox.

My help is free, however, if you wish to make a small donation to show appreciation and to help me continue the fight against Malware, then click here

#12 juanymerja

New Member

Members
9 posts

Posted 03 September 2012 - 09:06 AM

Yes, it worked out! No more redirect to blekko when using firefox or chrome! Thanks!! Is there anything else I should do to be really safe about all this?

#13 Maniac

Forum Deity

Experts
17,441 posts

Gender:Male
Location:Bulgaria, EU

Posted 03 September 2012 - 09:15 AM

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan

Tick the box next to YES, I accept the Terms of Use
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan (This scan can take several hours, so please be patient)
Once the scan is completed, you may close the window
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

My help is free, however, if you wish to make a small donation to show appreciation and to help me continue the fight against Malware, then click here

#14 juanymerja

New Member

Members
9 posts

Posted 03 September 2012 - 09:18 PM

ESET log:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-04 01:51:36
# local_time=2012-09-03 09:51:36 (-0400, SA Western Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3073 16777213 80 71 632637 22294474 0 0
# compatibility_mode=5893 16776573 100 94 0 98259910 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=213987
# found=1
# cleaned=1
# scan_time=7035
C:\Windows\KMSEmulator.exe a variant of Win32/HackKMS.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

#15 Maniac

Forum Deity

Experts
17,441 posts

Gender:Male
Location:Bulgaria, EU

Posted 04 September 2012 - 06:46 AM

How are things now?

My help is free, however, if you wish to make a small donation to show appreciation and to help me continue the fight against Malware, then click here

#16 juanymerja

New Member

Members
9 posts

Posted 04 September 2012 - 07:09 AM

All three browsers working all right. No mores redirects. Thanks a lot for your help!

#17 Maniac

Forum Deity

Experts
17,441 posts

Gender:Male
Location:Bulgaria, EU

Posted 04 September 2012 - 10:03 AM

Glad I could help!

Please run OTL and click on CleanUp button. Next, uninstall ESET Online Scanner.

Some malware prevention tips:
http://forums.malwar...howtopic=104379

Safe surfing!

My help is free, however, if you wish to make a small donation to show appreciation and to help me continue the fight against Malware, then click here

#18 Maurice Naggar

Eradicator de logiciels malveillants

Moderators
13,598 posts

Gender:Male
Location:USA
Interests:Security, Windows, Windows Update, malware prevention

Posted 05 September 2012 - 08:14 AM

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Maurice Naggar
Consumer Support Specialist

Back to Resolved HijackThis Logs

Also tagged with one or more of these keywords: Browsers, Redirect

Malware Removal Support → Malware Removal Help → Resolved HijackThis Logs → google redirect virus and suspicious outgoing activity to 106.236.82.107 Started by abracadabra, 28 May 2013 google, redirect, virus and 1 more... 1 2	Hot 34 replies 378 views	LDTate 06 Jun 2013
Malware Removal Support → Malware Removal Help → Resolved HijackThis Logs → SweetPacks Redirect w/ dds logs Started by ShardtheFox, 03 May 2013 SweetPacks, sweetpacks, redirect and 1 more...	Hot 14 replies 342 views	Maurice Naggar 04 May 2013
Malwarebytes Anti-Malware Support → Malwarebytes Anti-Malware Help → Ebine and malicious code masquerading as legitimate Started by Justice_Manley, 29 Apr 2013 ebine doubleclick, ebine and 2 more...	1 reply 178 views	AdvancedSetup 29 Apr 2013
Malware Removal Support → Malware Removal Help → Resolved HijackThis Logs → Live Search redirect virus Started by JeffLCSW, 08 Apr 2013 redirect	Hot 18 replies 718 views	Maurice Naggar 15 Apr 2013
Malware Removal Support → Malware Removal Help → Resolved HijackThis Logs → need help with click.livesearchnow redirect virus in multiple browsers Started by bubba2435, 12 Feb 2013 redirect, livesearchnow and 1 more...	12 replies 724 views	Maurice Naggar 12 Mar 2013

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Blekko redirect all my browser (IE9, Chrome and Firefox)

Attached Files

Also tagged with one or more of these keywords: Browsers, Redirect

0 user(s) are reading this topic

Sign In