Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads

User Tag List

Possible crss infection

This is a discussion on Possible crss infection within the Resolved HJT Threads forums, part of the Tech Support Forum category. Its been a long time sine I have had any problems I am super careful but got an email with


 
 
Thread Tools Search this Thread
Old 12-11-2015, 12:45 AM   #1
Registered Member
 
Join Date: May 2007
Posts: 55
OS: MS 7



Its been a long time sine I have had any problems I am super careful but got an email with a link and along with a [email protected], I clicked it and as it was launching my browser I closed it. I figured I kept any issues out since it did nto launch my browser. I may have been wrong.

I use panda for virus protection

It wasn't till about a month later I noticed abnormal amount of CPU usage when using chrome and firefox from time to time (seems to have no rhyme or reason based on what I have noticed. When I looked at processes running I spotted crss listed but no CPU usage ascribed to it. It was then I remembered hitting that link

I'm not sure if it is causing a problem, I've right-clicked to delete and got a window box (I saw that means it could be legit).

So I checked back in here...

Tried stopping the process, ran deep Panda Scan what I could, it is still there.

I tried system restore but it failed

I had cleaned up my computer a while back, removed some stupid stuff ( avg removed which does not seem to bother me any more) and it was screaming (for my purposes) but it is old. I back up regularly so it was backed up with the crss on there. (system image as well)

Here ya go:

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17041 BrowserJavaVersion: 10.55.2
Run by James Kirwin at 3:23:20 on 2015-12-11
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.7990.6331 [GMT -5:00]
.
AV: Panda Free Antivirus *Disabled/Updated* {AAF74A68-8713-CDF1-004F-30003398BE9E}
SP: Panda Free Antivirus *Disabled/Updated* {1196AB8C-A129-C27F-3AFF-0B72481FF423}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Panda Firewall *Disabled* {92CCCB4D-CD7C-CCA9-2B10-9935CD4BF9E5}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\vcsFPService.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k NetworkService
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\IDT\WDM\AESTSr64.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\SwSetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
C:\Program Files\Panda Security URL Filtering\Panda_URL_Filteringb.exe
C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files (x86)\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\CCleaner\CCleaner64.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreamsDownloader.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.google.com
uProxyOverride = <-loopback>
uURLSearchHooks: {D8278076-BC68-4484-9233-6E7F1628B56C} - <orphaned>
uURLSearchHooks: {A3BC75A2-1F87-4686-AA43-5347D756017C} - <orphaned>
dURLSearchHooks: {A3BC75A2-1F87-4686-AA43-5347D756017C} - <orphaned>
mWinlogon: Userinit = userinit.exe,
BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Skype Click to Call for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: Panda Security Toolbar: {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll
BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: Panda Security Toolbar: {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
uRun: [Google Update] "C:\Users\James Kirwin\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
uRun: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
uRun: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun: [PSUAMain] "C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe" /LaunchSysTray
mRun: [Panda Security URL Filtering] "C:\Program Files\Panda Security URL Filtering\Panda_URL_Filtering.exe"
dRunOnce: [panda] reg.exe delete "HKCU\Software\AppDataLow\Software\panda" /f
dRunOnce: [panda_XP] reg.exe delete "HKCU\Software\panda" /f
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: MaxGPOScriptWait = dword:600
IE: &ieSpell Options - C:\Program Files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Check &Spelling - C:\Program Files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000
IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: Lookup on Merriam Webster - C:\Program Files (x86)\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - C:\Program Files (x86)\ieSpell\wikipedia.HTM
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} - hxxp://www.caminova.net/en/downloads/getmodule.aspx?lang=en
DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} - hxxps://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB
DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxp://kitchenplanner.ikea.com/US/Core/Player/2020PlayerAX_Win32.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab
DPF: {8BE5651C-D60B-4B59-B5B2-F0EB93733D17} - hxxps://www36.verizon.com/FiOSVoice/UnProtected/FiosVoiceVMUtil.CAB
DPF: {CAFEEFAC-0017-0000-0055-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{50C5D11D-8D32-4AFA-B881-FCCA4F35FD78} : DHCPNameServer = 172.20.10.1
TCP: Interfaces\{AA3A7119-B258-4E6D-90B5-814A458C02AC} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{AA3A7119-B258-4E6D-90B5-814A458C02AC}\14E67656C61672370284F6D65602E4564777F627B6 : DHCPNameServer = 192.168.2.1
TCP: Interfaces\{AA3A7119-B258-4E6D-90B5-814A458C02AC}\2656C6B696E6E2432623E2765756374737 : DHCPNameServer = 192.168.169.1
TCP: Interfaces\{AA3A7119-B258-4E6D-90B5-814A458C02AC}\2656C6B696E6E253166323 : DHCPNameServer = 192.168.2.1
TCP: Interfaces\{AA3A7119-B258-4E6D-90B5-814A458C02AC}\74F6F676C6560235471627265736B637 : DHCPNameServer = 8.8.8.8 8.8.4.4
TCP: Interfaces\{AA3A7119-B258-4E6D-90B5-814A458C02AC}\84F4D454D263142473 : DHCPNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{AA3A7119-B258-4E6D-90B5-814A458C02AC}\D4168737D21637B602245656274756E64656270266F62702163636563737 : DHCPNameServer = 192.168.2.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
SSODL: WebCheck - <orphaned>
LSA: Notification Packages = Error!
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.80\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
mASetup: {A6EADE66-0000-0000-484E-7E8A45000000} - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll",CreateReaderUserSettings
x64-mStart Page = hxxp://www.google.com
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: Skype Click to Call for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-BHO: Panda Security Toolbar: {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-TB: Panda Security Toolbar: {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
x64-Run: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe /hidden
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-Run: [HP LaserJet 200 color MFP M276 Series Fax] C:\Program Files (x86)\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe "HP LaserJet 200 color MFP M276 Series Fax"
x64-Run: [BrightAdjustTool] C:\Program Files (x86)\Nova Star\NovaLCT-Mars\Bin\BrightAdjustTool\BrightAdjustTool.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
x64-IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\
FF - prefs.js: keyword.URL - hxxp://pandasecurity.mystart.com/results.php?pr=vmn&id=pandasecuritytb&v=4_3&idate=2015-06-26&ent=tb____campaignID___&mkt=us&u=AD504C14F4F2BEC820E596558DB172AA&q=
FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\James Kirwin\AppData\Local\Citrix\Plugins\104\npappdetector.dll
FF - plugin: C:\Users\James Kirwin\AppData\Local\Google\Update\1.3.29.1\npGoogleUpdate3.dll
FF - plugin: C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}\plugins\npGarmin.dll
FF - plugin: C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\extensions\[email protected]\plugins\npLogitechDeviceDetection.dll
FF - plugin: C:\Users\James Kirwin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
FF - plugin: C:\Users\James Kirwin\AppData\Roaming\Mozilla\plugins\npo1d.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll
FF - ExtSQL: !HIDDEN! 2011-02-08 09:46; [email protected]; C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
============= SERVICES / DRIVERS ===============
.
R1 Avgfwfd;AVG network filter service;C:\Windows\System32\drivers\avgfwd6a.sys [2010-7-12 57696]
R1 DVMIO;DeviceVM IO Service;C:\Windows\System32\drivers\dvmio.sys [2009-11-11 20056]
R1 NNSALPC;NNSALPC;C:\Windows\System32\drivers\NNSAlpc.sys [2015-7-9 94456]
R1 NNSHTTP;NNSHTTP;C:\Windows\System32\drivers\NNSHttp.sys [2015-7-9 201976]
R1 NNSHTTPS;NNSHTTPS;C:\Windows\System32\drivers\NNSHttps.sys [2015-7-9 110840]
R1 NNSIDS;NNSIDS;C:\Windows\System32\drivers\NNSIds.sys [2015-7-9 110840]
R1 NNSNAHSL;Network Activity Hook Server LightWeight Filter Driver;C:\Windows\System32\drivers\NNSNAHSL.sys [2015-5-20 57648]
R1 NNSPICC;NNSPICC;C:\Windows\System32\drivers\NNSpicc.sys [2015-7-9 103160]
R1 NNSPIHSW;NNSPIHSW;C:\Windows\System32\drivers\NNSPihsw.sys [2015-8-31 73464]
R1 NNSPOP3;NNSPOP3;C:\Windows\System32\drivers\NNSPop3.sys [2015-7-9 124152]
R1 NNSPROT;NNSPROT;C:\Windows\System32\drivers\NNSProt.sys [2015-7-9 300280]
R1 NNSPRV;NNSPRV;C:\Windows\System32\drivers\NNSPrv.sys [2015-7-9 170232]
R1 NNSSMTP;NNSSMTP;C:\Windows\System32\drivers\NNSSmtp.sys [2015-7-9 113400]
R1 NNSSTRM;NNSSTRM;C:\Windows\System32\drivers\NNSStrm.sys [2015-7-9 257784]
R1 NNSTLSC;NNSTLSC;C:\Windows\System32\drivers\NNStlsc.sys [2015-7-9 106232]
R1 PSINKNC;PSINKNC;C:\Windows\System32\drivers\PSINKNC.sys [2015-7-19 197880]
R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-5-10 89600]
R2 Apple Mobile Device Service;Apple Mobile Device Service;C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2015-1-19 77128]
R2 DvmMDES;DeviceVM Meta Data Export Service;C:\SwSetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe [2010-6-25 338168]
R2 HP LaserJet Service;HP LaserJet Service;C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [2012-5-2 164864]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-6-18 103992]
R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2009-7-8 30520]
R2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe [2014-4-1 49464]
R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-11-9 26680]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-12-4 13336]
R2 NanoServiceMain;Panda Protection Service;C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [2015-10-18 142072]
R2 panda_url_filtering;panda_url_filtering Service;C:\Program Files\Panda Security URL Filtering\Panda_URL_Filteringb.exe -- --> C:\Program Files\Panda Security URL Filtering\Panda_URL_Filteringb.exe -- [?]
R2 PandaAgent;Panda Devices Agent;C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [2015-10-28 73464]
R2 PSINAflt;PSINAflt;C:\Windows\System32\drivers\PSINAflt.sys [2015-7-19 164088]
R2 PSINFile;PSINFile;C:\Windows\System32\drivers\PSINFile.sys [2015-7-19 121592]
R2 PSINProc;PSINProc;C:\Windows\System32\drivers\PSINProc.sys [2015-7-19 124152]
R2 PSINProt;PSINProt;C:\Windows\System32\drivers\PSINProt.sys [2015-7-19 134392]
R2 PSINReg;PSINReg;C:\Windows\System32\drivers\PSINReg.sys [2015-7-19 107768]
R2 PSUAService;Panda Product Service;C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [2015-10-22 38136]
R2 UNS;Intel(R) Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-4 2533400]
R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2010-2-23 2192176]
R3 clwvd;HP Webcam Splitter;C:\Windows\System32\drivers\clwvd.sys [2010-6-25 32880]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2010-12-4 56344]
R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2010-12-4 158976]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2010-12-4 271872]
R3 panda_url_filteringd;panda_url_filteringd driver;C:\Program Files\Panda Security URL Filtering\Panda_URL_Filteringd.sys [2014-3-19 51288]
R3 wdkmd;Intel WiDi KMD;C:\Windows\System32\drivers\WDKMD.sys [2010-4-16 39832]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-10-23 172192]
S3 AmUStor;AM USB Stroage Driver;C:\Windows\System32\drivers\AmUStor.sys [2011-5-10 51712]
S3 btwampfl;Bluetooth AMP USB Filter;C:\Windows\System32\drivers\btwampfl.sys [2010-12-4 342056]
S3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2010-12-4 39464]
S3 HP DS Service;HP DS Service;C:\Program Files (x86)\HP\HPBDSService\HPBDSService.exe [2011-10-17 13824]
S3 HtcUsbMdmV64;HTC Proprietary USB Driver;C:\Windows\System32\drivers\HtcUsbMdmV64.sys [2011-3-5 121800]
S3 HtcVCom32;HTC Diagnostic Port;C:\Windows\System32\drivers\HtcVComV64.sys [2011-3-5 121800]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-5-11 111616]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-5-14 192216]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-3-5 340240]
S3 Netaapl;Apple Mobile Device Ethernet Service;C:\Windows\System32\drivers\netaapl64.sys [2013-7-25 23040]
S3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\System32\drivers\NETw5s64.sys [2010-3-18 7680512]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368]
S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]
S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-12-4 349800]
S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;C:\Windows\System32\drivers\silabenm.sys [2015-7-29 27336]
S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;C:\Windows\System32\drivers\silabser.sys [2015-7-29 70656]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-7-1 59392]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2014-8-15 54784]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-1-26 1255736]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-10 389120]
S4 AVG Security Toolbar Service;AVG Security Toolbar Service;C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe --> C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [?]
S4 c2cautoupdatesvc;Skype Click to Call Updater;C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2015-5-1 1394816]
S4 c2cpnrsvc;Skype Click to Call PNR Service;C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2015-5-1 1772672]
S4 File Backup;File Backup Service;C:\Program Files (x86)\Starfield\offSyncService.exe [2011-2-2 1215216]
S4 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2014-9-18 14624]
.
=============== Created Last 30 ================
.
2015-12-11 01:12:29 75888 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{AEB3F429-5245-49D5-9602-525537328FFF}\offreg.5364.dll
2015-12-08 18:55:53 61712 ----a-w- C:\Windows\System32\drivers\PSKMAD.sys
2015-12-04 12:43:18 75888 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{AEB3F429-5245-49D5-9602-525537328FFF}\offreg.5588.dll
2015-12-02 22:20:56 -------- d-----w- C:\Users\James Kirwin\AppData\Local\Downloaded Installations
2015-12-02 17:49:23 -------- d-----w- C:\Program Files\Panda Security URL Filtering
2015-12-02 17:49:01 -------- d-----w- C:\Program Files (x86)\pandasecuritytb
2015-11-28 18:41:58 75888 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{AEB3F429-5245-49D5-9602-525537328FFF}\offreg.4896.dll
2015-11-28 18:41:02 11138400 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{AEB3F429-5245-49D5-9602-525537328FFF}\mpengine.dll
.
==================== Find3M ====================
.
2015-12-11 01:02:45 796864 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2015-12-11 01:02:45 142528 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2015-12-04 12:11:20 192216 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2015-10-27 14:45:00 76384 ----a-w- C:\Windows\SysWow64\libusb0.dll
2015-10-27 14:45:00 52832 ----a-w- C:\Windows\SysWow64\drivers\libusb0.sys
2015-10-05 14:50:18 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys
2015-10-05 14:50:10 109272 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
2015-10-05 14:50:06 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys
.
============= FINISH: 3:23:36.84 ===============
Attached Files
File Type: txt attach.txt (14.2 KB, 259 views)
Jkirwin is offline  
Sponsored Links
Advertisement
 
Old 12-18-2015, 09:13 AM   #2
Registered Member
 
Join Date: May 2007
Posts: 55
OS: MS 7



Bump?
Jkirwin is offline  
Old 12-19-2015, 07:17 PM   #3
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar

Microsoft Most Valuable Professional
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



Hello and Welcome to TSF.

If you haven't already, please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

------------------------------------------------------

**Note - Please do NOT upgrade your OS to Windows 10 until your machine is clean, and we have uninstalled all our removal tools. Thanks.

------------------------------------------------------

Please download AdwCleaner from here and save it to your desktop.
  • Run AdwCleaner and select Scan
  • Once the Scan is done, select Cleaning
  • Once done it will ask to reboot, please allow the reboot.
  • On reboot, a log will be produced. It can also be found at C:\AdwCleaner\AdwCleaner[C#].txt
  • Please copy/paste the contents of the log in your next reply.
------------------------------------------------------

Please download Farbar Recovery Scan Tool and save it to your desktop.
  • Double-click FRST64 to run it. When the tool opens click Yes to the disclaimer.
  • Make sure the Addition.txt button is ticked.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply.
------------------------------------------------------
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
Sponsored Links
Advertisement
 
Old 12-19-2015, 09:23 PM   #4
Registered Member
 
Join Date: May 2007
Posts: 55
OS: MS 7



# AdwCleaner v5.025 - Logfile created 20/12/2015 at 00:04:22
# Updated 13/12/2015 by Xplode
# Database : 2015-12-13.2 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : James Kirwin - JAMESKIRWIN-HP
# Running from : C:\Users\James Kirwin\Desktop\AdwCleaner.exe
# Option : Cleaning
# Support : Forum - ToolsLib

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\Users\James Kirwin\AppData\Local\YSearchUtil
[-] Folder Deleted : C:\Windows\SysWOW64\config\systemprofile\AppData\Local\YSearchUtil

***** [ Files ] *****


***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! SearchSet

***** [ Web browsers ] *****

[-] [C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\prefs.js] [Preference] Deleted : user_pref("keyword.URL", "hxxp://pandasecurity.mystart.com/results.php?pr=vmn&id=pandasecuritytb&v=4_3&idate=2015-06-26&ent=tb____campaignID___&mkt=us&u=AD504C14F4F2BEC820E596558DB172AA&q=");

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C3].txt - [1257 bytes] ##########


Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:19-12-2015
Ran by James Kirwin (administrator) on JAMESKIRWIN-HP (20-12-2015 00:11:54)
Running from C:\Users\James Kirwin\Desktop
Loaded Profiles: James Kirwin (Available Profiles: James Kirwin & Guest)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(DeviceVM, Inc.) C:\SwSetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe
(HP) C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
(Visicom Media Inc.) C:\Program Files\Panda Security URL Filtering\Panda_URL_Filteringb.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2010-09-13] (Synaptics Incorporated)
HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1928976 2010-03-05] (Intel(R) Corporation)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2011-05-10] (Alcor Micro Corp.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-05-10] (IDT, Inc.)
HKLM\...\Run: [HP LaserJet 200 color MFP M276 Series Fax] => C:\Program Files (x86)\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe [3706424 2011-10-09] (Hewlett-Packard Company)
HKLM\...\Run: [BrightAdjustTool] => C:\Program Files (x86)\Nova Star\NovaLCT-Mars\Bin\BrightAdjustTool\BrightAdjustTool.exe
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586296 2010-11-09] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [54520 2015-10-22] (Panda Security, S.L.)
HKLM-x32\...\Run: [Panda Security URL Filtering] => "C:\Program Files\Panda Security URL Filtering\Panda_URL_Filtering.exe"
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7021880 2015-12-18] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\Run: [Google Update] => C:\Users\James Kirwin\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-30] (Google Inc.)
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\MountPoints2: F - F:\TL-Bootstrap.exe
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\MountPoints2: {a656459c-4be0-11e0-b182-b9b1c4761543} - G:\TL-Bootstrap.exe
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\MountPoints2: {acc286f2-e8a3-11e0-a658-dab51169ef79} - G:\TL-Bootstrap.exe
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\MountPoints2: {cbb0af62-532b-11e0-860d-aefe312e2c93} - G:\TL-Bootstrap.exe
HKU\S-1-5-18\...\RunOnce: [panda] => reg.exe delete "HKCU\Software\AppDataLow\Software\panda" /f
HKU\S-1-5-18\...\RunOnce: [panda_XP] => reg.exe delete "HKCU\Software\panda" /f
Lsa: [Notification Packages]
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-12-18] (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2011-02-08]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
GroupPolicyScripts-x32: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:65242;https=127.0.0.1:65242
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{50C5D11D-8D32-4AFA-B881-FCCA4F35FD78}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{AA3A7119-B258-4E6D-90B5-814A458C02AC}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT/1
SearchScopes: HKLM -> {2C9CBC53-FF66-4768-A3DE-A8DCA29C69BB} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
SearchScopes: HKLM -> {8C59D559-FB2D-476E-BFF3-C7D74A197EBC} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {9E46111C-472C-44A6-89A1-08BE7F016E4C} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM -> {B5870DAD-0C3E-4A0E-A02F-75060EF099CA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {8C59D559-FB2D-476E-BFF3-C7D74A197EBC} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {9E46111C-472C-44A6-89A1-08BE7F016E4C} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {B5870DAD-0C3E-4A0E-A02F-75060EF099CA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL =
SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> {2DA851A9-9BA1-4AA3-915E-1120AD8EAD17} URL = hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> {8C59D559-FB2D-476E-BFF3-C7D74A197EBC} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> {9E46111C-472C-44A6-89A1-08BE7F016E4C} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> {B5870DAD-0C3E-4A0E-A02F-75060EF099CA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-12-18] (AVAST Software)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-12-19] (Google Inc.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Panda Security Toolbar -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -> C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll [2015-10-05] ()
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2010-05-28] (Hewlett-Packard Co.)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-12-18] (AVAST Software)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-12-19] (Google Inc.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Panda Security Toolbar -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -> C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll [2015-10-05] ()
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2010-05-28] (Hewlett-Packard Co.)
Toolbar: HKLM - Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll [2015-10-05] ()
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-12-19] (Google Inc.)
Toolbar: HKLM-x32 - Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll [2015-10-05] ()
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-12-19] (Google Inc.)
Toolbar: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Toolbar: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-12-19] (Google Inc.)
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: HKLM-x32 {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} hxxp://www.caminova.net/en/downloads/getmodule.aspx?lang=en
DPF: HKLM-x32 {1851174C-97BD-4217-A0CC-E908F60D5B7A} hxxps://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB
DPF: HKLM-x32 {1C11B948-582A-433F-A98D-A8C4D5CC64F2} hxxp://kitchenplanner.ikea.com/US/Core/Player/2020PlayerAX_Win32.cab
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: HKLM-x32 {8BE5651C-D60B-4B59-B5B2-F0EB93733D17} hxxps://www36.verizon.com/FiOSVoice/UnProtected/FiosVoiceVMUtil.CAB
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll [2010-04-17] (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll [2010-04-17] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-04-08] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default
FF DefaultSearchEngine.US: Google
FF Homepage: hxxp://www.google.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-10] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-10] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [No File]
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-04-17] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2845901189-3817738784-3823200384-1001: @citrixonline.com/appdetectorplugin -> C:\Users\James Kirwin\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-03-20] (Citrix Online)
FF Plugin HKU\S-1-5-21-2845901189-3817738784-3823200384-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\James Kirwin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-2845901189-3817738784-3823200384-1001: @talk.google.com/O1DPlugin -> C:\Users\James Kirwin\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-2845901189-3817738784-3823200384-1001: @tools.google.com/Google Update;version=3 -> C:\Users\James Kirwin\AppData\Local\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin HKU\S-1-5-21-2845901189-3817738784-3823200384-1001: @tools.google.com/Google Update;version=9 -> C:\Users\James Kirwin\AppData\Local\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdjvu.dll [2011-03-21] (Caminova, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2015-02-22] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2015-02-22] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2015-02-22] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2015-02-22] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2015-02-22] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\James Kirwin\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\James Kirwin\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF SearchPlugin: C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\searchplugins\yahoo-web.xml [2015-12-11]
FF Extension: Garmin Communicator - C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2015-06-09]
FF Extension: Updated Ad Blocker for Firefox 11+ - C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}.xpi [2015-06-09]
FF Extension: Logitech Device Detection - C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\Extensions\[email protected] [2013-10-15] [not signed]
FF Extension: Lightbeam - C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\Extensions\[email protected] [2015-12-04]
FF Extension: New Tab by Yahoo - C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\Extensions\[email protected] [2015-10-08] [not signed]
FF Extension: Panda Security Toolbar - C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\Extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [2015-06-26] [not signed]
FF Extension: Adblock Plus - C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-12-17]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-05-01] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-18]
FF HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-02-08] [not signed]

Chrome:
=======
CHR HomePage: Profile 1 -> hxxp://start.mysearchdial.com/?f=1&a=irmsd103&cd=2XzuyEtN2Y1L1QzutDtDtByC0CyB0D0A0B0BtDyDtCyCtC0DtN0D0Tzu0SyCzzyBtN1L2XzutBtFtBtFtCtAtFtCtAtAzztN1L1CzutCtD1B1P1R&cr=1521708419&ir=
CHR StartupUrls: Profile 1 -> "hxxps://www.google.com/"
CHR DefaultSearchURL: Profile 1 -> hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=orcl_default
CHR DefaultSearchKeyword: Profile 1 -> Yahoo
CHR DefaultSuggestURL: Profile 1 -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR Profile: C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Google Docs) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-12]
CHR Extension: (Google Drive) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-13]
CHR Extension: (YouTube) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-27]
CHR Extension: (Google Search) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-13]
CHR Extension: (User-Agent Switcher for Chrome) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\djflhoibgkdhkhhcedjiklpkjnoahfmg [2015-04-06]
CHR Extension: (Google Docs Offline) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-20]
CHR Extension: (AdBlock) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-12-05]
CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hokdglbhghcebcopdbanieangmcamaak [2014-04-24] [UpdateUrl: hxxp://www.interoperabilitybridges.com/ChromeWMP/wmpChromeupdates.xml] <==== ATTENTION
CHR Extension: (Skype Click to Call) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-11-13]
CHR Extension: (Boomerang for Gmail) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\mdanidgdpmkimeiiojknlnekblgmpdll [2015-02-21]
CHR Extension: (Chrome Web Store Payments) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-02]
CHR Extension: (Gmail) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-31]
CHR HKLM-x32\...\Chrome\Extension: [aaffhmecfaelkngcbnfdkcckmillnoki] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-12-18]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [226440 2015-12-18] (AVAST Software)
S4 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
S4 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 DvmMDES; C:\SwSetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe [338168 2010-06-25] (DeviceVM, Inc.)
S4 File Backup; C:\Program Files (x86)\Starfield\offSyncService.exe [1215216 2011-02-02] (Starfield Technologies, Inc.)
S3 HP DS Service; C:\Program Files (x86)\HP\HPBDSService\HPBDSService.exe [13824 2011-10-17] (Hewlett-Packard Company) [File not signed]
R2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [164864 2012-05-02] (HP) [File not signed]
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [49464 2014-04-01] (Hewlett-Packard Company)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [142072 2015-10-18] (Panda Security, S.L.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2011-04-13] (Hewlett-Packard) [File not signed]
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [73464 2015-10-28] (Panda Security, S.L.)
R2 panda_url_filtering; C:\Program Files\Panda Security URL Filtering\Panda_URL_Filteringb.exe [287752 2015-10-02] (Visicom Media Inc.)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2011-04-13] (Hewlett-Packard) [File not signed]
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2015-10-22] (Panda Security, S.L.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-12-18] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [97648 2015-12-18] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-12-18] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-12-18] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1055560 2015-12-18] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [451040 2015-12-18] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [155304 2015-12-18] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [273784 2015-12-18] (AVAST Software)
S3 DSI_SiUSBXp_3_1; C:\Windows\System32\drivers\DSI_SiUSBXp_3_1.sys [16384 2007-09-06] (Silicon Laboratories)
R1 DVMIO; C:\Windows\System32\DRIVERS\dvmio.sys [20056 2009-11-11] (DeviceVM, Inc.)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 HtcUsbMdmV64; C:\Windows\System32\DRIVERS\HtcUsbMdmV64.sys [121800 2010-03-08] (QUALCOMM Incorporated) [File not signed]
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-08] (QUALCOMM Incorporated) [File not signed]
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2015-12-04] (Malwarebytes)
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [94456 2015-07-09] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [201976 2015-07-09] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [110840 2015-07-09] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [110840 2015-07-09] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [57648 2015-05-20] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [103160 2015-07-09] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [73464 2015-08-31] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [124152 2015-07-09] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [300280 2015-07-09] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [170232 2015-07-09] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [113400 2015-07-09] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [257784 2015-07-09] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [106232 2015-07-09] (Panda Security, S.L.)
R3 panda_url_filteringd; C:\Program Files\Panda Security URL Filtering\panda_url_filteringd.sys [51288 2014-03-19] (Visicom Media Inc.)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [164088 2015-07-19] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [121592 2015-07-19] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [197880 2015-07-19] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [124152 2015-07-19] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [134392 2015-07-19] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [107768 2015-07-19] (Panda Security, S.L.)
U3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [61712 2015-05-22] (Panda Security, S.L.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-20 00:11 - 2015-12-20 00:12 - 00032629 _____ C:\Users\James Kirwin\Desktop\FRST.txt
2015-12-20 00:11 - 2015-12-20 00:11 - 00000000 ____D C:\FRST
2015-12-20 00:10 - 2015-12-20 00:10 - 02370048 _____ (Farbar) C:\Users\James Kirwin\Desktop\FRST64.exe
2015-12-20 00:06 - 2015-05-22 03:45 - 00061712 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2015-12-19 23:56 - 2015-12-19 23:56 - 01740288 _____ C:\Users\James Kirwin\Desktop\AdwCleaner.exe
2015-12-18 22:44 - 2015-12-18 22:41 - 00386096 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-12-18 22:42 - 2015-12-18 22:42 - 00001922 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-12-18 22:42 - 2015-12-18 22:42 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
2015-12-18 22:42 - 2015-12-18 22:42 - 00000000 ____D C:\Users\James Kirwin\AppData\Roaming\AVAST Software
2015-12-18 22:42 - 2015-12-18 22:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-12-18 22:42 - 2015-12-18 22:42 - 00000000 ____D C:\Program Files\Common Files\AV
2015-12-18 22:41 - 2015-12-18 22:44 - 00003924 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-12-18 22:41 - 2015-12-18 22:42 - 00451040 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-12-18 22:41 - 2015-12-18 22:42 - 00097648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-12-18 22:41 - 2015-12-18 22:41 - 01055560 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2015-12-18 22:41 - 2015-12-18 22:41 - 00273784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2015-12-18 22:41 - 2015-12-18 22:41 - 00155304 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-12-18 22:41 - 2015-12-18 22:41 - 00093528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-12-18 22:41 - 2015-12-18 22:41 - 00065224 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2015-12-18 22:41 - 2015-12-18 22:41 - 00043112 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-12-18 22:41 - 2015-12-18 22:41 - 00028656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2015-12-18 22:40 - 2015-12-18 22:40 - 00000000 ____D C:\Program Files\AVAST Software
2015-12-18 22:39 - 2015-12-18 22:39 - 05066096 _____ (AVAST Software) C:\Users\James Kirwin\Downloads\avast_free_antivirus_setup_online.exe
2015-12-18 22:39 - 2015-12-18 22:39 - 00000000 ____D C:\ProgramData\AVAST Software
2015-12-18 15:53 - 2015-12-20 00:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-12-17 13:18 - 2015-12-17 13:18 - 00464882 _____ C:\Users\James Kirwin\Downloads\New Millennium Gaming, LLC.pdf
2015-12-12 14:47 - 2015-12-12 14:47 - 00111985 _____ C:\Users\James Kirwin\Documents\Pay stub JJK Oct.pdf
2015-12-12 14:45 - 2015-12-12 14:45 - 00111787 _____ C:\Users\James Kirwin\Documents\Pay stub JJK Nov.pdf
2015-12-11 20:39 - 2015-12-11 20:39 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-12-11 20:39 - 2015-12-11 20:39 - 00000000 ____D C:\Users\James Kirwin\AppData\Roaming\Sun
2015-12-11 20:39 - 2015-12-11 20:39 - 00000000 ____D C:\Users\James Kirwin\.oracle_jre_usage
2015-12-11 20:39 - 2015-12-11 20:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-12-11 20:37 - 2015-12-11 20:37 - 00000000 ____D C:\Users\James Kirwin\AppData\LocalLow\Oracle
2015-12-11 20:34 - 2015-12-11 20:34 - 00584288 _____ (Oracle Corporation) C:\Users\James Kirwin\Desktop\jxpiinstall.exe
2015-12-11 20:19 - 2015-12-20 00:04 - 00000000 ____D C:\AdwCleaner
2015-12-11 06:09 - 2015-12-11 06:10 - 00085304 _____ C:\Users\James Kirwin\Downloads\techstars-series-aa-model-documents.zip
2015-12-11 03:17 - 2015-12-11 03:17 - 00688992 ____R (Swearware) C:\Users\James Kirwin\Downloads\dds(1).scr
2015-12-10 10:03 - 2015-12-10 10:03 - 00016327 _____ C:\Users\James Kirwin\Downloads\Countries for patents - 13270-6(1) Kirwin FINAL2.xlsx
2015-12-10 09:33 - 2015-12-10 09:33 - 00203450 _____ C:\Users\James Kirwin\Documents\James Kirwin 2015Dec.pdf
2015-12-09 22:19 - 2015-12-10 10:03 - 00016327 _____ C:\Users\James Kirwin\Downloads\Countries for patents - 13270-6(1) Kirwin FINAL.xlsx
2015-12-09 22:09 - 2015-12-09 22:09 - 00013952 _____ C:\Users\James Kirwin\Downloads\Countries for patents - 13270-6(1).xlsx
2015-12-04 07:10 - 2015-12-04 07:11 - 00113528 _____ C:\Windows\ntbtlog.txt
2015-12-03 21:11 - 2015-12-03 21:12 - 03092247 _____ C:\Users\James Kirwin\Downloads\timingcover.zip
2015-12-03 11:34 - 2015-12-03 11:35 - 03109614 _____ C:\Users\James Kirwin\Downloads\oilpan.zip
2015-12-03 10:08 - 2015-12-03 10:16 - 00003563 _____ C:\Users\James
2015-12-03 10:02 - 2015-12-03 10:02 - 00000000 ____D C:\Users\James Kirwin\Documents\Wondershare Dr.Fone for iOS
2015-12-03 10:02 - 2015-12-03 10:02 - 00000000 ____D C:\Users\James Kirwin\Documents\Wondershare Dr.Fone for iOS
2015-12-03 08:07 - 2015-12-08 13:54 - 00000000 ____D C:\Users\James Kirwin\Downloads\ProcessExplorer
2015-12-03 08:06 - 2015-12-03 08:06 - 01125626 _____ C:\Users\James Kirwin\Downloads\ProcessExplorer.zip
2015-12-03 08:00 - 2015-12-03 08:00 - 02523624 _____ (Hewlett-Packard Development Company, L.P. ) C:\Users\James Kirwin\Downloads\sp44620(1).exe
2015-12-02 18:23 - 2015-12-08 13:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Free Antivirus
2015-12-02 17:20 - 2015-12-02 17:20 - 00000000 ____D C:\Users\James Kirwin\AppData\Local\Downloaded Installations
2015-12-02 13:03 - 2015-12-02 13:03 - 00053455 _____ C:\Users\James Kirwin\Downloads\International Gaming Tables(2).xlsx
2015-12-02 12:49 - 2015-12-08 13:54 - 00000000 ____D C:\Program Files\Panda Security URL Filtering
2015-12-02 12:49 - 2015-12-08 13:54 - 00000000 ____D C:\Program Files (x86)\pandasecuritytb
2015-12-01 20:26 - 2015-12-01 20:26 - 00013820 _____ C:\Users\James Kirwin\Downloads\Countries for patents - 13270-6.xlsx
2015-12-01 12:48 - 2015-12-01 12:48 - 00051373 _____ C:\Users\James Kirwin\Downloads\NMG-Diagram of Game Changing.pdf
2015-11-25 13:58 - 2015-11-25 13:58 - 00219483 _____ C:\Users\James Kirwin\Downloads\Full Page Front 85x11 22615.pdf
2015-11-25 13:56 - 2015-11-25 13:56 - 01035131 _____ C:\Users\James Kirwin\Downloads\rephotofromoct2014photostream.zip
2015-11-22 22:04 - 2015-12-08 13:54 - 00000000 ____D C:\Users\James Kirwin\Documents\Firestone Nove 22_files
2015-11-22 22:04 - 2015-11-22 22:04 - 00136955 _____ C:\Users\James Kirwin\Documents\Firestone Nove 22.htm
2015-11-21 21:36 - 2015-11-21 22:53 - 00425667 _____ C:\Users\James Kirwin\Documents\ViggenMSRP.pptx
2015-11-21 21:11 - 2015-11-21 21:11 - 00513499 _____ C:\Users\James Kirwin\Downloads\38729l437.zip
2015-11-21 15:53 - 2015-11-21 15:53 - 00225811 _____ C:\Users\James Kirwin\Downloads\000450.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-20 00:11 - 2009-07-14 00:13 - 00782510 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-20 00:11 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\inf
2015-12-20 00:11 - 2009-07-13 22:20 - 00000000 ____D C:\Windows
2015-12-20 00:09 - 2011-01-23 17:31 - 00000188 _____ C:\Users\James Kirwin\AppData\Local\mv_Photo.xml
2015-12-20 00:08 - 2015-04-06 21:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-12-20 00:06 - 2011-08-13 16:52 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-20 00:05 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-20 00:03 - 2014-01-09 09:56 - 00000000 ____D C:\Users\James Kirwin\Documents\Outlook Files
2015-12-19 23:58 - 2011-08-13 16:52 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-19 23:54 - 2014-01-09 09:56 - 00000000 ____D C:\Users\James Kirwin\AppData\Local\407945DA-7AA0-4547-BD61-D904061716C4.aplzod
2015-12-19 23:53 - 2011-06-22 14:53 - 00000936 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2845901189-3817738784-3823200384-1001UA.job
2015-12-19 23:17 - 2014-08-05 05:02 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-12-19 15:21 - 2015-06-26 15:10 - 00000000 ____D C:\ProgramData\panda_url_filtering
2015-12-18 15:14 - 2011-06-22 14:53 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2845901189-3817738784-3823200384-1001Core.job
2015-12-17 13:56 - 2009-07-13 23:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-17 13:56 - 2009-07-13 23:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-16 19:17 - 2014-02-12 12:47 - 00000000 ____D C:\Users\James Kirwin\Documents\NMG Files
2015-12-16 19:00 - 2013-10-17 11:00 - 00002143 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-16 13:55 - 2011-04-25 03:07 - 00000000 ____D C:\Users\James Kirwin\AppData\Roaming\Mozilla
2015-12-13 21:08 - 2009-07-14 00:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2015-12-13 20:31 - 2014-04-26 11:18 - 00000000 ____D C:\Users\James Kirwin\Documents\Asorted Docs
2015-12-13 16:36 - 2011-01-23 17:31 - 00000131 _____ C:\Users\James Kirwin\AppData\Local\mv_music.xml
2015-12-12 16:04 - 2015-04-05 19:15 - 00000000 ____D C:\Users\James Kirwin\Documents\TurboTax
2015-12-11 20:41 - 2011-05-23 12:39 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2015-12-11 20:39 - 2011-01-23 17:21 - 00000000 ____D C:\Users\James Kirwin
2015-12-11 20:38 - 2013-10-04 11:03 - 00000000 ____D C:\ProgramData\Oracle
2015-12-11 20:38 - 2010-10-26 14:32 - 00000000 ____D C:\Program Files (x86)\Java
2015-12-11 20:20 - 2011-05-23 12:39 - 00000000 ____D C:\Users\James Kirwin\AppData\LocalLow\Yahoo!
2015-12-11 03:23 - 2015-08-31 01:06 - 00028413 _____ C:\Users\James Kirwin\Desktop\dds.txt
2015-12-11 03:23 - 2015-08-31 01:06 - 00014500 _____ C:\Users\James Kirwin\Desktop\attach.txt
2015-12-10 20:02 - 2014-08-17 13:08 - 00000000 ____D C:\Users\James Kirwin\AppData\Local\Adobe
2015-12-10 20:02 - 2014-08-05 05:02 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-12-10 20:02 - 2014-05-14 18:01 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-12-10 20:02 - 2014-05-14 18:01 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-08 13:55 - 2013-10-17 11:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-08 13:55 - 2010-10-26 12:17 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-12-08 13:54 - 2015-08-31 21:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-12-08 13:54 - 2015-08-31 21:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-12-08 13:54 - 2013-09-11 19:55 - 00000000 ___HD C:\Program Files (x86)\Dr.Fone_Temp
2015-12-08 13:54 - 2011-11-13 10:35 - 00000000 ____D C:\Windows\system32\Macromed
2015-12-08 13:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy
2015-12-08 13:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\NDF
2015-12-08 13:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration
2015-12-08 13:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\AppCompat
2015-12-08 13:10 - 2011-02-08 09:44 - 00000000 ____D C:\Users\James Kirwin\AppData\Roaming\HpUpdate
2015-12-05 10:33 - 2011-04-29 16:34 - 00000000 ____D C:\Users\James Kirwin\AppData\Local\ElevatedDiagnostics
2015-12-04 07:11 - 2014-05-14 12:52 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-12-03 10:02 - 2015-02-22 10:47 - 00001271 _____ C:\Users\Public\Desktop\Wondershare Dr.Fone for iOS.lnk
2015-12-03 10:02 - 2013-10-14 04:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
2015-12-03 09:39 - 2014-02-01 10:26 - 00000000 ____D C:\Users\James Kirwin\Documents\NMG Graphics
2015-12-03 08:07 - 2014-06-28 16:47 - 00002028 _____ C:\Users\James Kirwin\Desktop\Eula.txt
2015-12-02 18:51 - 2011-12-08 14:25 - 00000000 ____D C:\Users\James Kirwin\AppData\Local\Apple Computer
2015-12-02 18:28 - 2011-01-23 17:26 - 00124296 _____ C:\Users\James Kirwin\AppData\Local\GDIPFONTCACHEV1.DAT
2015-12-02 18:28 - 2009-07-13 23:45 - 00502648 _____ C:\Windows\system32\FNTCACHE.DAT
2015-12-02 18:26 - 2011-01-23 17:29 - 00000000 ____D C:\Users\James Kirwin\AppData\Local\EgisTec
2015-12-02 18:26 - 2010-10-26 12:42 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2015-12-02 18:26 - 2010-10-26 12:15 - 00000000 ____D C:\Program Files (x86)\Hewlett-Packard
2015-12-02 13:18 - 2011-01-23 17:33 - 00301728 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-12-02 12:49 - 2015-06-26 15:08 - 00000000 ____D C:\Program Files (x86)\Panda Security
2015-12-02 12:48 - 2011-06-22 14:53 - 00003920 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2845901189-3817738784-3823200384-1001UA
2015-12-02 12:48 - 2011-06-22 14:53 - 00003524 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2845901189-3817738784-3823200384-1001Core
2015-12-02 03:53 - 2011-08-13 16:52 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-02 03:53 - 2011-08-13 16:52 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-11-25 14:00 - 2015-08-12 06:05 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-11-22 05:42 - 2011-05-23 09:09 - 00007603 _____ C:\Users\James Kirwin\AppData\Local\Resmon.ResmonCfg

==================== Files in the root of some directories =======

2011-02-08 09:49 - 2012-01-09 11:27 - 0001311 _____ () C:\Users\James Kirwin\AppData\Roaming\ConvAPIPlugin.log
2011-05-25 06:02 - 2011-07-12 13:22 - 0001854 _____ () C:\Users\James Kirwin\AppData\Roaming\GhostObjGAFix.xml
2011-03-30 20:29 - 2011-05-16 15:29 - 0002155 _____ () C:\Users\James Kirwin\AppData\Roaming\SAS7_000.DAT
2013-12-19 10:18 - 2014-03-31 00:10 - 0000141 _____ () C:\Users\James Kirwin\AppData\Roaming\WB.CFG
2011-01-23 17:31 - 2015-12-13 16:36 - 0000131 _____ () C:\Users\James Kirwin\AppData\Local\mv_music.xml
2011-01-23 17:31 - 2015-12-20 00:09 - 0000188 _____ () C:\Users\James Kirwin\AppData\Local\mv_Photo.xml
2011-05-23 09:09 - 2015-11-22 05:42 - 0007603 _____ () C:\Users\James Kirwin\AppData\Local\Resmon.ResmonCfg
2011-11-10 14:51 - 2011-11-10 14:51 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-04-05 19:13 - 2015-04-12 10:05 - 0000469 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2010-12-04 22:31 - 2010-12-04 22:31 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
2010-10-26 14:10 - 2010-10-26 14:11 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2010-12-04 22:30 - 2010-12-04 22:30 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
2010-10-26 14:07 - 2010-10-26 14:07 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2010-12-04 22:30 - 2010-12-04 22:30 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
2010-12-04 22:31 - 2010-12-04 22:31 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
2010-10-26 14:06 - 2010-10-26 14:07 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2010-10-26 14:07 - 2010-10-26 14:10 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
2010-12-04 22:31 - 2010-12-04 22:31 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log

Some files in TEMP:
====================
C:\Users\James Kirwin\AppData\Local\Temp\DeleteInstall.exe
C:\Users\James Kirwin\AppData\Local\Temp\ImationLOCKv229.exe
C:\Users\James Kirwin\AppData\Local\Temp\rwxeyqrh.dll
C:\Users\James Kirwin\AppData\Local\Temp\sqlite3.dll
C:\Users\James Kirwin\AppData\Local\Temp\xReflect.exe
C:\Users\James Kirwin\AppData\Local\Temp\ytb.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-12-10 17:29

==================== End of FRST.txt ============================
Attached Files
File Type: txt Addition.txt (57.9 KB, 32 views)
Jkirwin is offline  
Old 12-20-2015, 12:36 AM   #5
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar

Microsoft Most Valuable Professional
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



Hello Jkirwin. I don't think crss is infected. Please refrain from deleting anything on your own.

Why did you install avast! while aready running Panda?

------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper.

------------------------------------------------------

If there are any personal files, pics, etc. on your computer you cannot live without, back them up now just as a precaution.

If you haven't done so already, create a system repair disc. It's really easy and quick.

How To Create a Windows 7 System Repair Disc [Easy]

------------------------------------------------------
  • Open Notepad (Start > All Programs > Accessories > Notepad).
  • Please copy all the text in the codebox below. (To do this highlight the contents of the box, right-click on it and select Copy. Right-click in the open Notepad and select Paste).
  • Save it as fixlist.txt next to FRST64.exe
  • If asked to change 'Encoding:' to 'Unicode:', please agree and save it.

    NOTE: Both FRST64.exe and the fixlist.txt must be in the same location or the fix will not work.


    Code:
    start
    createrestorepoint:
    AVG PC TuneUp 2015 (en-US) (x32 Version: 15.0.1001.403 - AVG Technologies) Hidden
    Panda Free Antivirus (Version: 8.04.00.0000 - Panda Security) Hidden
    CustomCLSID: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\James Kirwin\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll => No File
    CustomCLSID: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\James Kirwin\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll => No File
    CustomCLSID: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}\InprocServer32 -> C:\Users\James Kirwin\AppData\Local\Google\Update\1.3.28.13\psuser_64.dll => No File
    CustomCLSID: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\James Kirwin\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll => No File
    CustomCLSID: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\James Kirwin\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll => No File
    Task: {041742B3-A3C9-4860-B56E-DA84E65C19C4} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\AVG\AVG PC TuneUp\OneClick.exe [2015-02-25] (AVG Technologies)
    Task: {DBF5FC50-AC0C-40DA-9614-476090BB7DC1} - \MySearchDial -> No File <==== ATTENTION
    AlternateDataStreams: C:\ProgramData\Temp:0B4227B4
    AlternateDataStreams: C:\ProgramData\Temp:0FF263E8
    FirewallRules: [{B26A5A8E-4A61-4C8B-A521-205EFF7EAFC1}] => (Allow) C:\Program Files (x86)\AVG\AVG10\avgdiagex.exe
    FirewallRules: [{13FE2E82-7D26-47BA-A54E-4F31E658BF47}] => (Allow) C:\Program Files (x86)\AVG\AVG10\avgdiagex.exe
    HKLM-x32\...\Run: [] => [X]
    HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\MountPoints2: F - F:\TL-Bootstrap.exe
    HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\MountPoints2: {a656459c-4be0-11e0-b182-b9b1c4761543} - G:\TL-Bootstrap.exe
    HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\MountPoints2: {acc286f2-e8a3-11e0-a658-dab51169ef79} - G:\TL-Bootstrap.exe
    HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\MountPoints2: {cbb0af62-532b-11e0-860d-aefe312e2c93} - G:\TL-Bootstrap.exe
    HKU\S-1-5-18\...\RunOnce: [panda] => reg.exe delete "HKCU\Software\AppDataLow\Software\panda" /f
    HKU\S-1-5-18\...\RunOnce: [panda_XP] => reg.exe delete "HKCU\Software\panda" /f
    GroupPolicyScripts-x32: Restriction <======= ATTENTION
    ProxyEnable: [.DEFAULT] => Proxy is enabled.
    ProxyServer: [.DEFAULT] => http=127.0.0.1:65242;https=127.0.0.1:65242
    SearchScopes: HKLM -> {2C9CBC53-FF66-4768-A3DE-A8DCA29C69BB} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL =
    Toolbar: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [No File]
    FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll [No File]
    C:\Program Files\McAfee Security Scan
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
    FF SearchPlugin: C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\searchplugins\yahoo-web.xml [2015-12-11]
    CHR HomePage: Profile 1 -> hxxp://start.mysearchdial.com/?f=1&a=irmsd103&cd=2XzuyEtN2Y1L1QzutDtDtByC0CyB0D0A0B0BtDyDtCyCtC0DtN0D0Tzu0SyCzzyBtN1L2XzutBtFtBtFtCtAtFtCtAtAzztN1L1CzutCtD1B1P1R&cr=1521708419&ir=
    CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hokdglbhghcebcopdbanieangmcamaak [2014-04-24] [UpdateUrl: hxxp://www.interoperabilitybridges.com/ChromeWMP/wmpChromeupdates.xml] <==== ATTENTION
    CHR HKLM-x32\...\Chrome\Extension: [aaffhmecfaelkngcbnfdkcckmillnoki] - hxxps://clients2.google.com/service/update2/crx
    Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\AVG Security Toolbar Service" /f
    Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk" /f
    Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnTBMon" /f
    Reg: reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /s
    Reg: reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS" /s
    File: C:\Windows\System32\vssvc.exe
    EmptyTemp:
    end
  • Double-click FRST64 to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
  • Click the Fix button just once, and wait.
  • If you receive a message that a reboot is required, please make sure you allow it to restart normally.
  • The tool will complete its run after the restart.
  • When finished, the tool will make a log (Fixlog.txt) in the same location from where it was run. Please post the Fixlog.txt log in your reply.

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

------------------------------------------------------
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
Old 12-20-2015, 06:37 AM   #6
Registered Member
 
Join Date: May 2007
Posts: 55
OS: MS 7



Hello Chemist, thanks for your continued help.

I disabled Panda and then installed and ran Avast since I saw Panda files were using memory and I felt may have been slowing my computer. If I need to completely unistall one let me know I will uninstall the Panda that I am not using.

Here is the Fixlog

Fix result of Farbar Recovery Scan Tool (x64) Version:19-12-2015
Ran by James Kirwin (2015-12-20 09:28:34) Run:1
Running from C:\Users\James Kirwin\Desktop
Loaded Profiles: James Kirwin (Available Profiles: James Kirwin & Guest)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
createrestorepoint:
AVG PC TuneUp 2015 (en-US) (x32 Version: 15.0.1001.403 - AVG Technologies) Hidden
Panda Free Antivirus (Version: 8.04.00.0000 - Panda Security) Hidden
CustomCLSID: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\James Kirwin\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\James Kirwin\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}\InprocServer32 -> C:\Users\James Kirwin\AppData\Local\Google\Update\1.3.28.13\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\James Kirwin\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\James Kirwin\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll => No File
Task: {041742B3-A3C9-4860-B56E-DA84E65C19C4} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\AVG\AVG PC TuneUp\OneClick.exe [2015-02-25] (AVG Technologies)
Task: {DBF5FC50-AC0C-40DA-9614-476090BB7DC1} - \MySearchDial -> No File <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:0B4227B4
AlternateDataStreams: C:\ProgramData\Temp:0FF263E8
FirewallRules: [{B26A5A8E-4A61-4C8B-A521-205EFF7EAFC1}] => (Allow) C:\Program Files (x86)\AVG\AVG10\avgdiagex.exe
FirewallRules: [{13FE2E82-7D26-47BA-A54E-4F31E658BF47}] => (Allow) C:\Program Files (x86)\AVG\AVG10\avgdiagex.exe
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\MountPoints2: F - F:\TL-Bootstrap.exe
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\MountPoints2: {a656459c-4be0-11e0-b182-b9b1c4761543} - G:\TL-Bootstrap.exe
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\MountPoints2: {acc286f2-e8a3-11e0-a658-dab51169ef79} - G:\TL-Bootstrap.exe
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\...\MountPoints2: {cbb0af62-532b-11e0-860d-aefe312e2c93} - G:\TL-Bootstrap.exe
HKU\S-1-5-18\...\RunOnce: [panda] => reg.exe delete "HKCU\Software\AppDataLow\Software\panda" /f
HKU\S-1-5-18\...\RunOnce: [panda_XP] => reg.exe delete "HKCU\Software\panda" /f
GroupPolicyScripts-x32: Restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:65242;https=127.0.0.1:65242
SearchScopes: HKLM -> {2C9CBC53-FF66-4768-A3DE-A8DCA29C69BB} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL =
Toolbar: HKU\S-1-5-21-2845901189-3817738784-3823200384-1001 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [No File]
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll [No File]
C:\Program Files\McAfee Security Scan
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF SearchPlugin: C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\searchplugins\yahoo-web.xml [2015-12-11]
CHR HomePage: Profile 1 -> hxxp://start.mysearchdial.com/?f=1&a=irmsd103&cd=2XzuyEtN2Y1L1QzutDtDtByC0CyB0D0A0B0BtDyDtCyCtC0DtN0D0Tzu0SyCzzyBtN1L2XzutBtFtBtFtCtAtFtCtAtAzztN1L1CzutCtD1B1P1R&cr=1521708419&ir=
CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hokdglbhghcebcopdbanieangmcamaak [2014-04-24] [UpdateUrl: hxxp://www.interoperabilitybridges.com/ChromeWMP/wmpChromeupdates.xml] <==== ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [aaffhmecfaelkngcbnfdkcckmillnoki] - hxxps://clients2.google.com/service/update2/crx
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\AVG Security Toolbar Service" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnTBMon" /f
Reg: reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /s
Reg: reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS" /s
File: C:\Windows\System32\vssvc.exe
EmptyTemp:
end
*****************

Restore point was successfully created.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4AC74ED1-719B-46DA-8B8A-340FBF892291}\\SystemComponent => value removed successfully
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{293AA48A-DFC2-4F7D-9ED7-1A0F25CB5368}\\SystemComponent => value removed successfully
"HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}" => key removed successfully
"HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}" => key removed successfully
"HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}" => key removed successfully
"HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}" => key removed successfully
"HKU\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{041742B3-A3C9-4860-B56E-DA84E65C19C4}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{041742B3-A3C9-4860-B56E-DA84E65C19C4}" => key removed successfully
C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\TuneUpUtilities_Task_BkGndMaintenance2013" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DBF5FC50-AC0C-40DA-9614-476090BB7DC1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DBF5FC50-AC0C-40DA-9614-476090BB7DC1}" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MySearchDial => key not found.
C:\ProgramData\Temp => ":0B4227B4" ADS removed successfully.
C:\ProgramData\Temp => ":0FF263E8" ADS removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{B26A5A8E-4A61-4C8B-A521-205EFF7EAFC1} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{13FE2E82-7D26-47BA-A54E-4F31E658BF47} => value removed successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
"HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F" => key removed successfully
"HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a656459c-4be0-11e0-b182-b9b1c4761543}" => key removed successfully
HKCR\CLSID\{a656459c-4be0-11e0-b182-b9b1c4761543} => key not found.
"HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{acc286f2-e8a3-11e0-a658-dab51169ef79}" => key removed successfully
HKCR\CLSID\{acc286f2-e8a3-11e0-a658-dab51169ef79} => key not found.
"HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cbb0af62-532b-11e0-860d-aefe312e2c93}" => key removed successfully
HKCR\CLSID\{cbb0af62-532b-11e0-860d-aefe312e2c93} => key not found.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\panda => value removed successfully
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\panda_XP => value removed successfully
C:\Windows\SysWOW64\GroupPolicy\Machine => moved successfully
C:\Windows\SysWOW64\GroupPolicy\GPT.ini => moved successfully
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value removed successfully
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value removed successfully
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2C9CBC53-FF66-4768-A3DE-A8DCA29C69BB}" => key removed successfully
HKCR\CLSID\{2C9CBC53-FF66-4768-A3DE-A8DCA29C69BB} => key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully
HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
"HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
"HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}" => key removed successfully
HKCR\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} => key not found.
HKU\S-1-5-21-2845901189-3817738784-3823200384-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => value removed successfully
HKCR\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => key not found.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer" => key removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@mcafee.com/McAfeeMssPlugin" => key removed successfully
"C:\Program Files\McAfee Security Scan" => not found.
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully
C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\searchplugins\yahoo-web.xml => moved successfully
Chrome HomePage => removed successfully
C:\Users\James Kirwin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hokdglbhghcebcopdbanieangmcamaak <==== ATTENTION => not found
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\aaffhmecfaelkngcbnfdkcckmillnoki" => key removed successfully

========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\AVG Security Toolbar Service" /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk" /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnTBMon" /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /s =========


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
auditbaseobjects REG_DWORD 0x0
auditbasedirectories REG_DWORD 0x0
crashonauditfail REG_DWORD 0x0
fullprivilegeauditing REG_BINARY 00
Bounds REG_BINARY 0030000000200000
LimitBlankPasswordUse REG_DWORD 0x1
NoLmHash REG_DWORD 0x1
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0tspkg\0pku2u
Authentication Packages REG_MULTI_SZ msv1_0
LsaPid REG_DWORD 0x318
SecureBoot REG_DWORD 0x1
ProductType REG_DWORD 0x3
disabledomaincreds REG_DWORD 0x0
everyoneincludesanonymous REG_DWORD 0x0
forceguest REG_DWORD 0x0
restrictanonymous REG_DWORD 0x0
restrictanonymoussam REG_DWORD 0x1
Notification Packages REG_MULTI_SZ

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders
MartaExtension REG_SZ ntmarta.dll
ProviderOrder REG_MULTI_SZ Windows NT Access Provider

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider
ProviderPath REG_EXPAND_SZ %SystemRoot%\system32\ntmarta.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy
AuditPolicySD REG_BINARY 01000000D08C9DDF0115D1118C7A00C04FC297EB010000000F412EF247F9084E8F2A8F65DF603F8D000000201C0000004100750064006900740050006F006C00690063007900530044000000106600000001000020000000526040245E306A9D5A5693B0DC1B7D386D4711246CBB7AA8C77420177369BDEA000000000E8000000002000020000000E31A4B3A21866FB1AC0701F72B2EE36E1FC9DE1C98C035AB80EBB988AAD89DB070000000C7D205CAD2E57920D6FCC6A9D177973BC0DFC7362E194993FA64C1346AF5EB4595462101E58D9D127E86E1FDEFE6C2CDBEE2ADFD337FDFB8B92E7B0EACE5953213381CC51D585CF79A1331AA3817989FAECD358C9BFF542099B1B84A0534AC923CFD327BBE01CD9A8D8ABD3E85D29F8640000000BB9942A6FF3F51C8FEDC2661D8D77DD6E67DFDB8BA434F0E5F48536B43AE35E6468D9DD7195E0D631C9CDF0E2ED4F5D77118EB924A7C491E9A41F8EC00F0473C

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp
DebugLogLevel REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowDefaultCredentials

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowDefaultCredentialsDomain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowDefaultCredentialsWhenNTLMOnly

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowDefaultCredentialsWhenNTLMOnlyDomain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowFreshCredentials

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowFreshCredentialsDomain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowFreshCredentialsWhenNTLMOnly

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowFreshCredentialsWhenNTLMOnlyDomain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowSavedCredentials

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowSavedCredentialsDomain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowSavedCredentialsWhenNTLMOnly

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\AllowSavedCredentialsWhenNTLMOnlyDomain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenyDefaultCredentials

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenyDefaultCredentialsDomain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenyFreshCredentials

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenyFreshCredentialsDomain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenySavedCredentials

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults\DenySavedCredentialsDomain

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Data
Pattern REG_BINARY 6CD1C9465A912AC60C55833E0F3E9544

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
Enabled REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\GBG
GrafBlumGroup REG_BINARY 49498DA78036E4254E

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\JD
Lookup REG_BINARY 9477A03F6E31

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\HostToRealm

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
Auth132 REG_SZ IISSUBA
NtlmMinClientSec REG_DWORD 0x20000000
NtlmMinServerSec REG_DWORD 0x20000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Skew1
SkewMatrix REG_BINARY 8413A8A4B1DC304C525ED99E67D7F05D

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO\Passport1.4
SSOURL REG_SZ https://www.passport.com

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache
Time REG_BINARY D7598D064A1ACD01

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\credssp.dll
Name REG_SZ CREDSSP
Comment REG_SZ Microsoft CredSSP Security Provider
Capabilities REG_DWORD 0x10733
RpcId REG_DWORD 0xffff
Version REG_DWORD 0x1
TokenSize REG_DWORD 0x90a8
Time REG_BINARY 40BBDA77B688CB01
Type REG_DWORD 0x21



========= End of Reg: =========


========= reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS" /s =========


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS
DisplayName REG_SZ @%systemroot%\system32\vssvc.exe,-102
ImagePath REG_EXPAND_SZ %systemroot%\system32\vssvc.exe
Description REG_SZ @%systemroot%\system32\vssvc.exe,-101
ObjectName REG_SZ LocalSystem
ErrorControl REG_DWORD 0x1
Start REG_DWORD 0x3
Type REG_DWORD 0x10
DependOnService REG_MULTI_SZ RPCSS
ServiceSidType REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\SPP
SppGetSnapshots (Enter) REG_BINARY 480000000000000094BDCB1BE53AD101C009000048150000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
SppGetSnapshots (Leave) REG_BINARY 480000000000000085F15C1CE53AD101C009000048150000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
SppEnumGroups (Enter) REG_BINARY 480000000000000085F15C1CE53AD101C009000048150000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
SppEnumGroups (Leave) REG_BINARY 4800000000000000E5525F1CE53AD101C009000048150000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
SppCreate (Enter) REG_BINARY 4800000000000000C312E8B5323BD1016C0B0000D80F0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
SppGatherWriterMetadata (Enter) REG_BINARY 4800000000000000E436EFB5323BD1016C0B0000D80F0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
SppGatherWriterMetadata (Leave) REG_BINARY 480000000000000056F4E3BA323BD1016C0B0000D80F0000D30700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
SppAddInterestingComponents (Enter) REG_BINARY 480000000000000056F4E3BA323BD1016C0B0000D80F0000D40700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
SppAddInterestingComponents (Leave) REG_BINARY 4800000000000000BF8132BB323BD1016C0B0000D80F0000D40700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
SppCreate (Leave) REG_BINARY 4800000000000000313F27C0323BD1016C0B0000D80F0000D00700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\SystemRestore
SrCreateRp (Enter) REG_BINARY 4800000000000000428DDEB5323BD101B01C000010130000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
SrCreateRp (Leave) REG_BINARY 4800000000000000313F27C0323BD101B01C000010130000D50700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\ASR Writer
IDENTIFY (Enter) REG_BINARY 4800000000000000055BF6B5323BD101681900000C1A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
IDENTIFY (Leave) REG_BINARY 4800000000000000267FFDB5323BD101681900000C1A0000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\BITS Writer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\COM+ REGDB Writer
IDENTIFY (Enter) REG_BINARY 4800000000000000055BF6B5323BD1016819000044140000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
IDENTIFY (Leave) REG_BINARY 4800000000000000267FFDB5323BD1016819000044140000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
PREPAREBACKUP (Enter) REG_BINARY 4800000000000000B2C0D6BB323BD101681900000C1A0000E9030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPAREBACKUP (Leave) REG_BINARY 4800000000000000F408E5BB323BD101681900000C1A0000E9030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_STABLE (SetCurrentState) REG_BINARY 4800000000000000F408E5BB323BD101681900000C1A000001000000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Enter) REG_BINARY 4800000000000000E74789BC323BD101681900000C1A0000F9030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Leave) REG_BINARY 480000000000000047A98BBC323BD101681900000C1A0000F9030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPARESNAPSHOT (Enter) REG_BINARY 4800000000000000CD46E8BE323BD10168190000E41E0000EA030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPARESNAPSHOT (Leave) REG_BINARY 4800000000000000D15C0EBF323BD10168190000E41E0000EA030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) REG_BINARY 4800000000000000D15C0EBF323BD10168190000E41E000002000000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Enter) REG_BINARY 4800000000000000A88DD1BF323BD101681900004C1E0000EB030000010000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Leave) REG_BINARY 4800000000000000A88DD1BF323BD101681900004C1E0000EB030000000000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_THAW (SetCurrentState) REG_BINARY 4800000000000000A88DD1BF323BD101681900004C1E000003000000010000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BKGND_FREEZE_THREAD (Enter) REG_BINARY 4800000000000000A88DD1BF323BD10168190000B8100000FC030000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Enter) REG_BINARY 4800000000000000738735C0323BD10168190000D01E0000F2030000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BKGND_FREEZE_THREAD (Leave) REG_BINARY 4800000000000000738735C0323BD10168190000B8100000FC030000000000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Leave) REG_BINARY 4800000000000000738735C0323BD10168190000D01E0000F2030000000000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) REG_BINARY 4800000000000000738735C0323BD10168190000D01E000004000000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Enter) REG_BINARY 48000000000000008255D1C1323BD101681900004C140000F5030000010000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Leave) REG_BINARY 4800000000000000E3B6D3C1323BD101681900004C140000F5030000000000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) REG_BINARY 4800000000000000E3B6D3C1323BD101681900004C14000005000000010000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\Lovelace
OPEN_VOLUME_HANDLE (Enter) REG_BINARY 48000000000000000AFAE6BF323BD101681900001C0F0000FD030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
OPEN_VOLUME_HANDLE (Leave) REG_BINARY 48000000000000006C66FCBF323BD101681900001C0F0000FD030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
IOCTL_FLUSH_AND_HOLD (Enter) REG_BINARY 48000000000000006C66FCBF323BD101681900001C0F0000FE030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
IOCTL_FLUSH_AND_HOLD (Leave) REG_BINARY 4800000000000000D1DD24C0323BD101681900001C0F0000FE030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
IOCTL_RELEASE (Enter) REG_BINARY 4800000000000000D1DD24C0323BD101681900001C0F0000FF0300000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
IOCTL_RELEASE (Leave) REG_BINARY 4800000000000000D1DD24C0323BD101681900001C0F0000FF0300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\Lovelace(__?_Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}_)
OPEN_VOLUME_HANDLE (Enter) REG_BINARY 48000000000000000AFAE6BF323BD101681900001C130000FD030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
OPEN_VOLUME_HANDLE (Leave) REG_BINARY 48000000000000006C66FCBF323BD101681900001C130000FD030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
IOCTL_FLUSH_AND_HOLD (Enter) REG_BINARY 48000000000000006C66FCBF323BD101681900001C130000FE030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
IOCTL_FLUSH_AND_HOLD (Leave) REG_BINARY 4800000000000000D1DD24C0323BD101681900001C130000FE030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
IOCTL_RELEASE (Enter) REG_BINARY 4800000000000000D1DD24C0323BD101681900001C130000FF030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
IOCTL_RELEASE (Leave) REG_BINARY 4800000000000000D1DD24C0323BD101681900001C130000FF030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\MSSearch Service Writer
IDENTIFY (Enter) REG_BINARY 480000000000000065BCF8B5323BD10178130000641B0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
IDENTIFY (Leave) REG_BINARY 4800000000000000C61DFBB5323BD10178130000641B0000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
PREPAREBACKUP (Enter) REG_BINARY 4800000000000000B2C0D6BB323BD10178130000181F0000E9030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPAREBACKUP (Leave) REG_BINARY 4800000000000000F408E5BB323BD10178130000181F0000E9030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_STABLE (SetCurrentState) REG_BINARY 4800000000000000F408E5BB323BD10178130000181F000001000000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Enter) REG_BINARY 4800000000000000E74789BC323BD10178130000641B0000F9030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Leave) REG_BINARY 480000000000000047A98BBC323BD10178130000641B0000F9030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPARESNAPSHOT (Enter) REG_BINARY 4800000000000000EE6AEFBE323BD10178130000641B0000EA030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPARESNAPSHOT (Leave) REG_BINARY 480000000000000031BE10BF323BD10178130000641B0000EA030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) REG_BINARY 480000000000000031BE10BF323BD10178130000641B000002000000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Enter) REG_BINARY 4800000000000000A88DD1BF323BD10178130000641B0000EB030000010000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Leave) REG_BINARY 4800000000000000A88DD1BF323BD10178130000641B0000EB030000000000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_THAW (SetCurrentState) REG_BINARY 4800000000000000A88DD1BF323BD10178130000641B000003000000010000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BKGND_FREEZE_THREAD (Enter) REG_BINARY 4800000000000000A88DD1BF323BD10178130000141E0000FC030000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Enter) REG_BINARY 480000000000000094AB3CC0323BD10178130000641B0000F2030000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BKGND_FREEZE_THREAD (Leave) REG_BINARY 480000000000000094AB3CC0323BD10178130000141E0000FC030000000000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Leave) REG_BINARY 480000000000000094AB3CC0323BD10178130000641B0000F2030000000000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) REG_BINARY 480000000000000094AB3CC0323BD10178130000641B000004000000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Enter) REG_BINARY 4800000000000000E3B6D3C1323BD10178130000641B0000F5030000010000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Leave) REG_BINARY 4800000000000000ACA524C2323BD10178130000641B0000F5030000000000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) REG_BINARY 4800000000000000ACA524C2323BD10178130000641B000005000000010000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\Registry Writer
IDENTIFY (Enter) REG_BINARY 4800000000000000055BF6B5323BD10168190000041D0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
IDENTIFY (Leave) REG_BINARY 4800000000000000C61DFBB5323BD10168190000041D0000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
PREPAREBACKUP (Enter) REG_BINARY 48000000000000001322D9BB323BD1016819000044140000E9030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPAREBACKUP (Leave) REG_BINARY 4800000000000000B4CBE9BB323BD1016819000044140000E9030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_STABLE (SetCurrentState) REG_BINARY 4800000000000000B4CBE9BB323BD101681900004414000001000000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Enter) REG_BINARY 4800000000000000E74789BC323BD1016819000044140000F9030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Leave) REG_BINARY 480000000000000047A98BBC323BD1016819000044140000F9030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPARESNAPSHOT (Enter) REG_BINARY 48000000000000006CE5E5BE323BD101681900001C110000EA030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPARESNAPSHOT (Leave) REG_BINARY 4800000000000000921F13BF323BD101681900001C110000EA030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) REG_BINARY 4800000000000000921F13BF323BD101681900001C11000002000000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Enter) REG_BINARY 4800000000000000AA98E4BF323BD10168190000D01E0000EB030000010000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Leave) REG_BINARY 48000000000000000AFAE6BF323BD10168190000D01E0000EB030000000000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_THAW (SetCurrentState) REG_BINARY 48000000000000000AFAE6BF323BD10168190000D01E000003000000010000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BKGND_FREEZE_THREAD (Enter) REG_BINARY 48000000000000000AFAE6BF323BD10168190000EC0F0000FC030000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Enter) REG_BINARY 4800000000000000132633C0323BD101681900001C110000F2030000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BKGND_FREEZE_THREAD (Leave) REG_BINARY 4800000000000000132633C0323BD10168190000EC0F0000FC030000000000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Leave) REG_BINARY 4800000000000000132633C0323BD101681900001C110000F2030000000000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) REG_BINARY 4800000000000000132633C0323BD101681900001C11000004000000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Enter) REG_BINARY 48000000000000008255D1C1323BD10168190000E41E0000F5030000010000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Leave) REG_BINARY 4800000000000000E3B6D3C1323BD10168190000E41E0000F5030000000000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) REG_BINARY 4800000000000000E3B6D3C1323BD10168190000E41E000005000000010000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\Shadow Copy Optimization Writer
IDENTIFY (Enter) REG_BINARY 4800000000000000055BF6B5323BD10168190000E4090000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
IDENTIFY (Leave) REG_BINARY 4800000000000000267FFDB5323BD10168190000E4090000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
PREPAREBACKUP (Enter) REG_BINARY 4800000000000000B2C0D6BB323BD10168190000E4090000E9030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPAREBACKUP (Leave) REG_BINARY 480000000000000094A7E2BB323BD10168190000E4090000E9030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_STABLE (SetCurrentState) REG_BINARY 480000000000000094A7E2BB323BD10168190000E409000001000000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Enter) REG_BINARY 4800000000000000E74789BC323BD10168190000E4090000F9030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Leave) REG_BINARY 480000000000000047A98BBC323BD10168190000E4090000F9030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPARESNAPSHOT (Enter) REG_BINARY 48000000000000006CE5E5BE323BD10168190000D01E0000EA030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPARESNAPSHOT (Leave) REG_BINARY 4800000000000000D15C0EBF323BD10168190000D01E0000EA030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) REG_BINARY 4800000000000000D15C0EBF323BD10168190000D01E000002000000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Enter) REG_BINARY 480000000000000024FDB4BF323BD101681900001C110000EB030000010000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Leave) REG_BINARY 480000000000000024FDB4BF323BD101681900001C110000EB030000000000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_THAW (SetCurrentState) REG_BINARY 480000000000000024FDB4BF323BD101681900001C11000003000000010000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BKGND_FREEZE_THREAD (Enter) REG_BINARY 480000000000000024FDB4BF323BD10168190000501E0000FC030000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Enter) REG_BINARY 4800000000000000132633C0323BD101681900004C140000F2030000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BKGND_FREEZE_THREAD (Leave) REG_BINARY 4800000000000000132633C0323BD10168190000501E0000FC030000000000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Leave) REG_BINARY 4800000000000000132633C0323BD101681900004C140000F2030000000000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) REG_BINARY 4800000000000000132633C0323BD101681900004C14000004000000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Enter) REG_BINARY 48000000000000008255D1C1323BD101681900004C1E0000F5030000010000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Leave) REG_BINARY 48000000000000002F3641C2323BD101681900004C1E0000F5030000000000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) REG_BINARY 48000000000000002F3641C2323BD101681900004C1E000005000000010000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_BEGINPREPARE (Enter) REG_BINARY 4800000000000000B0B5C3BB323BD10168190000E409000001040000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PROVIDER_BEGINPREPARE (Leave) REG_BINARY 48000000000000001017C6BB323BD10168190000E409000001040000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PROVIDER_ENDPREPARE (Enter) REG_BINARY 4800000000000000CD44BBBC323BD101681900001C0F000002040000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PROVIDER_ENDPREPARE (Leave) REG_BINARY 4800000000000000AA17CEBE323BD101681900001C0F000002040000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PROVIDER_PRECOMMIT (Enter) REG_BINARY 48000000000000000AFAE6BF323BD101681900001C0F000003040000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PROVIDER_PRECOMMIT (Leave) REG_BINARY 48000000000000000AFAE6BF323BD101681900001C0F000003040000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PROVIDER_COMMIT (Enter) REG_BINARY 4800000000000000D1DD24C0323BD10168190000501A000004040000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PROVIDER_COMMIT (Leave) REG_BINARY 4800000000000000D1DD24C0323BD10168190000501A000004040000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PROVIDER_POSTCOMMIT (Enter) REG_BINARY 4800000000000000D1DD24C0323BD101681900001C0F000005040000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PROVIDER_POSTCOMMIT (Leave) REG_BINARY 4800000000000000313F27C0323BD101681900001C0F000005040000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PROVIDER_PREFINALCOMMIT (Enter) REG_BINARY 4800000000000000546E41C0323BD101681900001C0F000006040000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PROVIDER_PREFINALCOMMIT (Leave) REG_BINARY 4800000000000000A16EC5C1323BD101681900001C0F000006040000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PROVIDER_POSTFINALCOMMIT (Enter) REG_BINARY 48000000000000002F3641C2323BD101681900001C0F000007040000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PROVIDER_POSTFINALCOMMIT (Leave) REG_BINARY 4800000000000000C41EF6C2323BD101681900001C0F000007040000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\System Writer
IDENTIFY (Enter) REG_BINARY 4800000000000000055BF6B5323BD101F40400001C170000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
IDENTIFY (Leave) REG_BINARY 48000000000000006A5335B7323BD101F40400001C170000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
PREPAREBACKUP (Enter) REG_BINARY 48000000000000001322D9BB323BD101F40400001C170000E9030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPAREBACKUP (Leave) REG_BINARY 4800000000000000459E78BC323BD101F40400001C170000E9030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_STABLE (SetCurrentState) REG_BINARY 4800000000000000459E78BC323BD101F40400001C17000001000000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Enter) REG_BINARY 4800000000000000E74789BC323BD101F40400001C170000F9030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Leave) REG_BINARY 480000000000000047A98BBC323BD101F40400001C170000F9030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPARESNAPSHOT (Enter) REG_BINARY 4800000000000000AE2DF4BE323BD101F404000048100000EA030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPARESNAPSHOT (Leave) REG_BINARY 48000000000000004316A9BF323BD101F404000048100000EA030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) REG_BINARY 48000000000000004316A9BF323BD101F40400004810000002000000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Enter) REG_BINARY 4800000000000000A88DD1BF323BD101F404000048100000EB030000010000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Leave) REG_BINARY 48000000000000006850D6BF323BD101F404000048100000EB030000000000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_THAW (SetCurrentState) REG_BINARY 48000000000000006850D6BF323BD101F40400004810000003000000010000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BKGND_FREEZE_THREAD (Enter) REG_BINARY 48000000000000006850D6BF323BD101F4040000301F0000FC030000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Enter) REG_BINARY 4800000000000000738735C0323BD101F404000048100000F2030000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BKGND_FREEZE_THREAD (Leave) REG_BINARY 4800000000000000344A3AC0323BD101F4040000301F0000FC030000000000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Leave) REG_BINARY 480000000000000094AB3CC0323BD101F404000048100000F2030000000000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) REG_BINARY 480000000000000094AB3CC0323BD101F40400004810000004000000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Enter) REG_BINARY 4800000000000000E3B6D3C1323BD101F40400001C170000F5030000010000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Leave) REG_BINARY 4800000000000000EBE21FC2323BD101F40400001C170000F5030000000000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) REG_BINARY 4800000000000000EBE21FC2323BD101F40400001C17000005000000010000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BACKUPSHUTDOWN (Enter) REG_BINARY 4800000000000000C62909C3323BD101F404000048100000FB030000010000000500000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BACKUPSHUTDOWN (Leave) REG_BINARY 4800000000000000C62909C3323BD101F404000048100000FB030000000000000500000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\VolSnap
Volume{4654cb38-2761-11e0-a66c-806e6f6e6963}DiscoverSnapshots (Enter) REG_BINARY 48000000000000000D7D340CE43AD1010000000000000000200000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb38-2761-11e0-a66c-806e6f6e6963}DiscoverSnapshots (Leave) REG_BINARY 48000000000000000D7D340CE43AD1010000000000000000210000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}DiscoverSnapshots (Enter) REG_BINARY 48000000000000006DDE360CE43AD1010000000000000000200000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}Activate (Enter) REG_BINARY 4800000000000000CD3F390CE43AD1010000000000000000080000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}ActivateLoop (Enter) REG_BINARY 4800000000000000CD3F390CE43AD10100000000000000001A0000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}ActivateLoop (Leave) REG_BINARY 480000000000000030AC4E0CE43AD10100000000000000001B0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}ComputeIgnorableProduct (Enter) REG_BINARY 4800000000000000A81015C3323BD10100000000000000000C0000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}ComputeIgnorableProduct (Leave) REG_BINARY 4800000000000000087217C3323BD10100000000000000000D0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}Activate (Leave) REG_BINARY 4800000000000000D1555F0CE43AD1010000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}DiscoverSnapshots (Leave) REG_BINARY 4800000000000000D1555F0CE43AD1010000000000000000210000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}DeleteProcess (Enter) REG_BINARY 4800000000000000313F27C0323BD1010000000000000000120000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{b0d6cac5-d929-11e3-bad4-806e6f6e6963}DiscoverSnapshots (Enter) REG_BINARY 4800000000000000D1555F0CE43AD1010000000000000000200000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{b0d6cac5-d929-11e3-bad4-806e6f6e6963}DiscoverSnapshots (Leave) REG_BINARY 4800000000000000D1555F0CE43AD1010000000000000000210000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}SetIgnorable (Enter) REG_BINARY 4800000000000000313F27C0323BD10100000000000000000A0000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}SetIgnorable (Leave) REG_BINARY 4800000000000000AA19FBC0323BD10100000000000000000B0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}AdjustBitmap (Enter) REG_BINARY 4800000000000000C41EF6C2323BD1010000000000000000040000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}ValidateDiffAreaFiles (Enter) REG_BINARY 4800000000000000C20A070EE43AD10100000000000000001C0000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
VolumesSafeForWrite (Enter) REG_BINARY 4800000000000000C20A070EE43AD10100000000000000001E0000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
VolumesSafeForWrite (Leave) REG_BINARY 4800000000000000694B540FE43AD10100000000000000001F0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}ValidateDiffAreaFiles (Leave) REG_BINARY 4800000000000000694B540FE43AD10100000000000000001D0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}DeleteProcess (Leave) REG_BINARY 4800000000000000AC240EC1323BD1010000000000000000130000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}AdjustBitmap (Leave) REG_BINARY 48000000000000004ABA25C3323BD1010000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}PrepareForSnapshot (Enter) REG_BINARY 480000000000000087E8B3BE323BD101441200009C120000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}PreExposure (Enter) REG_BINARY 480000000000000049B6CBBE323BD101441200009C120000020000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}PreExposure (Leave) REG_BINARY 480000000000000049B6CBBE323BD101441200009C120000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}PrepareForSnapshot (Leave) REG_BINARY 4800000000000000AA17CEBE323BD101441200009C120000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}EndCommit (Enter) REG_BINARY 4800000000000000D1DD24C0323BD101441200009C120000060000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Volume{4654cb39-2761-11e0-a66c-806e6f6e6963}EndCommit (Leave) REG_BINARY 4800000000000000313F27C0323BD101441200009C120000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\VssapiPublisher
IDENTIFY (Enter) REG_BINARY 48000000000000004598F1B5323BD1016C0B000030050000E8030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
IDENTIFY (Leave) REG_BINARY 48000000000000002A163AB7323BD1016C0B000030050000E8030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPAREBACKUP (Enter) REG_BINARY 4800000000000000D1D9CABB323BD1016C0B000074080000E9030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPAREBACKUP (Leave) REG_BINARY 4800000000000000459E78BC323BD1016C0B000074080000E9030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Enter) REG_BINARY 4800000000000000A5FF7ABC323BD1016C0B0000F4190000F9030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Leave) REG_BINARY 4800000000000000A70A8EBC323BD1016C0B0000F4190000F9030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
DOSNAPSHOT (Enter) REG_BINARY 4800000000000000CD44BBBC323BD1016C0B0000D80F00000A040000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
DOSNAPSHOT (Leave) REG_BINARY 4800000000000000313F27C0323BD1016C0B00008C0400000A040000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\VssvcPublisher
PREPARESNAPSHOT (Enter) REG_BINARY 48000000000000000A79D0BE323BD101681900001C0F0000EA030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPARESNAPSHOT (Leave) REG_BINARY 48000000000000004316A9BF323BD101681900001C0F0000EA030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Enter) REG_BINARY 48000000000000004316A9BF323BD101681900001C0F0000EB030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE_FRONT (Enter) REG_BINARY 48000000000000004316A9BF323BD101681900001C0F0000EC030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE_FRONT (Leave) REG_BINARY 4800000000000000855EB7BF323BD101681900001C0F0000EC030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE_BACK (Enter) REG_BINARY 4800000000000000855EB7BF323BD101681900001C0F0000ED030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE_BACK (Leave) REG_BINARY 48000000000000006645C3BF323BD101681900001C0F0000ED030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE_SYSTEM (Enter) REG_BINARY 48000000000000006645C3BF323BD101681900001C0F0000EE030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE_SYSTEM (Leave) REG_BINARY 48000000000000006850D6BF323BD101681900001C0F0000EE030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE_KTM (Enter) REG_BINARY 48000000000000006850D6BF323BD101681900001C0F0000F0030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE_KTM (Leave) REG_BINARY 48000000000000006850D6BF323BD101681900001C0F0000F0030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE_RM (Enter) REG_BINARY 48000000000000006850D6BF323BD101681900001C0F0000EF030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE_RM (Leave) REG_BINARY 48000000000000000AFAE6BF323BD101681900001C0F0000EF030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Leave) REG_BINARY 48000000000000000AFAE6BF323BD101681900001C0F0000EB030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW_KTM (Enter) REG_BINARY 4800000000000000313F27C0323BD101681900001C0F0000F4030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW_KTM (Leave) REG_BINARY 4800000000000000313F27C0323BD101681900001C0F0000F4030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Enter) REG_BINARY 4800000000000000313F27C0323BD101681900001C0F0000F2030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Leave) REG_BINARY 4800000000000000546E41C0323BD101681900001C0F0000F2030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Enter) REG_BINARY 4800000000000000A16EC5C1323BD101681900001C0F0000F5030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Leave) REG_BINARY 48000000000000002F3641C2323BD101681900001C0F0000F5030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BACKUPSHUTDOWN (Enter) REG_BINARY 480000000000000085E1FAC2323BD101681900001C0F0000FB030000010000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BACKUPSHUTDOWN (Leave) REG_BINARY 4800000000000000278B0BC3323BD101681900001C0F0000FB030000000000000000000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Diag\WMI Writer
IDENTIFY (Enter) REG_BINARY 480000000000000065BCF8B5323BD1010C05000034150000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
IDENTIFY (Leave) REG_BINARY 4800000000000000267FFDB5323BD1010C05000034150000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
PREPAREBACKUP (Enter) REG_BINARY 4800000000000000B2C0D6BB323BD1010C050000E4180000E9030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPAREBACKUP (Leave) REG_BINARY 4800000000000000F408E5BB323BD1010C050000E4180000E9030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_STABLE (SetCurrentState) REG_BINARY 4800000000000000546AE7BB323BD1010C050000E418000001000000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Enter) REG_BINARY 4800000000000000E74789BC323BD1010C050000E4180000F9030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
GETSTATE (Leave) REG_BINARY 480000000000000047A98BBC323BD1010C050000E4180000F9030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPARESNAPSHOT (Enter) REG_BINARY 48000000000000002DA8EABE323BD1010C050000C8110000EA030000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
PREPARESNAPSHOT (Leave) REG_BINARY 4800000000000000921F13BF323BD1010C050000C8110000EA030000000000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) REG_BINARY 4800000000000000921F13BF323BD1010C050000C811000002000000010000000100000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Enter) REG_BINARY 480000000000000024FDB4BF323BD1010C050000C8110000EB030000010000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
FREEZE (Leave) REG_BINARY 4800000000000000855EB7BF323BD1010C050000C8110000EB030000000000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_THAW (SetCurrentState) REG_BINARY 4800000000000000855EB7BF323BD1010C050000C811000003000000010000000200000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BKGND_FREEZE_THREAD (Enter) REG_BINARY 4800000000000000855EB7BF323BD1010C050000D8170000FC030000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Enter) REG_BINARY 4800000000000000738735C0323BD1010C050000C8110000F2030000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BKGND_FREEZE_THREAD (Leave) REG_BINARY 4800000000000000738735C0323BD1010C050000D8170000FC030000000000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
THAW (Leave) REG_BINARY 4800000000000000738735C0323BD1010C050000C8110000F2030000000000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) REG_BINARY 4800000000000000738735C0323BD1010C050000C811000004000000010000000300000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Enter) REG_BINARY 4800000000000000E3B6D3C1323BD1010C050000C8110000F5030000010000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
POSTSNAPSHOT (Leave) REG_BINARY 4800000000000000E3B6D3C1323BD1010C050000C8110000F5030000000000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) REG_BINARY 4800000000000000E3B6D3C1323BD1010C050000C811000005000000010000000400000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BACKUPSHUTDOWN (Enter) REG_BINARY 4800000000000000C62909C3323BD1010C050000E4180000FB030000010000000500000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000
BACKUPSHUTDOWN (Leave) REG_BINARY 4800000000000000C62909C3323BD1010C050000E4180000FB030000000000000500000000000000BF7772D6DC233F4CBF8BCACEF471BB7000000000000000000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers\{b5946137-7b9f-4925-af80-51abd60b20d5}
(Default) REG_SZ Microsoft Software Shadow Copy provider 1.0
Type REG_DWORD 0x1
Version REG_SZ 1.0.0.7
VersionId REG_SZ {00000001-0000-0000-0007-000000000001}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers\{b5946137-7b9f-4925-af80-51abd60b20d5}\CLSID
(Default) REG_SZ {65EE1DBA-8FF4-4a58-AC1C-3470EE2F376A}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Settings\WritersBlockingRevert
{2707761B-2324-473D-88EB-EB007A359533} REG_SZ DFS-R Writer
{D76F5A28-3092-4589-BA48-2958FB88CE29} REG_SZ FRS Writer
{B2014C9E-8711-4C5C-A5A9-3CF384484757} REG_SZ AD Writer
{DD846AAA-A1B6-42a8-AAF8-03DCB6114BFD} REG_SZ ADAM Writer
TornComponentsBlockRevert REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
NT Authority\NetworkService REG_DWORD 0x1



========= End of Reg: =========


========================= File: C:\Windows\System32\vssvc.exe ========================

File is digitally signed
MD5: B60BA0BC31B0CB414593E169F6F21CC2
Creation and modification date: 2011-07-01 06:34 - 2010-11-20 08:25
Size: 1600512
Attributes: ----A
Company Name: Microsoft Corporation
Internal Name: VSSVC.EXE
Original Name: VSSVC.EXE.MUI
Product: Microsoft® Windows® Operating System
Description: Microsoft® Volume Shadow Copy Service
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Version: 6.1.7600.16385
Copyright: © Microsoft Corporation. All rights reserved.

====== End of File: ======

EmptyTemp: => 1 GB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 09:29:24 ====
Jkirwin is offline  
Old 12-20-2015, 02:07 PM   #7
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar

Microsoft Most Valuable Professional
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



Hello again, Jkirwin. You're very welcome. Yes, please uninstall Panda via Programs and Features in your Control Panel.

If prompted to restart, choose 'No' then do the following...

Please download the Panda 2015 Generic Uninstaller and Save it to your Desktop.
  • Right-click uninstaller.exe and choose 'Run as administrator'. An MS-DOS window will open.
  • Press Yes to start the removal process.
  • Once the uninstall process is complete, reboot your computer if not prompted already.
  • Then delete uninstaller.exe from your desktop.
------------------------------------------------------

AVG PC Tuneup
CCleaner


We do not recommend the use of registry cleaners, or the registry cleaner feature of CCleaner. Our colleague miekiemoes has an excellent writeup here

We suggest uninstalling AVG PC Tuneup via Programs and Features in your Control Panel.

------------------------------------------------------

Please download ComboFix and Save it to your Desktop.

**Note: It is important that it is saved directly to your desktop**

* Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix.

Get help here

Double-click ComboFix.exe and follow the prompts to run it.

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, C:\ComboFix.txt, in your next reply.

Please re-enable your antivirus before posting the ComboFix.txt log.

Note: If you get an 'Illegal operation attempted on a Registry key which has been marked for deletion' error message, please open Task Manager and 'End Process' on explorer.exe

Next, go File > New Task(Run...) and type explorer then press 'Enter'.

------------------------------------------------------
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
Old 12-20-2015, 07:37 PM   #8
Registered Member
 
Join Date: May 2007
Posts: 55
OS: MS 7



Hello Chemist,

I have tired to uninstall AVG several times in the past. When I click on it in the control panel uninstall does not come up in the header so I have never been able to get rid of it. (I just tried it again and its a no go)

CC Cleaner is not in the control panel to uninstall at all. I had it on my machine but deleted it, I think I had gotten instructions to use it from the internet when I was trying to speed up my machine. Then I deleted it

I uninstalled Panda in the control panel but missed that you wanted me to say no to the restart so I restarted the machine.

Now the generic uninstaller crashes ( I tried it a couple of times) First it said reboot before using, I had to do that that a couple of times before I got it to continue. When I got it to run it churned and churned ( longer that 15 minutes) I checked the Task Manger and saw nothing running in the applications. It crashed shortly thereafter.

Then I re-read your instructions and notice it said NO to reboot.

I am sorry I screwed that up, what should I do now?
Jkirwin is offline  
Old 12-20-2015, 08:40 PM   #9
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar

Microsoft Most Valuable Professional
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



Hello again, Jkirwin. No worries. You don't have to uninstall CCleaner, just don't use the reg cleaning feature.

We can take care of AVG PC TuneUp later. And don't worry about the Panda Uninstaller.

Just proceed with the ComboFix instructions and we'll go from there.

------------------------------------------------------
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
Old 12-21-2015, 01:07 AM   #10
Registered Member
 
Join Date: May 2007
Posts: 55
OS: MS 7



ComboFix 15-12-16.01 - James Kirwin 12/21/2015 3:36.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.7990.5000 [GMT -5:00]
Running from: c:\users\James Kirwin\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\users\James Kirwin\Documents\~WRL0003.tmp
c:\users\James Kirwin\Documents\~WRL0819.tmp
c:\users\James Kirwin\g2mdlhlpx.exe
c:\users\James Kirwin\Documents\Wondershare Dr.Fone for iOS . . . . Failed to delete
.
.
((((((((((((((((((((((((( Files Created from 2015-11-21 to 2015-12-21 )))))))))))))))))))))))))))))))
.
.
2015-12-21 03:16 . 2015-12-21 03:16 -------- d-----w- C:\SMCLpav
2015-12-20 05:11 . 2015-12-20 14:30 -------- d-----w- C:\FRST
2015-12-19 03:44 . 2015-12-19 03:41 386096 ----a-w- c:\windows\system32\aswBoot.exe
2015-12-19 03:42 . 2015-12-19 03:42 -------- d-----w- c:\users\James Kirwin\AppData\Roaming\AVAST Software
2015-12-19 03:42 . 2015-12-19 03:42 -------- d-----w- c:\windows\SysWow64\config\systemprofile\.oracle_jre_usage
2015-12-19 03:42 . 2015-12-19 03:42 -------- d-----w- c:\program files (x86)\Common Files\AV
2015-12-19 03:42 . 2015-12-19 03:42 -------- d-----w- c:\program files\Common Files\AV
2015-12-19 03:41 . 2015-12-19 03:42 97648 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2015-12-19 03:41 . 2015-12-19 03:42 451040 ----a-w- c:\windows\system32\drivers\aswSP.sys
2015-12-19 03:41 . 2015-12-19 03:41 93528 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2015-12-19 03:41 . 2015-12-19 03:41 65224 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2015-12-19 03:41 . 2015-12-19 03:41 28656 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2015-12-19 03:41 . 2015-12-19 03:41 273784 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2015-12-19 03:41 . 2015-12-19 03:41 155304 ----a-w- c:\windows\system32\drivers\aswStm.sys
2015-12-19 03:41 . 2015-12-19 03:41 1055560 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2015-12-19 03:41 . 2015-12-19 03:41 43112 ----a-w- c:\windows\avastSS.scr
2015-12-19 03:40 . 2015-12-19 03:40 -------- d-----w- c:\program files\AVAST Software
2015-12-19 03:39 . 2015-12-19 03:39 -------- d-----w- c:\programdata\AVAST Software
2015-12-12 18:59 . 2015-11-17 12:43 11138400 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C049C4AD-8C19-450E-AF36-D7F074723701}\mpengine.dll
2015-12-12 01:39 . 2015-12-12 01:39 -------- d-----w- c:\program files (x86)\Common Files\Java
2015-12-12 01:39 . 2015-12-12 01:39 -------- d-----w- c:\users\James Kirwin\.oracle_jre_usage
2015-12-12 01:39 . 2015-12-12 01:39 97888 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-12-12 01:19 . 2015-12-20 05:04 -------- d-----w- C:\AdwCleaner
2015-12-02 22:20 . 2015-12-02 22:20 -------- d-----w- c:\users\James Kirwin\AppData\Local\Downloaded Installations
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-12-11 01:02 . 2014-05-14 23:01 796864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-12-11 01:02 . 2014-05-14 23:01 142528 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-12-04 12:11 . 2014-05-14 17:52 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-12-02 18:18 . 2011-01-23 22:33 301728 ------w- c:\windows\system32\MpSigStub.exe
2015-10-27 14:45 . 2013-11-04 15:45 76384 ----a-w- c:\windows\SysWow64\libusb0.dll
2015-10-27 14:45 . 2013-11-04 15:45 52832 ----a-w- c:\windows\SysWow64\drivers\libusb0.sys
2015-10-05 14:50 . 2015-09-01 02:36 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-10-05 14:50 . 2015-09-01 02:36 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-10-05 14:50 . 2015-09-01 02:36 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2014-11-21 43816]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2014-11-21 43816]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-11-09 586296]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2015-11-09 596528]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-12-19 7021880]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2010-5-28 276328]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"MaxGPOScriptWait"= 600 (0x258)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS;c:\windows\SYSNATIVE\drivers\AmUStor.SYS [x]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
R3 HP DS Service;HP DS Service;c:\program files (x86)\HP\HPBDSService\HPBDSService.exe;c:\program files (x86)\HP\HPBDSService\HPBDSService.exe [x]
R3 HtcUsbMdmV64;HTC Proprietary USB Driver;c:\windows\system32\DRIVERS\HtcUsbMdmV64.sys;c:\windows\SYSNATIVE\DRIVERS\HtcUsbMdmV64.sys [x]
R3 HtcVCom32;HTC Diagnostic Port;c:\windows\system32\DRIVERS\HtcVComV64.sys;c:\windows\SYSNATIVE\DRIVERS\HtcVComV64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys;c:\windows\SYSNATIVE\DRIVERS\silabenm.sys [x]
R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys;c:\windows\SYSNATIVE\DRIVERS\silabser.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
R4 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
R4 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
R4 File Backup;File Backup Service;c:\program files (x86)\Starfield\offSyncService.exe;c:\program files (x86)\Starfield\offSyncService.exe [x]
R4 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 DVMIO;DeviceVM IO Service;c:\windows\system32\DRIVERS\dvmio.sys;c:\windows\SYSNATIVE\DRIVERS\dvmio.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
S2 Apple Mobile Device Service;Apple Mobile Device Service;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
S2 DvmMDES;DeviceVM Meta Data Export Service;c:\swsetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe;c:\swsetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe [x]
S2 HP LaserJet Service;HP LaserJet Service;c:\program files (x86)\HP\HPLaserJetService\HPLaserJetService.exe;c:\program files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe;c:\windows\SYSNATIVE\vcsFPService.exe [x]
S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys;c:\windows\SYSNATIVE\DRIVERS\WDKMD.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-12-16 23:59 1000264 ----a-w- c:\program files (x86)\Google\Chrome\Application\47.0.2526.106\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{A6EADE66-0000-0000-484E-7E8A45000000}]
2015-11-18 16:22 286904 ----a-w- c:\program files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll
.
Contents of the 'Scheduled Tasks' folder
.
2015-12-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14 01:02]
.
2015-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-13 04:44]
.
2015-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-13 04:44]
.
2015-12-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2845901189-3817738784-3823200384-1001Core.job
- c:\users\James Kirwin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-22 04:45]
.
2015-12-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2845901189-3817738784-3823200384-1001UA.job
- c:\users\James Kirwin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-22 04:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-12-19 03:41 873304 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-03-05 1928976]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-06-18 8192]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2011-05-10 324096]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-05-10 525312]
"HP LaserJet 200 color MFP M276 Series Fax"="c:\program files (x86)\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe" [2011-10-10 3706424]
.
------- Supplementary Scan -------
.
uStart Page = https://www.yahoo.com/?fr=yset_ie_sy...ype=orcl_hpset
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <-loopback>
IE: &ieSpell Options - c:\program files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Check &Spelling - c:\program files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: Lookup on Merriam Webster - file://c:\program files (x86)\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files (x86)\ieSpell\wikipedia.HTM
IE: Se&nd to OneNote - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: secureserver.net\login
TCP: DhcpNameServer = 192.168.1.1
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB
DPF: {8BE5651C-D60B-4B59-B5B2-F0EB93733D17} - hxxps://www36.verizon.com/FiOSVoice/UnProtected/FiosVoiceVMUtil.CAB
FF - ProfilePath - c:\users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - ExtSQL: !HIDDEN! 2011-02-08 09:46; [email protected]; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-ISUSPM - c:\programdata\FLEXnet\Connect\11\ISUSPM.exe
SafeBoot-MBAMSwissArmy
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-BrightAdjustTool - c:\program files (x86)\Nova Star\NovaLCT-Mars\Bin\BrightAdjustTool\BrightAdjustTool.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-SLABCOMM&10C4&EA60 - c:\program files (x86)\Silabs\MCU\DriverUninstall\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"v5Licence0"="15-E47T-D414-6FA8-U69R-2ARV-AKHQ5QS"
"Activated"="N"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2015-12-21 04:01:38 - machine was rebooted
ComboFix-quarantined-files.txt 2015-12-21 09:01
.
Pre-Run: 285,107,163,136 bytes free
Post-Run: 286,225,281,024 bytes free
.
- - End Of File - - C4A1EDDA280A555E1B3D5F3265EFC004
Jkirwin is offline  
Old 12-21-2015, 02:18 PM   #11
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar

Microsoft Most Valuable Professional
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



Hello again, Jkirwin. How is the machine behaving? Any improvement?

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook_x64.exe to run it. (Vista/Win7/Win8/Win10 users, right-click > Run as administrator)
  • Copy/paste the contents of the following codebox into the main textfield:
    Code:
    :folderfind
    AVG
    Panda
    
    :regfind
    TuneUp
    Panda
  • Click the Look button to start the scan.
  • Please be patient, as it may take a while.
  • When finished, a Notepad file will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

------------------------------------------------------
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
Old 12-21-2015, 03:20 PM   #12
Registered Member
 
Join Date: May 2007
Posts: 55
OS: MS 7



Thanks

Here ya go

SystemLook 30.07.11 by jpshortstuff
Log created at 18:17 on 21/12/2015 by James Kirwin
Administrator - Elevation successful

========== folderfind ==========

Searching for "AVG"
C:\Program Files (x86)\AVG d------ [23:58 21/03/2011]
C:\ProgramData\AVG d------ [13:41 14/05/2014]
C:\Users\All Users\AVG d------ [13:41 14/05/2014]
C:\Users\James Kirwin\AppData\Local\AVG d------ [13:42 14/05/2014]
C:\Users\James Kirwin\AppData\Local\VirtualStore\ProgramData\AVG d------ [13:41 14/05/2014]
C:\Users\James Kirwin\AppData\Roaming\AVG d------ [13:42 14/05/2014]
C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\avg d------ [12:08 09/11/2012]
C:\Windows\System32\config\systemprofile\AppData\Local\Avg d------ [01:19 02/03/2015]
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Avg d------ [01:18 02/03/2015]
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\AVG d------ [02:38 03/03/2015]

Searching for "Panda"
C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\Avatar_Models\Panda d------ [03:28 05/12/2010]

========== regfind ==========

Searching for "TuneUp"
[HKEY_CURRENT_USER\Software\Microsoft\IntelliPoint\AppSpecific\TUMessages.exe]
"Path"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUMessages.exe"
[HKEY_CURRENT_USER\Software\Microsoft\IntelliType Pro\AppSpecific\TUMessages.exe]
"Path"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUMessages.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources]
"LangTuneUp"="OfficeCompleted"
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\AVG\AVG PC TuneUp\Integrator.exe"="AVG PC TuneUp - Start Center"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{51F2A986-73E1-4C23-85F2-690C7828CC11}]
"LocalService"="TuneUp.UtilitiesSvc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00711705-12C5-420B-A4E5-6413F2AB3C7B}]
@="TuneUp WinLogon Extension"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02849255-07CD-4C09-97D7-017DA2AE45AA}]
@="TuneUp Utilities Tools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02849255-07CD-4C09-97D7-017DA2AE45AA}\LocalServer32]
@=""C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02849255-07CD-4C09-97D7-017DA2AE45AA}\ProgID]
@="TuneUp.TUUtilityTools.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02849255-07CD-4C09-97D7-017DA2AE45AA}\VersionIndependentProgID]
@="TuneUp.TUUtilityTools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2509ABBC-871E-42e5-A27B-F7DA394B1897}]
@="TuneUp Utilities Tools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2509ABBC-871E-42e5-A27B-F7DA394B1897}\LocalServer32]
@=""C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2509ABBC-871E-42e5-A27B-F7DA394B1897}\ProgID]
@="TuneUp.UtilitiesSvcTools.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2509ABBC-871E-42e5-A27B-F7DA394B1897}\VersionIndependentProgID]
@="TuneUp.UtilitiesSvcTools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42D67DD2-D956-4698-A502-9F59727E044A}\InprocServer32]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUTuningIndex64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4838CD50-7E5D-4811-9B17-C47A85539F28}\InProcServer32]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\DseShExt-x64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}\InProcServer32]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\SDShelEx-x64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5EF1CF5D-87A9-434b-8786-2A08E1C30F6C}]
@="TuneUp Program Manager"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5EF1CF5D-87A9-434b-8786-2A08E1C30F6C}\LocalServer32]
@=""C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5EF1CF5D-87A9-434b-8786-2A08E1C30F6C}\ProgID]
@="TuneUp.ProgramManager.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5EF1CF5D-87A9-434b-8786-2A08E1C30F6C}\VersionIndependentProgID]
@="TuneUp.ProgramManager"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\TuneUp Undelete]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\TuneUp Undelete]
@="TuneUp Undelete"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\TuneUp Undelete]
"Icon"="C:\Program Files (x86)\AVG\AVG PC TuneUp\Undelete.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\TuneUp Undelete\Command]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\Undelete.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8443292F-BFCE-4C79-8192-922DBA7B2866}\LocalServer32]
@=""C:\Program Files (x86)\AVG\AVG PC TuneUp\ProcessManager64.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCA02D56-BF9D-4591-AD41-E59AF763C64A}]
@="TuneUp Utilities Service"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCA02D56-BF9D-4591-AD41-E59AF763C64A}\LocalServer32]
@=""C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCA02D56-BF9D-4591-AD41-E59AF763C64A}\ProgID]
@="TuneUp.UtilitiesSvc.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCA02D56-BF9D-4591-AD41-E59AF763C64A}\VersionIndependentProgID]
@="TuneUp.UtilitiesSvc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FD8DB406-E813-4FF5-BEB0-6C6DC373B985}\InprocServer32]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAnalyzeInfo64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\1DE47CA4B917AD64B8A843F0FB982219]
"ProductName"="AVG PC TuneUp 2015 (en-US)"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\281C699A42731FD44ACB6651F45ED7EF]
"ProductName"="AVG PC TuneUp 2015"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7F8549F-814B-417D-ADC6-C2AFD6ADF1BB}]
@="ITuneUpToolsPrefetchInfo"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.ProgramManager]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.ProgramManager]
@="TuneUp Program Manager"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.ProgramManager\CurVer]
@="TuneUp.ProgramManager.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.ProgramManager.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.ProgramManager.1]
@="TuneUp Program Manager"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.TUUtilityTools]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.TUUtilityTools]
@="TuneUp Utilities Tools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.TUUtilityTools\CurVer]
@="TuneUp.TUUtilityTools.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.TUUtilityTools.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.TUUtilityTools.1]
@="TuneUp Utilities Tools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvc]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvc]
@="TuneUp Utilities Service"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvc\CurVer]
@="TuneUp.UtilitiesSvc.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvc.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvc.1]
@="TuneUp Utilities Service"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvcTools]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvcTools]
@="TuneUp Utilities Tools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvcTools\CurVer]
@="TuneUp.UtilitiesSvcTools.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvcTools.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvcTools.1]
@="TuneUp Utilities Tools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}\1.0]
@="TuneUp Utilities Service Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}\1.0\0\win64]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}\1.0\HELPDIR]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{606F0A47-FA39-4F52-8556-5565AE7F586F}\1.0]
@="TuneUp Utilities Program Manager Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{606F0A47-FA39-4F52-8556-5565AE7F586F}\1.0\0\win64]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe\2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{606F0A47-FA39-4F52-8556-5565AE7F586F}\1.0\HELPDIR]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8195A3CB-8892-4914-A680-FEBD2C1A2EC2}\1.0\0\win64]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\ProcessManager64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8195A3CB-8892-4914-A680-FEBD2C1A2EC2}\1.0\HELPDIR]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F04CE194-D75F-4CDC-9816-08193D328B65}\1.0\0\win64]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe\4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F04CE194-D75F-4CDC-9816-08193D328B65}\1.0\HELPDIR]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00711705-12C5-420B-A4E5-6413F2AB3C7B}]
@="TuneUp WinLogon Extension"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7F8549F-814B-417D-ADC6-C2AFD6ADF1BB}]
@="ITuneUpToolsPrefetchInfo"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{51F2A986-73E1-4C23-85F2-690C7828CC11}]
"LocalService"="TuneUp.UtilitiesSvc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}\1.0]
@="TuneUp Utilities Service Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}\1.0\0\win64]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}\1.0\HELPDIR]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{606F0A47-FA39-4F52-8556-5565AE7F586F}\1.0]
@="TuneUp Utilities Program Manager Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{606F0A47-FA39-4F52-8556-5565AE7F586F}\1.0\0\win64]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe\2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{606F0A47-FA39-4F52-8556-5565AE7F586F}\1.0\HELPDIR]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{8195A3CB-8892-4914-A680-FEBD2C1A2EC2}\1.0\0\win64]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\ProcessManager64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{8195A3CB-8892-4914-A680-FEBD2C1A2EC2}\1.0\HELPDIR]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{F04CE194-D75F-4CDC-9816-08193D328B65}\1.0\0\win64]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe\4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{F04CE194-D75F-4CDC-9816-08193D328B65}\1.0\HELPDIR]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\AVG\AVG PC TuneUp\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\018647013AAD3BC41860311C4741396B]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\SilentUpdater.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\024B9E1C9FB70154F90C413532A546BA]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\tuavga.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\04746129646274C4B939D6FC71EF4F2A]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0C25C3CE0B60FB54D89CE2B9D56ED9C4]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\DuplicateFinder.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0D15832E0443B0343957E18497F6BAE5]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUiOSCleanera.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0F3E84C4789ECA948A6040F9981CF2F1]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\RegistryDefrag.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\106C0329EB6F96F4B820D25C40407183]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\SettingCenter.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11867B7A679F38D4F91977CCAEDD63A0]
"281C699A42731FD44ACB6651F45ED7EF"="00:\TuneUp.Icon.Package\EditFlags"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1388D766C7040F14A9265D117B2A4E1B]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\tulngx.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16290A0D96554E14E990F7399848038E]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\dxBarExtItemsD12.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1CC1DF8FB58E47448B91333BDFD4D571]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\PowerModeManager.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20AE8B36FE07E2D4892FF146FB5770AC]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\dxGDIPlusD12.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20B9A0EC9E8112349BFFD4E24AE7B2F3]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUTransl.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2464177FA2DE5E74498637068DA3C7BA]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUBasic.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2527F68EF3E3EDA4C8CFA05746D0E27B]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\tulnga.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2634A0CE5AEDB4346AFAD1186E49C1C1]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\DiskDoctor.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2642BF6F76E577243945F5E888376DEE]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\IECacheWinInetLdr.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\30319372162210F419BA849293BE91D0]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\authuitu-x64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\310054E6F94C1264F9020F69B693A103]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TURatingSynch.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3309675AD51EAB340BFCFD0FDA86E4DC]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\uxtuneup-x86.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3771063D460538642B97CC8AE976F840]
"281C699A42731FD44ACB6651F45ED7EF"="02:\Software\Microsoft\Windows\CurrentVersion\Uninstall\AVG PC TuneUp\DisplayName"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A6887691BFBD384FBB63B00B90B8859]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\uxtuneup-x64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A891C71A03BC544582D1370DCAA37B3]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\PMLauncher.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3D374B1AC9E6BED4CA4295CE27BB6C72]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3EB9A9FF0F75DB74F83B0118FC675D25]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAnalyzeInfo.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\420AD3DC0342B5E4E8DC01A70AE7625C]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\Integrator.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\42F75296D7067B54AAD40227A7F1F02F]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUInstallHelper.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4329F0B9F3594FA438356B1CE6BE3A25]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\Undelete.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\463EC6B2C073C484A87C317774C41EE9]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\icudt.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4697AEEA899D389459D43F1E190D5CA8]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\vclimg190.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49EB20E14F01B95489AB758F12C71782]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\ProcessManager.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A2F2139191A0C24F819D7C545691D05]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAnalyzeInfo64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4F7067B03618A2744BB53A9DFE35C680]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\avgloga.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5065CB0F9D055944C8A8640132BDF2E3]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\ProcessManager64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5204F549D5956D245A8609622211BEB0]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUDefragBackend64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53237B88B40119144A152B114CA917ED]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpRPC32.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\55254E5BD6EDD9C4F94C9C7608152374]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUComponents.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57EE8392BC95B4847AE5F024E378D6D0]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUTuningIndex64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\593F28AC1DDADC64A9AAC2DC62167560]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\SystemControl.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59CCBD5582C2BFB44B1A32F6FCB6B256]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\rtl190.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5BE314CD606D6FF43BBF4E21AA81DC39]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\dxSkinsCoreD12.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\65250F0ED68B7C147AEEF9D90B096EFD]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\MsStyles.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\699C18B59FEDB7345A4589B91B6E5CED]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\iOSCleaner.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6A7D1E6506B117B479B2FFF227B41649]
"281C699A42731FD44ACB6651F45ED7EF"="02:\Software\TuneUp\Setup\Compatibility\1\ProductCode"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C2DF650F65CC9042B96DF9672AC19FA]
"281C699A42731FD44ACB6651F45ED7EF"="00:\TuneUp.Utilities.2013.Unlock.Code\EditFlags"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EFB6C20ED4E12E4C87FDCC648CE75C0]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUMessages.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\71FDBBCDCE09831408B32D56EF6C829C]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUVCL.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\74261C5C907F4264CA786B802A9BD5D5]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\Report.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\78CAAFAB319609F4B90E926AF17E4D0B]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUSqlDB32.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\794A9CF6C0A028E409CA94BE15D59E6E]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\GR32_D6.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\79E9D5EB9CF65ED49A056416FBB809FD]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\vcl190.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CF216552A2643C48B3B73E8C7168390]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUUUnInstallHelper.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FD321E98D536C2499939A7E1D67CAC4]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\avgrepliba.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8453B91AEE3AA4245BF5B7D09C2A11CE]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\BrowserCleaner.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8521CBD769651A8488A89D388A78F01F]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\tux64thk.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86D434B4243A0D14E9BFC83B2F250C87]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpa.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CB21A6D0A2675F409A70DF9CCEC2044]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUProduct.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CCA42DEFD70AA14BAAF818AA6346DA4]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\DseShExt-x64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8E1FF55D50CEBD748A4684E5D4655B7E]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\RescueCenter.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F17458D795978B4594EB0C96389A6C3]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoUpdateCheck.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\93442F26E6193F344ACA61E56B63AF93]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\SDShelEx-win32.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\937732AC7230BFE40ACAE58899EF4BB5]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\dxBarD12.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97AADAB00AEA9F5448CA9471B7EFA10B]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\EnergyOptimizer.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B20961489CDA6D43A01BB544E09C045]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\dxRibbonD12.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B472ED9EA42F6044B7BCE7BFBAA3BA8]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\DuplicateFileFinder.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B765335767F2164A9E3DBFD635F1211]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUPSAPI.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9BC05D135F451C44F94BD870489413EB]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\Stiderc.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C6EB587006F9274CB35421CA25A4C2B]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\SystemInformation.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9ECF20D0246959E4493EAB432DB608BA]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\DriveDefrag.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9EE651545CD5D644BA5BAD9AD8F8F72D]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\DseShExt-x86.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A217A9C9D0FD2CB40B64EA890BD8452F]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\vclx190.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A24755BBFCD0E3C44AE59617A2D6F8FA]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\SDShelEx-x64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A724CACFB59D2E7418C2CD99FF1239D1]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\dxCoreD12.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A7E04CD373226E1439E4F8BEFBE7C005]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\DiskCleaner.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A827772DACF666B40870ACA546CDAAA7]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\PerformanceOptimizer.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A8AA4D1E6B2905B449F8619B2FA8C1C3]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\Styler.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AA42B59EDCF31C14CBA3F68F944F6E9C]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\StartUpManager.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AA7A1C1D025287647A564E71FA413A02]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\tuneup_us.lng"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AEC29866530EA5F4899D4C22C0C6B326]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\UpdateWizard.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B072C6A84A094F944B0D552D269F164A]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\avglogx.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B53D3EE0691580B4B8197C50BCB7DD19]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUShell.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B90A5B697A1E3CA40A82CF622EC8F29D]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\avgdiagex.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC7C09865DE3D3D49BFF377B7E8B98FC]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\OneClickStarter.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD762B36F481F5E488FDD0C76758EFC7]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.cat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BE0E6688D4B46CA448D1D680AC2A29CE]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\RegWiz.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C2C47AE18AF7DE94987494B253F3AE94]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C30A26845A82CA340B087B665F46124D]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\PerlRegEx.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C37B43163C234D945BE3F8D117F70858]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\crash.avgdx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C5C0D5776267F764B94307DC98586F16]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\DiskExplorer.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C9134FC31AC61F742A5A1EBEFCA7662C]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\Shredder.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE9C52A24623A1344AFDD03D0E00B1D2]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\xmlrtl190.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D2E597356A79EBE409E103B24DF7BF77]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\tulic-x64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D8426BD2A40AB694B85AF987899C67C7]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUiOSCleanerx.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D8C9004D824A64E46A8928E56E8565C6]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\XMLComponents.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D93C08663E49C274EAA2C25524F4294C]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\RegistryEditor.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DC202D53591178548BA58A4C327A91BA]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E2B17EE021576AE42BA931E776DBEFBD]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUKernel.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E44AE4BE0C485E84F8A316D61B255D32]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\StartupOptimizer.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4692DFA04D3E9740AEF41D64DD38027]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\tulic.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E48E42685AE42CC4EAC153958AE8C32D]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpSystemStatusCheck.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4CD54C1452BA5844A6CCDE2F9C7398B]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\ImgResTu.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E615018751FF1F74DA0E34C0D866047F]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TURar.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E6457078E8B3D244D811FC9363453D83]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\RepairWizard.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E8D288CD8FD8A2349BD81A0ED48AAD0D]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\UninstallManager.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E93AB854AD2F0704FA8A2107980825FD]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\libcef.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E98FA0BC3C8C5524B9C1DD5007A14AD2]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\avgreplibx.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBD8BE1FFDACCF947BB47076EC0A17A6]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\dxComnD12.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ECC07E2E118DD9744B679F928FCC0E48]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\avgduix.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F0306CB437D2591489F5F5FFB1E90FB0]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\HexEdit.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F068A7A365FAFAB4098BF266899ACDEF]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\UnRar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2041205A868DB544961100B7A1B319D]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\ShortcutCleaner.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F30768324B90A5448A03A8E84002A220]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUParams.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F390639AC7B79C04FABF466DC779696D]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\ProgramDeactivator.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F436B169A6332784AB34F33FFC4ACDBE]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\RegistryCleaner.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F62CF862776900D41847C5958000CFF4]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\authuitu-x86.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F63BC76C8D5660C4A9D9517504B05D02]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TURegOpt64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F735FFB166EB2DD47BB765BA191F4904]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\dxDockingD12.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F78CA130741688A4594ADEF4FDF458B2]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\OneClick.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7CDD49CE743404498B63F676C061032]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\cxLibraryD12.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F92971B5EC0FFD046A050846102701DE]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUData.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F95E3A9619FE2E1478E8D5DEC28EADE8]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuZenManager.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F9C92A445C614F844914C5E426C0599E]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\tuavgx.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA8FEDA97A156AE4CA221AD128E5927E]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\dxThemeD12.bpl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FC44AAD5806FA524DAF4FADC3326FE19]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FCB20C5589C6F184F90CB60C36702C8E]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUTuningIndex.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FD3D78EC347DAB14FA67E08F7065F93F]
"281C699A42731FD44ACB6651F45ED7EF"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\1DE47CA4B917AD64B8A843F0FB982219\InstallProperties]
"DisplayName"="AVG PC TuneUp 2015 (en-US)"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\281C699A42731FD44ACB6651F45ED7EF\InstallProperties]
"InstallLocation"="C:\Program Files (x86)\AVG\AVG PC TuneUp\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\281C699A42731FD44ACB6651F45ED7EF\InstallProperties]
"DisplayName"="AVG PC TuneUp 2015"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant]
"ExecutablestoExclude"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUInstallHelper.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AVG\AWL2015]
"InstallPath"="C:\Program Files (x86)\AVG\AVG PC TuneUp\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AVG\AWL2015\Shortcuts]
"PinWandIntegrator"="AVG PC TuneUp 2015|Starts AVG PC TuneUp 2015.|Integrator.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AVG\AWL2015\Shortcuts]
"FolderName"="AVG PC TuneUp 2015"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AVG\AWL2015\Shortcuts]
"MenuIntegratorProgramsRoot"="AVG PC TuneUp 2015|Starts AVG PC TuneUp 2015.|Integrator.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AVG\AWL2015\Shortcuts]
"MenuIntegratorSub"="AVG PC TuneUp 2015|Starts AVG PC TuneUp 2015.|Integrator.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AVG\AWL2015\Shortcuts]
"MenuHelpSub"="AVG PC TuneUp Help|Shows the AVG PC TuneUp help file.|main_vista_7.chm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AVG\AWL2015\Shortcuts]
"SettingCenterSub"="AVG Setting Center|A central point for modifying all AVG PC TuneUp settings.|SettingCenter.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AVG\AWL2015\Shortcuts]
"UpdateWizardSub"="AVG Update Wizard|Keeps your version of AVG PC TuneUp always up to date.|UpdateWizard.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AVG\AWL2015\Shortcuts]
"DesktopIntegrator"="AVG PC TuneUp 2015|Starts AVG PC TuneUp 2015.|Integrator.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4AC74ED1-719B-46DA-8B8A-340FBF892291}]
"DisplayName"="AVG PC TuneUp 2015 (en-US)"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TuneUp]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{00711705-12C5-420B-A4E5-6413F2AB3C7B}]
@="TuneUp WinLogon Extension"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{E7F8549F-814B-417D-ADC6-C2AFD6ADF1BB}]
@="ITuneUpToolsPrefetchInfo"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\{51F2A986-73E1-4C23-85F2-690C7828CC11}]
"LocalService"="TuneUp.UtilitiesSvc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}\1.0]
@="TuneUp Utilities Service Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}\1.0\0\win64]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}\1.0\HELPDIR]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{606F0A47-FA39-4F52-8556-5565AE7F586F}\1.0]
@="TuneUp Utilities Program Manager Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{606F0A47-FA39-4F52-8556-5565AE7F586F}\1.0\0\win64]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe\2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{606F0A47-FA39-4F52-8556-5565AE7F586F}\1.0\HELPDIR]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{8195A3CB-8892-4914-A680-FEBD2C1A2EC2}\1.0\0\win64]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\ProcessManager64.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{8195A3CB-8892-4914-A680-FEBD2C1A2EC2}\1.0\HELPDIR]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{F04CE194-D75F-4CDC-9816-08193D328B65}\1.0\0\win64]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe\4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{F04CE194-D75F-4CDC-9816-08193D328B65}\1.0\HELPDIR]
@="C:\Program Files (x86)\AVG\AVG PC TuneUp"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TUNEUPUTILITIESDRV]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\TuneUp]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_TUNEUPUTILITIESDRV]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\eventlog\TuneUp]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TUNEUPUTILITIESDRV]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\TuneUp]
[HKEY_USERS\S-1-5-21-2845901189-3817738784-3823200384-1001\Software\Microsoft\IntelliPoint\AppSpecific\TUMessages.exe]
"Path"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUMessages.exe"
[HKEY_USERS\S-1-5-21-2845901189-3817738784-3823200384-1001\Software\Microsoft\IntelliType Pro\AppSpecific\TUMessages.exe]
"Path"="C:\Program Files (x86)\AVG\AVG PC TuneUp\TUMessages.exe"
[HKEY_USERS\S-1-5-21-2845901189-3817738784-3823200384-1001\Software\Microsoft\Office\14.0\Common\LanguageResources]
"LangTuneUp"="OfficeCompleted"
[HKEY_USERS\S-1-5-21-2845901189-3817738784-3823200384-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\AVG\AVG PC TuneUp\Integrator.exe"="AVG PC TuneUp - Start Center"
[HKEY_USERS\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\AVG\AVG PC TuneUp\Integrator.exe"="AVG PC TuneUp - Start Center"

Searching for "Panda"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75}\InprocServer32]
@="C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAShell.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}]
@="Panda Security Toolbar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}\InprocServer32]
@="C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A7DF5BD5-7139-4D75-BEBE-EE785C0AAE24}\1.0\0\win32]
@="C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A7DF5BD5-7139-4D75-BEBE-EE785C0AAE24}\1.0\HELPDIR]
@="C:\Program Files (x86)\Panda Security\Panda Security Protection"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AA50F6CC-C49D-44DF-B397-ADF57A8DE4EC}\1.0\0\win64]
@="C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAShell.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AA50F6CC-C49D-44DF-B397-ADF57A8DE4EC}\1.0\HELPDIR]
@="C:\Program Files (x86)\Panda Security\Panda Security Protection"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{A7DF5BD5-7139-4D75-BEBE-EE785C0AAE24}\1.0\0\win32]
@="C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{A7DF5BD5-7139-4D75-BEBE-EE785C0AAE24}\1.0\HELPDIR]
@="C:\Program Files (x86)\Panda Security\Panda Security Protection"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{AA50F6CC-C49D-44DF-B397-ADF57A8DE4EC}\1.0\0\win64]
@="C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAShell.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{AA50F6CC-C49D-44DF-B397-ADF57A8DE4EC}\1.0\HELPDIR]
@="C:\Program Files (x86)\Panda Security\Panda Security Protection"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC2DE09D-AF76-42f2-80E9-E5FFE623B971}]
"AppPath"="C:\Program Files (x86)\pandasecuritytb"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\Avatar_Models\Panda\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\Gadget\gadget_panda\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Panda Security\Panda Security Protection\Res\Current\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Panda Security\Panda Security Protection\Res\Current\Images\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0B407178B3B08624ECF8964382F87CFE]
"8994BF104C33134458DE70E9E3FE7ED5"="C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\Avatar_Models\Panda\panda.hdp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C9C7053B77DC665EF06F5CB685429ACC]
"8994BF104C33134458DE70E9E3FE7ED5"="C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\Gadget\gadget_panda\hat.gdt"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC2DE09D-AF76-42f2-80E9-E5FFE623B971}]
"AppPath"="C:\Program Files (x86)\pandasecuritytb"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Panda Software]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{A7DF5BD5-7139-4D75-BEBE-EE785C0AAE24}\1.0\0\win32]
@="C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{A7DF5BD5-7139-4D75-BEBE-EE785C0AAE24}\1.0\HELPDIR]
@="C:\Program Files (x86)\Panda Security\Panda Security Protection"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{AA50F6CC-C49D-44DF-B397-ADF57A8DE4EC}\1.0\0\win64]
@="C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAShell.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{AA50F6CC-C49D-44DF-B397-ADF57A8DE4EC}\1.0\HELPDIR]
@="C:\Program Files (x86)\Panda Security\Panda Security Protection"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PANDA_URL_FILTERINGD]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{8E7A0A43-3899-4FCF-9FC2-FE042E225A65}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\pandasecuritytb\cleanupie.exe|Name=Panda Security Toolbar IE Cleaner|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1C4C4CB3-030E-43F8-A8FA-AD1F108F25E1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\pandasecuritytb\cleanupie.exe|Name=Panda Security Toolbar IE Cleaner|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{60892E9B-8DD2-43BA-877F-4AD083D30875}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\pandasecuritytb\ToolbarCleaner.exe|Name=ToolbarCleaner|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{F82B5DAC-3410-46D3-A9AD-9803E6FC350C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\pandasecuritytb\ToolbarCleaner.exe|Name=ToolbarCleaner|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_PANDA_URL_FILTERINGD]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PSGenUn]
"ImagePath"="C:\SMCLpav\SMCLpav.exe /LogC:\ProgramData\Panda Security\PSLogs\SMCLpav_exe.log /RunService"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PSGenUn]
"DisplayName"="Panda Security Generic Uninstaller"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{8E7A0A43-3899-4FCF-9FC2-FE042E225A65}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\pandasecuritytb\cleanupie.exe|Name=Panda Security Toolbar IE Cleaner|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1C4C4CB3-030E-43F8-A8FA-AD1F108F25E1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\pandasecuritytb\cleanupie.exe|Name=Panda Security Toolbar IE Cleaner|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{60892E9B-8DD2-43BA-877F-4AD083D30875}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\pandasecuritytb\ToolbarCleaner.exe|Name=ToolbarCleaner|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{F82B5DAC-3410-46D3-A9AD-9803E6FC350C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\pandasecuritytb\ToolbarCleaner.exe|Name=ToolbarCleaner|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PANDA_URL_FILTERINGD]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{8E7A0A43-3899-4FCF-9FC2-FE042E225A65}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\pandasecuritytb\cleanupie.exe|Name=Panda Security Toolbar IE Cleaner|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1C4C4CB3-030E-43F8-A8FA-AD1F108F25E1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\pandasecuritytb\cleanupie.exe|Name=Panda Security Toolbar IE Cleaner|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{60892E9B-8DD2-43BA-877F-4AD083D30875}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\pandasecuritytb\ToolbarCleaner.exe|Name=ToolbarCleaner|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{F82B5DAC-3410-46D3-A9AD-9803E6FC350C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\pandasecuritytb\ToolbarCleaner.exe|Name=ToolbarCleaner|"
[HKEY_USERS\.DEFAULT\Software\AppDataLow\Software\panda]
[HKEY_USERS\S-1-5-18\Software\AppDataLow\Software\panda]

-= EOF =-
Jkirwin is offline  
Old 12-21-2015, 06:30 PM   #13
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar

Microsoft Most Valuable Professional
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



Hello again, Jkirwin. You're very welcome. Please tell us how your system is behaving. Any improvement?

While I analyze those last results, do the following:

------------------------------------------------------
  • Launch Malwarebytes' Anti-Malware
  • On the Dashboard, click the Scan Now button.
  • A check for database updates will be performed.
  • After the update check completes, a Threat Scan will begin.
  • When the scan is complete, if there have been detections, click Remove Selected to allow MBAM to clean what was detected.
  • In most cases, a restart will be required and a prompt will be shown.
  • Wait for the prompt to restart the computer to appear, then click on Yes
  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs
  • Double-click on the Scan Log which shows the Date and Time of the scan just performed.
  • Click Export
  • Click Text file (*.txt)
  • In the Save File dialog box which appears, click on Desktop.
  • In the File name: box type a name for your scan log.
  • A message box named File Saved should appear stating "Your file has been successfully exported".
  • Click Ok
  • Post that saved log in your next reply.
------------------------------------------------------

Please run this online scan to help look for remnants. Ensure your external and/or USB drives are inserted during the scan.

Go here and click 'Run ESET Online Scanner'.
  • If you are not using Internet Explorer, double-click esetsmartinstaller_enu.exe to install it, then click 'Run'.
  • Turn off the real-time scanner of any existing antivirus program while performing the online scan. Here's how
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • If using Internet Explorer, allow the ActiveX control to install when asked.
  • Once the components have downloaded, tick the option Enable detection of potentially unwanted applications
  • Click on Advanced Settings
  • Make sure that the option Remove found threats is unticked.
  • Ensure these options are ticked:
    • Scan Archives
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • Next to 'Current scan targets: Operating memory, Local drives', click the Change... button.
  • Tick all the boxes that correspond to your external/inserted drives.
  • Click Start
  • Wait for the scan to finish.
  • When the scan is done, if it shows a screen that says "Threats found!", click "List of found threats", and then click "Export to text file..."
  • Save that text file to your desktop, and then copy/paste the contents in your next reply.
------------------------------------------------------

Please post the following in your next reply:

MBAM log
ESET report
report on system behavior
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
Old 12-21-2015, 09:26 PM   #14
Registered Member
 
Join Date: May 2007
Posts: 55
OS: MS 7



MBAM ( This looks good)

Malwarebytes Anti-Malware
www.malwarebytes.org


Update, 12/22/2015 12:23 AM, SYSTEM, JAMESKIRWIN-HP, Manual, Malware Database, 2015.12.21.8, 2015.12.22.1,

(end)

ESET

C:\Program Files (x86)\NCH Software\WavePad\wavepad.exe a variant of Win32/Bundled.Toolbar.Google.C potentially unsafe application
C:\System Volume Information\SystemRestore\FRStaging\Program Files (x86)\Panda Security\Panda Security Protection\Tools\PandaSecurityTb.exe a variant of Win32/Toolbar.Visicom.A potentially unwanted application
C:\System Volume Information\SystemRestore\FRStaging\Program Files (x86)\pandasecuritytb\dtuser.exe a variant of Win32/Toolbar.Visicom.C potentially unwanted application
C:\System Volume Information\SystemRestore\FRStaging\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll a variant of Win32/Toolbar.Visicom.B potentially unwanted application
C:\System Volume Information\SystemRestore\FRStaging\Program Files (x86)\pandasecuritytb\pandasecuritytb.dll a variant of Win32/Toolbar.Visicom.A potentially unwanted application
C:\System Volume Information\SystemRestore\FRStaging\Program Files (x86)\pandasecuritytb\ToolbarCleaner.exe a variant of Win32/Toolbar.Visicom.E potentially unwanted application
C:\System Volume Information\SystemRestore\FRStaging\Program Files (x86)\pandasecuritytb\uninstall.exe a variant of Win32/Toolbar.Visicom.E potentially unwanted application
C:\System Volume Information\SystemRestore\FRStaging\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringc.dll a variant of Win64/NetFilter.A potentially unsafe application
C:\Users\James Kirwin\Desktop\cbsidlm-cbsi213-Free_MP4_Player-SEO-75965047.exe a variant of Win32/CNETInstaller.B potentially unwanted application
C:\Users\James Kirwin\Documents\Exotic\exotic2.zip HTML/Iframe.B trojan
C:\Users\James Kirwin\Downloads\cbsidlm-cbsi188-RAR_File_Open_Knife__Free_Opener-SEO-10971016.exe a variant of Win32/CNETInstaller.B potentially unwanted application
C:\Users\James Kirwin\Downloads\cbsidlm-cbsi188-Wise_Registry_Cleaner-SEO-10605508 (1).exe a variant of Win32/CNETInstaller.B potentially unwanted application
C:\Users\James Kirwin\Downloads\cbsidlm-cbsi188-Wise_Registry_Cleaner-SEO-10605508.exe a variant of Win32/CNETInstaller.B potentially unwanted application
C:\Users\James Kirwin\Downloads\ccsetup509.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\James Kirwin\Downloads\WinZip180.exe a variant of Win32/OpenInstall potentially unwanted application
C:\Windows\Installer\MSI5CB3.tmp a variant of Win32/Bundled.Toolbar.Ask.M potentially unsafe application
G:\JAMESKIRWIN-HP\Backup Set 2015-12-10 063830\Backup Files 2015-12-10 063830\Backup files 17.zip a variant of Win32/Toolbar.Visicom.C potentially unwanted application
G:\JAMESKIRWIN-HP\Backup Set 2015-12-10 063830\Backup Files 2015-12-10 063830\Backup files 179.zip HTML/Iframe.B trojan
G:\JAMESKIRWIN-HP\Backup Set 2015-12-10 063830\Backup Files 2015-12-10 063830\Backup files 35.zip a variant of Win32/CNETInstaller.B potentially unwanted application
G:\JAMESKIRWIN-HP\Backup Set 2015-12-10 063830\Backup Files 2015-12-10 063830\Backup files 37.zip a variant of Win32/CNETInstaller.B potentially unwanted application
G:\JAMESKIRWIN-HP\Backup Set 2015-12-10 063830\Backup Files 2015-12-10 063830\Backup files 40.zip a variant of Win32/OpenInstall potentially unwanted application


Computer seems to be running better and more as expected
Jkirwin is offline  
Old 12-22-2015, 03:03 PM   #15
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar

Microsoft Most Valuable Professional
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



Hello again, Jkirwin. Glad to hear it. Almost done.

System Volume Information is where Windows keeps old system restore points. Both will get deleted when we uninstall ComboFix.

I'll leave it up to you whether to delete those backup zip files flagged by ESET.

------------------------------------------------------

Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix.

Open Notepad and copy/paste all the text in the quotebox below into Notepad:

Quote:
Folder::
C:\Program Files (x86)\AVG
C:\ProgramData\AVG
C:\Users\All Users\AVG
C:\Users\James Kirwin\AppData\Local\AVG
C:\Users\James Kirwin\AppData\Local\VirtualStore\ProgramData\AVG
C:\Users\James Kirwin\AppData\Roaming\AVG
C:\Users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\avg
C:\Windows\System32\config\systemprofile\AppData\Local\Avg
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Avg
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\AVG

File::
C:\Program Files (x86)\NCH Software\WavePad\wavepad.exe
C:\Users\James Kirwin\Desktop\cbsidlm-cbsi213-Free_MP4_Player-SEO-75965047.exe
C:\Users\James Kirwin\Documents\Exotic\exotic2.zip
C:\Users\James Kirwin\Downloads\cbsidlm-cbsi188-RAR_File_Open_Knife__Free_Opener-SEO-10971016.exe
C:\Users\James Kirwin\Downloads\cbsidlm-cbsi188-Wise_Registry_Cleaner-SEO-10605508 (1).exe
C:\Users\James Kirwin\Downloads\cbsidlm-cbsi188-Wise_Registry_Cleaner-SEO-10605508.exe
C:\Users\James Kirwin\Downloads\ccsetup509.exe
C:\Users\James Kirwin\Downloads\WinZip180.exe
C:\Windows\Installer\MSI5CB3.tmp

ClearJavaCache::

Registry::
[-HKEY_CURRENT_USER\Software\Microsoft\IntelliPoint\AppSpecific\TUMessages.exe]
[-HKEY_CURRENT_USER\Software\Microsoft\IntelliType Pro\AppSpecific\TUMessages.exe]
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\AVG\AVG PC TuneUp\Integrator.exe"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{51F2A986-73E1-4C23-85F2-690C7828CC11}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00711705-12C5-420B-A4E5-6413F2AB3C7B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02849255-07CD-4C09-97D7-017DA2AE45AA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2509ABBC-871E-42e5-A27B-F7DA394B1897}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42D67DD2-D956-4698-A502-9F59727E044A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4838CD50-7E5D-4811-9B17-C47A85539F28}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5EF1CF5D-87A9-434b-8786-2A08E1C30F6C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\TuneUp Undelete]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8443292F-BFCE-4C79-8192-922DBA7B2866}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCA02D56-BF9D-4591-AD41-E59AF763C64A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FD8DB406-E813-4FF5-BEB0-6C6DC373B985}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\1DE47CA4B917AD64B8A843F0FB982219]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\281C699A42731FD44ACB6651F45ED7EF]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7F8549F-814B-417D-ADC6-C2AFD6ADF1BB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.ProgramManager]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.TUUtilityTools]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvc]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvc]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TuneUp.UtilitiesSvcTools]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{606F0A47-FA39-4F52-8556-5565AE7F586F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8195A3CB-8892-4914-A680-FEBD2C1A2EC2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F04CE194-D75F-4CDC-9816-08193D328B65}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00711705-12C5-420B-A4E5-6413F2AB3C7B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7F8549F-814B-417D-ADC6-C2AFD6ADF1BB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{51F2A986-73E1-4C23-85F2-690C7828CC11}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{606F0A47-FA39-4F52-8556-5565AE7F586F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{8195A3CB-8892-4914-A680-FEBD2C1A2EC2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{F04CE194-D75F-4CDC-9816-08193D328B65}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\AVG\AVG PC TuneUp\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\018647013AAD3BC41860311C4741396B]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\024B9E1C9FB70154F90C413532A546BA]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\04746129646274C4B939D6FC71EF4F2A]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0C25C3CE0B60FB54D89CE2B9D56ED9C4]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0D15832E0443B0343957E18497F6BAE5]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0F3E84C4789ECA948A6040F9981CF2F1]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\106C0329EB6F96F4B820D25C40407183]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11867B7A679F38D4F91977CCAEDD63A0]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1388D766C7040F14A9265D117B2A4E1B]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16290A0D96554E14E990F7399848038E]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1CC1DF8FB58E47448B91333BDFD4D571]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20AE8B36FE07E2D4892FF146FB5770AC]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20B9A0EC9E8112349BFFD4E24AE7B2F3]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2464177FA2DE5E74498637068DA3C7BA]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2527F68EF3E3EDA4C8CFA05746D0E27B]
"281C699A42731FD44ACB6651F45ED7EF"=-"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2634A0CE5AEDB4346AFAD1186E49C1C1]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2642BF6F76E577243945F5E888376DEE]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\30319372162210F419BA849293BE91D0]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\310054E6F94C1264F9020F69B693A103]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3309675AD51EAB340BFCFD0FDA86E4DC]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3771063D460538642B97CC8AE976F840]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A6887691BFBD384FBB63B00B90B8859]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A891C71A03BC544582D1370DCAA37B3]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3D374B1AC9E6BED4CA4295CE27BB6C72]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3EB9A9FF0F75DB74F83B0118FC675D25]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\420AD3DC0342B5E4E8DC01A70AE7625C]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\42F75296D7067B54AAD40227A7F1F02F]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4329F0B9F3594FA438356B1CE6BE3A25]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\463EC6B2C073C484A87C317774C41EE9]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4697AEEA899D389459D43F1E190D5CA8]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49EB20E14F01B95489AB758F12C71782]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A2F2139191A0C24F819D7C545691D05]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4F7067B03618A2744BB53A9DFE35C680]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5065CB0F9D055944C8A8640132BDF2E3]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5204F549D5956D245A8609622211BEB0]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53237B88B40119144A152B114CA917ED]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\55254E5BD6EDD9C4F94C9C7608152374]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57EE8392BC95B4847AE5F024E378D6D0]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\593F28AC1DDADC64A9AAC2DC62167560]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59CCBD5582C2BFB44B1A32F6FCB6B256]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5BE314CD606D6FF43BBF4E21AA81DC39]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\65250F0ED68B7C147AEEF9D90B096EFD]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\699C18B59FEDB7345A4589B91B6E5CED]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6A7D1E6506B117B479B2FFF227B41649]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C2DF650F65CC9042B96DF9672AC19FA]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EFB6C20ED4E12E4C87FDCC648CE75C0]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\71FDBBCDCE09831408B32D56EF6C829C]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\74261C5C907F4264CA786B802A9BD5D5]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\78CAAFAB319609F4B90E926AF17E4D0B]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\794A9CF6C0A028E409CA94BE15D59E6E]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\79E9D5EB9CF65ED49A056416FBB809FD]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CF216552A2643C48B3B73E8C7168390]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FD321E98D536C2499939A7E1D67CAC4]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8453B91AEE3AA4245BF5B7D09C2A11CE]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8521CBD769651A8488A89D388A78F01F]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86D434B4243A0D14E9BFC83B2F250C87]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CB21A6D0A2675F409A70DF9CCEC2044]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CCA42DEFD70AA14BAAF818AA6346DA4]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8E1FF55D50CEBD748A4684E5D4655B7E]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F17458D795978B4594EB0C96389A6C3]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\93442F26E6193F344ACA61E56B63AF93]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\937732AC7230BFE40ACAE58899EF4BB5]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97AADAB00AEA9F5448CA9471B7EFA10B]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B20961489CDA6D43A01BB544E09C045]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B472ED9EA42F6044B7BCE7BFBAA3BA8]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B765335767F2164A9E3DBFD635F1211]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9BC05D135F451C44F94BD870489413EB]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C6EB587006F9274CB35421CA25A4C2B]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9ECF20D0246959E4493EAB432DB608BA]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9EE651545CD5D644BA5BAD9AD8F8F72D]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A217A9C9D0FD2CB40B64EA890BD8452F]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A24755BBFCD0E3C44AE59617A2D6F8FA]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A724CACFB59D2E7418C2CD99FF1239D1]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A7E04CD373226E1439E4F8BEFBE7C005]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A827772DACF666B40870ACA546CDAAA7]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A8AA4D1E6B2905B449F8619B2FA8C1C3]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AA42B59EDCF31C14CBA3F68F944F6E9C]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AA7A1C1D025287647A564E71FA413A02]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AEC29866530EA5F4899D4C22C0C6B326]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B072C6A84A094F944B0D552D269F164A]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B53D3EE0691580B4B8197C50BCB7DD19]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B90A5B697A1E3CA40A82CF622EC8F29D]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC7C09865DE3D3D49BFF377B7E8B98FC]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD762B36F481F5E488FDD0C76758EFC7]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BE0E6688D4B46CA448D1D680AC2A29CE]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C2C47AE18AF7DE94987494B253F3AE94]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C30A26845A82CA340B087B665F46124D]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C37B43163C234D945BE3F8D117F70858]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C5C0D5776267F764B94307DC98586F16]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C9134FC31AC61F742A5A1EBEFCA7662C]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE9C52A24623A1344AFDD03D0E00B1D2]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D2E597356A79EBE409E103B24DF7BF77]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D8426BD2A40AB694B85AF987899C67C7]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D8C9004D824A64E46A8928E56E8565C6]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D93C08663E49C274EAA2C25524F4294C]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DC202D53591178548BA58A4C327A91BA]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E2B17EE021576AE42BA931E776DBEFBD]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E44AE4BE0C485E84F8A316D61B255D32]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4692DFA04D3E9740AEF41D64DD38027]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E48E42685AE42CC4EAC153958AE8C32D]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4CD54C1452BA5844A6CCDE2F9C7398B]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E615018751FF1F74DA0E34C0D866047F]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E6457078E8B3D244D811FC9363453D83]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E8D288CD8FD8A2349BD81A0ED48AAD0D]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E93AB854AD2F0704FA8A2107980825FD]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E98FA0BC3C8C5524B9C1DD5007A14AD2]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBD8BE1FFDACCF947BB47076EC0A17A6]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ECC07E2E118DD9744B679F928FCC0E48]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F0306CB437D2591489F5F5FFB1E90FB0]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F068A7A365FAFAB4098BF266899ACDEF]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2041205A868DB544961100B7A1B319D]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F30768324B90A5448A03A8E84002A220]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F390639AC7B79C04FABF466DC779696D]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F436B169A6332784AB34F33FFC4ACDBE]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F62CF862776900D41847C5958000CFF4]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F63BC76C8D5660C4A9D9517504B05D02]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F735FFB166EB2DD47BB765BA191F4904]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F78CA130741688A4594ADEF4FDF458B2]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7CDD49CE743404498B63F676C061032]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F92971B5EC0FFD046A050846102701DE]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F95E3A9619FE2E1478E8D5DEC28EADE8]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F9C92A445C614F844914C5E426C0599E]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA8FEDA97A156AE4CA221AD128E5927E]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FC44AAD5806FA524DAF4FADC3326FE19]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FCB20C5589C6F184F90CB60C36702C8E]
"281C699A42731FD44ACB6651F45ED7EF"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FD3D78EC347DAB14FA67E08F7065F93F]
"281C699A42731FD44ACB6651F45ED7EF"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\1DE47CA4B917AD64B8A843F0FB982219]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\281C699A42731FD44ACB6651F45ED7EF]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant]
"ExecutablestoExclude"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AVG]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4AC74ED1-719B-46DA-8B8A-340FBF892291}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TuneUp]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{00711705-12C5-420B-A4E5-6413F2AB3C7B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{E7F8549F-814B-417D-ADC6-C2AFD6ADF1BB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\{51F2A986-73E1-4C23-85F2-690C7828CC11}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{3D61672B-0DE5-46B9-BE0D-2E03FA9AD49C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{606F0A47-FA39-4F52-8556-5565AE7F586F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{8195A3CB-8892-4914-A680-FEBD2C1A2EC2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{F04CE194-D75F-4CDC-9816-08193D328B65}]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TUNEUPUTILITIESDRV]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\TuneUp]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_TUNEUPUTILITIESDRV]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\eventlog\TuneUp]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TUNEUPUTILITIESDRV]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\TuneUp]
[-HKEY_USERS\S-1-5-21-2845901189-3817738784-3823200384-1001\Software\Microsoft\IntelliPoint\AppSpecific\TUMessages.exe]
[HKEY_USERS\S-1-5-21-2845901189-3817738784-3823200384-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\AVG\AVG PC TuneUp\Integrator.exe"=-
[HKEY_USERS\S-1-5-21-2845901189-3817738784-3823200384-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\AVG\AVG PC TuneUp\Integrator.exe"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A7DF5BD5-7139-4D75-BEBE-EE785C0AAE24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AA50F6CC-C49D-44DF-B397-ADF57A8DE4EC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{A7DF5BD5-7139-4D75-BEBE-EE785C0AAE24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{AA50F6CC-C49D-44DF-B397-ADF57A8DE4EC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC2DE09D-AF76-42f2-80E9-E5FFE623B971}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Panda Security\Panda Security Protection\Res\Current\"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Panda Security\Panda Security Protection\Res\Current\Images\"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC2DE09D-AF76-42f2-80E9-E5FFE623B971}]
"AppPath"="C:\Program Files (x86)\pandasecuritytb"
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Panda Software]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{A7DF5BD5-7139-4D75-BEBE-EE785C0AAE24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{AA50F6CC-C49D-44DF-B397-ADF57A8DE4EC}]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PANDA_URL_FILTERINGD]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{8E7A0A43-3899-4FCF-9FC2-FE042E225A65}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1C4C4CB3-030E-43F8-A8FA-AD1F108F25E1}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{60892E9B-8DD2-43BA-877F-4AD083D30875}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{F82B5DAC-3410-46D3-A9AD-9803E6FC350C}"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_PANDA_URL_FILTERINGD]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PSGenUn]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{8E7A0A43-3899-4FCF-9FC2-FE042E225A65}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1C4C4CB3-030E-43F8-A8FA-AD1F108F25E1}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{60892E9B-8DD2-43BA-877F-4AD083D30875}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{F82B5DAC-3410-46D3-A9AD-9803E6FC350C}"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PANDA_URL_FILTERINGD]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{8E7A0A43-3899-4FCF-9FC2-FE042E225A65}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1C4C4CB3-030E-43F8-A8FA-AD1F108F25E1}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{60892E9B-8DD2-43BA-877F-4AD083D30875}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{F82B5DAC-3410-46D3-A9AD-9803E6FC350C}"=-
[-HKEY_USERS\.DEFAULT\Software\AppDataLow\Software\panda]
[-HKEY_USERS\S-1-5-18\Software\AppDataLow\Software\panda]
Save this Notepad file as CFScript.txt to your Desktop and then close the file.





Referring to the picture above, drag CFScript onto ComboFix.

If you are prompted to update ComboFix and have an internet connection, please choose Yes

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

Please re-enable your antivirus before posting the ComboFix.txt log.

------------------------------------------------------
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
Old 12-22-2015, 03:42 PM   #16
Registered Member
 
Join Date: May 2007
Posts: 55
OS: MS 7



I will delete the back-ups and the files flagged, I no longer need them.

Here is the file:

ComboFix 15-12-16.01 - James Kirwin 12/22/2015 18:20:28.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.7990.6557 [GMT -5:00]
Running from: c:\users\James Kirwin\Desktop\ComboFix.exe
Command switches used :: c:\users\James Kirwin\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"c:\program files (x86)\NCH Software\WavePad\wavepad.exe"
"c:\users\James Kirwin\Desktop\cbsidlm-cbsi213-Free_MP4_Player-SEO-75965047.exe"
"c:\users\James Kirwin\Documents\Exotic\exotic2.zip"
"c:\users\James Kirwin\Downloads\cbsidlm-cbsi188-RAR_File_Open_Knife__Free_Opener-SEO-10971016.exe"
"c:\users\James Kirwin\Downloads\cbsidlm-cbsi188-Wise_Registry_Cleaner-SEO-10605508 (1).exe"
"c:\users\James Kirwin\Downloads\cbsidlm-cbsi188-Wise_Registry_Cleaner-SEO-10605508.exe"
"c:\users\James Kirwin\Downloads\ccsetup509.exe"
"c:\users\James Kirwin\Downloads\WinZip180.exe"
"c:\windows\Installer\MSI5CB3.tmp"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\AVG
c:\program files (x86)\AVG\AVG PC TuneUp\authuitu-x64.dll
c:\program files (x86)\AVG\AVG PC TuneUp\authuitu-x86.dll
c:\program files (x86)\AVG\AVG PC TuneUp\avgdiagex.exe
c:\program files (x86)\AVG\AVG PC TuneUp\avgduix.dll
c:\program files (x86)\AVG\AVG PC TuneUp\avgdumpa.exe
c:\program files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe
c:\program files (x86)\AVG\AVG PC TuneUp\avgloga.dll
c:\program files (x86)\AVG\AVG PC TuneUp\avglogx.dll
c:\program files (x86)\AVG\AVG PC TuneUp\avgrepliba.dll
c:\program files (x86)\AVG\AVG PC TuneUp\avgreplibx.dll
c:\program files (x86)\AVG\AVG PC TuneUp\BrowserCleaner.exe
c:\program files (x86)\AVG\AVG PC TuneUp\data\CheckBoxChecked_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\CheckmarkGreen_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\CLSID_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\delete_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\delete_browser_16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\delete_files_16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\DuplicateFileFinder\js\duplicatefilefinder.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\empty.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\empty_vista.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\exportregistry.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\bootstrap-2.3.2.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\bootstrap-2.3.2.min.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\bootstrap.switch-1.8.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\format4js.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\jquery-1.4.2.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\jquery-2.0.2.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\jquery-2.0.2.min.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\jquery.color.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\jquery.countdown.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\jquery.easing.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\jquery.focus.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\jquery.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\jquery.layerbutton.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\js\helpers.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\js\tu.util.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\nag-auto-resize.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\prototype-1.7.1.mod.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Framework\tuneup.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Help_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_AppPaths_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_0_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_1_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_10_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_11_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_12_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_13_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_14_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_15_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_16_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_2_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_3_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_4_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_5_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_6_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_7_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_8_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_autorumsettings_ilSmall_9_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_chartbar_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_0_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_0_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_1_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_1_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_10_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_10_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_11_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_11_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_12_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_12_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_13_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_13_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_14_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_14_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_2_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_2_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_3_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_3_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_4_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_4_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_5_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_5_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_6_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_6_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_7_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_7_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_8_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_8_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_9_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_cmDisplayStartmenuForm_il_9_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_DLLFile_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_DocShortcut_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Exclamation_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Favorites_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_fiberoptic.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_filetype_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_FixedDisk_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Folder_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Folder_Hidden_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Folder_Opened_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Folder32_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_foldersearch_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_FontsFolder_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_HelpFile_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_History_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_home_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_inet_conn.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Information_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Information2_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_IniFile_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_inputdevices_ilhover_0_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_inputdevices_ilhover_1_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_inputdevices_ilhover_2_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_inputdevices_ilhover_3_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_lan_corporate.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_lan_private.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_MTU_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_MUICache_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_MultipleDrives.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_MyComputer_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_no_conn.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_no_internet.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_ODBC_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_OpenWith_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_opera_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_OrangeArrow_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_passwordsaving_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_public_network.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_questionMark.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_ras_modem.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_RegistryEditor_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_0_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_1_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_10_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_11_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_12_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_13_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_14_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_15_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_16_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_17_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_18_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_19_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_2_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_20_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_21_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_22_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_23_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_24_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_25_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_26_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_27_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_28_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_29_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_3_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_30_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_31_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_4_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_5_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_6_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_7_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_8_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_registryeditor_il_9_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_RescueCenter_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_RescueCenter_grey_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_safari_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_satellite.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Search_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Search_16x16_small.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Search_16x16_small_ani1.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Search_16x16_small_ani2.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Search_16x16_small_grey.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Services_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SharedFile_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_snaptobutton_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Software_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SoftwareSection_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_Sound_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_StartMenuXP_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SysInfo_Unit1_ImageList1_0_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SysInfo_Unit1_ImageList1_1_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SysInfo_Unit1_ImageList1_10_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SysInfo_Unit1_ImageList1_11_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SysInfo_Unit1_ImageList1_12_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SysInfo_Unit1_ImageList1_2_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SysInfo_Unit1_ImageList1_3_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SysInfo_Unit1_ImageList1_4_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SysInfo_Unit1_ImageList1_5_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SysInfo_Unit1_ImageList1_6_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SysInfo_Unit1_ImageList1_7_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SysInfo_Unit1_ImageList1_8_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SysInfo_Unit1_ImageList1_9_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_SystemExtensions_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_top100_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_TTL_32x32.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_unknown_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\ico_alpha_WindowsFirewall_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\Integrator\js\debug.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Integrator\js\integrator.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Integrator\js\pillar_problem_details.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\Integrator\js\proxy.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\iOSCleaner\components\tooltip\tooltip.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\iOSCleaner\css\fonts\handsofsean.ttf
c:\program files (x86)\AVG\AVG PC TuneUp\data\iOSCleaner\js\ioscleaner.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\iOSCleaner\js\view.cleaned.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\iOSCleaner\js\view.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\iOSCleaner\js\view.nojunk.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\iOSCleaner\js\view.results.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\iOSCleaner\js\view.scan.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\iOSCleaner\js\view.welcome.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\PerformanceOptimizer\tw_tuning_possibility.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\ProgramDeactivator\impactgraphinfo.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\ProgramDeactivator\sm_sidebar.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\RCArrow_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\shortcut_cleaner_16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\SimpleQuestionMark_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\StartUpControl_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\StartUpManager\sm_sidebar.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\SysteamHealth_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\css\main.css
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\gadget.xml
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\bg_button.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\bg_error.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\bg_gadget.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\blank.gif
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\button_economy_active.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\button_economy_default.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\button_economy_hover.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\button_economy_pressed.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\button_standard_active.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\button_standard_default.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\button_standard_hover.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\button_standard_pressed.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\button_turbo_active.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\button_turbo_default.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\button_turbo_hover.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\button_turbo_pressed.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\logo.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\logotu.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\progress_balloon_economy.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\progress_balloon_standard.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\progress_balloon_turbo.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\progress_bar_economy.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\progress_bar_standard.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\progress_bar_turbo.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\status_critical.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\status_critical_hover.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\status_good.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\status_good_hover.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\status_warning.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\images\status_warning_hover.png
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\js\com.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\js\jquery.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\js\main.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\js\sprintf.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\js\status.js
c:\program files (x86)\AVG\AVG PC TuneUp\data\TuneUpUtilities.gadget\main.html
c:\program files (x86)\AVG\AVG PC TuneUp\data\windows-functions_16x16.ico
c:\program files (x86)\AVG\AVG PC TuneUp\DiskCleaner.exe
c:\program files (x86)\AVG\AVG PC TuneUp\DiskDoctor.exe
c:\program files (x86)\AVG\AVG PC TuneUp\DiskExplorer.exe
c:\program files (x86)\AVG\AVG PC TuneUp\DriveDefrag.exe
c:\program files (x86)\AVG\AVG PC TuneUp\DseShExt-x64.dll
c:\program files (x86)\AVG\AVG PC TuneUp\DseShExt-x86.dll
c:\program files (x86)\AVG\AVG PC TuneUp\DuplicateFileFinder.dll
c:\program files (x86)\AVG\AVG PC TuneUp\DuplicateFinder.exe
c:\program files (x86)\AVG\AVG PC TuneUp\EnergyOptimizer.exe
c:\program files (x86)\AVG\AVG PC TuneUp\icudt.dll
c:\program files (x86)\AVG\AVG PC TuneUp\IECacheWinInetLdr.exe
c:\program files (x86)\AVG\AVG PC TuneUp\Integrator.exe
c:\program files (x86)\AVG\AVG PC TuneUp\iOSCleaner.exe
c:\program files (x86)\AVG\AVG PC TuneUp\libcef.dll
c:\program files (x86)\AVG\AVG PC TuneUp\MsStyles.dll
c:\program files (x86)\AVG\AVG PC TuneUp\OneClick.exe
c:\program files (x86)\AVG\AVG PC TuneUp\OneClickStarter.exe
c:\program files (x86)\AVG\AVG PC TuneUp\PerformanceOptimizer.exe
c:\program files (x86)\AVG\AVG PC TuneUp\PMLauncher.exe
c:\program files (x86)\AVG\AVG PC TuneUp\PowerModeManager.exe
c:\program files (x86)\AVG\AVG PC TuneUp\ProcessManager.exe
c:\program files (x86)\AVG\AVG PC TuneUp\ProcessManager64.exe
c:\program files (x86)\AVG\AVG PC TuneUp\ProgramDeactivator.exe
c:\program files (x86)\AVG\AVG PC TuneUp\RegistryCleaner.exe
c:\program files (x86)\AVG\AVG PC TuneUp\RegistryDefrag.exe
c:\program files (x86)\AVG\AVG PC TuneUp\RegistryEditor.exe
c:\program files (x86)\AVG\AVG PC TuneUp\RegWiz.exe
c:\program files (x86)\AVG\AVG PC TuneUp\RepairWizard.exe
c:\program files (x86)\AVG\AVG PC TuneUp\Report.exe
c:\program files (x86)\AVG\AVG PC TuneUp\RescueCenter.exe
c:\program files (x86)\AVG\AVG PC TuneUp\SDShelEx-win32.dll
c:\program files (x86)\AVG\AVG PC TuneUp\SDShelEx-x64.dll
c:\program files (x86)\AVG\AVG PC TuneUp\SettingCenter.exe
c:\program files (x86)\AVG\AVG PC TuneUp\ShortcutCleaner.exe
c:\program files (x86)\AVG\AVG PC TuneUp\Shredder.exe
c:\program files (x86)\AVG\AVG PC TuneUp\SilentUpdater.exe
c:\program files (x86)\AVG\AVG PC TuneUp\StartUpManager.exe
c:\program files (x86)\AVG\AVG PC TuneUp\StartupOptimizer.exe
c:\program files (x86)\AVG\AVG PC TuneUp\Stiderc.dll
c:\program files (x86)\AVG\AVG PC TuneUp\Styler.exe
c:\program files (x86)\AVG\AVG PC TuneUp\SystemControl.exe
c:\program files (x86)\AVG\AVG PC TuneUp\SystemInformation.exe
c:\program files (x86)\AVG\AVG PC TuneUp\TUAnalyzeInfo.dll
c:\program files (x86)\AVG\AVG PC TuneUp\TUAnalyzeInfo64.dll
c:\program files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe
c:\program files (x86)\AVG\AVG PC TuneUp\TUAutoUpdateCheck.exe
c:\program files (x86)\AVG\AVG PC TuneUp\tuavga.dll
c:\program files (x86)\AVG\AVG PC TuneUp\tuavgx.dll
c:\program files (x86)\AVG\AVG PC TuneUp\TUDefragBackend64.exe
c:\program files (x86)\AVG\AVG PC TuneUp\TUInstallHelper.exe
c:\program files (x86)\AVG\AVG PC TuneUp\TUiOSCleanera.dll
c:\program files (x86)\AVG\AVG PC TuneUp\TUiOSCleanerx.dll
c:\program files (x86)\AVG\AVG PC TuneUp\tulic-x64.dll
c:\program files (x86)\AVG\AVG PC TuneUp\tulic.dll
c:\program files (x86)\AVG\AVG PC TuneUp\tulnga.dll
c:\program files (x86)\AVG\AVG PC TuneUp\tulngx.dll
c:\program files (x86)\AVG\AVG PC TuneUp\TUMessages.exe
c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpRPC32.dll
c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpSystemStatusCheck.exe
c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe
c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.cat
c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys
c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
c:\program files (x86)\AVG\AVG PC TuneUp\TUParams.dll
c:\program files (x86)\AVG\AVG PC TuneUp\TUPSAPI.dll
c:\program files (x86)\AVG\AVG PC TuneUp\TURatingSynch.exe
c:\program files (x86)\AVG\AVG PC TuneUp\TURegOpt64.exe
c:\program files (x86)\AVG\AVG PC TuneUp\TUSqlDB32.dll
c:\program files (x86)\AVG\AVG PC TuneUp\TUTuningIndex.dll
c:\program files (x86)\AVG\AVG PC TuneUp\TUTuningIndex64.dll
c:\program files (x86)\AVG\AVG PC TuneUp\TUUUnInstallHelper.exe
c:\program files (x86)\AVG\AVG PC TuneUp\tux64thk.exe
c:\program files (x86)\AVG\AVG PC TuneUp\TuZenManager.exe
c:\program files (x86)\AVG\AVG PC TuneUp\Undelete.exe
c:\program files (x86)\AVG\AVG PC TuneUp\UninstallManager.exe
c:\program files (x86)\AVG\AVG PC TuneUp\uninstmsmsg.ini
c:\program files (x86)\AVG\AVG PC TuneUp\UnRar.dll
c:\program files (x86)\AVG\AVG PC TuneUp\UpdateWizard.exe
c:\program files (x86)\AVG\AVG PC TuneUp\uxtuneup-x64.dll
c:\program files (x86)\AVG\AVG PC TuneUp\uxtuneup-x86.dll
c:\program files (x86)\AVG\AVG10\Toolbar.old\IE8Lib.dll
c:\program files (x86)\AVG\AVG10\Toolbar.old\IEToolbar.dll
c:\program files (x86)\AVG\AVG10\Toolbar.old\ToolbarBroker.exe
c:\programdata\AVG
c:\programdata\AVG\AWL\AvgRep.xml
c:\programdata\AVG\AWL\Program Statistics\ProgramStatistics.2013.tudb
c:\programdata\AVG\AWL\TUProgMan.10.tudb
c:\programdata\AVG\AWL\TUProgManagerCache.10.tudb
c:\programdata\AVG\AWL\TUTuningIndex.10.2.tudb
c:\programdata\AVG\AWL\TUUtilitiesSvc.13.tudb
c:\programdata\AVG\AWL002277980B590DA479FD767F860473FB.xml
c:\programdata\AVG\AWL2014\TUProgRating.10.tudb
c:\programdata\AVG\AWL2014\TUReportData.10.tudb
c:\programdata\AVG\AWL2015\en-US\cm_diskspaceVista.png
c:\programdata\AVG\AWL2015\en-US\cm_diskspaceW7.png
c:\programdata\AVG\AWL2015\en-US\cm_diskspaceXP.png
c:\programdata\AVG\AWL2015\en-US\cm_logonVista.png
c:\programdata\AVG\AWL2015\en-US\cm_logonW7.png
c:\programdata\AVG\AWL2015\en-US\cm_logonW8.png
c:\programdata\AVG\AWL2015\en-US\cm_logonXP_new.png
c:\programdata\AVG\AWL2015\en-US\cm_logonXP_old.png
c:\programdata\AVG\AWL2015\en-US\cm_report_noui.jpg
c:\programdata\AVG\AWL2015\en-US\cm_report_send.jpg
c:\programdata\AVG\AWL2015\en-US\cm_report_showui.jpg
c:\programdata\AVG\AWL2015\en-US\cm_werconsent1.jpg
c:\programdata\AVG\AWL2015\en-US\cm_werconsent1_W7.jpg
c:\programdata\AVG\AWL2015\en-US\cm_werconsent3.jpg
c:\programdata\AVG\AWL2015\en-US\cm_werconsent3_W7.jpg
c:\programdata\AVG\AWL2015\en-US\cm_werconsent4_W7.jpg
c:\programdata\AVG\AWL2015\en-US\default.mo
c:\programdata\AVG\AWL2015\en-US\iecontextmenu.ini
c:\programdata\AVG\AWL2015\en-US\license.rtf
c:\programdata\AVG\AWL2015\en-US\main_vista_7.chm
c:\programdata\AVG\AWL2015\en-US\main_xp.chm
c:\programdata\AVG\AWL2015\en-US\PrivacyPolicy_Activation.rtf
c:\programdata\AVG\AWL2015\en-US\PrivacyPolicy_Installation.rtf
c:\programdata\AVG\AWL2015\en-US\PrivacyPolicy_Reg_News.rtf
c:\programdata\AVG\AWL2015\en-US\ProductInfo.dat
c:\programdata\AVG\AWL2015\en-US\regwiz_country.diz
c:\programdata\AVG\AWL2015\en-US\startmenu_nonscroll.png
c:\programdata\AVG\AWL2015\en-US\startmenu_scroll.png
c:\programdata\AVG\AWL2015\en-US\TUSearchScopes.xml
c:\programdata\AVG\AWL2015\Log\avgdiag.cfg
c:\programdata\AVG\AWL2015\Log\Global.cfg
c:\programdata\AVG\AWL2015\TTUSvc.tt
c:\programdata\AVG\AWL2015\TUInstallLog_2015-03-02_01-17-04.log
c:\programdata\AVG\AWL2015\TUInstallLog_2015-03-02_01-17-26.log
c:\programdata\AVG\AWL2015\TUProgRating.10.tudb
c:\programdata\AVG\AWL2015\TUReportData.10.tudb
c:\programdata\AVG\AWL2015\Web\gbacklinks.htm
c:\programdata\AVG\AWL2015\Web\gcache.htm
c:\programdata\AVG\AWL2015\Web\gsearch.htm
c:\programdata\AVG\AWL2015\Web\gsimilar.htm
c:\programdata\AVG\AWL2015\Web\gtranslate.htm
c:\programdata\AVG\AWL2015\Web\tuarch.htm
c:\programdata\AVG\AWL2015\Web\tumrcheck.htm
c:\programdata\AVG\AWL2015\Web\tuofinw.htm
c:\programdata\AVG\AWL2015\Web\tutrans.htm
c:\programdata\AVG\AWL2015\Web\tuzoomin.htm
c:\programdata\AVG\AWL2015\Web\tuzoomout.htm
c:\programdata\AVG\AWL2015\WinStyler\LogoAnimations\_default.tla
c:\users\All Users\AVG\AWL\AvgRep.xml
c:\users\All Users\AVG\AWL\Program Statistics\ProgramStatistics.2013.tudb
c:\users\All Users\AVG\AWL\TUProgMan.10.tudb
c:\users\All Users\AVG\AWL\TUProgManagerCache.10.tudb
c:\users\All Users\AVG\AWL\TUTuningIndex.10.2.tudb
c:\users\All Users\AVG\AWL\TUUtilitiesSvc.13.tudb
c:\users\All Users\AVG\AWL002277980B590DA479FD767F860473FB.xml
c:\users\All Users\AVG\AWL2014\TUProgRating.10.tudb
c:\users\All Users\AVG\AWL2014\TUReportData.10.tudb
c:\users\All Users\AVG\AWL2015\en-US\cm_diskspaceVista.png
c:\users\All Users\AVG\AWL2015\en-US\cm_diskspaceW7.png
c:\users\All Users\AVG\AWL2015\en-US\cm_diskspaceXP.png
c:\users\All Users\AVG\AWL2015\en-US\cm_logonVista.png
c:\users\All Users\AVG\AWL2015\en-US\cm_logonW7.png
c:\users\All Users\AVG\AWL2015\en-US\cm_logonW8.png
c:\users\All Users\AVG\AWL2015\en-US\cm_logonXP_new.png
c:\users\All Users\AVG\AWL2015\en-US\cm_logonXP_old.png
c:\users\All Users\AVG\AWL2015\en-US\cm_report_noui.jpg
c:\users\All Users\AVG\AWL2015\en-US\cm_report_send.jpg
c:\users\All Users\AVG\AWL2015\en-US\cm_report_showui.jpg
c:\users\All Users\AVG\AWL2015\en-US\cm_werconsent1.jpg
c:\users\All Users\AVG\AWL2015\en-US\cm_werconsent1_W7.jpg
c:\users\All Users\AVG\AWL2015\en-US\cm_werconsent3.jpg
c:\users\All Users\AVG\AWL2015\en-US\cm_werconsent3_W7.jpg
c:\users\All Users\AVG\AWL2015\en-US\cm_werconsent4_W7.jpg
c:\users\All Users\AVG\AWL2015\en-US\default.mo
c:\users\All Users\AVG\AWL2015\en-US\iecontextmenu.ini
c:\users\All Users\AVG\AWL2015\en-US\license.rtf
c:\users\All Users\AVG\AWL2015\en-US\main_vista_7.chm
c:\users\All Users\AVG\AWL2015\en-US\main_xp.chm
c:\users\All Users\AVG\AWL2015\en-US\PrivacyPolicy_Activation.rtf
c:\users\All Users\AVG\AWL2015\en-US\PrivacyPolicy_Installation.rtf
c:\users\All Users\AVG\AWL2015\en-US\PrivacyPolicy_Reg_News.rtf
c:\users\All Users\AVG\AWL2015\en-US\ProductInfo.dat
c:\users\All Users\AVG\AWL2015\en-US\regwiz_country.diz
c:\users\All Users\AVG\AWL2015\en-US\startmenu_nonscroll.png
c:\users\All Users\AVG\AWL2015\en-US\startmenu_scroll.png
c:\users\All Users\AVG\AWL2015\en-US\TUSearchScopes.xml
c:\users\All Users\AVG\AWL2015\Log\avgdiag.cfg
c:\users\All Users\AVG\AWL2015\Log\Global.cfg
c:\users\All Users\AVG\AWL2015\TTUSvc.tt
c:\users\All Users\AVG\AWL2015\TUInstallLog_2015-03-02_01-17-04.log
c:\users\All Users\AVG\AWL2015\TUInstallLog_2015-03-02_01-17-26.log
c:\users\All Users\AVG\AWL2015\TUProgRating.10.tudb
c:\users\All Users\AVG\AWL2015\TUReportData.10.tudb
c:\users\All Users\AVG\AWL2015\Web\gbacklinks.htm
c:\users\All Users\AVG\AWL2015\Web\gcache.htm
c:\users\All Users\AVG\AWL2015\Web\gsearch.htm
c:\users\All Users\AVG\AWL2015\Web\gsimilar.htm
c:\users\All Users\AVG\AWL2015\Web\gtranslate.htm
c:\users\All Users\AVG\AWL2015\Web\tuarch.htm
c:\users\All Users\AVG\AWL2015\Web\tumrcheck.htm
c:\users\All Users\AVG\AWL2015\Web\tuofinw.htm
c:\users\All Users\AVG\AWL2015\Web\tutrans.htm
c:\users\All Users\AVG\AWL2015\Web\tuzoomin.htm
c:\users\All Users\AVG\AWL2015\Web\tuzoomout.htm
c:\users\All Users\AVG\AWL2015\WinStyler\LogoAnimations\_default.tla
c:\users\James Kirwin\AppData\Local\AVG
c:\users\James Kirwin\AppData\Local\AVG\AWL2014\Log\integrator.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2014\Log\oneclick.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2014\Log\tuinstallhelper.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2014\Log\updatewizard.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\Cache\Cookies-journal
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\Cache\Cookies
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\Cache\data_0
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\Cache\data_1
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\Cache\data_2
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\Cache\data_3
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\Cache\index
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\avglng.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\avglng.log.lock
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\integrator.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\oneclick.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\oneclickstarter.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\performanceoptimizer.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\settingcenter.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\sqldb.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\tuinstallhelper.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\tumessages.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\tuneupsystemstatuscheck.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\tupk.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\tupk.log.lock
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\uninstallmanager.log
c:\users\James Kirwin\AppData\Local\AVG\AWL2015\log\updatewizard.log
c:\users\James Kirwin\AppData\Local\VirtualStore\ProgramData\AVG
c:\users\James Kirwin\AppData\Local\VirtualStore\ProgramData\AVG\AWL\TUProgMan.10.tudb
c:\users\James Kirwin\AppData\Local\VirtualStore\ProgramData\AVG\AWL\TUProgManagerCache.10.tudb
c:\users\James Kirwin\AppData\Local\VirtualStore\ProgramData\AVG\AWL\TUTuningIndex.10.2.tudb
c:\users\James Kirwin\AppData\Local\VirtualStore\ProgramData\AVG\AWL2015\TUReportData.10.tudb
c:\users\James Kirwin\AppData\Roaming\AVG
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2014\Backups\00000001.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2014\Dashboard\IntegratorStates_en-US.xml
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Backups\00000001.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Backups\00000002.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Backups\00000003.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Backups\00000004.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Backups\00000005.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Backups\00000006.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Backups\00000007.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Backups\00000008.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Backups\00000009.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Backups\00000010.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Backups\00000011.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Backups\00000012.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Backups\00000013.rcb
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Dashboard\IntegratorStates_en-US.xml
c:\users\James Kirwin\AppData\Roaming\AVG\AWL2015\Speed Optimizer\SpeedOptimizerStates.xml
c:\users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\avg
c:\users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\avg\dt.dat
c:\windows\System32\config\systemprofile\AppData\Local\Avg
c:\windows\System32\config\systemprofile\AppData\Local\Avg\AWL2015\log\avglng.log
c:\windows\System32\config\systemprofile\AppData\Local\Avg\AWL2015\log\avglng.log.lock
c:\windows\System32\config\systemprofile\AppData\Local\Avg\AWL2015\log\tuautoupdatecheck.log
c:\windows\SysWOW64\config\systemprofile\AppData\Local\Avg
c:\windows\SysWOW64\config\systemprofile\AppData\Local\Avg\AWL2015\log\avglng.log
c:\windows\SysWOW64\config\systemprofile\AppData\Local\Avg\AWL2015\log\avglng.log.lock
c:\windows\SysWOW64\config\systemprofile\AppData\Local\Avg\AWL2015\log\tuautoupdatecheck.log
c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\AVG
.
.
((((((((((((((((((((((((( Files Created from 2015-11-22 to 2015-12-22 )))))))))))))))))))))))))))))))
.
.
2015-12-22 23:26 . 2015-12-22 23:26 -------- d-----w- c:\users\Guest\AppData\Local\temp
2015-12-22 23:26 . 2015-12-22 23:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-12-22 12:39 . 2015-12-22 12:39 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C049C4AD-8C19-450E-AF36-D7F074723701}\offreg.2572.dll
2015-12-22 03:04 . 2015-12-22 03:04 -------- d-----w- c:\program files (x86)\ESET
2015-12-21 08:57 . 2015-12-21 08:57 2 ----a-w- c:\windows\RAVDG.TMP
2015-12-21 03:16 . 2015-12-21 08:57 -------- d-----w- C:\SMCLpav
2015-12-20 05:11 . 2015-12-20 14:30 -------- d-----w- C:\FRST
2015-12-19 03:44 . 2015-12-19 03:41 386096 ----a-w- c:\windows\system32\aswBoot.exe
2015-12-19 03:42 . 2015-12-19 03:42 -------- d-----w- c:\users\James Kirwin\AppData\Roaming\AVAST Software
2015-12-19 03:42 . 2015-12-19 03:42 -------- d-----w- c:\windows\SysWow64\config\systemprofile\.oracle_jre_usage
2015-12-19 03:42 . 2015-12-19 03:42 -------- d-----w- c:\program files (x86)\Common Files\AV
2015-12-19 03:42 . 2015-12-19 03:42 -------- d-----w- c:\program files\Common Files\AV
2015-12-19 03:41 . 2015-12-19 03:42 97648 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2015-12-19 03:41 . 2015-12-19 03:42 451040 ----a-w- c:\windows\system32\drivers\aswSP.sys
2015-12-19 03:41 . 2015-12-19 03:41 93528 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2015-12-19 03:41 . 2015-12-19 03:41 65224 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2015-12-19 03:41 . 2015-12-19 03:41 28656 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2015-12-19 03:41 . 2015-12-19 03:41 273784 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2015-12-19 03:41 . 2015-12-19 03:41 155304 ----a-w- c:\windows\system32\drivers\aswStm.sys
2015-12-19 03:41 . 2015-12-19 03:41 1055560 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2015-12-19 03:41 . 2015-12-19 03:41 43112 ----a-w- c:\windows\avastSS.scr
2015-12-19 03:40 . 2015-12-19 03:40 -------- d-----w- c:\program files\AVAST Software
2015-12-19 03:39 . 2015-12-19 03:39 -------- d-----w- c:\programdata\AVAST Software
2015-12-12 18:59 . 2015-11-17 12:43 11138400 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C049C4AD-8C19-450E-AF36-D7F074723701}\mpengine.dll
2015-12-12 01:39 . 2015-12-12 01:39 -------- d-----w- c:\program files (x86)\Common Files\Java
2015-12-12 01:39 . 2015-12-12 01:39 -------- d-----w- c:\users\James Kirwin\.oracle_jre_usage
2015-12-12 01:39 . 2015-12-12 01:39 97888 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-12-12 01:19 . 2015-12-20 05:04 -------- d-----w- C:\AdwCleaner
2015-12-02 22:20 . 2015-12-02 22:20 -------- d-----w- c:\users\James Kirwin\AppData\Local\Downloaded Installations
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-12-22 05:23 . 2014-05-14 17:52 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-12-11 01:02 . 2014-05-14 23:01 796864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-12-11 01:02 . 2014-05-14 23:01 142528 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-12-02 18:18 . 2011-01-23 22:33 301728 ------w- c:\windows\system32\MpSigStub.exe
2015-10-27 14:45 . 2013-11-04 15:45 76384 ----a-w- c:\windows\SysWow64\libusb0.dll
2015-10-27 14:45 . 2013-11-04 15:45 52832 ----a-w- c:\windows\SysWow64\drivers\libusb0.sys
2015-10-05 14:50 . 2015-09-01 02:36 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-10-05 14:50 . 2015-09-01 02:36 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-10-05 14:50 . 2015-09-01 02:36 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2014-11-21 43816]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2014-11-21 43816]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-11-09 586296]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2015-11-09 596528]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-12-19 7021880]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2010-5-28 276328]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"MaxGPOScriptWait"= 600 (0x258)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS;c:\windows\SYSNATIVE\drivers\AmUStor.SYS [x]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
R3 HP DS Service;HP DS Service;c:\program files (x86)\HP\HPBDSService\HPBDSService.exe;c:\program files (x86)\HP\HPBDSService\HPBDSService.exe [x]
R3 HtcUsbMdmV64;HTC Proprietary USB Driver;c:\windows\system32\DRIVERS\HtcUsbMdmV64.sys;c:\windows\SYSNATIVE\DRIVERS\HtcUsbMdmV64.sys [x]
R3 HtcVCom32;HTC Diagnostic Port;c:\windows\system32\DRIVERS\HtcVComV64.sys;c:\windows\SYSNATIVE\DRIVERS\HtcVComV64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys;c:\windows\SYSNATIVE\DRIVERS\silabenm.sys [x]
R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys;c:\windows\SYSNATIVE\DRIVERS\silabser.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
R4 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
R4 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
R4 File Backup;File Backup Service;c:\program files (x86)\Starfield\offSyncService.exe;c:\program files (x86)\Starfield\offSyncService.exe [x]
R4 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 DVMIO;DeviceVM IO Service;c:\windows\system32\DRIVERS\dvmio.sys;c:\windows\SYSNATIVE\DRIVERS\dvmio.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
S2 Apple Mobile Device Service;Apple Mobile Device Service;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 DvmMDES;DeviceVM Meta Data Export Service;c:\swsetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe;c:\swsetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe [x]
S2 HP LaserJet Service;HP LaserJet Service;c:\program files (x86)\HP\HPLaserJetService\HPLaserJetService.exe;c:\program files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe;c:\windows\SYSNATIVE\vcsFPService.exe [x]
S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys;c:\windows\SYSNATIVE\DRIVERS\WDKMD.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-12-16 23:59 1000264 ----a-w- c:\program files (x86)\Google\Chrome\Application\47.0.2526.106\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{A6EADE66-0000-0000-484E-7E8A45000000}]
2015-11-18 16:22 286904 ----a-w- c:\program files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll
.
Contents of the 'Scheduled Tasks' folder
.
2015-12-22 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14 01:02]
.
2015-12-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-13 04:44]
.
2015-12-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-13 04:44]
.
2015-12-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2845901189-3817738784-3823200384-1001Core.job
- c:\users\James Kirwin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-22 04:45]
.
2015-12-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2845901189-3817738784-3823200384-1001UA.job
- c:\users\James Kirwin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-22 04:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-12-19 03:41 873304 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-03-05 1928976]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-06-18 8192]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2011-05-10 324096]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-05-10 525312]
"HP LaserJet 200 color MFP M276 Series Fax"="c:\program files (x86)\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe" [2011-10-10 3706424]
"BrightAdjustTool"="c:\program files (x86)\Nova Star\NovaLCT-Mars\Bin\BrightAdjustTool\BrightAdjustTool.exe" [BU]
.
------- Supplementary Scan -------
.
uStart Page = https://www.yahoo.com/?fr=yset_ie_sy...ype=orcl_hpset
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <-loopback>
IE: &ieSpell Options - c:\program files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Check &Spelling - c:\program files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: Lookup on Merriam Webster - file://c:\program files (x86)\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files (x86)\ieSpell\wikipedia.HTM
IE: Se&nd to OneNote - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: secureserver.net\login
TCP: DhcpNameServer = 192.168.1.1
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB
DPF: {8BE5651C-D60B-4B59-B5B2-F0EB93733D17} - hxxps://www36.verizon.com/FiOSVoice/UnProtected/FiosVoiceVMUtil.CAB
FF - ProfilePath - c:\users\James Kirwin\AppData\Roaming\Mozilla\Firefox\Profiles\bcduuvot.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - ExtSQL: !HIDDEN! 2011-02-08 09:46; [email protected]; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-SLABCOMM&10C4&EA60 - c:\program files (x86)\Silabs\MCU\DriverUninstall\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"v5Licence0"="15-E47T-D414-6FA8-U69R-2ARV-AKHQ5QS"
"Activated"="N"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2015-12-22 18:28:10
ComboFix-quarantined-files.txt 2015-12-22 23:28
ComboFix2.txt 2015-12-21 09:01
.
Pre-Run: 287,386,206,208 bytes free
Post-Run: 287,314,776,064 bytes free
.
- - End Of File - - 60D9E5B753727932B3ECD27038A1B776
Jkirwin is offline  
Old 12-22-2015, 05:43 PM   #17
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar

Microsoft Most Valuable Professional
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



Congratulations. Well done! Your logs appear clean. You should be good to go.

As far as those infected objects listed in the ESET report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now.

Please disable Panda before uninstalling ComboFix and then re-enable it after doing so.

Press the Windows "logo" key and "R" key and Copy/Paste the following single-line command into the Run box and click OK:

combofix /uninstall

This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point.

Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already.
  • Run AdwCleaner and select Uninstall
  • Confirm by clicking Yes
------------------------------------------------------

Press the Windows "logo" key and "R" key then copy/paste the following single-line command into the Run box and click OK:

cmd /c rd /s /q "C:\FRST"

A DOS window will open and close again, this is normal.

------------------------------------------------------

You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix.

Keep MBAM, update and run a Scan('Threat Scan' by default, or 'Scan Now' under the Dashboard tab) weekly.

Empty your Recycle Bin if it does not do so automatically.

------------------------------------------------------

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

------------------------------------------------------

Make sure you backup your system, so possible reformatting in the future isn't necessary:

Support - Windows Help

------------------------------------------------------

SPYWARE PREVENTION
In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read this well written article: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware, or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an add-on available for IE, Firefox, and Chrome.
  • MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows 7 here
Keep your antivirus program and antispyware programs updated and scan with them on a regular basis.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
Old 12-22-2015, 06:07 PM   #18
Registered Member
 
Join Date: May 2007
Posts: 55
OS: MS 7



Thanks for all your help, once again a very happy camper and a pleasant experience.

Good to know that I have had this computer for about 5 years before I had any issues, I will follow your instructions ( they have changed with regard to software to use and NOT use)

I hope to get a couple more years from this laptop, I bought it with the idea it would last if I got the top of the ine processor ( of that day) and am happy I5 still works well.

Kind regards,

James
Jkirwin is offline  
Old 12-22-2015, 06:37 PM   #19
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar

Microsoft Most Valuable Professional
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



You're very welcome, James! Glad to have helped.
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
 

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Similar Threads
Thread Thread Starter Forum Replies Last Post
Windows 7 malware infection rate soars in 2012
Windows 7's malware infection rate climbed by as much as 182% this year, Microsoft said today. But even with that dramatic increase, Windows 7 remained two to three times less likely to fall to hacker attack than the aged Windows XP. Data from Microsoft's newest twice-yearly security report...
Glaswegian Computer Security News 0 10-09-2012 01:16 PM
Win7 infection rates rose during the second half of 2010
Win7 machines harder hit by infection as VXers change tactics ? The Register
reventon Computer Security News 0 05-15-2011 06:46 PM
Trojan Infection (pop-ups)
Hello all, since a couple of days I have had some problems with a trojan horse (I think). I keep getting pop-ups at my desktop, sometimes 10 in half an hour. My antivirus blocks the pop-ups but still it seriously bugs me. Normally I'm very carefull with my computer, it's the first serious...
TomWV Resolved HJT Threads 9 04-18-2011 02:52 PM

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2
Powered by vBadvanced CMPS v3.2.3


All times are GMT -7. The time now is 02:38 PM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging v3.1.0 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
Copyright 2001 - 2018, Tech Support Forum

Windows 10 - Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts