Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Gorilla Price & Who Knows What Else...


  • This topic is locked This topic is locked
3 replies to this topic

#1 texidio

texidio

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:06:49 AM

Posted 13 April 2014 - 07:23 AM

BleepingComputer - First off, I was following a random thread somewhere else and (I believe) determined that I would need to run combofix so I apologize as I already have (I am an windows software developer so I can most likely recover from any damage) but I do not know what I'm looking for in the log.  I have/had GorillaPrice for sure and I let my 4 children ages 8-14 use this machine so who knows what else...what I can say is that whatever was on my machine had the ability to block Spybot from running...the window for Spybot came up minimized and if you maximized it was a black screen.  Never seen that before.  Anyway, here is my combofix log:

 

ComboFix 14-04-12.01 - Steve Lacy 04/13/2014   5:46.1.8 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.6135.4008 [GMT -5:00]
Running from: c:\users\Steve Lacy\Downloads\ComboFix.exe
AV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Security Suite *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\SearchProtect
c:\program files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll
c:\users\Lacy-Valarie\AppData\Local\assembly\tmp
c:\users\Steve Lacy\AppData\Local\assembly\tmp
c:\users\Steve Lacy\AppData\Roaming\windows
.
.
(((((((((((((((((((((((((   Files Created from 2014-03-13 to 2014-04-13  )))))))))))))))))))))))))))))))
.
.
2014-04-13 11:01 . 2014-04-13 11:01 -------- d-----w- c:\users\Quinn\AppData\Local\temp
2014-04-13 11:01 . 2014-04-13 11:01 -------- d-----w- c:\users\Lacy-Valarie\AppData\Local\temp
2014-04-13 11:01 . 2014-04-13 11:01 -------- d-----w- c:\users\Super Hero Quinn\AppData\Local\temp
2014-04-13 11:01 . 2014-04-13 11:01 -------- d-----w- c:\users\Rosa\AppData\Local\temp
2014-04-13 11:01 . 2014-04-13 11:01 -------- d-----w- c:\users\Lili\AppData\Local\temp
2014-04-13 06:44 . 2014-04-13 06:44 -------- d-----w- c:\users\Steve Lacy\AppData\Local\pptaddin
2014-04-13 06:44 . 2014-04-13 06:44 -------- d-----w- c:\users\Steve Lacy\AppData\Local\SoftUpdate
2014-04-13 06:44 . 2014-04-13 06:44 -------- d-----w- c:\users\Steve Lacy\AppData\Local\emaze
2014-04-11 12:46 . 2014-04-11 12:46 -------- d-----w- c:\users\Lili\AppData\Local\Apps
2014-04-10 00:29 . 2014-04-10 00:29 -------- d-----w- c:\users\Quinn\AppData\Roaming\DivX
2014-04-09 10:38 . 2014-04-13 08:21 -------- d-----w- c:\users\Steve Lacy\AppData\Roaming\avidemux
2014-04-09 10:38 . 2014-04-09 10:38 -------- d-----w- c:\program files\Avidemux 2.6 - 64bits
2014-04-09 09:37 . 2014-04-09 09:37 -------- d-----w- c:\users\Steve Lacy\AppData\Local\DDMSettings
2014-04-09 09:33 . 2014-04-09 11:05 -------- d-----w- c:\users\Steve Lacy\AppData\Roaming\DivX
2014-04-09 09:32 . 2014-04-09 09:33 -------- d-----w- c:\program files\DivX
2014-04-09 09:32 . 2014-04-09 09:33 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared
2014-04-09 09:32 . 2014-04-09 09:34 -------- d-----w- c:\program files (x86)\DivX
2014-04-09 09:28 . 2014-04-09 09:34 -------- d-----w- c:\programdata\DivX
2014-04-09 08:11 . 2014-04-09 08:33 -------- d-----w- c:\users\Steve Lacy\AppData\Local\Movavi
2014-04-09 08:11 . 2014-04-09 08:11 -------- d-----w- c:\users\Steve Lacy\AppData\Roaming\MOVAVI
2014-04-09 08:11 . 2014-04-13 08:35 -------- d-----w- c:\users\Steve Lacy\AppData\Local\Video Enhancer
2014-04-09 08:11 . 2014-04-09 08:11 -------- d-----w- c:\program files (x86)\Video Enhancer
2014-04-09 08:10 . 2014-04-09 08:11 -------- d-----w- c:\program files (x86)\Movavi Video Editor 9
2014-04-09 01:33 . 2014-04-09 01:33 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-09 01:31 . 2014-04-09 01:31 -------- d-----w- c:\users\Quinn\AppData\Local\Apple Computer
2014-04-09 01:09 . 2014-01-24 02:37 1684928 ----a-w- c:\windows\system32\drivers\ntfs.sys
2014-04-07 05:06 . 2014-04-07 05:06 -------- d-----w- c:\program files (x86)\ASIO4ALL v2
2014-04-05 16:47 . 2014-04-05 16:47 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2014-04-05 16:47 . 2014-04-05 16:47 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2014-04-05 16:47 . 2014-04-05 16:47 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2014-04-05 16:47 . 2014-04-05 16:47 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2014-04-05 16:47 . 2014-04-05 16:47 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2014-04-05 03:46 . 2014-04-05 03:46 -------- d-----w- c:\users\Steve Lacy\AppData\Roaming\redsn0w
2014-04-05 03:33 . 2014-04-05 03:33 -------- d-----w- c:\users\Steve Lacy\AppData\Roaming\StormFall598
2014-04-05 03:33 . 2014-04-05 03:33 -------- d-----w- c:\users\Steve Lacy\AppData\Roaming\0S1F1O2Z0S2Y1H1T
2014-04-05 02:18 . 2014-04-05 02:18 -------- d-----w- c:\users\Lili\AppData\Local\Apple Computer
2014-04-04 00:52 . 2014-04-04 00:52 -------- d-----w- c:\program files\Common Files\logishrd
2014-04-01 21:40 . 2014-04-01 21:40 -------- d-----w- c:\users\Lili\AppData\Roaming\Yahoo!
2014-04-01 18:56 . 2014-04-09 02:20 -------- d-----w- c:\programdata\Yahoo!
2014-04-01 00:46 . 2012-08-21 18:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2014-04-01 00:46 . 2014-04-01 00:46 -------- d-----w- c:\program files\iTunes
2014-04-01 00:46 . 2014-04-01 00:46 -------- d-----w- c:\program files (x86)\iTunes
2014-04-01 00:46 . 2014-04-01 00:46 -------- d-----w- c:\program files\iPod
2014-04-01 00:44 . 2014-04-01 00:44 -------- d-----w- c:\program files (x86)\Apple Software Update
2014-04-01 00:43 . 2014-04-01 00:43 -------- d-----w- c:\program files\Bonjour
2014-04-01 00:43 . 2014-04-01 00:43 -------- d-----w- c:\program files (x86)\Bonjour
2014-03-28 23:00 . 2014-03-28 23:04 -------- d-----w- c:\users\Quinn\AppData\Roaming\Curse Advertising
2014-03-28 22:59 . 2014-03-28 22:59 -------- d-----w- c:\users\Quinn\AppData\Local\Apps
2014-03-28 22:59 . 2014-04-11 01:45 -------- d-----w- c:\users\Quinn\AppData\Local\Deployment
2014-03-21 08:01 . 2013-12-21 08:56 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2014-03-21 08:01 . 2013-12-21 09:53 548864 ----a-w- c:\windows\system32\vbscript.dll
2014-03-20 18:48 . 2009-07-14 01:41 101376 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPWN7.DLL
2014-03-20 11:23 . 2013-10-14 23:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2014-03-20 09:57 . 2008-05-08 00:59 99840 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPLHN.DLL
2014-03-17 10:58 . 2014-03-17 10:58 -------- d-----w- c:\programdata\Hewlett-Packard
2014-03-17 10:58 . 2009-07-14 01:41 230400 ----a-w- c:\windows\system32\Spool\prtprocs\x64\hpzppw71.dll
2014-03-17 07:55 . 2014-02-04 02:32 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-03-17 07:55 . 2014-02-04 02:04 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-03-17 07:55 . 2014-01-29 02:32 484864 ----a-w- c:\windows\system32\wer.dll
2014-03-17 07:55 . 2014-01-29 02:06 381440 ----a-w- c:\windows\SysWow64\wer.dll
2014-03-17 07:55 . 2014-02-07 01:23 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-03-17 07:55 . 2014-01-28 02:32 228864 ----a-w- c:\windows\system32\wwansvc.dll
2014-03-17 07:55 . 2014-02-04 02:32 624128 ----a-w- c:\windows\system32\qedit.dll
2014-03-17 07:55 . 2014-02-04 02:04 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2014-03-15 20:45 . 2014-03-15 20:45 -------- d-----w- c:\program files (x86)\EZ Label Xpress
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-13 04:04 . 2010-05-18 22:23 736952 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2014-04-13 04:03 . 2010-06-03 14:42 2876528 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2014-04-13 03:54 . 2010-06-03 14:41 42168 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2014-04-09 08:03 . 2010-05-23 04:25 90655440 ----a-w- c:\windows\system32\MRT.exe
2014-04-07 04:46 . 2012-06-12 23:13 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-04-07 04:46 . 2012-03-24 13:11 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-03-04 09:17 . 2014-04-09 01:10 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2014-02-21 03:24 . 2014-02-21 03:24 17858952 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-02-14 01:01 . 2014-02-15 06:01 128320 ----a-w- c:\windows\system32\IObitSmartDefragExtension.dll
2014-02-13 12:46 . 2014-02-13 12:46 354656 ----a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl
2014-01-17 21:24 . 2014-01-17 21:24 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2014-01-17 21:24 . 2014-01-17 21:24 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2014-01-14 15:46 . 2010-06-06 15:45 736952 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll
2014-01-14 15:46 . 2010-05-18 22:23 2876528 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2014-01-14 15:46 . 2010-05-18 22:23 42168 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2014-01-14 15:46 . 2010-07-07 15:31 539984 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Steve Lacy\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Steve Lacy\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Steve Lacy\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Steve Lacy\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"InstaLAN"="c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2012-02-23 1885088]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-02-21 152392]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2014-02-14 450560]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2014-01-10 1861968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20140319.001\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
R3 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
R3 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys;c:\windows\SYSNATIVE\DRIVERS\lv302a64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 MAUSBMOBILEPREII;Service for M-Audio MobilePre II;c:\windows\system32\DRIVERS\MAudioMobilePreII.sys;c:\windows\SYSNATIVE\DRIVERS\MAudioMobilePreII.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 sonydcam;Generic 1394 Desktop Camera;c:\windows\system32\DRIVERS\sonydcam.sys;c:\windows\SYSNATIVE\DRIVERS\sonydcam.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 Te.Service;Te.Service;c:\program files (x86)\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe;c:\program files (x86)\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 UsbFltr;WayTech USB Filter Driver;c:\windows\system32\Drivers\UsbFltr.sys;c:\windows\SYSNATIVE\Drivers\UsbFltr.sys [x]
R3 VsEtwService120;Visual Studio ETW Event Collection Service;c:\program files\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe;c:\program files\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys;c:\windows\SYSNATIVE\drivers\WsAudio_DeviceS(1).sys [x]
R3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys;c:\windows\SYSNATIVE\drivers\WsAudio_DeviceS(2).sys [x]
R3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys;c:\windows\SYSNATIVE\drivers\WsAudio_DeviceS(3).sys [x]
R3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys;c:\windows\SYSNATIVE\drivers\WsAudio_DeviceS(4).sys [x]
R3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys;c:\windows\SYSNATIVE\drivers\WsAudio_DeviceS(5).sys [x]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R4 GorillaPrice;GorillaPrice;c:\program files (x86)\GorillaPrice\gorillaprice.exe;c:\program files (x86)\GorillaPrice\gorillaprice.exe [x]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x]
R4 RsFx0153;RsFx0153 Driver;c:\windows\system32\DRIVERS\RsFx0153.sys;c:\windows\SYSNATIVE\DRIVERS\RsFx0153.sys [x]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10_50.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE;c:\program files\Microsoft SQL Server\MSSQL10_50.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [x]
R4 WatGorp;WatGorp;c:\programdata\gorillaprice\WatGorp.exe;c:\programdata\gorillaprice\WatGorp.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys;c:\windows\SYSNATIVE\Drivers\SmartDefragDriver.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\0502020.003\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\0502020.003\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\0502020.003\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\0502020.003\SYMEFA64.SYS [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20140410.001\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20140410.001\IDSvia64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\0502020.003\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\0502020.003\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\0502020.003\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\N360x64\0502020.003\SYMNETS.SYS [x]
S2 Belkin Local Backup Service;Belkin Local Backup Service;c:\program files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe;c:\program files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [x]
S2 Belkin Network USB Helper;Belkin Network USB Helper;c:\program files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe;c:\program files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [x]
S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [x]
S2 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [x]
S2 N360;Norton Security Suite;c:\program files (x86)\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe;c:\program files (x86)\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe [x]
S2 sxuptp;SXUPTP Driver;c:\windows\system32\DRIVERS\sxuptp.sys;c:\windows\SYSNATIVE\DRIVERS\sxuptp.sys [x]
S2 WMSVC;Web Management Service;c:\windows\system32\inetsrv\wmsvc.exe;c:\windows\SYSNATIVE\inetsrv\wmsvc.exe [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys;c:\windows\SYSNATIVE\drivers\LVUSBS64.sys [x]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ   w3svc was
apphost REG_MULTI_SZ   apphostsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-02-21 19:54 1150280 ----a-w- c:\program files (x86)\Google\Chrome\Application\33.0.1750.117\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-04-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-12 04:46]
.
2014-02-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-28 23:50]
.
2014-02-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-28 23:50]
.
2014-02-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4110668027-1638749547-3865159956-1001Core.job
- c:\users\Steve Lacy\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-22 00:28]
.
2014-02-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4110668027-1638749547-3865159956-1001UA.job
- c:\users\Steve Lacy\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-22 00:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Steve Lacy\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Steve Lacy\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Steve Lacy\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Steve Lacy\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.conduit.com/?gd=&ctid=CT3320048&octid=EB_ORIGINAL_CTID&ISID=MF47A7EBA-4D54-40D1-A483-287D8E5D2480&SearchSource=55&CUI=&UM=5&UP=SP56BFC2BF-6D73-43A6-A53B-1AFF38523E2B&SSPV=
mStart Page = hxxp://start.mysearchdial.com/?f=1&a=suma_14_14_ch&cd=2XzuyEtN2Y1L1Qzu0AyE0B0A0D0BtDtAyE0F0FtBtCzytDzztN0D0Tzu0SzztByDtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtDzztAyBzy0BzytG0FyCyEzytG0FyEzztAtGtAtDtA0CtGtD0Bzz0ByB0ByCyBzztCtAyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StA0F0FtAzz0FtB0AtGyE0D0DyBtG0DtByEyDtG0D0Bzy0CtGtAyDtD0C0AyEyEzz0FtDyBzz2Q&cr=1305214648&ir=
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = actsvr.comcastonline.com:8100
uInternet Settings,ProxyOverride = cdn;192.168.*.*;*.local
uSearchAssistant = hxxp://feed.snapdo.com/?publisher=AirInstaller&dpid=AirInstallerCH&co=US&userid=ada6ac87-9311-1bdd-14dc-c34e70d5a822&searchtype=ds&q={searchTerms}&installDate={installDate}&barcodeid={barcodeID}&um={UM}
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office14\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Se&nd to OneNote - c:\progra~2\MIF5BA~1\Office14\ONBttnIE.dll/105
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 75.75.76.76 75.75.75.75
FF - ProfilePath - c:\users\Steve Lacy\AppData\Roaming\Mozilla\Firefox\Profiles\b7fb260e.default\
FF - prefs.js: browser.search.selectedEngine - Conduit Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?gd=&ctid=CT3320048&octid=EB_ORIGINAL_CTID&ISID=MF47A7EBA-4D54-40D1-A483-287D8E5D2480&SearchSource=55&CUI=&UM=5&UP=SP56BFC2BF-6D73-43A6-A53B-1AFF38523E2B&SSPV=
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3306061&SearchSource=2&CUI=UN13950029029987305&UM=2&q=
FF - ExtSQL: !HIDDEN! 2010-11-30 19:33; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: content.notify.ontimer - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.switch.threshold - 750000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: extensions.autoDisableScopes - 0
FF - user.js: extensions.shownSelectionUI - true
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
FF - user.js: extensions.irmysearch.aflt - suma_14_14_ch
FF - user.js: extensions.irmysearch.instlRef - 140305_b
FF - user.js: extensions.irmysearch.cr - 1305214648
FF - user.js: extensions.irmysearch.cd - 2XzuyEtN2Y1L1Qzu0AyE0B0A0D0BtDtAyE0F0FtBtCzytDzztN0D0Tzu0SzztByDtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtDzztAyBzy0BzytG0FyCyEzytG0FyEzztAtGtAtDtA0CtGtD0Bzz0ByB0ByCyBzztCtAyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StA0F0FtAzz0FtB0AtGyE0D0DyBtG0DtByEyDtG0D0Bzy0CtGtAyDtD0C0AyEyEzz0FtDyBzz2Q
FF - user.js: extensions.mysearchdial.hmpg - true
FF - user.js: extensions.mysearchdial.hmpgUrl - hxxp://start.mysearchdial.com/?f=1&a=suma_14_14_ch&cd=2XzuyEtN2Y1L1Qzu0AyE0B0A0D0BtDtAyE0F0FtBtCzytDzztN0D0Tzu0SzztByDtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtDzztAyBzy0BzytG0FyCyEzytG0FyEzztAtGtAtDtA0CtGtD0Bzz0ByB0ByCyBzztCtAyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StA0F0FtAzz0FtB0AtGyE0D0DyBtG0DtByEyDtG0D0Bzy0CtGtAyDtD0C0AyEyEzz0FtDyBzz2Q&cr=1305214648&ir=
FF - user.js: extensions.mysearchdial.dfltSrch - true
FF - user.js: extensions.mysearchdial.srchPrvdr - Mysearchdial
FF - user.js: extensions.mysearchdial.dnsErr - true
FF - user.js: extensions.mysearchdial_i.newTab - false
FF - user.js: extensions.mysearchdial.newTabUrl - hxxp://start.mysearchdial.com/?f=2&a=suma_14_14_ch&cd=2XzuyEtN2Y1L1Qzu0AyE0B0A0D0BtDtAyE0F0FtBtCzytDzztN0D0Tzu0SzztByDtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtDzztAyBzy0BzytG0FyCyEzytG0FyEzztAtGtAtDtA0CtGtD0Bzz0ByB0ByCyBzztCtAyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StA0F0FtAzz0FtB0AtGyE0D0DyBtG0DtByEyDtG0D0Bzy0CtGtAyDtD0C0AyEyEzz0FtDyBzz2Q&cr=1305214648&ir=
FF - user.js: extensions.mysearchdial.tlbrSrchUrl - hxxp://start.mysearchdial.com/?f=3&a=suma_14_14_ch&cd=2XzuyEtN2Y1L1Qzu0AyE0B0A0D0BtDtAyE0F0FtBtCzytDzztN0D0Tzu0SzztByDtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtDzztAyBzy0BzytG0FyCyEzytG0FyEzztAtGtAtDtA0CtGtD0Bzz0ByB0ByCyBzztCtAyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StA0F0FtAzz0FtB0AtGyE0D0DyBtG0DtByEyDtG0D0Bzy0CtGtAyDtD0C0AyEyEzz0FtDyBzz2Q&cr=1305214648&ir=&q=
FF - user.js: extensions.mysearchdial.id - A4BADB034FF21908
FF - user.js: extensions.mysearchdial.instlDay - 16164
FF - user.js: extensions.mysearchdial.vrsn - 1.8.29.0
FF - user.js: extensions.mysearchdial.vrsni - 1.8.29.0
FF - user.js: extensions.mysearchdial_i.vrsnTs - 1.8.29.022:33
FF - user.js: extensions.mysearchdial.prtnrId - mysearchdial
FF - user.js: extensions.mysearchdial.prdct - mysearchdial
FF - user.js: extensions.mysearchdial.aflt - suma_14_14_ch
FF - user.js: extensions.mysearchdial_i.smplGrp - none
FF - user.js: extensions.mysearchdial.tlbrId - base
FF - user.js: extensions.mysearchdial.instlRef - 140305_b
FF - user.js: extensions.mysearchdial.dfltLng - 
FF - user.js: extensions.mysearchdial.appId - {CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}
FF - user.js: extensions.mysearchdial.excTlbr - false
FF - user.js: extensions.mysearchdial.cr - 1305214648
FF - user.js: extensions.mysearchdial.cd - 2XzuyEtN2Y1L1Qzu0AyE0B0A0D0BtDtAyE0F0FtBtCzytDzztN0D0Tzu0SzztByDtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtDzztAyBzy0BzytG0FyCyEzytG0FyEzztAtGtAtDtA0CtGtD0Bzz0ByB0ByCyBzztCtAyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StA0F0FtAzz0FtB0AtGyE0D0DyBtG0DtByEyDtG0D0Bzy0CtGtAyDtD0C0AyEyEzz0FtDyBzz2Q
FF - user.js: extensions.mysearchdial.AL - 2
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - (no file)
BHO-{9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
Toolbar-Locked - (no file)
Toolbar-{9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
Wow6432Node-HKLM-Run-BrowserAppCoreService - c:\users\Steve Lacy\AppData\Roaming\ShopAtHome.com BrowserAppCore Service\SahProcessManager.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-{29828f33-4679-462a-8c98-1c3507678922} - c:\programdata\Package Cache\{29828f33-4679-462a-8c98-1c3507678922}\VS2012.3.exe
AddRemove-{49c53021-7c66-4b0b-b842-9b878d2f0e0f} - c:\programdata\Package Cache\{49c53021-7c66-4b0b-b842-9b878d2f0e0f}\WinLibJS_VSE.exe
AddRemove-{56ef8912-352f-4fab-9c73-6f1c92a7127f} - c:\programdata\Package Cache\{56ef8912-352f-4fab-9c73-6f1c92a7127f}\patch_KB2781514.exe
AddRemove-{5dd5a0ee-7621-4121-9aca-4587b88f1cb9} - c:\programdata\Package Cache\{5dd5a0ee-7621-4121-9aca-4587b88f1cb9}\SSDTSetup.exe
AddRemove-{71a40c60-27c2-443a-b7c7-6e4f3aad1d5a} - c:\programdata\Package Cache\{71a40c60-27c2-443a-b7c7-6e4f3aad1d5a}\AspNetWebTools2012Setup.exe
AddRemove-{8040aebb-c735-4cbe-a6ce-827e359b268b} - c:\programdata\Package Cache\{8040aebb-c735-4cbe-a6ce-827e359b268b}\WindowsAzureTools.VS110.exe
AddRemove-{ae17ae9b-af38-40d2-a194-6102c56ed502} - c:\programdata\Package Cache\{ae17ae9b-af38-40d2-a194-6102c56ed502}\vs_ultimate.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\MsDepSvc]
"ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc"
--
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\N360]
"ImagePath"="\"c:\program files (x86)\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton Security Suite\Engine\5.2.2.3\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"=hex:51,66,7a,6c,4c,1d,38,12,8d,ec,f8,
   7b,2b,25,27,06,e7,c4,bc,f0,98,15,0d,de
"{03EB0E9C-7A91-4381-A220-9B52B641CDB1}"=hex:51,66,7a,6c,4c,1d,38,12,f2,0d,f8,
   07,a3,34,ef,06,dd,36,d8,12,b3,1f,89,a5
"{0347C33E-8762-4905-BF09-768834316C61}"=hex:51,66,7a,6c,4c,1d,38,12,50,c0,54,
   07,50,c9,6b,0c,c0,1f,35,c8,31,6f,28,75
"{432DD630-7E03-4C97-9D62-B99F52DF4FC2}"=hex:51,66,7a,6c,4c,1d,38,12,5e,d5,3e,
   47,31,30,f9,09,e2,74,fa,df,57,81,0b,d6
"{48A789BF-F6D6-4930-9C8B-77855A63EDE1}"=hex:51,66,7a,6c,4c,1d,38,12,d1,8a,b4,
   4c,e4,b8,5e,0c,e3,9d,34,c5,5f,3d,a9,f5
"{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}"=hex:51,66,7a,6c,4c,1d,38,12,60,d8,39,
   64,cd,04,79,07,f5,b7,d6,9a,c1,81,e0,1c
"{6D53EC84-6AAE-4787-AEEE-F4628F01010C}"=hex:51,66,7a,6c,4c,1d,38,12,ea,ef,40,
   69,9c,24,e9,02,d1,f8,b7,22,8a,5f,45,18
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
   76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
   72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{876D9F09-C6D6-4324-A2CC-04DD9A4DE12F}"=hex:51,66,7a,6c,4c,1d,38,12,67,9c,7e,
   83,e4,88,4a,06,dd,da,47,9d,9f,13,a5,3b
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
   b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}"=hex:51,66,7a,6c,4c,1d,38,12,e3,94,1f,
   be,3b,97,d8,0c,d0,f4,c8,9e,21,03,83,f2
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}"=hex:51,66,7a,6c,4c,1d,38,12,91,fc,ec,
   fb,7c,81,45,0a,c2,d4,4d,32,e4,48,ec,42
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,
   2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85
"{46857999-9B7C-4895-9D22-81A4A2478868}"=hex:51,66,7a,6c,4c,1d,38,12,f7,7a,96,
   42,4e,d5,fb,0d,e2,34,c2,e4,a7,19,cc,7c
"{3142C289-F319-47F5-A594-A827028714C9}"=hex:51,66,7a,6c,4c,1d,38,12,e7,c1,51,
   35,2b,bd,9b,02,da,82,eb,67,07,d9,50,dd
"{555D4D79-4BD2-4094-A395-CFC534424A05}"=hex:51,66,7a,6c,4c,1d,38,12,17,4e,4e,
   51,e0,05,fa,05,dc,83,8c,85,31,1c,0e,11
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:ba,7d,32,4e,50,db,ce,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a9,4f,c9,0e,9d,01,06,44,87,d4,c4,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a9,4f,c9,0e,9d,01,06,44,87,d4,c4,\
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.032"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.abr"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.apd"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-4110668027-1638749547-3865159956-1001)
"Progid"="ACDSee Pro 7.arw"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.bay"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.cs1"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-4110668027-1638749547-3865159956-1001)
"Progid"="ACDSee Pro 7.dcr"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.djv"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-4110668027-1638749547-3865159956-1001)
"Progid"="ACDSee Pro 7.dng"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.erf"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.fff"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.hdr"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.icn"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.iw4"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.j2c"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.jbr"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.jfif"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.jif"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.jpk"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.jpx"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.mef"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.mos"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-4110668027-1638749547-3865159956-1001)
"Progid"="ACDSee Pro 7.mrw"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-4110668027-1638749547-3865159956-1001)
"Progid"="ACDSee Pro 7.nef"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-4110668027-1638749547-3865159956-1001)
"Progid"="ACDSee Pro 7.nrw"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-4110668027-1638749547-3865159956-1001)
"Progid"="ACDSee Pro 7.orf"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.pbr"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.pct"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-4110668027-1638749547-3865159956-1001)
"Progid"="ACDSee Pro 7.pef"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.pic"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.pict"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.pspbrush"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.pspimage"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-4110668027-1638749547-3865159956-1001)
"Progid"="ACDSee Pro 7.raf"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-4110668027-1638749547-3865159956-1001)
"Progid"="ACDSee Pro 7.rw2"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.rwl"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-4110668027-1638749547-3865159956-1001)
"Progid"="ACDSee Pro 7.sr2"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.srf"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.srw"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.THM\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.thm"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.ttc"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v70po\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.v70po"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v70pp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.v70pp"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v70ppf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.v70ppf"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.wbm"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.xif"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 7.xmp"
.
[HKEY_USERS\S-1-5-21-4110668027-1638749547-3865159956-1001\Software\SecuROM\License information*]
"datasecu"=hex:c3,2b,8c,8e,34,64,e7,14,82,7e,d5,45,b3,ff,27,7c,3c,00,71,2a,1c,
   5d,04,c5,b9,d5,00,bb,d9,c6,f8,fa,b8,a7,24,36,32,fd,d6,52,6b,eb,85,73,6d,68,\
"rkeysecu"=hex:c8,99,34,2a,26,07,92,5c,ef,d0,14,82,bb,f6,42,55
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_70_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_70_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.12"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Completion time: 2014-04-13  06:12:45 - machine was rebooted
ComboFix-quarantined-files.txt  2014-04-13 11:12
.
Pre-Run: 87,089,131,520 bytes free
Post-Run: 86,776,926,208 bytes free
.
- - End Of File - - CE8EBF7A8388C93A1448213D466AA14B
A36C5E4F47E84449FF07ED3517B43A31
 

Attached Files



BC AdBot (Login to Remove)

 


m

#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:07:49 AM

Posted 15 April 2014 - 08:27 AM





Hello texidio

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I would like you to run this program for me.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:07:49 AM

Posted 18 April 2014 - 07:33 AM


Hello

48 Hour bump

It has been more than 48 hours since my last post.
  • do you still need help with this?
  • do you need more time?
  • are you having problems following my instructions?
  • if after 48hrs you have not replied to this thread then it will have to be closed!
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:07:49 AM

Posted 23 April 2014 - 07:20 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users