We're aware that some users are experiencing technical issues which the team are working to resolve. See the Community Noticeboard for more info. Thank you for your patience.
📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!

Malwarebytes Log

Options
13»

Comments

  • waddler_8
    waddler_8 Posts: 3,588 Forumite
    If you're happy that you've turned everything off, click ok to the prompts & continue with the scan.
  • kws
    kws Posts: 43 Forumite
    It has run, but I am unable to post the log at present as it has lost its internet connection (I'm on another pc, but don't have a USB stick to copy the files across at the moment).

    I tried rebooting, but that didn't work, so I then tried to follow the instructions for manually reconnecting the inernet, but they seem to be out of date and don't cover Windows 7.

    I eventually found the Network Connections page and right-clicked on my Wireless Network Connection, but there was no repair option, so I tried diagnose and it came back saying that the Windows wireless service is not running. I tried repairing it as an administrator, but it just says it can't fix it.
  • kws
    kws Posts: 43 Forumite
    Managed to get the wireless adapter workingafter a bit of Googling, so here is the log.

    ComboFix 13-04-02.01 - XXX 04/04/2013 2:26.1.2 - x64 NETWORK
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.4000.2796 [GMT 1:00]
    Running from: c:\users\XXX\Desktop\ComboFix.exe
    AV: McAfee Anti-Virus and Anti-Spyware *Disabled* {ADA629C7-7F48-5689-624A-3B76997E0892}
    FW: McAfee Firewall *Disabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
    SP: McAfee Anti-Virus and Anti-Spyware *Disabled* {16C7C823-5972-5907-58FA-0004E2F9422F}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    ADS - Windows: deleted 192 bytes in 1 streams.
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\programdata\FullRemove.exe
    c:\windows\SysWow64\d2d1debug1.dll
    D:\install.exe
    .
    .
    ((((((((((((((((((((((((( Files Created from 2013-03-04 to 2013-04-04 )))))))))))))))))))))))))))))))
    .
    .
    2013-04-04 00:34 . 2013-04-04 00:34
    d
    w- c:\users\Jane\AppData\Local\temp
    2013-03-29 16:49 . 2013-03-29 16:49
    d
    w- C:\_OTM
    2013-03-27 16:01 . 2013-03-26 11:33 383608 ----a-w- c:\windows\SysWow64\nuragoLSPService64.dll
    2013-03-27 16:01 . 2013-03-26 11:33 316024 ----a-w- c:\windows\SysWow64\nuragoLSPService.dll
    2013-03-26 21:10 . 2013-03-26 21:10
    d
    w- c:\users\XXX\AppData\Roaming\Malwarebytes
    2013-03-26 21:10 . 2013-03-26 21:10
    d
    w- c:\programdata\Malwarebytes
    2013-03-26 21:10 . 2013-03-26 21:10
    d
    w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2013-03-26 21:10 . 2012-12-14 15:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys
    2013-03-24 09:53 . 2013-03-24 09:53
    d
    w- c:\users\Temp\AppData\Local\VMware
    2013-03-24 09:53 . 2013-03-24 09:53
    d
    w- c:\users\Temp\AppData\Roaming\VMware
    2013-03-23 13:18 . 2013-03-23 13:18
    d
    w- c:\users\XXX\AppData\Roaming\dvdcss
    2013-03-20 20:47 . 2013-02-12 04:12 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys
    2013-03-17 16:29 . 2013-03-17 16:29
    d
    w- c:\program files\CCleaner
    2013-03-17 16:23 . 2013-03-17 16:23
    d
    w- c:\program files\Microsoft Office
    2013-03-17 16:07 . 2013-03-17 16:07
    d
    w- c:\programdata\APN
    2013-03-17 14:47 . 2013-03-17 14:47
    d
    w- c:\users\XXX\AppData\Local\ElevatedDiagnostics
    2013-03-17 13:59 . 2013-03-17 13:59
    d
    r- C:\MSOCache
    2013-03-17 10:46 . 2013-03-17 10:46
    d
    w- c:\windows\PCHEALTH
    2013-03-17 10:45 . 2013-03-17 10:45
    d
    w- c:\program files\Microsoft Analysis Services
    2013-03-17 10:45 . 2013-03-17 10:45
    d
    w- c:\program files (x86)\Microsoft Analysis Services
    2013-03-17 09:34 . 2013-03-20 15:59 1066368 ----a-w- c:\programdata\Microsoft\WDExpress\11.0\1033\ResourceCache.dll
    2013-03-17 09:33 . 2013-03-17 09:33
    d
    w- c:\program files (x86)\NuGet
    2013-03-17 09:28 . 2013-03-17 09:28
    d
    w- c:\program files (x86)\Common Files\Merge Modules
    2013-03-17 09:26 . 2013-03-17 09:26
    d
    w- c:\windows\symbols
    2013-03-17 09:25 . 2013-03-17 09:25
    d
    w- c:\program files (x86)\Common Files\Microsoft
    2013-03-17 09:24 . 2013-03-17 09:24
    d
    w- c:\program files (x86)\Windows Kits
    2013-03-17 09:22 . 2013-03-17 09:22
    d
    w- c:\program files (x86)\Microsoft Help Viewer
    2013-03-17 09:22 . 2013-03-17 09:22
    d
    w- c:\program files (x86)\Microsoft SDKs
    2013-03-17 09:21 . 2013-03-17 09:21
    d
    w- c:\windows\SysWow64\1033
    2013-03-17 09:21 . 2013-03-17 09:21
    d
    w- c:\windows\system32\1033
    2013-03-17 09:21 . 2013-03-17 09:32
    d
    w- c:\program files (x86)\Microsoft SQL Server
    2013-03-17 09:21 . 2013-03-17 09:32
    d
    w- c:\program files\Microsoft SQL Server
    2013-03-17 09:21 . 2013-03-17 09:21
    d
    w- c:\program files\Microsoft SQL Server Compact Edition
    2013-03-17 09:20 . 2013-03-17 09:24
    d
    w- c:\program files (x86)\Microsoft Visual Studio 11.0
    2013-03-17 09:07 . 2013-03-20 02:12
    d
    w- c:\programdata\regid.1991-06.com.microsoft
    2013-03-17 08:38 . 2013-03-17 08:38
    d
    w- C:\78b16a95dce4d77da3
    2013-03-16 20:26 . 2013-03-26 21:16
    d
    w- c:\users\XXX\AppData\Roaming\install
    2013-03-14 02:01 . 2013-03-14 02:01
    d
    w- c:\program files\Microsoft Silverlight
    2013-03-14 02:01 . 2013-03-14 02:01
    d
    w- c:\program files (x86)\Microsoft Silverlight
    2013-03-13 18:23 . 2013-03-13 18:23 15859416 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
    2013-03-09 14:08 . 2012-10-24 13:17 67224 ----a-w- c:\windows\system32\vsocklib.dll
    2013-03-09 14:08 . 2012-10-24 13:17 63128 ----a-w- c:\windows\SysWow64\vsocklib.dll
    2013-03-09 14:08 . 2012-10-24 13:17 70296 ----a-w- c:\windows\system32\drivers\vsock.sys
    2013-03-09 14:08 . 2013-02-26 01:28 67664 ----a-w- c:\windows\system32\drivers\vmx86.sys
    2013-03-09 14:08 . 2013-02-26 01:27 33360 ----a-w- c:\windows\system32\drivers\VMkbd.sys
    2013-03-09 14:07 . 2013-02-26 01:28 357456 ----a-w- c:\windows\SysWow64\vmnetdhcp.exe
    2013-03-09 14:07 . 2013-02-26 01:28 436304 ----a-w- c:\windows\SysWow64\vmnat.exe
    2013-03-09 14:07 . 2013-02-26 01:28 30800 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys
    2013-03-09 14:07 . 2013-02-26 01:29 933968 ----a-w- c:\windows\system32\vnetlib64.dll
    2013-03-09 14:07 . 2012-10-11 15:15 52376 ----a-w- c:\windows\system32\drivers\hcmon.sys
    2013-03-09 14:07 . 2013-03-09 14:07
    d
    w- c:\program files\Common Files\VMware
    2013-03-09 14:07 . 2013-03-09 14:07
    d
    w- c:\program files (x86)\VMware
    2013-03-09 14:07 . 2013-03-09 14:07
    d
    w- c:\program files (x86)\Common Files\VMware
    2013-03-07 21:44 . 2013-02-19 13:14 34384 ----a-w- c:\program files (x86)\Mozilla Firefox\ScriptFF.dll
    2013-03-07 17:16 . 2013-03-07 17:16 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
    2013-03-07 17:16 . 2013-03-07 17:16
    d
    w- c:\program files (x86)\Java
    2013-03-07 17:09 . 2012-12-19 16:40 383608 ----a-w- c:\windows\system32\nuragoLSPService64.DLL
    2013-03-06 20:13 . 2013-03-17 13:42
    d
    w- c:\users\Temp2
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2013-04-03 19:58 . 2012-06-21 17:28 45056 ----a-w- c:\windows\SysWow64\acovcnt.exe
    2013-03-14 02:05 . 2012-06-21 20:33 72013344 ----a-w- c:\windows\system32\MRT.exe
    2013-03-13 18:23 . 2012-07-07 08:26 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2013-03-13 18:23 . 2012-07-07 08:26 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2013-03-07 17:16 . 2012-07-20 17:50 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2013-02-26 01:27 . 2013-02-26 01:27 62104 ----a-w- c:\windows\system32\vmnetbridge.dll
    2013-02-26 01:27 . 2013-02-26 01:27 48792 ----a-w- c:\windows\system32\vnetinst.dll
    2013-02-26 01:27 . 2013-02-26 01:27 45720 ----a-w- c:\windows\system32\drivers\vmnetbridge.sys
    2013-02-26 01:27 . 2013-02-26 01:27 24216 ----a-w- c:\windows\system32\drivers\vmnet.sys
    2013-02-26 01:27 . 2013-02-26 01:27 20120 ----a-w- c:\windows\system32\drivers\vmnetadapter.sys
    2013-02-25 23:59 . 2013-02-25 23:59 360528 ----a-w- c:\windows\SysWow64\vmnc.dll
    2013-02-22 20:45 . 2012-07-20 17:50 861088 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
    2013-02-19 12:59 . 2012-08-16 06:23 70112 ----a-w- c:\windows\system32\drivers\cfwids.sys
    2013-02-19 12:56 . 2012-06-22 05:38 340216 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
    2013-02-19 12:56 . 2012-08-16 06:10 182752 ----a-w- c:\windows\system32\mfevtps.exe
    2013-02-19 12:55 . 2012-08-16 06:23 10728 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
    2013-02-19 12:55 . 2012-08-16 06:23 106552 ----a-w- c:\windows\system32\drivers\mferkdet.sys
    2013-02-19 12:54 . 2012-06-22 05:36 771536 ----a-w- c:\windows\system32\drivers\mfehidk.sys
    2013-02-19 12:53 . 2012-08-16 06:23 515968 ----a-w- c:\windows\system32\drivers\mfefirek.sys
    2013-02-19 12:53 . 2012-08-16 06:23 309840 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
    2013-02-19 12:52 . 2012-06-22 05:34 179280 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
    2013-02-12 05:45 . 2013-03-13 05:21 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
    2013-02-12 05:45 . 2013-03-13 05:21 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
    2013-02-12 05:45 . 2013-03-13 05:21 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
    2013-02-12 05:45 . 2013-03-13 05:21 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
    2013-02-12 04:48 . 2013-03-13 05:21 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
    2013-02-12 04:48 . 2013-03-13 05:21 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
    2013-01-13 21:17 . 2013-02-28 05:07 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
    2013-01-13 21:17 . 2013-02-28 05:07 2560 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
    2013-01-13 21:16 . 2013-02-28 05:07 10752 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
    2013-01-13 21:12 . 2013-02-28 05:07 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
    2013-01-13 21:11 . 2013-02-28 05:07 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
    2013-01-13 21:11 . 2013-02-28 05:07 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
    2013-01-13 21:11 . 2013-02-28 05:07 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
    2013-01-13 21:11 . 2013-02-28 05:07 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
    2013-01-13 21:11 . 2013-02-28 05:07 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
    2013-01-13 20:35 . 2013-02-28 05:07 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
    2013-01-13 20:35 . 2013-02-28 05:07 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
    2013-01-13 20:35 . 2013-02-28 05:07 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
    2013-01-13 20:32 . 2013-02-28 05:07 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
    2013-01-13 20:31 . 2013-02-28 05:07 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
    2013-01-13 20:31 . 2013-02-28 05:07 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
    2013-01-13 20:31 . 2013-02-28 05:07 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
    2013-01-13 20:31 . 2013-02-28 05:07 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
    2013-01-13 20:31 . 2013-02-28 05:07 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
    2013-01-13 20:31 . 2013-02-28 05:07 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll
    2013-01-13 20:22 . 2013-02-28 05:07 1988096 ----a-w- c:\windows\SysWow64\d3d10warp.dll
    2013-01-13 20:20 . 2013-02-28 05:07 293376 ----a-w- c:\windows\SysWow64\dxgi.dll
    2013-01-13 20:09 . 2013-02-28 05:07 249856 ----a-w- c:\windows\SysWow64\d3d10_1core.dll
    2013-01-13 20:08 . 2013-02-28 05:07 220160 ----a-w- c:\windows\SysWow64\d3d10core.dll
    2013-01-13 20:08 . 2013-02-28 05:07 1504768 ----a-w- c:\windows\SysWow64\d3d11.dll
    2013-01-13 19:59 . 2013-02-28 05:07 1643520 ----a-w- c:\windows\system32\DWrite.dll
    2013-01-13 19:58 . 2013-02-28 05:07 1175552 ----a-w- c:\windows\system32\FntCache.dll
    2013-01-13 19:54 . 2013-02-28 05:07 604160 ----a-w- c:\windows\SysWow64\d3d10level9.dll
    2013-01-13 19:53 . 2013-02-28 05:07 207872 ----a-w- c:\windows\SysWow64\WindowsCodecsExt.dll
    2013-01-13 19:53 . 2013-02-28 05:07 187392 ----a-w- c:\windows\SysWow64\UXXXimation.dll
    2013-01-13 19:51 . 2013-02-28 05:07 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
    2013-01-13 19:49 . 2013-02-28 05:07 363008 ----a-w- c:\windows\system32\dxgi.dll
    2013-01-13 19:48 . 2013-02-28 05:07 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
    2013-01-13 19:46 . 2013-02-28 05:07 1080832 ----a-w- c:\windows\SysWow64\d3d10.dll
    2013-01-13 19:43 . 2013-02-28 05:07 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
    2013-01-13 19:38 . 2013-02-28 05:07 333312 ----a-w- c:\windows\system32\d3d10_1core.dll
    2013-01-13 19:38 . 2013-02-28 05:07 1887232 ----a-w- c:\windows\system32\d3d11.dll
    2013-01-13 19:38 . 2013-02-28 05:07 296960 ----a-w- c:\windows\system32\d3d10core.dll
    2013-01-13 19:37 . 2013-02-28 05:07 3419136 ----a-w- c:\windows\SysWow64\d2d1.dll
    2013-01-13 19:25 . 2013-02-28 05:07 245248 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
    2013-01-13 19:24 . 2013-02-28 05:07 648192 ----a-w- c:\windows\system32\d3d10level9.dll
    2013-01-13 19:24 . 2013-02-28 05:07 221184 ----a-w- c:\windows\system32\UXXXimation.dll
    2013-01-13 19:20 . 2013-02-28 05:07 194560 ----a-w- c:\windows\system32\d3d10_1.dll
    2013-01-13 19:20 . 2013-02-28 05:07 1238528 ----a-w- c:\windows\system32\d3d10.dll
    2013-01-13 19:15 . 2013-02-28 05:07 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
    2013-01-13 19:10 . 2013-02-28 05:07 3928064 ----a-w- c:\windows\system32\d2d1.dll
    2013-01-13 19:02 . 2013-02-28 05:07 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
    2013-01-13 18:34 . 2013-02-28 05:07 364544 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
    2013-01-13 18:32 . 2013-02-28 05:07 465920 ----a-w- c:\windows\system32\WMPhoto.dll
    2013-01-13 18:09 . 2013-02-28 05:07 522752 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2013-01-13 17:26 . 2013-02-28 05:07 1158144 ----a-w- c:\windows\SysWow64\XpsPrint.dll
    2013-01-13 17:05 . 2013-02-28 05:07 1682432 ----a-w- c:\windows\system32\XpsPrint.dll
    2013-01-05 05:53 . 2013-02-13 05:33 5553512 ----a-w- c:\windows\system32\ntoskrnl.exe
    2013-01-05 05:00 . 2013-02-13 05:33 3967848 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
    2013-01-05 05:00 . 2013-02-13 05:33 3913064 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
    2013-01-04 06:11 . 2013-02-28 05:07 2284544 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
    2013-01-04 06:11 . 2013-02-28 05:07 2776576 ----a-w- c:\windows\system32\msmpeg2vdec.dll
    2013-01-04 05:46 . 2013-02-13 05:32 215040 ----a-w- c:\windows\system32\winsrv.dll
    2013-01-04 04:51 . 2013-02-13 05:32 5120 ----a-w- c:\windows\SysWow64\wow32.dll
    2013-01-04 04:43 . 2013-02-13 05:32 44032 ----a-w- c:\windows\apppatch\acwow64.dll
    2013-01-04 03:26 . 2013-02-13 05:32 3153408 ----a-w- c:\windows\system32\win32k.sys
    2013-01-04 02:47 . 2013-02-13 05:32 25600 ----a-w- c:\windows\SysWow64\setup16.exe
    2013-01-04 02:47 . 2013-02-13 05:32 7680 ----a-w- c:\windows\SysWow64\instnm.exe
    2013-01-04 02:47 . 2013-02-13 05:32 2048 ----a-w- c:\windows\SysWow64\user.exe
    2013-01-04 02:47 . 2013-02-13 05:32 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
    .
    .
  • kws
    kws Posts: 43 Forumite
    Rest of log

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2013-02-22 16:59 1722976 ----a-w- c:\progra~2\MIF5BA~1\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2013-02-22 16:59 1722976 ----a-w- c:\progra~2\MIF5BA~1\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2013-02-22 16:59 1722976 ----a-w- c:\progra~2\MIF5BA~1\Office15\GROOVEEX.DLL
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-01-08 18705664]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
    "iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2012-12-17 59872]
    "ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2012-12-17 59872]
    "com.apple.dav.bookmarks.daemon"="c:\program files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe" [2012-12-17 59872]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]
    "ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2011-04-13 2018032]
    "ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe" [2011-02-23 731472]
    "SonicMasterTray"="c:\program files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-10 984400]
    "ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2011-07-21 5716608]
    "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
    "HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
    "Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2011-09-09 2317312]
    "UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
    "UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
    "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2013-01-14 1534504]
    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
    "nurago-WatchDog"="c:\program files (x86)\nuragoLSPService\nurago-WatchDog.exe" [2013-03-26 60536]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
    .
    c:\users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    FancyStart daemon.lnk - c:\windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe [2011-11-29 12862]
    nurago-TrayIcon.lnk - c:\program files (x86)\nurago web meter\nurago-TrayIcon.exe [2013-3-2 171640]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
    "LoadAppInit_DLLs"=1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux1"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-07-08 123856]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2013-02-19 218760]
    R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\NLSSRV32.EXE [2012-07-08 69640]
    R2 nurago-Reporting-Service;nurago-Reporting-Service;c:\program files (x86)\nurago web meter\nurago-Reporting.exe [2013-03-26 3022456]
    R2 nuragoLSPService;nuragoLSPService;c:\program files (x86)\nuragoLSPService\nuragoLSPService.exe [2013-03-26 3302520]
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]
    R2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-08-24 2735528]
    R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-21 2656280]
    R3 HipShieldK;McAfee Inc. HipShieldK;c:\windows\system32\drivers\HipShieldK.sys [2012-04-20 196440]
    R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2013-02-19 106552]
    R3 MySQL55;MySQL55;c:\program files\MySQL\MySQL Server 5.5\bin\mysqld --defaults-file=c:\programdata\MySQL\MySQL Server 5.5\my.ini MySQL55 [x]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
    R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-06-22 1255736]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
    S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2013-02-19 340216]
    S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [2012-10-24 85104]
    S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys [2012-10-24 70296]
    S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-09-07 17536]
    S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2011-01-25 379520]
    S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]
    S2 ASUS InstantOn;ASUS InstantOn Service;c:\program files (x86)\Common Files\InstantOn\InsOnSrv.exe [2011-08-24 92800]
    S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]
    S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]
    S2 McNaXXXn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]
    S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2013-02-19 182752]
    S2 nurago-Update-Service;nurago-Update-Service;c:\program files (x86)\nurago web meter\nurago-Updater.exe [2013-03-26 1377912]
    S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2012-10-11 918680]
    S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-06-02 128488]
    S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-06-02 401896]
    S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2013-02-19 70112]
    S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2010-12-31 138024]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440]
    S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-08-24 76912]
    S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2013-02-19 515968]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - mfeavfk01
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
    iissvcs REG_MULTI_SZ w3svc was
    apphost REG_MULTI_SZ apphostsvc
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2013-04-03 19:22 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.43\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2013-04-03 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-07 18:23]
    .
    2013-04-03 c:\windows\Tasks\FinalTorrent Update Checker.job
    - c:\program files (x86)\FinalTorrent\FTCheckForUpdates.exe [2012-11-13 13:24]
    .
    2013-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-26 21:07]
    .
    2013-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-26 21:07]
    .
    .
    X64 Entries
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2013-02-22 17:04 2325624 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2013-02-22 17:04 2325624 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2013-02-22 17:04 2325624 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
    @="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
    [HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
    2010-09-02 08:41 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
    @="{64174815-8D98-4CE6-8646-4C039977D808}"
    [HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
    2010-09-02 08:41 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2011-03-21 361984]
    "RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-08-16 2277480]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-10-10 171040]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-10-10 399392]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2012-10-10 441888]
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
    FontCache
    .
    Supplementary Scan
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://www.google.co.uk/
    mStart Page = hxxp://asus.msn.com
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office15\EXCEL.EXE/3000
    IE: Microsoft Excel'e &Ver - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~2\MIF5BA~1\Office15\ONBttnIE.dll/105
    TCP: DhcpNameServer = 195.186.1.162 195.186.4.162
    Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    Wow6432Node-HKLM-Run-HF_G_Jul - c:\program files (x86)\AVG Secure Search\HF_G_Jul.exe
    Toolbar-Locked - (no file)
    HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
    HKLM-Run-Setwallpaper - c:\programdata\SetWallpaper.cmd
    AddRemove-ASUS_Screensaver - c:\windows\system32\ASUS_Screensaver.scr
    .
    .
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MySQL55]
    "ImagePath"="\"c:\program files\MySQL\MySQL Server 5.5\bin\mysqld\" --defaults-file=\"c:\programdata\MySQL\MySQL Server 5.5\my.ini\" MySQL55"
    .
    LOCKED REGISTRY KEYS
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.11"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
    @="?????????????????? v1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
    @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
    @="?????????????????? v2"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
    @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
    "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
    @Denied: (A) (Everyone)
    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
    @Denied: (A) (Everyone)
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
    "Key"="ActionsPane3"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0\Solutions\http://schemas.microsoft.com/office/smartdocuments/2003\0]
    "Key"="http://schemas.microsoft.com/office/smartdocuments/2003"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0\Solutions\http://schemas.microsoft.com/office/smartdocuments/2003\0\{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}\Alias]
    "0"="Microsoft Actions Pane 3"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip]
    "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Other Running Processes
    .
    c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
    c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
    c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    c:\program files (x86)\Common Files\InstantOn\InsOnWMI.exe
    c:\program files (x86)\Windows Live\Family Safety\fsssvc.exe
    c:\windows\SysWOW64\rundll32.exe
    c:\windows\SysWOW64\vmnat.exe
    c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
    c:\windows\SysWOW64\vmnetdhcp.exe
    c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
    c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
    c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
    .
    **************************************************************************
    .
    Completion time: 2013-04-04 02:45:16 - machine was rebooted
    ComboFix-quarantined-files.txt 2013-04-04 00:45
    .
    Pre-Run: 222,248,341,504 bytes free
    Post-Run: 222,087,147,520 bytes free
    .
    - - End Of File - - 64A5774F5850B249752DBFA98A5E4097
  • waddler_8
    waddler_8 Posts: 3,588 Forumite
    That looks ok to be honest.

    Go to virustotal & upload this file:
    C:\Qoobox\Quarantine\c\windows\SysWow64\d2d1debug1.dll.vir

    Choose file > browse to file > scan it > reanalyse if its been scanned before.

    Include a link to the report here or copy/paste the SHA256 value
  • kws
    kws Posts: 43 Forumite
    Here is the SHA256 from Virus Total

    898a945f757a5162a7213c330e02f9c15aa0d392da7af685382f245b338bb0e8
  • waddler_8
    waddler_8 Posts: 3,588 Forumite
    It's a false positive.

    Run this combofix script to dequarantine it (Ity'll not do a full run). If combofix tells you there is a newer version available, update it.
    • Open Notepad
    • Copy and paste the text present inside the code box below (Don't include Code:)
    DeQuarantine::
C:\Qoobox\Quarantine\c\windows\SysWow64\d2d1debug1.dll.vir
c:\windows\SysWow64\d2d1debug1.dll
Quit::
    • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
    • Temporarily disable Mcafee before following the steps below
    • CFScriptB-4.gif
    • Drag CFScript.txt into ComboFix.exe as the screenshot above shows.
    • ComboFix will run. DeQuarantine_log.txt will open.
    • Copy and paste the contents here.
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 350.8K Banking & Borrowing
  • 253.1K Reduce Debt & Boost Income
  • 453.5K Spending & Discounts
  • 243.8K Work, Benefits & Business
  • 598.7K Mortgages, Homes & Bills
  • 176.8K Life & Family
  • 257.1K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16.1K Discuss & Feedback
  • 37.6K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture