Solved Windows 7 slow startup and usage (suspected virus infection)

[Solved] Windows 7 slow startup and usage (suspected virus infection)

Sorry to trouble you again.

I am recently very frustrated with my laptop. It took about 10 mins to get it ready but the minimum specs are still there and there are still ample HDD space.
I can't even do smooth multi-tasking, while in the past I can do it. Now I can't even do virus scanning (It takes more than 1 hour and still not done) Applications will hang and stop responding for more than 1 minute!! (ARGHHHH) However this rarely occurs in Safe Mode.

I have ruled out hardware problems and even did chkdsk and sfc/scannow but no problems found. I really don't want to reformat my computer.

I suspect there is a hidden process which 'saps' out memory usage, because the moment I turn on the computer, memory usage is more than 1GB which is abnormal (usually only 500MB+)

I will post the required log later, your help is appreciated.

p/s: Sorry If I replied late or more than 3 days because I am currently studying A-Levels and I need more time on my studies

 

(all files are quarantined)

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 18/5/2014
Scan Time: 10:32:52 PM
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.05.18.04
Rootkit Database: v2014.03.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Chameleon: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Chrome

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 319089
Time Elapsed: 20 min, 13 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 9
PUP.Optional.OutBrowse, HKLM\SOFTWARE\CLASSES\TYPELIB\{DCABB943-792E-44C4-9029-ECBEE6265AF9}, , [34a852007b00ea4cee5d88a24bb7f40c],
PUP.Optional.OutBrowse, HKLM\SOFTWARE\CLASSES\INTERFACE\{3408AC0D-510E-4808-8F7B-6B70B1F88534}, , [34a852007b00ea4cee5d88a24bb7f40c],
PUP.Optional.InstallBrain.A, HKLM\SOFTWARE\InstallIQ, , [e4f8b49edaa132042e48bcdb7a88f20e],
Adware.Sogou, HKLM\SOFTWARE\CLASSES\SogouExplorerHTML, , [ddff5df56b1077bf89811eeb996a28d8],
Trojan.Agent, HKLM\SOFTWARE\CLASSES\thunder, , [5b8172e0c5b6d0662c107c8d9d664db3],
Adware.Sogou, HKU\S-1-5-21-4121174262-479391197-1674385959-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SogouExplorer, , [55877fd3f08bc86ef2d0e036c63de31d],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4121174262-479391197-1674385959-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [ecf0b59d0e6dab8bbbafdbc25fa317e9],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4121174262-479391197-1674385959-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [409c430fbbc09b9bf87dd7dcb44f659b],
PUP.Optional.Softonic.A, HKU\S-1-5-21-4121174262-479391197-1674385959-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, , [0ad27ad881fac86ee615dfac37cb10f0],

Registry Values: 2
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4121174262-479391197-1674385959-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0H1L1J1L1S1R1N, , [409c430fbbc09b9bf87dd7dcb44f659b]
PUP.Optional.LiveSupport, HKU\S-1-5-21-4121174262-479391197-1674385959-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|LiveSupport, "C:\Program Files\LiveSupport\LiveSupport.exe" /noshow /log, , [ce0e62f0d3a8b97db05cb1df48ba56aa]

Registry Data: 0
(No malicious items detected)

Folders: 1
PUP.Optional.SimilarSites.A, C:\Users\Chrome\AppData\Roaming\SimilarSites, , [ba22430fb5c60b2b0dbb1069c2408878],

Files: 4
PUP.Optional.OutBrowse, C:\Users\Chrome\AppData\Local\Temp\DownloadManager.exe, , [34a852007b00ea4cee5d88a24bb7f40c],
Adware.Sogou, C:\Users\Amos\AppData\Roaming\SogouExplorer\SogouExplorerSetup.exe.$p4p$, , [3ca00a485823d561938dc68dae56cc34],
Adware.Sogou, C:\Users\Chrome\AppData\Roaming\SogouExplorer\SogouExplorerSetup.exe, , [f7e556fc5c1f231371af72e1e61e50b0],
PUP.Optional.Somoto, C:\Users\Chrome\AppData\Local\Temp\nsu1559.tmp, , [904c81d1a9d28caaffecac314ab9ba46],

Physical Sectors: 0
(No malicious items detected)


(end)

 

in the midst of doing dds scan.....

BSOD APPEARED

STOP code: 0xF4

 

DDS log

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 11.0.9600.17041
Run by Chrome at 15:56:09 on 2014-05-19
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.60.1033.18.1910.1035 [GMT 8:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
.
============== Running Processes ================
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Program Files\Tablet\Pen\Pen_TouchService.exe
C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
C:\windows\SYSTEM32\WISPTIS.EXE
C:\windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
C:\Program Files\Tablet\Wacom\WacomHost.exe
C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
C:\windows\System32\spoolsv.exe
C:\windows\system32\taskeng.exe
C:\PROGRA~1\SOGOUI~1\SogouExe\SogouExe.exe
C:\windows\system32\taskhost.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\PROGRA~1\SOGOUI~1\710~1.16~\SGTool.exe
C:\Program Files\Microsoft Office\Office15\MsoSync.exe
C:\Program Files\SogouInput\Components\AddressSearch\OmniAddr\OmniAddrService.exe
C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzMaelstromVADStreamingService.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Real\RealPlayer\Update\realsched.exe
C:\Program Files\Tablet\Pen\Pen_Tablet.exe
C:\windows\system32\taskeng.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\SogouInput\Components\SGImeGuard\1.0.0.20\SGImeGuard.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
c:\Program Files\Microsoft Security Client\NisSrv.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\windows\system32\sppsvc.exe
C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\windows\system32\conhost.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\windows\system32\svchost.exe -k apphost
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\svchost.exe -k iissvcs
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\System32\svchost.exe -k LocalServicePeerNet
.
============== Pseudo HJT Report ===============
.
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uProxyServer = hxxp=137.135.119.129:8080
uProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: ??????????: {0C3ED74B-8703-4003-A1F4-2B2A0C450DD2} - c:\program files\sogouinput\components\addresssearch\omniaddr\OmniAddr.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - c:\program files\microsoft office\office15\OCHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - <orphaned>
BHO: {889D2FEB-5411-4565-8998-1DD2C5261283} - <orphaned>
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - c:\program files\windows live\companion\companioncore.dll
BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office15\URLREDIR.DLL
BHO: QUICKfind BHO Object: {C08DF07A-3E49-4E25-9AB0-D3882835F153} - c:\program files\idm\quickfind\plugins\IEHelp.dll
BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - c:\program files\microsoft office\office15\GROOVEEX.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} -
BHO: TOSHIBA Media Controller Plug-in: {F3C88694-EFFA-4d78-B409-54B7B2535B14} - c:\program files\toshiba\toshiba media controller plug-in\TOSHIBAMediaControllerIE.dll
uRun: [Google Update] "c:\users\chrome\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [ImeGuardCom] c:\program files\sogouinput\components\sgimeguard\1.0.0.20\SGImeGuard.exe
uRun: [ctfmon] c:\windows\system32\ctfmon.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [TPwrMain] c:\program files\toshiba\power saver\TPwrMain.EXE
mRun: [TosVolRegulator] c:\program files\toshiba\tosvolregulator\TosVolRegulator.exe
mRun: [TosSENotify] c:\program files\toshiba\toshiba hdd ssd alert\TosWaitSrv.exe
mRun: [TosReelTimeMonitor] c:\program files\toshiba\reeltime\TosReelTimeMonitor.exe
mRun: [SmoothView] c:\program files\toshiba\smoothview\SmoothView.exe
mRun: [00TCrdMain] c:\program files\toshiba\flashcards\TCrdMain.exe
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
uPolicies-Explorer: NoDriveTypeAutoRun = dword:255
mPolicies-Explorer: NoDriveTypeAutoRun = dword:255
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Download all by FlashGet3 - c:\users\chrome\appdata\roaming\flashgetbho\GetAllUrl.htm
IE: Download by FlashGet3 - c:\users\chrome\appdata\roaming\flashgetbho\GetUrl.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\micros~2\office15\ONBttnIE.dll/105
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office15\ONBttnIE.dll
IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - c:\program files\microsoft office\office15\OCHelper.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office15\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{1CFCB6E2-8F54-4F7D-896C-B269912F2F12} : DHCPNameServer = 122.255.99.228 122.255.99.236
TCP: Interfaces\{A7A0C57F-18B6-4D9F-A071-EE1AF5A0D885} : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{A7A0C57F-18B6-4D9F-A071-EE1AF5A0D885} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{D5B412E6-71BE-4C71-B166-AB6E5A870A17} : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{D5B412E6-71BE-4C71-B166-AB6E5A870A17} : DHCPNameServer = 122.255.99.228 122.255.99.236
TCP: Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF} : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF}\45D40275966496 : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF}\45D40275966496 : DHCPNameServer = 202.188.1.5 202.188.0.133
TCP: Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF}\C6169663237383830457E6966696 : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF}\C6169663237383830457E6966696 : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF}\D416368696E656 : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF}\D416368696E656 : DHCPNameServer = 192.168.1.1
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office15\MSOXMLMF.DLL
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - c:\program files\microsoft office\office15\MSOSB.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2014-1-25 231960]
R1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\drivers\hssdrv6.sys [2012-8-2 35560]
R2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\toshiba\configfree\CFIWmxSvcs.exe [2010-1-29 185712]
R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2009-3-11 46448]
R2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2014-3-11 104264]
R2 OmniAddrService;Sogou OmniAddr Update Service;c:\program files\sogouinput\components\addresssearch\omniaddr\OmniAddrService.exe [2014-3-28 155856]
R2 RzMaelstromVADStreamingService;Razer Surround Audio Service;c:\programdata\razer\synapse\devices\razer surround\driver\RzMaelstromVADStreamingService.exe [2013-9-18 3665408]
R2 TabletServicePen;TabletServicePen;c:\program files\tablet\pen\Pen_Tablet.exe [2011-12-23 4869488]
R2 TouchServicePen;Wacom Consumer Touch Service;c:\program files\tablet\pen\Pen_TouchService.exe [2011-12-23 416112]
R2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\intel\intel(r) management engine components\uns\UNS.exe [2011-4-21 2320920]
R2 WTabletServicePro;Wacom Professional Service;c:\program files\tablet\wacom\WTabletServicePro.exe [2014-3-13 531224]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2011-4-21 7680]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2010-2-27 132480]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\L1C62x86.sys [2011-4-19 69232]
R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2014-3-11 279776]
R3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [2011-4-21 24064]
R3 RZMAELSTROMVADService;Razer Surround Audio Enhancer Service;c:\windows\system32\drivers\RzMaelstromVAD.sys [2013-9-18 33016]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\toshiba\toshiba hdd ssd alert\TosSmartSrv.exe [2010-2-6 111960]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-10-23 172192]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [2014-1-22 88576]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-4-21 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2011-5-13 1492840]
S3 GamesAppIntegrationService;GamesAppIntegrationService;c:\program files\wildtangent games\app\GamesAppIntegrationService.exe [2014-4-25 227904]
S3 GamesAppService;GamesAppService;c:\program files\wildtangent games\app\GamesAppService.exe [2014-4-25 203344]
S3 hidkmdf;KMDF Driver;c:\windows\system32\drivers\hidkmdf.sys [2014-3-13 12088]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\ieetwcollector.exe [2014-4-19 108032]
S3 MT7118VU;MediaTek MT7118 WiMAX USB Card Driver for VISTA;c:\windows\system32\drivers\mt7118vu.sys [2011-12-20 131072]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2011-4-21 190464]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [2009-6-11 347136]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [2014-1-22 184192]
S3 TMachInfo;TMachInfo;c:\program files\toshiba\toshiba service station\TMachInfo.exe [2011-4-21 51512]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-8-12 52224]
S3 WacHidRouter;Wacom Hid Router;c:\windows\system32\drivers\wachidrouter.sys [2014-3-13 76600]
S3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\drivers\wacomrouterfilter.sys [2014-3-13 13112]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-8-7 1343400]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-23 51040]
.
=============== Created Last 30 ================
.
2014-05-18 14:10:23 107736 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-05-18 14:10:13 73432 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-05-18 14:10:13 51416 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-05-18 14:10:13 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-05-18 14:10:13 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2014-05-18 10:01:15 8050496 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{c4e70580-c4c9-41e8-a6ef-896f1e89ee81}\mpengine.dll
2014-05-17 11:56:28 -------- d-----w- c:\programdata\BlueStacks
2014-05-17 11:54:26 -------- d-----w- c:\program files\WildTangent Games
2014-05-16 11:11:48 765968 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\{169e8927-2484-4027-83d1-105deb0ef83a}\gapaengine.dll
2014-05-16 11:11:37 8050496 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2014-05-16 11:03:55 -------- d-----w- c:\program files\Microsoft Security Client
2014-05-16 05:56:58 8050496 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{42a5c78b-06bb-4071-8533-98e37b012283}\mpengine.dll
2014-05-14 14:21:22 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-07 07:47:24 -------- d-s---w- c:\windows\system32\CompatTel
2014-04-28 06:14:35 -------- d-----w- c:\program files\MSECache
2014-04-26 07:09:52 115432 ----a-w- c:\program files\common files\microsoft shared\proof\2052\MSGR3SC.DLL
2014-04-25 05:23:40 80806080 ----a-w- c:\program files\common files\microsoft shared\office15\MSORES.DLL
2014-04-25 05:23:38 548024 ----a-w- c:\program files\common files\microsoft shared\office15\MSOSQM.EXE
2014-04-25 05:23:38 26134720 ----a-w- c:\program files\common files\microsoft shared\office15\MSO.DLL
.
==================== Find3M ====================
.
2014-05-09 07:06:23 369664 ----a-w- c:\windows\system32\aepdu.dll
2014-05-09 07:04:12 302592 ----a-w- c:\windows\system32\aeinv.dll
2014-04-12 02:15:13 67520 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2014-04-12 02:15:13 136640 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2014-04-12 02:12:09 15872 ----a-w- c:\windows\system32\sspisrv.dll
2014-04-12 02:12:09 100352 ----a-w- c:\windows\system32\sspicli.dll
2014-04-12 02:12:06 22016 ----a-w- c:\windows\system32\secur32.dll
2014-04-12 02:11:58 1059840 ----a-w- c:\windows\system32\lsasrv.dll
2014-04-12 02:11:22 22528 ----a-w- c:\windows\system32\lsass.exe
2014-03-31 14:46:48 130712 ----a-w- c:\windows\system32\MSSTDFMT.DLL
2014-03-31 14:46:48 1070232 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2014-03-28 04:35:24 0 ----a-w- c:\windows\system32\nsv7B1F.tmp
2014-03-26 10:30:02 3558512 ----a-w- c:\windows\system32\SogouPY.ime
2014-03-11 01:52:30 104264 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2014-03-06 08:31:27 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2014-03-06 08:02:34 61952 ----a-w- c:\windows\system32\iesetup.dll
2014-03-06 08:02:33 455168 ----a-w- c:\windows\system32\vbscript.dll
2014-03-06 08:01:01 51200 ----a-w- c:\windows\system32\ieetwproxystub.dll
2014-03-06 07:46:36 4254720 ----a-w- c:\windows\system32\jscript9.dll
2014-03-06 07:38:13 112128 ----a-w- c:\windows\system32\ieUnatt.exe
2014-03-06 07:38:10 108032 ----a-w- c:\windows\system32\ieetwcollector.exe
2014-03-06 07:36:40 592896 ----a-w- c:\windows\system32\jscript9diag.dll
2014-03-06 07:28:01 646144 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2014-03-06 07:13:43 32256 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2014-03-06 06:40:39 1967104 ----a-w- c:\windows\system32\inetcpl.cpl
2014-03-06 05:41:49 1789440 ----a-w- c:\windows\system32\wininet.dll
2014-03-04 09:20:11 3969984 ----a-w- c:\windows\system32\ntkrnlpa.exe
2014-03-04 09:20:11 3914176 ----a-w- c:\windows\system32\ntoskrnl.exe
.
============= FINISH: 16:05:25.48 ===============

 

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 30/7/2011 6:07:21 PM
System Uptime: 19/5/2014 3:33:38 PM (1 hours ago)
.
Motherboard: TOSHIBA | | Portable PC
Processor: Intel(R) Pentium(R) CPU P6300 @ 2.27GHz | CPU | 929/1066mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 455 GiB total, 285.827 GiB free.
D: is CDROM ()
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
??????? 7.1???
µTorrent
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 12 Plugin
Adobe Help Manager
Adobe Photoshop CS5
Adobe Reader 9.4.6
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
Atheros Driver Installation Program
Audacity 2.0.2
Auslogics BoostSpeed
Bamboo
Bejeweled 2 Deluxe
bl
Build-a-lot 2
CamStudio OSS Desktop Recorder
Canon Inkjet Printer/Scanner/Fax Extended Survey Program
Canon MP Navigator EX 3.0
Canon MP250 series MP Drivers
Canon Utilities My Printer
CCleaner
Chuzzle Deluxe
CLIP STUDIO PAINT
Conexant HD Audio
Core Temp 1.0 RC6
D3DX10
Definition Update for Microsoft Office 2013 (KB2760587) 32-Bit Edition
Diablo II
Dota 2
FATE
Google Chrome
Haali Media Splitter
HetaOni English
Ink-Squared Deluxe 1.0
Intel(R) Graphics Media Accelerator Driver
Intel(R) Management Engine Components
Intel(R) Rapid Storage Technology
Jewel Quest - Heritage
Junk Mail filter update
Malwarebytes Anti-Malware version 2.0.1.1004
MapleStorySEA 1.35
Matroska Pack
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 4.5.1
Microsoft Access MUI (English) 2013
Microsoft Access Setup Metadata MUI (English) 2013
Microsoft Application Error Reporting
Microsoft AppLocale
Microsoft DCF MUI (English) 2013
Microsoft Excel MUI (English) 2013
Microsoft Groove MUI (English) 2013
Microsoft InfoPath MUI (English) 2013
Microsoft Lync MUI (English) 2013
Microsoft Office ???? 2013 - ????
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office OSM MUI (English) 2013
Microsoft Office OSM UX MUI (English) 2013
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Plus 2013
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing (English) 2013
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Proofing Tools 2013 - English
Microsoft Office Proofing Tools 2013 - Español
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared MUI (English) 2013
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2013
Microsoft Office Word MUI (English) 2007
Microsoft OneNote MUI (English) 2013
Microsoft Outlook MUI (English) 2013
Microsoft PowerPoint MUI (English) 2013
Microsoft Publisher MUI (English) 2013
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005
Microsoft Windows Application Compatibility Database
Microsoft Word MUI (English) 2013
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Norton Internet Security
NVIDIA PhysX
OpenITG
OpenOffice.org 3.3
Outils de vérification linguistique 2013 de Microsoft Office*- Français
Oxford Advanced Learner's Dictionary - 8th Edition
PDF Settings CS5
ph
Picasa 3
Plants vs. Zombies
PlayReady PC Runtime x86
Polar Bowler
PPSSPP version 0.9.8
QUICKfind server v1.1
Razer Surround
Razer Synapse 2.0
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek USB 2.0 Card Reader
RealUpgrade 1.1
RGSS-RTP Standard
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
Security Update for Microsoft .NET Framework 4.5.1 (KB2931368)
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597973) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760411) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760415) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760585) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760591) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2817330) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2817641) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2827326) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2850022) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2878236) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2880507) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2880508) 32-Bit Edition
Security Update for Microsoft Office 2013 (KB2878316) 32-Bit Edition
Security Update for Microsoft Office 2013 (KB2880463) 32-Bit Edition
Security Update for Microsoft Office 2013 (KB2880502) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2827324) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2817565) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2878237) 32-Bit Edition
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition
ShowTime 1.2.17
Skype Toolbars
Skype™ 6.11
Speccy
SpeedFan (remove only)
Steam
Synaptics Pointing Device Driver
TOSHIBA Assist
TOSHIBA Bulletin Board
TOSHIBA ConfigFree
TOSHIBA Disc Creator
TOSHIBA Face Recognition
TOSHIBA Hardware Setup
TOSHIBA HDD/SSD Alert
TOSHIBA Media Controller
TOSHIBA Media Controller Plug-in
TOSHIBA Recovery Media Creator
TOSHIBA ReelTime
TOSHIBA Service Station
TOSHIBA Speech System Applications
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
TOSHIBA Supervisor Password
TOSHIBA Value Added Package
TOSHIBA Web Camera Application
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Excel 2013 (KB2880475) 32-Bit Edition
Update for Microsoft Lync 2013 (KB2817678) 32-Bit Edition
Update for Microsoft Lync 2013 (KB2880980) 32-Bit Edition
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office 2013 (KB2760344) 32-Bit Edition
Update for Microsoft Office 2013 (KB2760544) 32-Bit Edition
Update for Microsoft Office 2013 (KB2768012) 32-Bit Edition
Update for Microsoft Office 2013 (KB2817302) 32-Bit Edition
Update for Microsoft Office 2013 (KB2826040) 32-Bit Edition
Update for Microsoft Office 2013 (KB2827272) 32-Bit Edition
Update for Microsoft Office 2013 (KB2837644) 32-Bit Edition
Update for Microsoft Office 2013 (KB2863825) 32-Bit Edition
Update for Microsoft Office 2013 (KB2863843) 32-Bit Edition
Update for Microsoft Office 2013 (KB2863844) 32-Bit Edition
Update for Microsoft Office 2013 (KB2880462) 32-Bit Edition
Update for Microsoft Office 2013 (KB2880464) 32-Bit Edition
Update for Microsoft Office 2013 (KB2880476) 32-Bit Edition
Update for Microsoft Office 2013 (KB2880478) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Microsoft OneDrive for Business (KB2880480) 32-Bit Edition
Update for Microsoft OneNote 2013 (KB2817628) 32-Bit Edition
Update for Microsoft Outlook 2013 (KB2880470) 32-Bit Edition
Update for Microsoft PowerPoint 2013 (KB2878315) 32-Bit Edition
Update for Microsoft Publisher 2013 (KB2726952) 32-Bit Edition
Update for Microsoft Visio Viewer 2013 (KB2817301) 32-Bit Edition
Update for Microsoft Word 2013 (KB2878319) 32-Bit Edition
Update for Microsoft Word 2013 (KB2880455) 32-Bit Edition
Update Installer for WildTangent Games App
Virtual Villagers 4 - The Tree of Life
Wacom Tablet
WebTablet FB Plugin 32 bit
WebTablet IE Plugin
WebTablet Netscape Plugin
Wheel of Fortune 2
WildTangent Games
WildTangent Games App (Toshiba Games)
Windows 7 USB/DVD Download Tool
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Player Firefox Plugin
Windows Movie Maker 2.6
WinRAR 4.01 (32-bit)
Xiph.Org Open Codecs 0.85.17777
Zuma's Revenge
.
==== End Of File ===========================

 

New MBAM log

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 18/5/2014
Scan Time: 10:32:58 PM
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.05.18.04
Rootkit Database: v2014.03.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Chameleon: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Chrome

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 319089
Time Elapsed: 20 min, 18 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 9
PUP.Optional.OutBrowse, HKLM\SOFTWARE\CLASSES\TYPELIB\{DCABB943-792E-44C4-9029-ECBEE6265AF9}, Quarantined, [34a852007b00ea4cee5d88a24bb7f40c],
PUP.Optional.OutBrowse, HKLM\SOFTWARE\CLASSES\INTERFACE\{3408AC0D-510E-4808-8F7B-6B70B1F88534}, Quarantined, [34a852007b00ea4cee5d88a24bb7f40c],
PUP.Optional.InstallBrain.A, HKLM\SOFTWARE\InstallIQ, Quarantined, [e4f8b49edaa132042e48bcdb7a88f20e],
Adware.Sogou, HKLM\SOFTWARE\CLASSES\SogouExplorerHTML, Quarantined, [ddff5df56b1077bf89811eeb996a28d8],
Trojan.Agent, HKLM\SOFTWARE\CLASSES\thunder, Quarantined, [5b8172e0c5b6d0662c107c8d9d664db3],
Adware.Sogou, HKU\S-1-5-21-4121174262-479391197-1674385959-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SogouExplorer, Quarantined, [55877fd3f08bc86ef2d0e036c63de31d],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4121174262-479391197-1674385959-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, Quarantined, [ecf0b59d0e6dab8bbbafdbc25fa317e9],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4121174262-479391197-1674385959-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, Quarantined, [409c430fbbc09b9bf87dd7dcb44f659b],
PUP.Optional.Softonic.A, HKU\S-1-5-21-4121174262-479391197-1674385959-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, Quarantined, [0ad27ad881fac86ee615dfac37cb10f0],

Registry Values: 2
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4121174262-479391197-1674385959-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0H1L1J1L1S1R1N, Quarantined, [409c430fbbc09b9bf87dd7dcb44f659b]
PUP.Optional.LiveSupport, HKU\S-1-5-21-4121174262-479391197-1674385959-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|LiveSupport, "C:\Program Files\LiveSupport\LiveSupport.exe" /noshow /log, Quarantined, [ce0e62f0d3a8b97db05cb1df48ba56aa]

Registry Data: 0
(No malicious items detected)

Folders: 1
PUP.Optional.SimilarSites.A, C:\Users\Chrome\AppData\Roaming\SimilarSites, Quarantined, [ba22430fb5c60b2b0dbb1069c2408878],

Files: 4
PUP.Optional.OutBrowse, C:\Users\Chrome\AppData\Local\Temp\DownloadManager.exe, Quarantined, [34a852007b00ea4cee5d88a24bb7f40c],
Adware.Sogou, C:\Users\Amos\AppData\Roaming\SogouExplorer\SogouExplorerSetup.exe.$p4p$, Quarantined, [3ca00a485823d561938dc68dae56cc34],
Adware.Sogou, C:\Users\Chrome\AppData\Roaming\SogouExplorer\SogouExplorerSetup.exe, Quarantined, [f7e556fc5c1f231371af72e1e61e50b0],
PUP.Optional.Somoto, C:\Users\Chrome\AppData\Local\Temp\nsu1559.tmp, Quarantined, [904c81d1a9d28caaffecac314ab9ba46],

Physical Sectors: 0
(No malicious items detected)


(end)

 

I am seriously frustrated when it took about 20 minutes to boot it up and 10 minutes for dds scanning

seems that the boot time is increasing like a rising exponential curve

 

Rogue Killer Report

RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : Chrome [Admin rights]
Mode : Remove -- Date : 05/20/2014 16:08:47
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] RzMaelstromVADStreamingService.exe -- C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzMaelstromVADStreamingService.exe [-] -> KILLED [TermProc]

¤¤¤ Registry Entries : 4 ¤¤¤
[HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
[HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 2 ¤¤¤
[V2][SUSP PATH] RunAsStdUser Task : C:\Users\Chrome\AppData\Local\Oxy\Application\oxy.exe - --app=chrome-extension://cgeglcjaapbfihfpfmamaoipnbocnjkl/index.html#q= "Meso Generator Updated" [x][x] -> DELETED
[V2][SUSP PATH] {00A4B1DB-3F36-45CC-83B8-A5A2474BA181} : C:\Users\Chrome\Documents\avira_premium_security_suite_en.exe [x] -> DELETED

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤
[Address] EAT @explorer.exe (BeginBufferedAnimation) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746A09AE)
[Address] EAT @explorer.exe (BeginBufferedPaint) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746949A1)
[Address] EAT @explorer.exe (BeginPanningFeedback) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C0731)
[Address] EAT @explorer.exe (BufferedPaintClear) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x74696395)
[Address] EAT @explorer.exe (BufferedPaintInit) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469940E)
[Address] EAT @explorer.exe (BufferedPaintRenderAnimation) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746A08ED)
[Address] EAT @explorer.exe (BufferedPaintSetAlpha) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746AE6B3)
[Address] EAT @explorer.exe (BufferedPaintStopAllAnimations) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746AD395)
[Address] EAT @explorer.exe (BufferedPaintUnInit) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746994AB)
[Address] EAT @explorer.exe (CloseThemeData) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x74696A18)
[Address] EAT @explorer.exe (DrawThemeBackground) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x74693982)
[Address] EAT @explorer.exe (DrawThemeBackgroundEx) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746AD9DA)
[Address] EAT @explorer.exe (DrawThemeEdge) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746B3B52)
[Address] EAT @explorer.exe (DrawThemeIcon) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C35E7)
[Address] EAT @explorer.exe (DrawThemeParentBackground) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746953E5)
[Address] EAT @explorer.exe (DrawThemeParentBackgroundEx) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746951BF)
[Address] EAT @explorer.exe (DrawThemeText) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x74694EA1)
[Address] EAT @explorer.exe (DrawThemeTextEx) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746963E6)
[Address] EAT @explorer.exe (EnableThemeDialogTexture) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469FCAF)
[Address] EAT @explorer.exe (EnableTheming) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C2FEB)
[Address] EAT @explorer.exe (EndBufferedAnimation) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x74693F9A)
[Address] EAT @explorer.exe (EndBufferedPaint) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x74693F9A)
[Address] EAT @explorer.exe (EndPanningFeedback) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C06CC)
[Address] EAT @explorer.exe (GetBufferedPaintBits) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x74694BAF)
[Address] EAT @explorer.exe (GetBufferedPaintDC) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746A04BC)
[Address] EAT @explorer.exe (GetBufferedPaintTargetDC) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746A0473)
[Address] EAT @explorer.exe (GetBufferedPaintTargetRect) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C2E7F)
[Address] EAT @explorer.exe (GetCurrentThemeName) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746A05DD)
[Address] EAT @explorer.exe (GetThemeAppProperties) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746A0FB1)
[Address] EAT @explorer.exe (GetThemeBackgroundContentRect) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469CD2E)
[Address] EAT @explorer.exe (GetThemeBackgroundExtent) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469F8BF)
[Address] EAT @explorer.exe (GetThemeBackgroundRegion) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746A165D)
[Address] EAT @explorer.exe (GetThemeBitmap) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469BF93)
[Address] EAT @explorer.exe (GetThemeBool) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x74697C1F)
[Address] EAT @explorer.exe (GetThemeColor) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469616C)
[Address] EAT @explorer.exe (GetThemeDocumentationProperty) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C2932)
[Address] EAT @explorer.exe (GetThemeEnumValue) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469616C)
[Address] EAT @explorer.exe (GetThemeFilename) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C2412)
[Address] EAT @explorer.exe (GetThemeFont) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469FF21)
[Address] EAT @explorer.exe (GetThemeInt) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469616C)
[Address] EAT @explorer.exe (GetThemeIntList) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C23B1)
[Address] EAT @explorer.exe (GetThemeMargins) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746986E9)
[Address] EAT @explorer.exe (GetThemeMetric) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746A06E2)
[Address] EAT @explorer.exe (GetThemePartSize) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469CDB1)
[Address] EAT @explorer.exe (GetThemePosition) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C2350)
[Address] EAT @explorer.exe (GetThemePropertyOrigin) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746B3FBB)
[Address] EAT @explorer.exe (GetThemeRect) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746A3611)
[Address] EAT @explorer.exe (GetThemeStream) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746A39D9)
[Address] EAT @explorer.exe (GetThemeString) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C22E4)
[Address] EAT @explorer.exe (GetThemeSysBool) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C3172)
[Address] EAT @explorer.exe (GetThemeSysColor) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746B3274)
[Address] EAT @explorer.exe (GetThemeSysColorBrush) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C301E)
[Address] EAT @explorer.exe (GetThemeSysFont) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C29C4)
[Address] EAT @explorer.exe (GetThemeSysInt) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C2BD3)
[Address] EAT @explorer.exe (GetThemeSysSize) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C320B)
[Address] EAT @explorer.exe (GetThemeSysString) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C2B3F)
[Address] EAT @explorer.exe (GetThemeTextExtent) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x74692D57)
[Address] EAT @explorer.exe (GetThemeTextMetrics) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469F992)
[Address] EAT @explorer.exe (GetThemeTransitionDuration) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746A1081)
[Address] EAT @explorer.exe (GetWindowTheme) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469DF46)
[Address] EAT @explorer.exe (HitTestThemeBackground) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746A3CE3)
[Address] EAT @explorer.exe (IsAppThemed) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469F869)
[Address] EAT @explorer.exe (IsCompositionActive) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x74692E9A)
[Address] EAT @explorer.exe (IsThemeActive) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469F785)
[Address] EAT @explorer.exe (IsThemeBackgroundPartiallyTransparent) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746960AB)
[Address] EAT @explorer.exe (IsThemeDialogTextureEnabled) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C312B)
[Address] EAT @explorer.exe (IsThemePartDefined) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746985B4)
[Address] EAT @explorer.exe (OpenThemeData) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746973D2)
[Address] EAT @explorer.exe (OpenThemeDataEx) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746B3D43)
[Address] EAT @explorer.exe (SetThemeAppProperties) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C3296)
[Address] EAT @explorer.exe (SetWindowTheme) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746A0134)
[Address] EAT @explorer.exe (SetWindowThemeAttribute) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746ACFE6)
[Address] EAT @explorer.exe (ThemeInitApiHook) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x7469B176)
[Address] EAT @explorer.exe (UpdatePanningFeedback) : PROPSYS.dll -> HOOKED (C:\windows\system32\UxTheme.dll @ 0x746C068D)

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Hitachi HTS545050B9A300 +++++
--- User ---
[MBR] bc01381f6447e42aa6374ce510853ca3
[BSP] 69648b3eca26ce729ee2a6d32f8b3eaa : Windows Vista MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 MB
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 465461 MB
2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 956338176 | Size: 9978 MB
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_D_05202014_160847.txt >>
RKreport[0]_S_05202014_160804.txt

 

Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2014.05.21.03

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.17107
Chrome :: AMOS-PC [administrator]

21/5/2014 3:43:18 PM
mbar-log-2014-05-21 (15-43-18).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Kernel memory modifications detected. Deep Anti-Rootkit Scan engaged.
Objects scanned: 316691
Time elapsed: 1 hour(s), 4 minute(s), 41 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

 

ComboFix 14-05-19.01 - Chrome 22/05/2014 15:49:52.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.60.1033.18.1910.1058 [GMT 8:00]
Running from: c:\users\Chrome\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\1318138072.1096.bin
c:\programdata\1318138072.3480.bin
c:\programdata\1318138072.4348.bin
c:\programdata\1318138072.4364.bin
c:\programdata\1318138072.4368.bin
c:\programdata\1318138072.4372.bin
c:\programdata\1318138072.4448.bin
c:\programdata\1318138072.4532.bin
c:\programdata\1318138072.5384.bin
c:\programdata\1318138072.6056.bin
c:\users\Amos\AppData\Roaming\SogouExplorer
c:\users\Amos\AppData\Roaming\SogouExplorer\Bin\flash_wk.dll
c:\users\Amos\AppData\Roaming\SogouExplorer\Bin\malurl.dat
c:\users\Amos\AppData\Roaming\SogouExplorer\confdll.dll
c:\users\Amos\AppData\Roaming\SogouExplorer\datapack1
c:\users\Amos\AppData\Roaming\SogouExplorer\datapack2
c:\users\Amos\AppData\Roaming\SogouExplorer\datapack3
c:\users\Amos\AppData\Roaming\SogouExplorer\MetaSearch\metasearchupdate1
c:\users\Amos\AppData\Roaming\SogouExplorer\MetaSearch\metasearchupdate2
c:\users\Amos\AppData\Roaming\SogouExplorer\script.dat
c:\users\Amos\AppData\Roaming\SogouExplorer\SoDA\SogouExplorerSetup.exe.$finfo$
c:\users\Amos\AppData\Roaming\SogouExplorer\SoDA\SogouExplorerSetup.exe.$fmap$
c:\users\Amos\AppData\Roaming\SogouExplorer\urlblack.dat
c:\users\Chrome\AppData\Local\TempDIR
c:\users\Chrome\AppData\Roaming\SogouExplorer
c:\users\Chrome\AppData\Roaming\SogouExplorer\confdll.dll
c:\users\Chrome\AppData\Roaming\SogouExplorer\SoDA\SEUp.exe_tmp.$finfo$
c:\users\Chrome\AppData\Roaming\SogouExplorer\SoDA\SEUp.exe_tmp.$fmap$
c:\users\Chrome\AppData\Roaming\SogouExplorer\SoDA\SIUp.exe_tmp.$finfo$
c:\users\Chrome\AppData\Roaming\SogouExplorer\SoDA\SIUp.exe_tmp.$fmap$
c:\users\Default\AppData\Roaming\SogouExplorer
c:\users\Default\AppData\Roaming\SogouExplorer\Bin\flash_wk.dll
c:\users\Default\AppData\Roaming\SogouExplorer\Bin\malurl.dat
c:\users\Default\AppData\Roaming\SogouExplorer\datapack1
c:\users\Default\AppData\Roaming\SogouExplorer\datapack2
c:\users\Default\AppData\Roaming\SogouExplorer\datapack3
c:\users\Default\AppData\Roaming\SogouExplorer\MetaSearch\metasearchupdate1
c:\users\Default\AppData\Roaming\SogouExplorer\MetaSearch\metasearchupdate2
c:\users\Default\AppData\Roaming\SogouExplorer\script.dat
c:\users\Default\AppData\Roaming\SogouExplorer\urlblack.dat
c:\users\DefaultAppPool\AppData\Roaming\SogouExplorer
c:\users\DefaultAppPool\AppData\Roaming\SogouExplorer\Bin\flash_wk.dll
c:\users\DefaultAppPool\AppData\Roaming\SogouExplorer\Bin\malurl.dat
c:\users\DefaultAppPool\AppData\Roaming\SogouExplorer\datapack1
c:\users\DefaultAppPool\AppData\Roaming\SogouExplorer\datapack2
c:\users\DefaultAppPool\AppData\Roaming\SogouExplorer\datapack3
c:\users\DefaultAppPool\AppData\Roaming\SogouExplorer\MetaSearch\metasearchupdate1
c:\users\DefaultAppPool\AppData\Roaming\SogouExplorer\MetaSearch\metasearchupdate2
c:\users\DefaultAppPool\AppData\Roaming\SogouExplorer\script.dat
c:\users\DefaultAppPool\AppData\Roaming\SogouExplorer\urlblack.dat
c:\windows\apppatch\AppLoc.exe
.
.
((((((((((((((((((((((((( Files Created from 2014-04-22 to 2014-05-22 )))))))))))))))))))))))))))))))
.
.
2014-05-22 08:00 . 2014-05-22 08:00 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-05-22 08:00 . 2014-05-22 08:00 -------- d-----w- c:\users\DefaultAppPool\AppData\Local\temp
2014-05-22 08:00 . 2014-05-22 08:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-22 08:00 . 2014-05-22 08:00 -------- d-----w- c:\users\Amos\AppData\Local\temp
2014-05-21 08:10 . 2014-05-16 11:11 765968 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-05-21 08:10 . 2014-05-16 11:11 765968 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A0246F35-0C9C-40B8-9169-04B510D9AE4D}\gapaengine.dll
2014-05-21 08:09 . 2014-04-30 23:37 8073384 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7159A6DE-C991-4067-91BA-4E96F1B61AC2}\mpengine.dll
2014-05-21 07:32 . 2014-05-21 07:32 -------- d-----w- c:\users\Chrome\AppData\Local\VirtualStore
2014-05-20 08:24 . 2014-05-21 08:47 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-05-20 07:34 . 2014-04-15 18:25 8050496 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-05-18 14:10 . 2014-05-21 07:42 107224 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-05-18 14:10 . 2014-05-21 07:40 75480 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-05-18 14:10 . 2014-05-18 14:10 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2014-05-18 14:10 . 2014-04-03 01:51 51416 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-05-18 14:10 . 2014-04-03 01:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-05-17 11:56 . 2014-05-17 11:56 -------- d-----w- c:\programdata\BlueStacks
2014-05-17 11:54 . 2014-05-17 11:55 -------- d-----w- c:\program files\WildTangent Games
2014-05-16 11:03 . 2014-05-16 11:04 -------- d-----w- c:\program files\Microsoft Security Client
2014-05-16 05:56 . 2014-04-16 21:32 8050496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{42A5C78B-06BB-4071-8533-98E37B012283}\mpengine.dll
2014-05-15 13:39 . 2014-05-15 13:39 -------- d-sh--w- c:\users\Amos\AppData\Local\EmieUserList
2014-05-15 13:39 . 2014-05-15 13:39 -------- d-sh--w- c:\users\Amos\AppData\Local\EmieSiteList
2014-05-14 14:21 . 2014-05-06 03:07 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-07 07:47 . 2014-05-16 05:40 -------- d-s---w- c:\windows\system32\CompatTel
2014-04-28 06:14 . 2014-04-28 06:14 -------- d-----w- c:\program files\MSECache
2014-04-26 07:09 . 2014-04-26 07:09 115432 ----a-w- c:\program files\Common Files\Microsoft Shared\PROOF\2052\MSGR3SC.DLL
2014-04-25 05:23 . 2014-04-25 05:23 80806080 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\MSORES.DLL
2014-04-25 05:23 . 2014-04-25 05:23 548024 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\MSOSQM.EXE
2014-04-25 05:23 . 2014-04-25 05:23 26134720 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\MSO.DLL
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-31 14:46 . 2014-03-31 14:46 130712 ----a-w- c:\windows\system32\MSSTDFMT.DLL
2014-03-31 14:46 . 2014-03-31 14:46 1070232 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2014-03-28 04:35 . 2014-03-28 04:35 0 ----a-w- c:\windows\system32\nsv7B1F.tmp
2014-03-26 10:30 . 2014-03-26 10:30 3558512 ----a-w- c:\windows\system32\SogouPY.ime
2014-03-11 01:52 . 2014-03-11 01:52 104264 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2014-03-06 08:31 . 2014-04-19 04:21 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2014-03-06 08:02 . 2014-04-19 04:21 61952 ----a-w- c:\windows\system32\iesetup.dll
2014-03-06 08:02 . 2014-04-19 04:21 455168 ----a-w- c:\windows\system32\vbscript.dll
2014-03-06 08:01 . 2014-04-19 04:20 51200 ----a-w- c:\windows\system32\ieetwproxystub.dll
2014-03-06 07:46 . 2014-04-19 04:20 4254720 ----a-w- c:\windows\system32\jscript9.dll
2014-03-06 07:38 . 2014-04-19 04:21 112128 ----a-w- c:\windows\system32\ieUnatt.exe
2014-03-06 07:38 . 2014-04-19 04:20 108032 ----a-w- c:\windows\system32\ieetwcollector.exe
2014-03-06 07:36 . 2014-04-19 04:20 592896 ----a-w- c:\windows\system32\jscript9diag.dll
2014-03-06 07:28 . 2014-04-19 04:20 646144 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2014-03-06 07:13 . 2014-04-19 04:20 32256 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2014-03-06 06:40 . 2014-04-19 04:20 1967104 ----a-w- c:\windows\system32\inetcpl.cpl
2014-03-06 05:41 . 2014-04-19 04:20 1789440 ----a-w- c:\windows\system32\wininet.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{0C3ED74B-8703-4003-A1F4-2B2A0C450DD2}]
2014-03-28 04:35 1854056 ----a-w- c:\program files\SogouInput\Components\AddressSearch\OmniAddr\OmniAddr.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@= "{8BA85C75-763B-4103-94EB-9470F12FE0F7} "
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-04-08 06:18 1728216 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@= "{CD55129A-B1A1-438E-A425-CEBC7DC684EE} "
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-04-08 06:18 1728216 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@= "{E768CD3B-BDDC-436D-9C13-E1B39CA257B1} "
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-04-08 06:18 1728216 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ImeGuardCom "= "c:\program files\SogouInput\Components\SGImeGuard\1.0.0.20\SGImeGuard.exe" [2014-01-04 372856]
"ctfmon "= "c:\windows\system32\ctfmon.exe" [2009-07-14 8704]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2010-08-10 136216]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2010-08-10 171032]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2010-08-10 170520]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-03-11 1697064]
"TPwrMain "= "c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2010-09-28 521640]
"TosVolRegulator "= "c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 22840]
"TosSENotify "= "c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-02-06 611672]
"TosReelTimeMonitor "= "c:\program files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [2010-03-03 30040]
"SmoothView "= "c:\program files\Toshiba\SmoothView\SmoothView.exe" [2009-07-28 460088]
"00TCrdMain "= "c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2010-05-09 742776]
"TkBellExe "= "c:\program files\Real\RealPlayer\update\realsched.exe" [2012-06-06 296056]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 951576]
.
c:\users\Amos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
"PromptOnSecureDesktop "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804]
Ime File REG_SZ SOGOUPY.IME
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
[HKLM\~\startupfolder\C:^Users^Chrome^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk]
path=c:\users\Chrome\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
backup=c:\windows\pss\OpenOffice.org 3.3.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidCall]
c:\program files\RC??\raidcall.exe [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06 958576 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2012-04-03 22:09 446392 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2009-03-24 02:00 1983816 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-08-13 09:26 136176 ----atw- c:\users\Chrome\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2009-02-26 10:36 30040 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Razer Synapse]
2013-09-28 08:46 442200 ----a-w- c:\program files\Razer\Synapse\RzSynapse.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2013-11-14 08:42 20584608 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartAudio]
2010-04-28 18:31 307768 ------w- c:\program files\CONEXANT\SAII\SAIICpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartFaceVWatcher]
2009-10-20 01:23 163840 ----a-w- c:\program files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2014-02-25 21:57 1821888 ----a-w- c:\program files\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2012-06-06 13:19 296056 ----a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TosNC]
2010-04-23 20:36 467816 ----a-w- c:\program files\TOSHIBA\BulletinBoard\TosNcCore.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TWebCamera]
2010-05-01 23:55 2454840 ----a-w- c:\program files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2012-08-23 02:54 896400 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
R1 MpKsl8076564a;MpKsl8076564a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D4274758-1D93-4773-BEE4-C3C943302367}\MpKsl8076564a.sys [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-10-23 172192]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2014-01-22 88576]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 GamesAppIntegrationService;GamesAppIntegrationService;c:\program files\WildTangent Games\App\GamesAppIntegrationService.exe [2014-04-24 227904]
R3 GamesAppService;GamesAppService;c:\program files\WildTangent Games\App\GamesAppService.exe [2014-04-24 203344]
R3 GGSAFERDriver;GGSAFER Driver;c:\users\Chrome\Documents\Games\Garena Massenger\Room\safedrv.sys [x]
R3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys [2013-09-18 12088]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-03-06 108032]
R3 MT7118VU;MediaTek MT7118 WiMAX USB Card Driver for VISTA;c:\windows\system32\DRIVERS\mt7118vu.sys [2010-07-05 131072]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2014-03-11 104264]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2014-03-11 279776]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-10-08 190464]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2009-07-13 347136]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2014-01-22 184192]
R3 TMachInfo;TMachInfo;c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-02-06 111960]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys [2013-09-18 76600]
R3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys [2013-09-18 13112]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-07 1343400]
R3 XDva398;XDva398;c:\windows\system32\XDva398.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2014-02-10 691696]
S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys [2012-08-01 35560]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe [2010-01-28 185712]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-11 46448]
S2 OmniAddrService;Sogou OmniAddr Update Service;c:\program files\SogouInput\Components\AddressSearch\OmniAddr\OmniAddrService.exe [2014-03-28 155856]
S2 RzMaelstromVADStreamingService;Razer Surround Audio Service;c:\programdata\Razer\Synapse\Devices\Razer Surround\Driver\RzMaelstromVADStreamingService.exe [2013-09-18 3665408]
S2 TabletServicePen;TabletServicePen;c:\program files\Tablet\Pen\Pen_Tablet.exe [2010-10-21 4869488]
S2 TouchServicePen;Wacom Consumer Touch Service;c:\program files\Tablet\Pen\Pen_TouchService.exe [2010-10-21 416112]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-03-03 2320920]
S2 WTabletServicePro;Wacom Professional Service;c:\program files\Tablet\Wacom\WTabletServicePro.exe [2013-10-04 531224]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [2009-07-07 7680]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 132480]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2011-04-18 69232]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2009-06-23 24064]
S3 RZMAELSTROMVADService;Razer Surround Audio Enhancer Service;c:\windows\system32\drivers\RzMaelstromVAD.sys [2013-09-18 33016]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
Contents of the 'Scheduled Tasks' folder
.
2014-05-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4121174262-479391197-1674385959-1000Core.job
- c:\users\Amos\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-30 10:34]
.
2014-05-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4121174262-479391197-1674385959-1000UA.job
- c:\users\Amos\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-30 10:34]
.
2014-05-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4121174262-479391197-1674385959-1003Core.job
- c:\users\Chrome\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-13 09:26]
.
2014-05-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4121174262-479391197-1674385959-1003UA.job
- c:\users\Chrome\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-13 09:26]
.
.
------- Supplementary Scan -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyServer = http=137.135.119.129:8080
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Download all by FlashGet3 - c:\users\Chrome\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
IE: Download by FlashGet3 - c:\users\Chrome\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office15\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{A7A0C57F-18B6-4D9F-A071-EE1AF5A0D885}: NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{D5B412E6-71BE-4C71-B166-AB6E5A870A17}: NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF}: NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF}\45D40275966496: NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF}\C6169663237383830457E6966696: NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF}\D416368696E656: NameServer = 208.67.222.222,208.67.220.220
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-AdobeCS5ServiceManager - c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
MSConfigStartUp-Akamai NetSession Interface - c:\users\Chrome\AppData\Local\Akamai\netsession_win.exe
MSConfigStartUp-BitTorrent - c:\users\Chrome\AppData\Roaming\BitTorrent\BitTorrent.exe
MSConfigStartUp-FlashGet 3 - c:\program files\FlashGet Network\FlashGet 3\Flashget3.exe
MSConfigStartUp-GarenaMessenger - c:\program files\Garena Plus\GarenaMessenger.exe
MSConfigStartUp-GarenaPlus - c:\users\Chrome\Documents\Games\Garena Massenger\GarenaMessenger.exe
MSConfigStartUp-mobilegeni daemon - c:\program files\Mobogenie\DaemonProcess.exe
MSConfigStartUp-P1 4G - c:\program files\P1\P1 4G\P1 4G.exe
MSConfigStartUp-Pando Media Booster - c:\program files\Pando Networks\Media Booster\PMB.exe
MSConfigStartUp-SwitchBoard - c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
AddRemove-RC?? - c:\program files\RC??\uninst.exe
AddRemove-RealPlayer 15.0 - c:\program files\real\realplayer\Update\r1puninst.exe
AddRemove-HetaOni English - c:\users\Chrome\Documents\Games\Ao Oni\aooni_en\Uninstal.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-4121174262-479391197-1674385959-1003\Software\SecuROM\License information*]
"datasecu "=hex:fb,92,68,58,f3,78,f9,a9,d5,de,6d,98,1d,32,46,87,7a,5c,f2,97,94,
2d,c1,3a,ad,31,d5,e4,6b,a6,f9,df,09,fa,3d,34,8f,eb,a5,39,1b,de,df,56,e4,f9,\
"rkeysecu "=hex:8a,80,10,b7,ac,3e,a7,c5,4c,41,35,92,c0,94,6e,93
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\progra~1\SOGOUI~1\SogouExe\SogouExe.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\windows\system32\taskhost.exe
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\program files\Tablet\Pen\Pen_TouchUser.exe
c:\progra~1\SOGOUI~1\710~1.16~\SGTool.exe
c:\program files\Tablet\Wacom\Wacom_TabletUser.exe
c:\program files\Tablet\Wacom\WacomHost.exe
c:\windows\system32\TODDSrv.exe
c:\program files\Tablet\Pen\Pen_TabletUser.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\System32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\program files\Tablet\Wacom\Wacom_Tablet.exe
c:\program files\Tablet\Wacom\Wacom_TouchUser.exe
c:\program files\Microsoft Office\Office15\MsoSync.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
c:\program files\TOSHIBA\ConfigFree\CFSwMgr.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Completion time: 2014-05-22 16:12:34 - machine was rebooted
ComboFix-quarantined-files.txt 2014-05-22 08:12
ComboFix2.txt 2011-10-08 07:50
.
Pre-Run: 306,334,203,904 bytes free
Post-Run: 306,669,953,024 bytes free
.
- - End Of File - - DFC2027FECF2C060C125E30734C532A9
5B5E648D12FCADC244C1EC30318E1EB9

 

AdwCleaner

# AdwCleaner v3.210 - Report created 23/05/2014 at 23:22:50
# Updated 19/05/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (32 bits)
# Username : Chrome - AMOS-PC
# Running from : C:\Users\Chrome\Downloads\adwcleaner_3.210.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\Program Files\Mobogenie
Folder Deleted : C:\Program Files\SimilarSites
Folder Deleted : C:\Users\Chrome\AppData\Local\Mobogenie
Folder Deleted : C:\Users\Chrome\AppData\Local\Oxy
Folder Deleted : C:\Users\Chrome\AppData\Roaming\Oxy
Folder Deleted : C:\Users\wangzhisong\AppData\Local\Mobogenie
File Deleted : C:\Users\Chrome\daemonprocess.txt
File Deleted : C:\Users\Chrome\AppData\Roaming\LiveSupport.exe_log.txt
File Deleted : C:\Users\Chrome\AppData\Roaming\regsvr32.exe_log.txt

***** [ Shortcuts ] *****

Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\???????\?????.lnk

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\oxy.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_windows-movie-maker_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_windows-movie-maker_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6DDA37BA-0553-499A-AE0D-BEBA67204548}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2974C985-8151-4DE5-B23C-B875F0A8522F}
Key Deleted : HKCU\Software\Escolade
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\Software\dt soft\daemon tools toolbar
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Google Chrome v

[ File : C:\Users\Amos\AppData\Local\Google\Chrome\User Data\Default\preferences ]


[ File : C:\Users\Chrome\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://en.softonic.com/s/{searchTerms}

*************************

AdwCleaner[R0].txt - [2632 octets] - [23/05/2014 23:18:47]
AdwCleaner[S0].txt - [2500 octets] - [23/05/2014 23:22:50]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2560 octets] ##########

 

Junk Remover Tool

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x86
Ran by Chrome on Fri 23/05/2014 at 23:42:36.75
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Chrome\AppData\Roaming\getrighttogo "
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{0D1DAAFB-5710-4C57-854A-C34A8A2E251D}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{12714F0C-F1D3-48C2-89FE-087DADCCB01A}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{17C6E0D1-3677-4813-8F4D-F3F231A0F53A}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{1E08A96A-497B-4D6E-98D6-B96178C92FE8}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{235F627D-2477-4B1D-8DE3-6C9D229FECBC}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{2947685E-6648-4F54-955B-32B379184F82}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{2F11DF85-1072-4818-A7B7-943316296811}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{329F774E-AC7C-471B-A89F-13A36A4E1957}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{39B1442F-AA47-46FF-A831-95393E2EBD2E}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{4156D940-10C2-42AE-BD2B-DBA6EBA18C7C}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{58A74BC7-5913-401E-9544-8CD377616FC4}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{5E48E30F-6DCA-4A28-8A4D-735CDF3A825A}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{5E99D0B5-FFE2-441D-A029-41C0E48F6368}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{62E8F213-B255-4461-A5D7-1C788F1D8892}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{6776B9B6-C3EC-43BB-BA54-334047FA1B11}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{717230D3-0C23-4D43-8E9C-2276B094FAB7}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{7E9B0108-FACD-48A3-8693-0DB7364FE6CD}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{842B6F34-DCDF-478D-85AB-3D348AD31C8D}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{9D81342A-32F9-4F66-AED2-05F5DDCE21EF}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{9E16D724-5684-44E6-BA09-C6BAB511E1DA}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{AF237AB8-2E65-445A-8765-EF688585CB32}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{C0887F20-758D-446A-A16B-0D5FAE865632}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{C452AA78-9275-4296-ABF7-D0A4635D449C}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{C82C1653-E3FB-43FC-8C23-81E8092CB34B}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{C96EA532-44B9-44FC-989D-4B48B97E3BC4}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{CF17F486-E61D-46F1-B623-BF3FDADACD0D}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{D4571A00-912D-4DB1-95D5-7AC88EC58CD9}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{D5E86948-0598-4892-9B09-63C6CCBB55EC}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{DE68BCE4-A147-49C2-8D2A-31C019E4E6CC}
Successfully deleted: [Empty Folder] C:\Users\Chrome\appdata\local\{E57664F6-ED10-4D4F-BDCF-44181EA3AE43}



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 23/05/2014 at 23:45:52.50
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

OTL logfile created on: 5/24/2014 12:10:48 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Chrome\Downloads
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17041)
Locale: 00000409 | Country: Malaysia | Language: ENM | Date Format: d/M/yyyy

1.87 Gb Total Physical Memory | 0.47 Gb Available Physical Memory | 25.20% Memory free
11.63 Gb Paging File | 10.12 Gb Available in Paging File | 87.05% Paging File free
Paging file location(s): c:\pagefile.sys 10000 12000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 454.55 Gb Total Space | 294.79 Gb Free Space | 64.85% Space Free | Partition Type: NTFS

Computer Name: AMOS-PC | User Name: Chrome | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/05/23 23:18:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Chrome\Downloads\OTL.exe
PRC - [2014/03/28 12:35:48 | 000,155,856 | ---- | M] (Sogou.com Inc) -- C:\Program Files\SogouInput\Components\AddressSearch\OmniAddr\OmniAddrService.exe
PRC - [2014/03/11 10:13:24 | 000,022,216 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2014/03/11 10:13:14 | 000,951,576 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2014/01/04 12:03:49 | 000,372,856 | ---- | M] (Sogou.com Inc.) -- C:\Program Files\SogouInput\Components\SGImeGuard\1.0.0.20\SGImeGuard.exe
PRC - [2013/10/04 08:00:20 | 004,159,256 | ---- | M] (Wacom Technology, Corp.) -- C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
PRC - [2013/10/04 08:00:20 | 001,618,712 | ---- | M] (Wacom Technology, Corp.) -- C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
PRC - [2013/10/04 08:00:20 | 000,531,224 | ---- | M] (Wacom Technology, Corp.) -- C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
PRC - [2013/10/04 08:00:19 | 008,004,376 | ---- | M] (Wacom Technology, Corp.) -- C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
PRC - [2013/09/18 09:47:32 | 003,665,408 | ---- | M] (A-Volute) -- C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzMaelstromVADStreamingService.exe
PRC - [2013/08/02 08:52:57 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2012/11/23 10:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2012/10/09 07:15:51 | 000,039,808 | ---- | M] (Wacom Technology) -- C:\Program Files\Tablet\Wacom\WacomHost.exe
PRC - [2012/06/06 21:19:29 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2011/02/25 13:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/10/21 09:38:32 | 004,869,488 | ---- | M] (Wacom Technology, Corp.) -- C:\Program Files\Tablet\Pen\Pen_Tablet.exe
PRC - [2010/10/21 09:38:32 | 002,953,584 | ---- | M] (Wacom Technology, Corp.) -- C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
PRC - [2010/10/21 09:38:32 | 001,153,392 | ---- | M] (Wacom Technology, Corp.) -- C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
PRC - [2010/10/21 09:38:32 | 000,416,112 | ---- | M] (Wacom Technology, Corp.) -- C:\Program Files\Tablet\Pen\Pen_TouchService.exe
PRC - [2010/10/21 05:40:16 | 000,128,416 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe
PRC - [2010/09/29 03:28:30 | 000,468,392 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
PRC - [2010/03/04 05:42:02 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010/03/04 05:41:58 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010/02/06 08:41:00 | 000,111,960 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
PRC - [2010/02/06 08:40:44 | 001,021,272 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
PRC - [2010/01/29 07:44:24 | 000,185,712 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe
PRC - [2009/07/14 09:14:26 | 006,376,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mspaint.exe
PRC - [2009/03/11 09:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
PRC - [2009/02/11 00:01:49 | 000,116,104 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe


========== Modules (No Company Name) ==========

MOD - [2014/05/08 07:29:33 | 000,390,472 | ---- | M] () -- C:\Users\Chrome\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppgooglenaclpluginchrome.dll
MOD - [2014/05/08 07:29:31 | 004,081,480 | ---- | M] () -- C:\Users\Chrome\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll
MOD - [2014/05/08 07:29:27 | 000,674,632 | ---- | M] () -- C:\Users\Chrome\AppData\Local\Google\Chrome\Application\34.0.1847.137\libglesv2.dll
MOD - [2014/05/08 07:29:27 | 000,093,000 | ---- | M] () -- C:\Users\Chrome\AppData\Local\Google\Chrome\Application\34.0.1847.137\libegl.dll
MOD - [2014/05/08 07:29:26 | 001,647,432 | ---- | M] () -- C:\Users\Chrome\AppData\Local\Google\Chrome\Application\34.0.1847.137\ffmpegsumo.dll
MOD - [2014/05/08 07:29:24 | 000,065,352 | ---- | M] () -- C:\Users\Chrome\AppData\Local\Google\Chrome\Application\34.0.1847.137\chrome_elf.dll
MOD - [2014/04/08 14:18:08 | 008,889,512 | ---- | M] () -- C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
MOD - [2013/10/04 08:00:21 | 000,963,864 | ---- | M] () -- C:\Program Files\Tablet\Wacom\libxml2.dll
MOD - [2011/08/14 12:27:53 | 001,460,840 | -HS- | M] () -- \\?\C:\ProgramData\Microsoft\Windows\DRM\Cache\Indiv_SID_S-1-5-21-4121174262-479391197-1674385959-1003\Indiv01.key
MOD - [2010/10/21 09:38:34 | 000,962,416 | ---- | M] () -- C:\Program Files\Tablet\Pen\libxml2.dll
MOD - [2010/02/06 08:40:28 | 000,079,192 | ---- | M] () -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll


========== Services (SafeList) ==========

SRV - [2014/04/25 05:04:16 | 000,227,904 | ---- | M] (WildTangent) [On_Demand | Stopped] -- C:\Program Files\WildTangent Games\App\GamesAppIntegrationService.exe -- (GamesAppIntegrationService)
SRV - [2014/04/25 05:00:06 | 000,203,344 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2014/03/28 12:35:48 | 000,155,856 | ---- | M] (Sogou.com Inc) [Auto | Running] -- C:\Program Files\SogouInput\Components\AddressSearch\OmniAddr\OmniAddrService.exe -- (OmniAddrService)
SRV - [2014/03/11 10:13:24 | 000,279,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2014/03/11 10:13:24 | 000,022,216 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2014/03/06 15:38:10 | 000,108,032 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\windows\System32\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV - [2013/10/23 08:15:08 | 000,172,192 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/10/04 08:00:20 | 000,531,224 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Program Files\Tablet\Wacom\WTabletServicePro.exe -- (WTabletServicePro)
SRV - [2013/09/18 09:47:32 | 003,665,408 | ---- | M] (A-Volute) [Auto | Running] -- C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzMaelstromVADStreamingService.exe -- (RzMaelstromVADStreamingService)
SRV - [2013/05/27 12:57:27 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2011/08/07 22:58:48 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010/11/20 20:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/11/20 20:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010/11/20 20:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2010/10/21 09:38:32 | 004,869,488 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Program Files\Tablet\Pen\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2010/10/21 09:38:32 | 000,416,112 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Program Files\Tablet\Pen\Pen_TouchService.exe -- (TouchServicePen)
SRV - [2010/10/21 05:40:16 | 000,128,416 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv)
SRV - [2010/09/29 03:28:30 | 000,468,392 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV - [2010/03/04 05:42:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010/03/04 05:41:58 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010/02/06 08:41:00 | 000,111,960 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV - [2010/01/29 07:44:24 | 000,185,712 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe -- (cfWiMAXService)
SRV - [2009/10/07 00:21:50 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2009/07/14 09:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/03/11 09:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)
SRV - [2009/02/11 00:01:49 | 000,116,104 | ---- | M] () [Auto | Running] -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\windows\system32\XDva398.sys -- (XDva398)
DRV - File not found [Kernel | System | Stopped] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D4274758-1D93-4773-BEE4-C3C943302367}\MpKsl8076564a.sys -- (MpKsl8076564a)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Chrome\Documents\Games\Garena Massenger\Room\safedrv.sys -- (GGSAFERDriver)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbnet.sys -- (ewusbnet)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\windows\system32\drivers\EagleXNt.sys -- (EagleXNt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Chrome\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (azaaicnm)
DRV - [2014/03/11 09:52:30 | 000,104,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2014/02/10 14:10:29 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2014/01/22 08:52:12 | 000,184,192 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm)
DRV - [2014/01/22 08:52:12 | 000,088,576 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus)
DRV - [2013/09/19 06:12:12 | 000,076,600 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wachidrouter.sys -- (WacHidRouter)
DRV - [2013/09/19 06:12:12 | 000,013,112 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wacomrouterfilter.sys -- (wacomrouterfilter)
DRV - [2013/09/19 06:12:12 | 000,012,088 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hidkmdf.sys -- (hidkmdf)
DRV - [2013/09/18 09:47:32 | 000,033,016 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RzMaelstromVAD.sys -- (RZMAELSTROMVADService)
DRV - [2012/12/30 04:59:38 | 000,024,184 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\Windows\System32\speedfan.sys -- (speedfan)
DRV - [2012/08/02 02:13:42 | 000,035,560 | ---- | M] (AnchorFree Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\hssdrv6.sys -- (HssDRV6)
DRV - [2012/08/02 02:13:40 | 000,033,512 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2011/04/19 02:50:40 | 000,069,232 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C)
DRV - [2010/11/20 20:30:18 | 000,296,064 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcvmm.sys -- (vpcvmm)
DRV - [2010/11/20 20:30:18 | 000,172,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpchbus.sys -- (vpcbus)
DRV - [2010/11/20 18:50:40 | 000,078,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpcusb.sys -- (vpcusb)
DRV - [2010/11/20 18:50:38 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV - [2010/11/20 18:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 17:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/10/09 02:49:06 | 000,190,464 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2010/10/05 13:26:02 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV - [2010/10/05 13:26:00 | 000,014,120 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
DRV - [2010/10/01 09:20:50 | 002,033,152 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2010/08/17 02:12:50 | 000,525,440 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2010/07/05 10:39:02 | 000,131,072 | ---- | M] (MediaTek Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mt7118vu.sys -- (MT7118VU)
DRV - [2010/02/27 07:31:22 | 000,132,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Impcd.sys -- (Impcd)
DRV - [2009/09/18 03:54:14 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (HECI)
DRV - [2009/07/31 08:45:56 | 000,022,912 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV - [2009/07/15 06:28:42 | 000,023,512 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TVALZ_O.SYS -- (TVALZ)
DRV - [2009/07/14 07:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009/07/14 06:02:53 | 000,347,136 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8187B.sys -- (RTL8187B)
DRV - [2009/07/08 00:53:06 | 000,007,680 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FwLnk.sys -- (FwLnk)
DRV - [2009/06/23 08:04:58 | 000,024,064 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PGEffect.sys -- (PGEffect)
DRV - [1996/04/04 03:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\giveio.sys -- (giveio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{F4ED0519-C584-4DDA-BE93-FA0B93D040F6}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHPDF&pc=MATP&src=IE-SearchBox


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-MY
IE - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B5 01 C5 48 81 22 CF 01 [binary data]
IE - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR
IE - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\..\SearchScopes\{109BF7AB-5A3E-4771-A730-B0307C796CCA}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searcerms}&src=IE-SearchBox&FORM=IE11SR
IE - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\..\SearchScopes\{F4ED0519-C584-4DDA-BE93-FA0B93D040F6}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHPDF&pc=MATP&src=IE-SearchBox
IE - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=137.135.119.129:8080


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.1.0.3: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Chrome\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Chrome\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\wacom.com/WacomTabletPlugin: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/06 21:19:44 | 000,000,000 | ---D | M]

[2012/04/22 14:54:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/03/23 15:48:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2013/11/15 03:30:36 | 000,034,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\npMeetingJoinPluginOC.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{googlemniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{googleageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.google.com.my/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Chrome\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Chrome\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Chrome\AppData\Local\Google\Chrome\Application\34.0.1847.137\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java(TM) Platform SE 6 U32 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.320.5 (Enabled) = C:\windows\system32\npdeployJava1.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: RealNetworks(tm) RealPlayer Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: Wacom Dynamic Link Library (Enabled) = C:\Program Files\TabletPlugins\npwacom.dll
CHR - plugin: Windows Live™ Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Chrome\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Windows Activation Technologies (Enabled) = C:\windows\system32\Wat\npWatWeb.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: Ultimate YouTube Downloader = C:\Users\Chrome\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfkpkealncpcbfklpgnggcgjjdkbljop\1.0.3.3_0\
CHR - Extension: YouTube = C:\Users\Chrome\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Users\Chrome\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: AdBlock = C:\Users\Chrome\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.34_0\
CHR - Extension: https://meb2098.1bestarinet.net/app/os = C:\Users\Chrome\AppData\Local\Google\Chrome\User Data\Default\Extensions\injjbodhikkdfgkbhcffmhnfnomjcani\2012.10.31.22115_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Chrome\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: ClipConverter = C:\Users\Chrome\AppData\Local\Google\Chrome\User Data\Default\Extensions\njjjgjlocdhecpgdcfjblcnfebfnmhpp\1.3.1_0\
CHR - Extension: Google Wallet = C:\Users\Chrome\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
CHR - Extension: Gmail = C:\Users\Chrome\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
CHR - Extension: ThemeBeta.com = C:\Users\Chrome\AppData\Local\Google\Chrome\User Data\Default\Extensions\ppopcdmgobcmfpcejfilggjcfgcjphgf\1_0\

O1 HOSTS File: ([2014/05/22 16:07:09 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (搜狗输入法地址栏搜索) - {0C3ED74B-8703-4003-A1F4-2B2A0C450DD2} - C:\Program Files\SogouInput\Components\AddressSearch\OmniAddr\OmniAddr.dll (Sogou.com Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
O2 - BHO: (no name) - {889D2FEB-5411-4565-8998-1DD2C5261283} - No CLSID value found.
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (QUICKfind BHO Object) - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Program Files\IDM\QUICKfind\PlugIns\IEHelp.dll (IDM)
O2 - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKU\S-1-5-21-4121174262-479391197-1674385959-1003..\Run: [ImeGuardCom] C:\Program Files\SogouInput\Components\SGImeGuard\1.0.0.20\SGImeGuard.exe (Sogou.com Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\S-1-5-21-4121174262-479391197-1674385959-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Download all by FlashGet3 - C:\Users\Chrome\AppData\Roaming\FlashGetBHO\GetAllUrl.htm ()
O8 - Extra context menu item: Download by FlashGet3 - C:\Users\Chrome\AppData\Roaming\FlashGetBHO\GetUrl.htm ()
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office15\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1CFCB6E2-8F54-4F7D-896C-B269912F2F12}: DhcpNameServer = 122.255.99.228 122.255.99.236
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A7A0C57F-18B6-4D9F-A071-EE1AF5A0D885}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A7A0C57F-18B6-4D9F-A071-EE1AF5A0D885}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D5B412E6-71BE-4C71-B166-AB6E5A870A17}: DhcpNameServer = 122.255.99.228 122.255.99.236
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D5B412E6-71BE-4C71-B166-AB6E5A870A17}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC1D8900-BE26-4970-A7A3-3296C1FE8FDF}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/11 05:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2014/05/23 23:41:54 | 000,000,000 | ---D | C] -- C:\windows\ERUNT
[2014/05/23 23:19:19 | 000,536,576 | ---- | C] (SQLite Development Team) -- C:\windows\System32\sqlite3.dll
[2014/05/23 23:18:42 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014/05/22 16:07:19 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2014/05/22 16:00:12 | 000,000,000 | ---D | C] -- C:\windows\temp
[2014/05/22 15:45:15 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
[2014/05/22 15:45:15 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
[2014/05/22 15:45:15 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
[2014/05/22 15:45:02 | 000,000,000 | ---D | C] -- C:\Qoobox
[2014/05/22 15:11:08 | 001,940,216 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\Chrome\Desktop\rkill.exe
[2014/05/22 15:10:02 | 005,200,426 | R--- | C] (Swearware) -- C:\Users\Chrome\Desktop\ComboFix.exe
[2014/05/21 15:32:25 | 000,000,000 | ---D | C] -- C:\Users\Chrome\AppData\Local\VirtualStore
[2014/05/20 16:24:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2014/05/20 16:19:55 | 000,000,000 | ---D | C] -- C:\Users\Chrome\Desktop\mbar
[2014/05/20 15:56:22 | 000,000,000 | ---D | C] -- C:\Users\Chrome\Desktop\RK_Quarantine
[2014/05/18 22:10:23 | 000,107,224 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\MBAMSwissArmy.sys
[2014/05/18 22:10:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
[2014/05/18 22:10:13 | 000,075,480 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamchameleon.sys
[2014/05/18 22:10:13 | 000,051,416 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mwac.sys
[2014/05/18 22:10:13 | 000,023,256 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2014/05/18 22:10:13 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes Anti-Malware
[2014/05/17 19:56:28 | 000,000,000 | ---D | C] -- C:\ProgramData\BlueStacks
[2014/05/17 19:54:26 | 000,000,000 | ---D | C] -- C:\Program Files\WildTangent Games
[2014/05/16 19:03:55 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2014/05/07 15:47:24 | 000,000,000 | --SD | C] -- C:\windows\System32\CompatTel
[2014/04/28 14:14:35 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache
[10 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014/05/23 23:57:42 | 000,000,912 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-4121174262-479391197-1674385959-1003UA.job
[2014/05/23 23:45:38 | 000,019,248 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014/05/23 23:45:38 | 000,019,248 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014/05/23 23:35:19 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2014/05/23 23:34:47 | 1501,974,528 | -HS- | M] () -- C:\hiberfil.sys
[2014/05/22 20:31:00 | 000,000,904 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-4121174262-479391197-1674385959-1000UA.job
[2014/05/22 16:07:09 | 000,000,027 | ---- | M] () -- C:\windows\System32\drivers\etc\hosts
[2014/05/22 15:11:30 | 001,940,216 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\Chrome\Desktop\rkill.exe
[2014/05/22 15:11:00 | 005,200,426 | R--- | M] (Swearware) -- C:\Users\Chrome\Desktop\ComboFix.exe
[2014/05/21 16:49:20 | 000,007,597 | ---- | M] () -- C:\Users\Chrome\AppData\Local\Resmon.ResmonCfg
[2014/05/21 15:42:39 | 000,107,224 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\MBAMSwissArmy.sys
[2014/05/21 15:40:19 | 000,075,480 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamchameleon.sys
[2014/05/19 15:46:14 | 366,112,626 | ---- | M] () -- C:\windows\MEMORY.DMP
[2014/05/18 22:10:16 | 000,001,026 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014/05/18 18:00:06 | 000,715,102 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2014/05/18 18:00:06 | 000,142,110 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2014/05/17 20:46:49 | 002,453,245 | ---- | M] () -- C:\Users\Chrome\Documents\Mercedes.png
[2014/05/17 19:31:00 | 000,000,852 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-4121174262-479391197-1674385959-1000Core.job
[2014/05/17 18:38:18 | 002,081,054 | ---- | M] () -- C:\Users\Chrome\Documents\students-manual.pdf
[2014/05/16 19:04:24 | 000,001,945 | ---- | M] () -- C:\windows\epplauncher.mif
[2014/05/16 13:57:00 | 000,000,860 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-4121174262-479391197-1674385959-1003Core.job
[2014/05/15 16:48:11 | 000,002,376 | ---- | M] () -- C:\Users\Chrome\Desktop\Google Chrome.lnk
[2014/05/11 01:15:26 | 000,368,968 | ---- | M] () -- C:\Users\Chrome\Documents\11 anjakan pelan pembangunan pendidikan.png
[2014/05/07 22:22:18 | 000,069,139 | ---- | M] () -- C:\Users\Chrome\Documents\download.png
[2014/05/07 21:21:43 | 002,350,550 | ---- | M] () -- C:\Users\Chrome\Documents\A level physics notes.pdf
[2014/05/07 20:33:53 | 003,832,448 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2014/05/04 19:43:28 | 000,011,776 | ---- | M] () -- C:\Users\Chrome\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2014/05/03 21:08:19 | 002,157,303 | ---- | M] () -- C:\Users\Chrome\Documents\39556121.jpg
[2014/05/03 21:03:26 | 000,828,120 | ---- | M] () -- C:\Users\Chrome\Documents\43264739.png
[2014/05/03 21:02:57 | 000,433,223 | ---- | M] () -- C:\Users\Chrome\Documents\43275747_p0.png
[2014/05/03 20:54:09 | 000,576,367 | ---- | M] () -- C:\Users\Chrome\Documents\38090394.jpg
[2014/05/02 17:14:07 | 001,323,008 | ---- | M] () -- C:\Users\Chrome\Documents\pure-notebook-vector-illustration-13029129$$01CF65E6DF2F9FBB.sai
[2014/05/02 16:04:55 | 000,099,094 | ---- | M] () -- C:\Users\Chrome\Documents\pure-notebook-vector-illustration-13029129.jpg
[2014/04/24 20:22:41 | 000,138,816 | ---- | M] () -- C:\Users\Chrome\Documents\FORM 6 (haiz).pdf
[10 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014/05/22 15:45:15 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe
[2014/05/22 15:45:15 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe
[2014/05/22 15:45:15 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2014/05/22 15:45:15 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2014/05/22 15:45:15 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2014/05/19 15:46:14 | 366,112,626 | ---- | C] () -- C:\windows\MEMORY.DMP
[2014/05/18 22:10:16 | 000,001,026 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014/05/17 20:46:47 | 002,453,245 | ---- | C] () -- C:\Users\Chrome\Documents\Mercedes.png
[2014/05/17 18:38:14 | 002,081,054 | ---- | C] () -- C:\Users\Chrome\Documents\students-manual.pdf
[2014/05/16 19:04:24 | 000,001,945 | ---- | C] () -- C:\windows\epplauncher.mif
[2014/05/16 19:04:11 | 000,002,083 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2014/05/11 01:15:21 | 000,368,968 | ---- | C] () -- C:\Users\Chrome\Documents\11 anjakan pelan pembangunan pendidikan.png
[2014/05/07 22:22:20 | 000,069,139 | ---- | C] () -- C:\Users\Chrome\Documents\download.png
[2014/05/07 21:21:30 | 002,350,550 | ---- | C] () -- C:\Users\Chrome\Documents\A level physics notes.pdf
[2014/05/03 21:08:17 | 002,157,303 | ---- | C] () -- C:\Users\Chrome\Documents\39556121.jpg
[2014/05/03 21:03:26 | 000,828,120 | ---- | C] () -- C:\Users\Chrome\Documents\43264739.png
[2014/05/03 21:02:56 | 000,433,223 | ---- | C] () -- C:\Users\Chrome\Documents\43275747_p0.png
[2014/05/03 20:54:07 | 000,576,367 | ---- | C] () -- C:\Users\Chrome\Documents\38090394.jpg
[2014/05/02 17:14:07 | 001,323,008 | ---- | C] () -- C:\Users\Chrome\Documents\pure-notebook-vector-illustration-13029129$$01CF65E6DF2F9FBB.sai
[2014/05/02 16:04:51 | 000,099,094 | ---- | C] () -- C:\Users\Chrome\Documents\pure-notebook-vector-illustration-13029129.jpg
[2014/04/24 20:22:34 | 000,138,816 | ---- | C] () -- C:\Users\Chrome\Documents\FORM 6 (haiz).pdf
[2014/02/10 15:22:37 | 000,050,732 | ---- | C] () -- C:\windows\DIIUnin.dat
[2013/10/16 15:28:05 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2013/06/28 15:12:04 | 000,000,175 | ---- | C] () -- C:\windows\System32\drivers\aswVmm.sys.sum
[2013/06/28 15:12:04 | 000,000,175 | ---- | C] () -- C:\windows\System32\drivers\aswSP.sys.sum
[2013/06/28 15:12:04 | 000,000,175 | ---- | C] () -- C:\windows\System32\drivers\aswSnx.sys.sum
[2013/05/10 15:32:06 | 000,013,624 | ---- | C] () -- C:\windows\System32\WacDriverDLCoinst.dll
[2013/02/09 15:12:33 | 000,778,752 | ---- | C] () -- C:\windows\System32\RGSS102E.dll
[2013/02/09 15:12:32 | 000,781,312 | ---- | C] () -- C:\windows\System32\RGSS102J.dll
[2013/02/09 15:12:32 | 000,685,056 | ---- | C] () -- C:\windows\System32\RGSS103J.dll
[2013/02/09 15:12:31 | 000,771,584 | ---- | C] () -- C:\windows\System32\RGSS100J.dll
[2012/12/22 15:00:52 | 000,000,081 | ---- | C] () -- C:\windows\System32\procexpdl.ini
[2012/12/22 15:00:39 | 000,003,072 | ---- | C] () -- C:\windows\setwintitle.exe
[2012/11/30 20:34:44 | 000,000,132 | ---- | C] () -- C:\Users\Chrome\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012/03/27 17:37:56 | 000,011,776 | ---- | C] () -- C:\Users\Chrome\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/24 23:05:26 | 000,045,270 | ---- | C] () -- C:\Users\Chrome\AppData\Roaming\room_v3.dat
[2011/10/08 18:10:02 | 000,007,597 | ---- | C] () -- C:\Users\Chrome\AppData\Local\Resmon.ResmonCfg

========== ZeroAccess Check ==========

[2009/07/14 12:42:31 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
" " = %SystemRoot%\system32\shell32.dll -- [2014/03/25 10:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
" " = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 20:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
" " = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 09:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2011/08/01 13:59:51 | 000,000,000 | ---D | M] -- C:\Users\Amos\AppData\Roaming\Auslogics
[2012/08/24 13:10:52 | 000,000,000 | ---D | M] -- C:\Users\Amos\AppData\Roaming\BITS
[2014/02/26 14:36:51 | 000,000,000 | ---D | M] -- C:\Users\Amos\AppData\Roaming\BitTorrent
[2014/03/15 19:54:36 | 000,000,000 | ---D | M] -- C:\Users\Amos\AppData\Roaming\Canon
[2012/04/29 20:34:04 | 000,000,000 | ---D | M] -- C:\Users\Amos\AppData\Roaming\ESET
[2011/12/01 14:04:04 | 000,000,000 | ---D | M] -- C:\Users\Amos\AppData\Roaming\FlashGet
[2014/02/11 18:52:58 | 000,000,000 | ---D | M] -- C:\Users\Amos\AppData\Roaming\RCTW
[2011/08/01 14:09:46 | 000,000,000 | ---D | M] -- C:\Users\Amos\AppData\Roaming\SoftGrid Client
[2011/07/30 20:33:31 | 000,000,000 | ---D | M] -- C:\Users\Amos\AppData\Roaming\SYSTEMAX Software Development
[2011/07/30 18:24:01 | 000,000,000 | ---D | M] -- C:\Users\Amos\AppData\Roaming\Toshiba
[2011/07/30 18:18:47 | 000,000,000 | ---D | M] -- C:\Users\Amos\AppData\Roaming\TP
[2014/04/29 13:40:11 | 000,000,000 | ---D | M] -- C:\Users\Amos\AppData\Roaming\uTorrent
[2014/05/17 19:56:10 | 000,000,000 | ---D | M] -- C:\Users\Amos\AppData\Roaming\WildTangent
[2012/09/15 19:00:59 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\Artisteer
[2012/12/08 22:28:39 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\Audacity
[2011/08/24 17:35:17 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\Auslogics
[2012/07/14 00:05:32 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\BITS
[2014/02/28 22:31:41 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\BitTorrent
[2013/10/15 09:26:54 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\Canon
[2014/02/28 10:53:18 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\CELSYS
[2014/02/28 10:47:18 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\CELSYS_EN
[2011/11/21 11:52:02 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2014/02/10 14:19:59 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\DAEMON Tools Lite
[2012/04/23 16:15:43 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\ESET
[2011/11/30 12:22:18 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\FlashGet
[2011/11/30 12:22:11 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\FlashGetBHO
[2013/02/17 14:29:56 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\GarenaPlus
[2011/11/04 17:54:51 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\oald8
[2012/03/23 15:50:13 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\OpenOffice.org
[2011/10/09 13:32:41 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\QuickScan
[2014/02/10 20:23:18 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\rcru
[2014/02/10 21:07:16 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\RCTW
[2013/02/16 13:51:39 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\SEGA
[2013/03/08 17:42:39 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\SogouInput
[2014/03/06 19:48:03 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\SogouMobileTool
[2011/08/07 11:46:47 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\SYSTEMAX Software Development
[2012/01/21 23:52:16 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\Toshiba
[2012/11/08 20:33:42 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\TuneUp Software
[2014/04/18 17:10:32 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\uTorrent
[2011/08/10 18:55:36 | 000,000,000 | ---D | M] -- C:\Users\Chrome\AppData\Roaming\WildTangent
[2012/11/09 15:16:39 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software
[2012/11/09 15:16:39 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2014/05/04 12:42:23 | 000,021,100 | ---- | M] ()(C:\Users\Chrome\Documents\???????????.docx) -- C:\Users\Chrome\Documents\奥巴马写给女儿的公开信.docx
[2014/05/04 12:36:36 | 000,022,868 | ---- | M] ()(C:\Users\Chrome\Documents\???????????.docx) -- C:\Users\Chrome\Documents\怎样作一个不讨人厌的人.docx
[2014/05/04 12:36:34 | 000,022,868 | ---- | C] ()(C:\Users\Chrome\Documents\???????????.docx) -- C:\Users\Chrome\Documents\怎样作一个不讨人厌的人.docx
[2014/05/03 20:27:13 | 000,021,100 | ---- | C] ()(C:\Users\Chrome\Documents\???????????.docx) -- C:\Users\Chrome\Documents\奥巴马写给女儿的公开信.docx
[2014/02/22 21:06:22 | 000,000,286 | ---- | M] ()(C:\Users\Chrome\Documents\DOTA??.txt) -- C:\Users\Chrome\Documents\DOTA泪影.txt
[2014/02/16 02:46:18 | 000,000,286 | ---- | C] ()(C:\Users\Chrome\Documents\DOTA??.txt) -- C:\Users\Chrome\Documents\DOTA泪影.txt
[2014/02/10 21:26:39 | 000,000,000 | ---D | M](C:\Program Files\RC??) -- C:\Program Files\RC語音
[2014/02/10 21:26:39 | 000,000,000 | ---D | M](C:\Program Files\RC??) -- C:\Program Files\RC語音
[2014/01/08 00:53:36 | 000,000,226 | ---- | M] ()(C:\Users\Chrome\Documents\??????.txt) -- C:\Users\Chrome\Documents\千言万语恶搞.txt
[2012/12/05 18:16:58 | 000,000,226 | ---- | C] ()(C:\Users\Chrome\Documents\??????.txt) -- C:\Users\Chrome\Documents\千言万语恶搞.txt
[2012/12/04 22:09:13 | 000,000,274 | ---- | M] ()(C:\Users\Chrome\Documents\????.txt) -- C:\Users\Chrome\Documents\舞伴泪影.txt
[2012/12/04 22:09:13 | 000,000,274 | ---- | C] ()(C:\Users\Chrome\Documents\????.txt) -- C:\Users\Chrome\Documents\舞伴泪影.txt
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\???????) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\搜狗拼音输入法
(C:\Program Files\RC??) -- C:\Program Files\RC語音

========== Alternate Data Streams ==========

@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:07BF512B

< End of report >

 

OTL Extras logfile created on: 5/23/2014 11:54:36 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Chrome\Downloads
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17041)
Locale: 00000409 | Country: Malaysia | Language: ENM | Date Format: d/M/yyyy

1.87 Gb Total Physical Memory | 0.37 Gb Available Physical Memory | 19.64% Memory free
11.63 Gb Paging File | 9.93 Gb Available in Paging File | 85.41% Paging File free
Paging file location(s): c:\pagefile.sys 10000 12000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 454.55 Gb Total Space | 294.81 Gb Free Space | 64.86% Space Free | Partition Type: NTFS

Computer Name: AMOS-PC | User Name: Chrome | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1 ",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office15\msohtmed.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe" = C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01C851B9-0F6B-44F4-9EB0-236C56DC70EB}" = lport=10243 | protocol=6 | dir=in | app=system |
"{0AF670CE-2847-4B6E-B26A-A0FC41BCFE65}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0F3C54B2-E11A-4E25-8A44-601AC2D2AEB6}" = lport=137 | protocol=17 | dir=in | app=system |
"{1C7A8A10-331B-48B1-A51F-A49DAA3A0741}" = lport=138 | protocol=17 | dir=in | app=system |
"{1FDE0EDA-78EA-482E-8A0E-A701DA6A69D9}" = rport=445 | protocol=6 | dir=out | app=system |
"{2B3385F1-9AC2-4D0E-B6F8-FF0AAA87C473}" = rport=139 | protocol=6 | dir=out | app=system |
"{2CF8C3B9-3255-4B26-99E0-9933D713ED1F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{54F61B6E-2F41-44AA-9641-F97CE5F4948D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{61C1F002-0610-4337-9B32-3D0F8424648D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{640AE2ED-1B3B-4F4F-A32B-67F59E104C20}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{668ACAB7-0EB1-4C1F-B09D-00B529BDC8E8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{670A7BD7-09AE-4341-84A1-204A09B53AA4}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7C27DA9A-1A31-4267-B7C3-61751C3A2382}" = lport=139 | protocol=6 | dir=in | app=system |
"{82348599-0E21-4B05-8D26-874633179E96}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{88C10C2E-6058-45C8-A3D3-653FE7D451C3}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{8AE54FD6-DF06-4C46-8625-E227D8EEEF2F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8D22CE4C-4BF7-4806-8308-7C029B8CA8C4}" = rport=137 | protocol=17 | dir=out | app=system |
"{8E3CFC01-6DCB-47DE-B597-78497F8A1D15}" = lport=9091 | protocol=6 | dir=in | name=oxy-remote |
"{8EA8DC09-D025-4117-8F85-74EC5E0BDA0C}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office15\outlook.exe |
"{984DF662-ACCA-4EA0-99FB-F1879D1FA572}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{B1D227DE-4943-4273-9DEC-5757BCFE12DB}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B2525A62-FEFB-4196-B9A3-D9821F05CF44}" = rport=10243 | protocol=6 | dir=out | app=system |
"{B9B8AD4C-8095-4CBC-9C0B-6583B3706559}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{CAB754CA-DA05-4BF2-86B8-3C0F31C9DFE0}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D8ABBBAF-8A52-4969-826F-C437ABB56311}" = rport=138 | protocol=17 | dir=out | app=system |
"{E365DE2B-F5A0-40DE-B8AC-EF4B414BDF04}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{F2F9E969-9F9D-40E1-8584-32874E887EB2}" = lport=445 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003F11EA-5079-4AF6-BE51-0D21623F0FB3}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.7.0.0747\sgtool.exe |
"{00918C24-B5A0-4F3C-BAA0-D5CADA11C12C}" = protocol=6 | dir=in | app=c:\program files\rc語音\rcplugin.exe |
"{0421EACB-DDDD-4CCC-AB1B-4C9F9F0FD44F}" = protocol=17 | dir=in | app=c:\users\chrome\appdata\local\temp\panwangzhanshen2.exe |
"{04A44FBD-D0C9-4CF4-943E-513B3B28EC02}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{066F165A-F105-49DD-9106-4E610BA50C52}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{0719AB36-9FF9-46A9-A9BE-9A66186BE7A2}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\sgtool.exe |
"{0854411A-95D7-451A-9992-43EB2D5DE5BA}" = protocol=17 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\imeutil.exe |
"{08C94E48-9CBA-4B1D-B479-0B64AC2ACA2A}" = protocol=17 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sgdownload.exe |
"{0B00305C-E04E-49B8-8AE3-2E2ED3D0EDB9}" = protocol=6 | dir=in | app=c:\program files\rc語音\rcplugin.exe |
"{0B0AB1CE-C5D7-410E-8C88-5655C1962DDD}" = protocol=6 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\pinyinup.exe |
"{0F3D03C4-C2A1-4DEF-B099-33EC12A4B562}" = protocol=6 | dir=in | app=c:\users\chrome\documents\games\warcraft iii(1.24e)\war3.exe |
"{108B0F24-45EE-4F25-83AE-66B75FF4C054}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\dota 2 beta\dota.exe |
"{10D52D8D-A295-4529-AE47-8F659D96E854}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{113939E5-CBEE-473C-B5D3-72F7CCA1C6A4}" = protocol=6 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sogoucloud.exe |
"{12583407-966F-44E3-AB20-66B7D6F2C999}" = protocol=17 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sgtool.exe |
"{13117153-9147-4AF5-B437-FDD413950BC3}" = protocol=17 | dir=in | app=c:\users\chrome\documents\games\warcraft iii(1.24e)\war3.exe |
"{14981272-371F-44CE-92E4-F24069F0A7E6}" = protocol=6 | dir=in | app=c:\users\chrome\appdata\local\temp\preupdater2.exe |
"{14A62728-39F0-4199-8C7A-5DA26C19379C}" = protocol=17 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sogoucloud.exe |
"{1540DDFA-D946-4948-B5E7-CDFF2DDCEA55}" = protocol=17 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\pinyinup.exe |
"{160D80CE-C047-488C-A7D0-3A86785F5604}" = protocol=17 | dir=in | app=c:\users\chrome\appdata\local\oxy\application\bin\oxy-downloader.exe |
"{18B1C613-962E-4F34-A143-DD53BC9BC221}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\sgdownload.exe |
"{18FC1DDC-A2DA-4F27-8FD4-6C1D8E3F26C0}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{19C9CDE0-0B56-4135-8A80-B276D352D22C}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{1C25AAB7-189D-4FD8-9862-5B85E7CAE8D2}" = protocol=17 | dir=in | app=c:\users\chrome\appdata\local\temp\wzpw2.exe |
"{1D58A94D-6664-445A-BEF9-0C1E41F8D79F}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\sgtool.exe |
"{1D7B70A5-4842-423E-A3D8-8B98140DE5FC}" = protocol=17 | dir=in | app=c:\program files\sogouinput\components\sogoucommgr.exe |
"{200995EA-27CD-4D8F-8901-8F68FB3067E9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{22E3C839-027B-4937-BD47-25059FFF434F}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.1.0.6700\pinyinup.exe |
"{232BD114-F46B-48D1-89CE-EDA0D59D6875}" = protocol=17 | dir=in | app=c:\users\chrome\documents\games\maplestorysea\maplestory.exe |
"{275EA65B-E37F-4988-8D83-0C00A18FCBD1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{2914097F-D8DE-44EC-A07D-86B1F4419FD8}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office15\lync.exe |
"{2A044E82-C3EF-4A37-865F-F238F42EF6C7}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{2B0BBF85-37D7-4EAB-9A4D-959B649F0F5A}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{332C1D67-450D-40D5-9355-27C704EAA0C1}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\pinyinup.exe |
"{35FC23C3-89DF-4509-AA6E-1919BE2E773F}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.1.0.6700\sefastinstall.exe |
"{36319141-8E1B-4D4D-8A85-5FD7007B8815}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office15\ucmapi.exe |
"{3B2E448D-FAAF-4920-9E1B-15799D04E4CE}" = protocol=6 | dir=in | app=c:\users\chrome\appdata\local\temp\wzpw2.exe |
"{3B9915ED-B38F-4736-AC14-0872B1375956}" = protocol=6 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\imeutil.exe |
"{3D453243-13C6-4234-B06B-D60992814AED}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{476C01DB-E5C0-4EF0-9462-3F98AE45A00A}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{4AD89ED7-B15D-45B3-A95D-8CFAD36A92D1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4EE52509-C812-41C3-9A75-03DBF5C64886}" = protocol=17 | dir=in | app=c:\users\chrome\appdata\local\temp\preupdater.20130325.exe |
"{50657898-453B-45D1-B131-9F2B264F9A8F}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{529FCF45-71D8-4B59-AC8A-8405A8478347}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{53767FEF-7EEA-4827-ADEF-D547525F29C4}" = protocol=6 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sgtool.exe |
"{569FC1AA-3A73-4B39-9224-5955D42E60A4}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.1.0.6700\sefastinstall.exe |
"{5C113135-38A7-43CA-952A-4850FB7B2209}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office15\lync.exe |
"{5C8CF153-EF78-4740-B09B-2958AB55C06A}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.2380\agent.exe |
"{5E68AE44-F164-499A-97CF-A5EF74C52EE0}" = protocol=6 | dir=in | app=c:\users\chrome\appdata\local\temp\smttt_gd3-8.exe |
"{6243C248-D007-4408-9C39-AB09EC23E187}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.5.0.9181\pinyinup.exe |
"{634FD685-C538-4083-AB11-6CF7DF83EC26}" = protocol=6 | dir=in | app=c:\users\chrome\appdata\local\temp\preupdater.20130313.exe |
"{64C840C4-1BC5-4C74-9493-33B3A4A8CBB1}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office15\ucmapi.exe |
"{67032D24-5AAE-4156-B56D-8DE2F5443704}" = protocol=17 | dir=in | app=c:\users\chrome\appdata\local\temp\guide_mtool325-3.exe |
"{6B930D8F-3AD5-4A79-827B-DEF490DF2991}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.2.0.7270\pinyinup.exe |
"{70B2AA8A-8E87-41E4-B3CB-40AB7A38EEF8}" = protocol=17 | dir=in | app=c:\users\chrome\appdata\local\akamai\netsession_win.exe |
"{742F3B78-6B18-47A1-9738-85A38F3EB439}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{799EA8E7-EC71-44B0-94B2-FA5A14678F40}" = protocol=17 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\pinyinup.exe |
"{7AABCDFA-56C7-417B-A465-16F52AFAEB4F}" = protocol=6 | dir=in | app=c:\users\chrome\appdata\local\temp\preupdater.20130325.exe |
"{7C0521E4-02D0-43A7-A4DC-C391940E4E52}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{7E1B2292-75E9-4F99-B2FF-56B8ECCA4CEE}" = protocol=6 | dir=in | app=c:\users\chrome\appdata\local\oxy\application\bin\oxy-downloader.exe |
"{7F03163C-B00A-4C44-923F-A1F0D381DECB}" = protocol=17 | dir=in | app=c:\program files\rc語音\rcplugin.exe |
"{7FE0D7D5-96CF-49BA-BC15-A1ECE83A21E6}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.1.0.6700\pinyinup.exe |
"{832D7986-B2F9-4911-AD01-5281DCBC0D34}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{85434AF7-3242-481D-B004-BC2EFD7388B9}" = protocol=6 | dir=in | app=c:\program files\sogouinput\5.0.0.3935\pinyinup.exe |
"{85E4C205-16CD-4B28-A151-CAF7DFC09356}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{8C96BB24-13C8-40F1-A17C-AF6799A5256D}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\dota 2 beta\dota.exe |
"{9014FB69-2B47-4E88-B994-22A955CE52B9}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.5.0.9181\pinyinup.exe |
"{915BC127-9C55-4B0F-9883-EFD2CC248C6D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{94905E67-DF53-4D72-93B8-40D585A7C99C}" = protocol=6 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\imeutil.exe |
"{966D7E5E-AFDF-47C3-90B2-02699EC7F5CC}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\sogoucloud.exe |
"{97D48A02-D1A0-4B90-B91B-D60BC6C137D4}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\sogoucloud.exe |
"{9A117A86-DE43-477D-A21D-F2DDAF6CAD93}" = protocol=17 | dir=in | app=c:\users\chrome\appdata\local\temp\szwz2mitool_2.2.0.16289_500002.exe |
"{9B34B1F2-37B9-4DE0-8781-F971FD207AE4}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{9D7D12AA-3F0A-4F8F-A443-0F69CFFB2B2E}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |
"{9DB8A5A8-5D4A-4BAF-9895-FCF84CC06551}" = protocol=17 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sgtool.exe |
"{A0CACEC5-D421-4E48-A449-66A0575DAC9F}" = protocol=6 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sgtool.exe |
"{A4F1F8AB-7995-4FCA-8E6A-7AA04342EB43}" = protocol=6 | dir=in | app=c:\users\chrome\appdata\local\temp\szwz2mitool_2.2.0.16289_500002.exe |
"{A5F91938-735A-4180-8F42-B6AE5A4B36CF}" = protocol=6 | dir=in | app=c:\users\chrome\documents\games\maplestorysea\maplestory.exe |
"{A62B5B5D-97F7-4B7A-B325-9A74157135AA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A86473CA-DDCA-46D8-A0E2-5C7E4F5B0CD8}" = protocol=17 | dir=in | app=c:\users\chrome\appdata\local\temp\preupdater2.exe |
"{AA7108DB-E87C-4D28-A3A2-C1A48DE4FE7D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AAC432FB-9243-4564-A1BC-720EA98028FA}" = protocol=6 | dir=in | app=c:\users\chrome\appdata\local\akamai\netsession_win.exe |
"{AD4F6C79-6597-4887-B937-39C0AFBA8724}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"{AD81E145-1D87-41BA-9546-83DBE13CF3A6}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\sgdownload.exe |
"{B2619785-365C-4FFF-AFD4-E55FAAF184DB}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\pinyinup.exe |
"{B551DE09-9877-4F44-BFE2-A9489CBF4D9E}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\pinyinup.exe |
"{B5FF5DA5-D6C3-410C-8328-7407315A12B7}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office15\lync.exe |
"{B63E9C48-AE23-4629-8CF0-916A4A09F7DA}" = protocol=6 | dir=in | app=c:\users\chrome\appdata\local\temp\guide_mtool325-3.exe |
"{B845E599-7945-4CDB-8721-C5F91DF8C601}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"{B8560C70-1241-42E6-86D2-E61FA6B3813B}" = protocol=6 | dir=in | app=c:\users\chrome\appdata\local\temp\panwangzhanshen2.exe |
"{B8B8BFCF-8413-4D8C-B2AC-3C61A731D2D3}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\pinyinup.exe |
"{B8F0C97A-85C3-4AC4-8DCD-F017B1F5FAD7}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.2380\agent.exe |
"{BC2D9F1F-EB2F-4795-8D7C-49B0F3226939}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.7.0.0747\sgtool.exe |
"{BC77C7D6-E9C0-4AFA-AC65-3A1205CC7EB8}" = protocol=17 | dir=in | app=c:\program files\sogouinput\5.0.0.3935\pinyinup.exe |
"{BCC72E9A-5EE3-40C6-86D2-E957961A242A}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\sgdownload.exe |
"{BDCBBD64-9F49-4253-B3F9-031407599D49}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{BEAF7B1A-7996-4156-8F3D-4791681EB6AD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BEEC9A90-CCD8-44FC-89A6-ED420D71C6E0}" = protocol=6 | dir=in | app=c:\program files\sogouinput\components\sogoucommgr.exe |
"{C1ABFA23-A183-4E7E-B095-D03DA61D3766}" = protocol=6 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sgtool.exe |
"{C3C795DE-C373-4339-BEE5-13BDD7985461}" = protocol=17 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sogoucloud.exe |
"{C3F4DC6E-42F4-41E6-A745-3C03EF7AE79A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C5CDB9BD-A7B9-41CE-B102-DD5651B4B9EB}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{C662C4E3-0E16-4B9B-8E1C-4C5325A843D7}" = protocol=6 | dir=in | app=c:\users\chrome\appdata\local\temp\sehelper.exe |
"{C83BEBF1-24E1-4848-A246-BCB792C8EC41}" = protocol=17 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\imeutil.exe |
"{CB07B14C-C858-4F0A-9212-32D86EE11DAB}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{CD9AC082-0E2C-409D-978C-E5DAF04D9441}" = protocol=17 | dir=in | app=c:\users\chrome\appdata\local\temp\preupdater.20130313.exe |
"{CDF41DF3-CDE8-4C68-A721-4FF591345E4B}" = protocol=6 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sgdownload.exe |
"{CFDB5E93-409A-4D58-B8D0-29DD27FC50C5}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office15\ucmapi.exe |
"{D00F8E71-6B1B-43FF-A610-B66EB9AA6E77}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{D11F0B18-EAC3-48E6-8E29-DB199EDE7A7D}" = protocol=6 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\pinyinup.exe |
"{D441FA0B-B7B7-4157-903F-785D44364170}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office15\lync.exe |
"{D63E846D-3A5E-4447-8B8F-064867A88D2C}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.2.0.7270\pinyinup.exe |
"{D87F55B0-4595-4BC2-BE5C-D3219F2E4C21}" = protocol=6 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sogoucloud.exe |
"{D8F7300F-DD67-4780-96E5-1D324601041C}" = protocol=6 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sgdownload.exe |
"{D8FAD341-0AD8-4195-9234-8C38F20A479E}" = protocol=6 | dir=out | app=system |
"{D9BDBB48-A2C8-4EB2-AACD-CB1167B5A13D}" = protocol=17 | dir=in | app=c:\program files\rc語音\rcplugin.exe |
"{DA729F4D-9034-4DE5-B6EC-F02B0B4E52F8}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.5.0.9181\sgtool.exe |
"{DB2F6C3D-D708-45BD-B6B2-859F9663D750}" = protocol=17 | dir=in | app=c:\users\chrome\appdata\local\temp\sehelper.exe |
"{DDCC3AFD-BF24-49C8-9709-E1065D4A2456}" = protocol=6 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\pinyinup.exe |
"{E110B47F-40D5-4714-B37E-B9CC1D7CF838}" = protocol=6 | dir=in | app=c:\program files\sogouinput\components\sogoucommgr.exe |
"{E25478F5-FDE3-439E-8161-5FF75693AB46}" = protocol=17 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sgtool.exe |
"{E47D3353-CE17-4A92-8BF7-C05FFE105608}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\sogoucloud.exe |
"{E522AF3D-C501-408B-BD6A-EA29912A8671}" = protocol=17 | dir=in | app=c:\users\chrome\appdata\local\temp\smttt_gd3-8.exe |
"{E57B3564-4601-4CCD-BF6A-A3BB2EA746FD}" = protocol=17 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\sgdownload.exe |
"{E67CC407-3968-424E-B492-90A602C6B144}" = protocol=17 | dir=in | app=c:\program files\sogouinput\components\sogoucommgr.exe |
"{E7A14D6D-4A11-4536-974B-7AEE0A740FED}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\sogoucloud.exe |
"{EB52C2A8-1BBA-428A-BEBF-49B6027A91E6}" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\pinyinup.exe |
"{ECF73A6F-3A89-44D3-87A6-30C84D85CC14}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{ED86BE52-59A5-4C1E-9CC1-3917F4191464}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\sgdownload.exe |
"{EF96B0C2-6A66-41A8-B124-D3794FAB7397}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{F2A8BA29-1F11-41D2-91D1-474F36965279}" = protocol=17 | dir=in | app=c:\program files\sogouinput\7.1.0.1662\pinyinup.exe |
"{F5C21851-CA0E-426E-A584-88422AEC00F5}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.8.0.1146\pinyinup.exe |
"{F675BF45-590D-4B6B-97FE-5AEA2FFF91C4}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F811F0CC-B9EB-4F9E-9584-852892F79C09}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office15\ucmapi.exe |
"{F8768E57-8085-4D4E-AF17-74FD9EE45B35}" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.5.0.9181\sgtool.exe |
"{FA29817A-F9E5-4373-989C-319C2C656F13}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |
"{FFCC89D5-9A9C-4735-BB47-7EF6FA18C2A0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{04CA5689-578B-44CF-B9B8-3D4C6E1CC666}C:\users\chrome\documents\games\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\users\chrome\documents\games\warcraft iii\war3.exe |
"TCP Query User{06D18E80-A465-4E5A-89D3-FF754A6FCB55}C:\users\chrome\downloads\microsoft office 2013 professional plus x86\microsoft toolkit 2.4.5.exe" = protocol=6 | dir=in | app=c:\users\chrome\downloads\microsoft office 2013 professional plus x86\microsoft toolkit 2.4.5.exe |
"TCP Query User{138B25D1-A795-4096-87CB-AFE84BC5220E}C:\users\chrome\documents\games\garena massenger\room\garena_room.exe" = protocol=6 | dir=in | app=c:\users\chrome\documents\games\garena massenger\room\garena_room.exe |
"TCP Query User{3D6BA734-8DAC-439C-B4C6-3E560E30930D}C:\users\chrome\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\chrome\appdata\local\akamai\netsession_win.exe |
"TCP Query User{403AC7EF-7A16-441A-B3A2-E4A2CB1C8982}C:\users\chrome\documents\games\diablo iii collectors edition\diablo iii.exe" = protocol=6 | dir=in | app=c:\users\chrome\documents\games\diablo iii collectors edition\diablo iii.exe |
"TCP Query User{5E1CF84B-5617-488B-B254-9A581B827291}C:\users\chrome\documents\games\warcraft iii(1.24e)\war3.exe" = protocol=6 | dir=in | app=c:\users\chrome\documents\games\warcraft iii(1.24e)\war3.exe |
"TCP Query User{659D0144-5283-4F45-8DF2-FCB6022DFEE9}C:\users\chrome\documents\games\garena plus\room\garena_room.exe" = protocol=6 | dir=in | app=c:\users\chrome\documents\games\garena plus\room\garena_room.exe |
"TCP Query User{AE0A4FB5-B64A-483F-827D-CC6B1368472A}C:\Program Files\SogouInput\6.5.0.9181\sgdownload.exe" = protocol=6 | dir=in | app=c:\program files\sogouinput\6.5.0.9181\sgdownload.exe |
"TCP Query User{CD9E1D1B-40DD-4BDC-BD6F-DCD5F8DF4C16}C:\program files\flashget network\flashget 3\flashget3.exe" = protocol=6 | dir=in | app=c:\program files\flashget network\flashget 3\flashget3.exe |
"TCP Query User{D24F8741-8AD2-400A-B743-A649CB9757A4}C:\users\chrome\documents\games\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\users\chrome\documents\games\warcraft iii\war3.exe |
"TCP Query User{DF4401C1-5792-447D-A49B-575B68500D90}C:\windows\system32\ftp.exe" = protocol=6 | dir=in | app=c:\windows\system32\ftp.exe |
"TCP Query User{F0E2D44F-1822-41C6-B162-A5D3D546CCBF}C:\users\chrome\documents\games\garena 1.23\garena.exe" = protocol=6 | dir=in | app=c:\users\chrome\documents\games\garena 1.23\garena.exe |
"TCP Query User{F3984708-3345-480F-998E-7EEA144153F3}C:\program files\flashget network\flashget 3\flashget3.exe" = protocol=6 | dir=in | app=c:\program files\flashget network\flashget 3\flashget3.exe |
"TCP Query User{FF2C8414-CF5D-40ED-BD85-8574FD788762}C:\users\chrome\documents\games\garena massenger\room\garena_room.exe" = protocol=6 | dir=in | app=c:\users\chrome\documents\games\garena massenger\room\garena_room.exe |
"UDP Query User{0AB27126-4492-47DB-80AD-8DA15C2386A8}C:\users\chrome\documents\games\warcraft iii(1.24e)\war3.exe" = protocol=17 | dir=in | app=c:\users\chrome\documents\games\warcraft iii(1.24e)\war3.exe |
"UDP Query User{1E4DE534-6DDD-46C9-A588-CA4877BB2232}C:\windows\system32\ftp.exe" = protocol=17 | dir=in | app=c:\windows\system32\ftp.exe |
"UDP Query User{207D8E05-F5F4-4FB9-9661-D7E09D5E686A}C:\users\chrome\documents\games\garena massenger\room\garena_room.exe" = protocol=17 | dir=in | app=c:\users\chrome\documents\games\garena massenger\room\garena_room.exe |
"UDP Query User{3009FE8D-1AF2-4B6B-BF19-A5BC07C8DF1C}C:\users\chrome\documents\games\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\users\chrome\documents\games\warcraft iii\war3.exe |
"UDP Query User{5CED374B-4DD2-437A-9AD0-FB32E7D670AC}C:\users\chrome\documents\games\garena plus\room\garena_room.exe" = protocol=17 | dir=in | app=c:\users\chrome\documents\games\garena plus\room\garena_room.exe |
"UDP Query User{6ED66A95-83CE-4078-B70F-5EE3944C95F6}C:\users\chrome\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\chrome\appdata\local\akamai\netsession_win.exe |
"UDP Query User{7CFC2C16-9FE1-4A81-A049-F2191FDF36C6}C:\users\chrome\documents\games\garena 1.23\garena.exe" = protocol=17 | dir=in | app=c:\users\chrome\documents\games\garena 1.23\garena.exe |
"UDP Query User{8DDFC555-755E-4E95-B039-E2E2EBDBCE4D}C:\Program Files\SogouInput\6.5.0.9181\sgdownload.exe" = protocol=17 | dir=in | app=c:\program files\sogouinput\6.5.0.9181\sgdownload.exe |
"UDP Query User{A771318E-0E21-4E6C-A7AE-84E6B85E8482}C:\users\chrome\documents\games\diablo iii collectors edition\diablo iii.exe" = protocol=17 | dir=in | app=c:\users\chrome\documents\games\diablo iii collectors edition\diablo iii.exe |
"UDP Query User{CF94E9A2-0A19-46D7-AF80-E4AC32DAAB99}C:\users\chrome\documents\games\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\users\chrome\documents\games\warcraft iii\war3.exe |
"UDP Query User{D34F9E87-199A-4641-8335-26FBDF22A3BD}C:\users\chrome\documents\games\garena massenger\room\garena_room.exe" = protocol=17 | dir=in | app=c:\users\chrome\documents\games\garena massenger\room\garena_room.exe |
"UDP Query User{E2E93089-D85D-43BC-AF17-E26474136DF4}C:\users\chrome\downloads\microsoft office 2013 professional plus x86\microsoft toolkit 2.4.5.exe" = protocol=17 | dir=in | app=c:\users\chrome\downloads\microsoft office 2013 professional plus x86\microsoft toolkit 2.4.5.exe |
"UDP Query User{F1B31700-D309-4A7E-862A-D2F229DCD92D}C:\program files\flashget network\flashget 3\flashget3.exe" = protocol=17 | dir=in | app=c:\program files\flashget network\flashget 3\flashget3.exe |
"UDP Query User{F338D5F2-6698-4B50-A660-1C0A4F5F2CCA}C:\program files\flashget network\flashget 3\flashget3.exe" = protocol=17 | dir=in | app=c:\program files\flashget network\flashget 3\flashget3.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{073B89C3-BA88-41B5-965F-B35A88EAE838}" = TOSHIBA Supervisor Password
"{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1" = Core Temp 1.0 RC6
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}" = Razer Synapse 2.0
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP250_series" = Canon MP250 series MP Drivers
"{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}" = Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{185F9795-9663-4F13-9EF9-307A282ADB5A}" = ph
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A075BB4-E976-4278-BF3F-E5C6945D84C0}" = bl
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{36A345C9-0691-45A1-AEEF-29ECEC8B5014}" = Microsoft Security Client
"{394BE3D9-7F57-4638-A8D1-1D88671913B7}" = Microsoft AppLocale
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{4903D172-DCCB-392F-93A3-34CA9D47FE3D}" = Microsoft .NET Framework 4.5.1
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.11
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{5E6F6CF3-BACC-4144-868C-E14622C658F3}" = TOSHIBA Web Camera Application
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-toshiba" = WildTangent Games App (Toshiba Games)
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7216871F-869E-437C-B9BF-2A13F2DCE63F}_is1" = Auslogics BoostSpeed
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{759142E8-25B0-42AE-B408-4215065D3F4B}" = Windows Live Family Safety
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7B15D70E-9449-4CFB-B9BC-798465B2BD5C}" = Norton Internet Security
"{80F696E0-AB85-433E-99E3-8CC6D98CF167}" = TOSHIBA ConfigFree
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90150000-0015-0409-0000-0000000FF1CE}" = Microsoft Access MUI (English) 2013
"{90150000-0016-0409-0000-0000000FF1CE}" = Microsoft Excel MUI (English) 2013
"{90150000-0018-0409-0000-0000000FF1CE}" = Microsoft PowerPoint MUI (English) 2013
"{90150000-0019-0409-0000-0000000FF1CE}" = Microsoft Publisher MUI (English) 2013
"{90150000-001A-0409-0000-0000000FF1CE}" = Microsoft Outlook MUI (English) 2013
"{90150000-001B-0409-0000-0000000FF1CE}" = Microsoft Word MUI (English) 2013
"{90150000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proofing Tools 2013 - English
"{90150000-001F-040C-0000-0000000FF1CE}" = Outils de vérification linguistique 2013 de Microsoft Office*- Français
"{90150000-001F-0804-0000-0000000FF1CE}" = Microsoft Office 校对工具 2013 - 简体中文
"{90150000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proofing Tools 2013 - Español
"{90150000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2013
"{90150000-0044-0409-0000-0000000FF1CE}" = Microsoft InfoPath MUI (English) 2013
"{90150000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2013
"{90150000-0090-0409-0000-0000000FF1CE}" = Microsoft DCF MUI (English) 2013
"{90150000-00A1-0409-0000-0000000FF1CE}" = Microsoft OneNote MUI (English) 2013
"{90150000-00BA-0409-0000-0000000FF1CE}" = Microsoft Groove MUI (English) 2013
"{90150000-00E1-0409-0000-0000000FF1CE}" = Microsoft Office OSM MUI (English) 2013
"{90150000-00E2-0409-0000-0000000FF1CE}" = Microsoft Office OSM UX MUI (English) 2013
"{90150000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2013
"{90150000-0117-0409-0000-0000000FF1CE}" = Microsoft Access Setup Metadata MUI (English) 2013
"{90150000-012B-0409-0000-0000000FF1CE}" = Microsoft Lync MUI (English) 2013
"{91150000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2013
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A536367E-C40C-4483-8F9B-19DEB881B205}" = TOSHIBA Hardware Setup
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC6569FA-6919-442A-8552-073BE69E247A}" = TOSHIBA Service Station
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.6
"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B2FB7DBA-CEEC-41F1-BC23-3323D96290F6}" = TOSHIBA Bulletin Board
"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Media Creator
"{B894522E-C079-4DC8-A305-30BA6E2F4459}" = TOSHIBA ReelTime
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{BCF16F16-AC0E-4ABE-A9EF-412CF484BA51}" = Windows Live Family Safety
"{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}" = TOSHIBA Assist
"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition
"{C7A4F26F-F9B0-41B2-8659-99181108CDE3}" = TOSHIBA Media Controller
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{CCF298AF-9CE1-4B26-B251-486E98A34789}" = Windows 7 USB/DVD Download Tool
"{ce085a78-074e-4823-8dc1-8a721b94b76d}" = Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb" = Microsoft Windows Application Compatibility Database
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4F184C1-E62E-44F0-B142-AB6197490834}" = CLIP STUDIO PAINT
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications
"{EF36D026-6634-4BED-A82F-D1EDCD4BE68C}_is1" = MapleStorySEA 1.35
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}" = TOSHIBA Media Controller Plug-in
"{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}" = Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005
"{FD9C31B6-F572-414D-81E3-89368C97A125}_is1" = CamStudio OSS Desktop Recorder
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 12 Plugin
"Audacity_is1" = Audacity 2.0.2
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon Utilities My Printer
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Diablo II" = Diablo II
"EagleGame ShowTime" = ShowTime 1.2.17
"ENTERPRISE" = Microsoft Office Enterprise 2007
"HaaliMkx" = Haali Media Splitter
"Ink-Squared Deluxe" = Ink-Squared Deluxe 1.0
"InstallShield_{B2FB7DBA-CEEC-41F1-BC23-3323D96290F6}" = TOSHIBA Bulletin Board
"InstallShield_{B894522E-C079-4DC8-A305-30BA6E2F4459}" = TOSHIBA ReelTime
"InstallShield_{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition
"InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware version 2.0.1.1004
"Matroska Pack" = Matroska Pack
"Microsoft Security Client" = Microsoft Security Essentials
"MP Navigator EX 3.0" = Canon MP Navigator EX 3.0
"NSIS_oald8" = Oxford Advanced Learner's Dictionary - 8th Edition
"Office15.PROPLUSR" = Microsoft Office Professional Plus 2013
"Open Codecs" = Xiph.Org Open Codecs 0.85.17777
"OpenITG" = OpenITG
"Pen Tablet Driver" = Bamboo
"Picasa 3" = Picasa 3
"PPSSPP_is1" = PPSSPP version 0.9.8
"QUICKfind" = QUICKfind server v1.1
"Razer Surround" = Razer Surround
"RC語音" = RC語音
"RGSS-RTP Standard_is1" = RGSS-RTP Standard
"Sogou Input" = 搜狗拼音输入法 7.1正式版
"Speccy" = Speccy
"SpeedFan" = SpeedFan (remove only)
"Steam App 570" = Dota 2
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Wacom Tablet Driver" = Wacom Tablet
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Internet Explorer and Netscape" = WebTablet FB Plugin 32 bit
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"WildTangent toshiba Master Uninstall" = WildTangent Games
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.01 (32-bit)
"WT088682" = Bejeweled 2 Deluxe
"WT088696" = Chuzzle Deluxe
"WT088702" = Plants vs. Zombies
"WT088703" = Build-a-lot 2
"WT088710" = Zuma's Revenge
"WT088739" = FATE
"WT088750" = Jewel Quest - Heritage
"WT088759" = Polar Bowler
"WT088760" = Virtual Villagers 4 - The Tree of Life
"WT088761" = Wheel of Fortune 2

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"uTorrent" = µTorrent

========== Last 20 Event Log Errors ==========

[ OSession Events ]
Error - 12/6/2011 12:13:50 AM | Computer Name = Amos-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 877 seconds with 720 seconds of active time. This session ended with a crash.


< End of report >

 

Now the cold-boot time is still very ridiculous (10 mins+), but now the operation usage of computer has become smoother. I can now do smooth multitasking with less hangs.