New
#1
Error Message On Startup
I'm receiving a message when windows opens that says that this cannot be found:
C:PROG~3\f991wao.jss
Can anyone tell me if it matters and how I can recover it if necessary?
I'm receiving a message when windows opens that says that this cannot be found:
C:PROG~3\f991wao.jss
Can anyone tell me if it matters and how I can recover it if necessary?
Let's see what starts when you boot your computer. Download and run Startup List (does not need to be installed, just run it).
When done, click File then Save as and save Startuplist.txt to your Desktop or somewhere you can find it.
Start a reply here and paste the contents of Startuplist.txt into it.
Rich,
When I try to paste the txt here it tells me there are too many characters for the post.
StartupList report, 12/22/2013, 5:49:33 PM
StartupList version 2.02.0
Started from: C:\Users\Bill\Desktop\startuplist\StartupList.EXE
Detected: Windows Vista SP1 (WinNT 6.01.7601)
Logged on as 'Bill' to 'BILL-PC'
* Using default options (see end of log for possible options)
==================================================
Running processes (21):
[C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (36)]
C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNSS_ENU.DLL
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\windows\system32\CNMNPPM.DLL
C:\windows\system32\dhcpcsvc.DLL
C:\windows\system32\dhcpcsvc6.DLL
C:\windows\system32\IMM32.DLL
C:\windows\system32\iphlpapi.dll
C:\windows\system32\mswsock.dll
C:\windows\system32\UxTheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\WINNSI.DLL
C:\windows\system32\WINSPOOL.DRV
C:\windows\System32\wshtcpip.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\syswow64\NSI.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WS2_32.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
[C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (74)]
C:\Program Files (x86)\Canon\Solution Menu EX\CCL.dll
C:\Program Files (x86)\Canon\Solution Menu EX\LangInfo\EN\CNSELANG.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\Program Files\Lenovo\Bluetooth Software\SysWOW64\BtMmHook.dll
C:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
C:\windows\system32\apphelp.dll
C:\windows\System32\bidispl.dll
C:\windows\system32\CRYPTSP.dll
C:\windows\system32\dwmapi.dll
C:\windows\system32\icm32.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\mscms.dll
C:\windows\system32\MSIMG32.dll
C:\windows\System32\msxml6.dll
C:\windows\system32\ntmarta.dll
C:\windows\system32\profapi.dll
C:\windows\system32\PROPSYS.dll
C:\windows\system32\RpcRtRemote.dll
C:\windows\system32\rsaenh.dll
C:\windows\system32\Secur32.dll
C:\windows\system32\USERENV.dll
C:\windows\system32\uxtheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\wiadss.dll
C:\windows\system32\wiatrace.dll
C:\windows\system32\WindowsCodecs.dll
C:\windows\system32\WINMM.dll
C:\windows\system32\WINSPOOL.DRV
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
C:\windows\syswow64\CFGMGR32.dll
C:\windows\syswow64\CLBCatQ.DLL
C:\windows\syswow64\comdlg32.dll
C:\windows\syswow64\CRYPT32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\DEVOBJ.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\iertutil.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSASN1.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\syswow64\normaliz.DLL
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\PSAPI.DLL
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SETUPAPI.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\Windows\SysWOW64\sti.dll
C:\Windows\SysWOW64\urlmon.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WININET.dll
C:\windows\syswow64\WLDAP32.dll
C:\windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCP 80.dll
C:\windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR 80.dll
C:\windows\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_cbf5e994470a1a8f\MFC80 U.DLL
C:\windows\WinSxS\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_03ce2c72205943d3\MF C80ENU.DLL
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b3 6\gdiplus.dll
[C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (32)]
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\uxtheme.dll
C:\windows\system32\version.DLL
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\iertutil.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\syswow64\normaliz.DLL
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\shlwapi.DLL
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WININET.dll
[C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (49)]
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorUIHelper.dll
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IntelVisualDesign.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\571f0babf15ab38dc80829622caa99d3\IAStorC ommon.ni.dll
C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\6c1d55eed243331c944206f8608fb850\IAStorUti l.ni.dll
C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni .dll
C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\29f3ae8d313e62b4daed1107ccd29f9f \System.Configuration.ni.dll
C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\Syste m.Drawing.ni.dll
C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d473c19e69818875b9c739cad8f386a5 \System.Runtime.Remoting.ni.dll
C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ef0a534be135cd8f0d99d938d8b1814a \System.Windows.Forms.ni.dll
C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xm l.ni.dll
C:\windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll
C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\4eef5a3a4d0ed6d6fd882947a70df530\WindowsB ase.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\windows\system32\apphelp.dll
C:\windows\system32\CRYPTSP.dll
C:\windows\system32\dwmapi.dll
C:\windows\system32\IMM32.DLL
C:\windows\SYSTEM32\MSCOREE.DLL
C:\windows\system32\profapi.dll
C:\windows\system32\RpcRtRemote.dll
C:\windows\system32\rsaenh.dll
C:\windows\system32\shfolder.dll
C:\windows\system32\uxtheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\WindowsCodecs.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\KERNEL32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\shell32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR 80.dll
C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b3 6\gdiplus.dll
[C:\Program Files (x86)\iTunes\iTunesHelper.exe (75)]
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\ASL.dll
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\CFNetwork.dll
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\CoreFoundation.dll
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\icudt46.dll
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libdispatch.dll
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libicuin.dll
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libicuuc.dll
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\objc.dll
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\pthreadVC2.dll
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\SQLite3.dll
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\iTunesMobileDevice.dll
C:\Program Files (x86)\iTunes\iTunesHelper.dll
C:\Program Files (x86)\iTunes\iTunesHelper.Resources\en.lproj\iTunesHelperLocalized.DLL
C:\Program Files (x86)\iTunes\iTunesHelper.Resources\iTunesHelper.DLL
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\windows\system32\CRYPTSP.dll
C:\windows\system32\dnssd.dll
C:\windows\system32\dwmapi.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\iphlpapi.dll
C:\windows\system32\mswsock.dll
C:\windows\system32\profapi.dll
C:\windows\system32\RpcRtRemote.dll
C:\windows\system32\rsaenh.dll
C:\windows\system32\SXS.DLL
C:\windows\system32\uxtheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\WINMM.dll
C:\windows\system32\WINNSI.DLL
C:\windows\system32\WINSTA.dll
C:\windows\System32\wshtcpip.dll
C:\windows\system32\WSOCK32.dll
C:\windows\system32\Wtsapi32.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
C:\windows\syswow64\CFGMGR32.dll
C:\windows\syswow64\CLBCatQ.DLL
C:\windows\syswow64\CRYPT32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\DEVOBJ.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\iertutil.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSASN1.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\syswow64\normaliz.DLL
C:\windows\syswow64\NSI.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SETUPAPI.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WININET.dll
C:\windows\syswow64\WINTRUST.dll
C:\windows\syswow64\WS2_32.dll
C:\windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCP 80.dll
C:\windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR 80.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_ec80f00e8593ece5\COMCTL32.dll
[C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe (22)]
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\windows\system32\dwmapi.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\uxtheme.dll
C:\windows\system32\VERSION.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
[C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe (36)]
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll
C:\Program Files (x86)\Lenovo\VeriFace\English\TimeLockRes.dll
C:\Program Files (x86)\Lenovo\VeriFace\MFC80UD.DLL
C:\Program Files (x86)\Lenovo\VeriFace\MSVCR80D.dll
C:\windows\system32\dwmapi.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\profapi.dll
C:\windows\system32\uxtheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\WINSTA.dll
C:\windows\system32\WTSAPI32.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\PSAPI.DLL
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR 80.dll
C:\windows\WinSxS\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_03ce2c72205943d3\MF C80ENU.DLL
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_ec80f00e8593ece5\COMCTL32.dll
[C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (39)]
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\msdmo.dll
C:\windows\system32\ntmarta.dll
C:\windows\system32\uxtheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\WINSTA.dll
C:\windows\system32\WTSAPI32.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\CFGMGR32.dll
C:\windows\syswow64\CLBCatQ.DLL
C:\windows\syswow64\CRYPT32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\Windows\SysWOW64\devenum.dll
C:\windows\syswow64\DEVOBJ.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSASN1.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\setupapi.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\Windows\SysWOW64\WINMM.dll
C:\windows\syswow64\WINTRUST.dll
C:\windows\syswow64\WLDAP32.dll
C:\windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR 80.dll
[C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (35)]
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.dll
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamnet.dll
C:\windows\system32\CRYPTSP.dll
C:\windows\system32\dwmapi.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\IPHLPAPI.DLL
C:\windows\system32\profapi.dll
C:\windows\system32\rsaenh.dll
C:\windows\system32\uxtheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\WINNSI.DLL
C:\windows\system32\WTSAPI32.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\CRYPT32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSASN1.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\syswow64\NSI.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WS2_32.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
[C:\Program Files (x86)\Mozilla Firefox\firefox.exe (176)]
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
C:\PROGRA~2\MICROS~2\Office14\1033\GrooveIntlResource.dll
C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
C:\Program Files (x86)\Bonjour\mdnsNSP.dll
C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll
C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
C:\Program Files (x86)\Internet Explorer\ieproxy.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\Program Files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
C:\Program Files (x86)\Mozilla Firefox\freebl3.dll
C:\Program Files (x86)\Mozilla Firefox\gkmedias.dll
C:\Program Files (x86)\Mozilla Firefox\mozalloc.dll
C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
C:\Program Files (x86)\Mozilla Firefox\MSVCP100.dll
C:\Program Files (x86)\Mozilla Firefox\MSVCR100.dll
C:\Program Files (x86)\Mozilla Firefox\nss3.dll
C:\Program Files (x86)\Mozilla Firefox\nssckbi.dll
C:\Program Files (x86)\Mozilla Firefox\nssdbm3.dll
C:\Program Files (x86)\Mozilla Firefox\softokn3.dll
C:\Program Files (x86)\Mozilla Firefox\xul.dll
C:\Program Files\Lenovo\Bluetooth Software\SysWOW64\BtMmHook.dll
C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\Components\nprndlffbrowserreco rdext.dll
C:\Users\Bill\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\logging.dll
C:\Users\Bill\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\MSVCP110.dll
C:\Users\Bill\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\MSVCR110.dll
C:\Users\Bill\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
C:\Users\Bill\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\Telemetry.dll
C:\Users\Bill\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
C:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
C:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
C:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
C:\windows\system32\apphelp.dll
C:\windows\system32\ATL.DLL
C:\windows\system32\AUDIOSES.DLL
C:\windows\system32\AVRT.dll
C:\windows\system32\Cabinet.dll
C:\windows\System32\comdlg32.dll
C:\windows\system32\CRYPTSP.dll
C:\windows\system32\cscapi.dll
C:\windows\System32\davclnt.dll
C:\windows\System32\DAVHLPR.dll
C:\windows\system32\dbghelp.dll
C:\windows\system32\dhcpcsvc.DLL
C:\windows\system32\dhcpcsvc6.DLL
C:\windows\system32\DNSAPI.dll
C:\windows\System32\drprov.dll
C:\windows\system32\DUI70.dll
C:\windows\system32\DUser.dll
C:\windows\system32\dwmapi.dll
C:\windows\system32\dwrite.dll
C:\windows\system32\dxva2.dll
C:\windows\system32\EhStorAPI.dll
C:\windows\system32\EhStorShell.dll
C:\windows\system32\explorerframe.dll
C:\windows\system32\faultrep.dll
C:\windows\System32\fwpuclnt.dll
C:\windows\system32\icm32.dll
C:\windows\system32\IconCodecService.dll
C:\windows\system32\ieframe.DLL
C:\windows\system32\IMM32.DLL
C:\windows\system32\IPHLPAPI.DLL
C:\windows\system32\ksuser.dll
C:\windows\system32\LINKINFO.dll
C:\windows\system32\mf.dll
C:\windows\system32\mfplat.dll
C:\windows\system32\mfreadwrite.dll
C:\windows\system32\midimap.dll
C:\windows\system32\mlang.dll
C:\windows\System32\MMDevApi.dll
C:\windows\system32\MPR.dll
C:\windows\system32\MSACM32.dll
C:\windows\system32\msacm32.drv
C:\windows\system32\mscms.dll
C:\windows\system32\msdmo.dll
C:\windows\system32\MSIMG32.dll
C:\windows\system32\msls31.dll
C:\windows\system32\mswsock.dll
C:\windows\system32\napinsp.dll
C:\windows\system32\NETAPI32.dll
C:\windows\system32\netutils.dll
C:\windows\system32\NetworkExplorer.dll
C:\windows\system32\NLAapi.dll
C:\windows\system32\NTDSAPI.dll
C:\windows\System32\ntlanman.dll
C:\windows\system32\ntmarta.dll
C:\windows\system32\ntshrui.dll
C:\windows\system32\pnrpnsp.dll
C:\windows\system32\PortableDeviceApi.dll
C:\windows\system32\profapi.dll
C:\windows\system32\propsys.dll
C:\windows\system32\rasadhlp.dll
C:\windows\system32\RpcRtRemote.dll
C:\windows\system32\rsaenh.dll
C:\windows\system32\SAMCLI.DLL
C:\windows\system32\SAMLIB.dll
C:\windows\system32\SearchFolder.dll
C:\windows\System32\Secur32.dll
C:\windows\system32\SHDOCVW.dll
C:\windows\system32\slc.dll
C:\windows\system32\srvcli.dll
C:\windows\System32\StructuredQuery.dll
C:\windows\system32\USERENV.dll
C:\windows\system32\UxTheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\wbem\fastprox.dll
C:\windows\system32\wbem\wbemprox.dll
C:\windows\system32\wbem\wbemsvc.dll
C:\windows\system32\wbemcomn.dll
C:\windows\system32\wdmaud.drv
C:\windows\system32\webio.dll
C:\windows\System32\wevtapi.dll
C:\windows\system32\WindowsCodecs.dll
C:\windows\system32\WINHTTP.dll
C:\windows\system32\WINMM.dll
C:\windows\system32\WINNSI.DLL
C:\windows\System32\winrnr.dll
C:\windows\System32\WINSTA.dll
C:\windows\system32\wkscli.dll
C:\windows\System32\Wpc.dll
C:\windows\system32\wshbth.dll
C:\windows\System32\wship6.dll
C:\windows\System32\wshtcpip.dll
C:\windows\system32\WSOCK32.dll
C:\windows\system32\XmlLite.dll
C:\windows\system32\zipfldr.dll
C:\Windows\SysWOW64\actxprxy.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
C:\windows\syswow64\CFGMGR32.dll
C:\windows\syswow64\CLBCatQ.DLL
C:\windows\syswow64\CRYPT32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\Windows\SysWOW64\devenum.dll
C:\windows\syswow64\DEVOBJ.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\iertutil.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\Windows\SysWOW64\mp3dmod.dll
C:\windows\syswow64\MSASN1.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\syswow64\normaliz.DLL
C:\windows\syswow64\NSI.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\Windows\SysWOW64\oleacc.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\PSAPI.DLL
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SETUPAPI.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\Windows\SysWOW64\thumbcache.dll
C:\windows\syswow64\urlmon.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WININET.dll
C:\windows\syswow64\WINTRUST.dll
C:\windows\syswow64\WLDAP32.dll
C:\windows\syswow64\WS2_32.dll
C:\windows\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\ATL90 .DLL
C:\windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCP 90.dll
C:\windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR 90.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
[C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (80)]
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\Program Files (x86)\Mozilla Firefox\gkmedias.dll
C:\Program Files (x86)\Mozilla Firefox\mozalloc.dll
C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
C:\Program Files (x86)\Mozilla Firefox\MSVCP100.dll
C:\Program Files (x86)\Mozilla Firefox\MSVCR100.dll
C:\Program Files (x86)\Mozilla Firefox\nss3.dll
C:\Program Files (x86)\Mozilla Firefox\xul.dll
C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Common\rndlmainbrowserrecordplugin.dll
C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\ThinShims\rndlnpshimswf.dll
C:\windows\system32\apphelp.dll
C:\windows\system32\AUDIOSES.DLL
C:\windows\system32\DINPUT8.dll
C:\windows\system32\DSOUND.dll
C:\windows\system32\dwmapi.dll
C:\windows\system32\icm32.dll
C:\windows\system32\IPHLPAPI.DLL
C:\windows\System32\MMDevApi.dll
C:\windows\system32\mscms.dll
C:\windows\system32\MSIMG32.dll
C:\windows\system32\NETAPI32.dll
C:\windows\system32\netutils.dll
C:\windows\system32\POWRPROF.dll
C:\windows\system32\profapi.dll
C:\windows\System32\PROPSYS.dll
C:\windows\system32\SAMCLI.DLL
C:\windows\system32\srvcli.dll
C:\windows\system32\USERENV.dll
C:\windows\system32\UxTheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\WINMM.dll
C:\windows\system32\WINNSI.DLL
C:\windows\system32\WINSPOOL.DRV
C:\windows\system32\wkscli.dll
C:\windows\system32\WSOCK32.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
C:\windows\syswow64\CFGMGR32.dll
C:\windows\syswow64\CLBCatQ.DLL
C:\windows\syswow64\COMDLG32.dll
C:\windows\syswow64\CRYPT32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\DEVOBJ.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\iertutil.dll
C:\windows\syswow64\IMM32.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll
C:\windows\syswow64\MSASN1.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\syswow64\normaliz.DLL
C:\windows\syswow64\NSI.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\PSAPI.DLL
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SETUPAPI.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\urlmon.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WININET.dll
C:\windows\syswow64\WS2_32.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b3 6\gdiplus.dll
[C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (134)]
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
C:\PROGRA~2\MICROS~2\Office14\1033\GrooveIntlResource.dll
C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
C:\Program Files (x86)\Bonjour\mdnsNSP.dll
C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\Program Files (x86)\Mozilla Thunderbird\freebl3.dll
C:\Program Files (x86)\Mozilla Thunderbird\gkmedias.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozalloc.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozglue.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozsqlite3.dll
C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
C:\Program Files (x86)\Mozilla Thunderbird\nspr4.dll
C:\Program Files (x86)\Mozilla Thunderbird\nss3.dll
C:\Program Files (x86)\Mozilla Thunderbird\nssckbi.dll
C:\Program Files (x86)\Mozilla Thunderbird\nssdbm3.dll
C:\Program Files (x86)\Mozilla Thunderbird\nssutil3.dll
C:\Program Files (x86)\Mozilla Thunderbird\plc4.dll
C:\Program Files (x86)\Mozilla Thunderbird\plds4.dll
C:\Program Files (x86)\Mozilla Thunderbird\smime3.dll
C:\Program Files (x86)\Mozilla Thunderbird\softokn3.dll
C:\Program Files (x86)\Mozilla Thunderbird\ssl3.dll
C:\Program Files (x86)\Mozilla Thunderbird\xpcom.dll
C:\Program Files (x86)\Mozilla Thunderbird\xul.dll
C:\Program Files\Lenovo\Bluetooth Software\SysWOW64\BtMmHook.dll
C:\Users\Bill\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\logging.dll
C:\Users\Bill\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\MSVCP110.dll
C:\Users\Bill\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\MSVCR110.dll
C:\Users\Bill\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
C:\Users\Bill\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\Telemetry.dll
C:\Users\Bill\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
C:\Users\Bill\AppData\Roaming\Thunderbird\Profiles\e5q1hwsl.default\extensions\{e2fda1a4-762b-4020-b5ad-a41df1933103}\components\calbasecomps.dll
C:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
C:\windows\system32\apphelp.dll
C:\windows\system32\AUDIOSES.DLL
C:\windows\system32\Cabinet.dll
C:\windows\system32\CRYPTSP.dll
C:\windows\system32\cscapi.dll
C:\windows\system32\dbghelp.dll
C:\windows\system32\dhcpcsvc.DLL
C:\windows\system32\dhcpcsvc6.DLL
C:\windows\system32\DNSAPI.dll
C:\windows\system32\dwmapi.dll
C:\windows\system32\dwrite.dll
C:\windows\system32\EhStorShell.dll
C:\windows\system32\faultrep.dll
C:\windows\system32\feclient.dll
C:\windows\System32\fwpuclnt.dll
C:\windows\system32\icm32.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\IPHLPAPI.DLL
C:\windows\system32\LINKINFO.dll
C:\windows\System32\MMDevApi.dll
C:\windows\system32\mscms.dll
C:\windows\system32\MSIMG32.dll
C:\windows\system32\mswsock.dll
C:\windows\system32\napinsp.dll
C:\windows\system32\NLAapi.dll
C:\windows\system32\ntmarta.dll
C:\windows\system32\ntshrui.dll
C:\windows\system32\pnrpnsp.dll
C:\windows\system32\profapi.dll
C:\windows\system32\propsys.dll
C:\windows\system32\rasadhlp.dll
C:\windows\system32\RpcRtRemote.dll
C:\windows\system32\rsaenh.dll
C:\windows\system32\slc.dll
C:\windows\system32\srvcli.dll
C:\windows\system32\t2embed.dll
C:\windows\system32\USERENV.dll
C:\windows\system32\UxTheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\webio.dll
C:\windows\system32\WindowsCodecs.dll
C:\windows\system32\WINHTTP.dll
C:\windows\system32\WINMM.dll
C:\windows\system32\WINNSI.DLL
C:\windows\System32\winrnr.dll
C:\windows\system32\wshbth.dll
C:\windows\System32\wship6.dll
C:\windows\System32\wshtcpip.dll
C:\windows\system32\WSOCK32.dll
C:\windows\system32\XmlLite.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll
C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
C:\windows\syswow64\CFGMGR32.dll
C:\windows\syswow64\CLBCatQ.DLL
C:\windows\syswow64\CRYPT32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\DEVOBJ.dll
C:\windows\syswow64\GDI32.dll
C:\Windows\SysWOW64\ieframe.dll
C:\windows\syswow64\iertutil.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSASN1.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\syswow64\normaliz.DLL
C:\windows\syswow64\NSI.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\PSAPI.DLL
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SETUPAPI.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\urlmon.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WININET.dll
C:\windows\syswow64\WINTRUST.dll
C:\windows\syswow64\WLDAP32.dll
C:\windows\syswow64\WS2_32.dll
C:\windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCP 80.dll
C:\windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR 80.dll
C:\windows\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19b\ATL90 .DLL
C:\windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCP 90.dll
C:\windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR 90.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
[C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe (38)]
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\windows\system32\CRYPTSP.dll
C:\windows\system32\dwmapi.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\ntmarta.dll
C:\windows\system32\profapi.dll
C:\windows\system32\propsys.dll
C:\windows\system32\RpcRtRemote.dll
C:\windows\system32\rsaenh.dll
C:\windows\system32\uxtheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\WINSTA.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\CFGMGR32.dll
C:\windows\syswow64\CLBCatQ.DLL
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\DEVOBJ.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SETUPAPI.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WLDAP32.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
[C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe (44)]
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\Program Files (x86)\RealNetworks\RealDownloader\common\hxmedpltfm.dll
C:\Program Files (x86)\RealNetworks\RealDownloader\RCAPlugins\rpbgrecorderapp.dll
C:\Program Files (x86)\RealNetworks\RealDownloader\RCAPlugins\rpsharedcomponents.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\MSVCP100.dll
C:\windows\system32\MSVCR100.dll
C:\windows\system32\ntmarta.dll
C:\windows\system32\PortableDeviceApi.dll
C:\windows\system32\PortableDeviceTypes.dll
C:\windows\system32\profapi.dll
C:\windows\system32\propsys.dll
C:\windows\system32\Secur32.dll
C:\windows\system32\uxtheme.dll
C:\windows\system32\VERSION.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\CFGMGR32.dll
C:\windows\syswow64\CLBCatQ.DLL
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\DEVOBJ.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\syswow64\NSI.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SETUPAPI.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WLDAP32.dll
C:\windows\syswow64\WS2_32.DLL
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b3 6\gdiplus.dll
[C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (35)]
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.dll
C:\windows\system32\dwmapi.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\ntmarta.dll
C:\windows\system32\uxtheme.dll
C:\windows\system32\VERSION.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\CFGMGR32.dll
C:\windows\syswow64\CRYPT32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\DEVOBJ.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSASN1.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SETUPAPI.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WINTRUST.dll
C:\windows\syswow64\WLDAP32.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
[C:\Users\Bill\AppData\Roaming\Dropbox\bin\Dropbox.exe (100)]
C:\Program Files (x86)\Bonjour\mdnsNSP.dll
C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\Users\Bill\AppData\Roaming\Dropbox\bin\icudt.dll
C:\Users\Bill\AppData\Roaming\Dropbox\bin\libcef.dll
C:\Users\Bill\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll
C:\windows\system32\bcrypt.dll
C:\windows\system32\credssp.dll
C:\windows\system32\cryptnet.dll
C:\windows\system32\CRYPTSP.dll
C:\windows\system32\d3dcompiler_43.dll
C:\windows\system32\dhcpcsvc.DLL
C:\windows\system32\dhcpcsvc6.DLL
C:\windows\system32\DNSAPI.dll
C:\windows\system32\dwmapi.dll
C:\windows\System32\fwpuclnt.dll
C:\windows\system32\GPAPI.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\iphlpapi.DLL
C:\windows\system32\LOGONCLI.DLL
C:\windows\system32\msimg32.dll
C:\windows\system32\MSWSOCK.dll
C:\windows\system32\napinsp.dll
C:\windows\system32\ncrypt.dll
C:\windows\system32\NETAPI32.dll
C:\windows\system32\netutils.dll
C:\windows\system32\NLAapi.dll
C:\windows\system32\ntdsapi.dll
C:\windows\system32\ntmarta.dll
C:\windows\system32\OLEACC.dll
C:\windows\system32\pnrpnsp.dll
C:\windows\system32\profapi.dll
C:\windows\system32\rasadhlp.dll
C:\windows\system32\RpcRtRemote.dll
C:\windows\system32\rsaenh.dll
C:\windows\system32\secur32.dll
C:\windows\system32\security.dll
C:\windows\system32\sfc.dll
C:\windows\system32\sfc_os.DLL
C:\windows\system32\srvcli.dll
C:\windows\system32\SXS.DLL
C:\windows\system32\USERENV.dll
C:\windows\system32\uxtheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\webio.dll
C:\windows\system32\WINHTTP.dll
C:\windows\system32\WINMM.dll
C:\windows\system32\WINNSI.DLL
C:\windows\System32\winrnr.dll
C:\windows\system32\WINSPOOL.DRV
C:\windows\system32\wkscli.dll
C:\windows\system32\wshbth.dll
C:\windows\System32\wship6.dll
C:\windows\System32\wshtcpip.dll
C:\windows\system32\WTSAPI32.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
C:\windows\SysWOW64\bcryptprimitives.dll
C:\windows\syswow64\CFGMGR32.dll
C:\windows\syswow64\CLBCatQ.DLL
C:\windows\syswow64\COMDLG32.dll
C:\windows\syswow64\Crypt32.DLL
C:\windows\syswow64\CRYPTBASE.dll
C:\Windows\SysWOW64\FirewallAPI.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\iertutil.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSASN1.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\syswow64\normaliz.DLL
C:\windows\syswow64\NSI.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\Psapi.dll
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\urlmon.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WININET.dll
C:\windows\syswow64\WLDAP32.dll
C:\windows\syswow64\WS2_32.dll
C:\windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCP 90.dll
C:\windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR 90.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
C:\windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b3 6\gdiplus.dll
[C:\Users\Bill\Desktop\startuplist\StartupList.exe (51)]
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\Program Files\Lenovo\Bluetooth Software\SysWOW64\BtMmHook.dll
C:\windows\system32\asycfilt.dll
C:\windows\system32\CRYPTSP.dll
C:\windows\system32\dwmapi.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\msi.dll
C:\windows\system32\msiltcfg.dll
C:\windows\system32\MSVBVM60.DLL
C:\windows\system32\NTDSAPI.dll
C:\windows\system32\RpcRtRemote.dll
C:\windows\system32\rsaenh.dll
C:\windows\system32\sfc_os.DLL
C:\windows\system32\SXS.DLL
C:\windows\system32\uxtheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\wbem\fastprox.dll
C:\windows\system32\wbem\wbemdisp.dll
C:\windows\system32\wbem\wbemprox.dll
C:\windows\system32\wbem\wbemsvc.dll
C:\windows\system32\wbem\wmiutils.dll
C:\windows\system32\wbemcomn.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\CLBCatQ.DLL
C:\windows\syswow64\comdlg32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\SysWOW64\MSCOMCTL.OCX
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\syswow64\NSI.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\PSAPI.DLL
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\SysWOW64\SFC.DLL
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WS2_32.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_ec80f00e8593ece5\COMCTL32.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.DLL
[C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe (51)]
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\windows\system32\apphelp.dll
C:\windows\system32\credssp.dll
C:\windows\system32\DINPUT8.dll
C:\windows\system32\MPR.dll
C:\windows\system32\ntmarta.dll
C:\windows\system32\profapi.dll
C:\windows\system32\Secur32.dll
C:\windows\system32\USERENV.dll
C:\windows\system32\uxtheme.dll
C:\windows\system32\version.DLL
C:\windows\system32\WINMM.dll
C:\windows\system32\WINSPOOL.DRV
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
C:\windows\syswow64\COMDLG32.dll
C:\windows\syswow64\CRYPT32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\iertutil.dll
C:\windows\syswow64\IMM32.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSASN1.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\syswow64\normaliz.DLL
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\PSAPI.DLL
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\schannel.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\shlwapi.DLL
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\urlmon.dll
C:\windows\syswow64\user32.DLL
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WININET.dll
C:\windows\syswow64\WLDAP32.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_ec80f00e8593ece5\COMCTL32.dll
[C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe (67)]
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\Program Files\Lenovo\Bluetooth Software\SysWOW64\BtMmHook.dll
C:\windows\system32\AUDIOSES.DLL
C:\windows\system32\d3d8thk.dll
C:\windows\system32\d3d9.dll
C:\windows\system32\DINPUT8.dll
C:\windows\system32\DSOUND.dll
C:\windows\system32\dwmapi.dll
C:\windows\system32\dxva2.dll
C:\windows\system32\igdumd32.dll
C:\windows\system32\igdumdx32.dll
C:\windows\system32\mlang.dll
C:\windows\System32\MMDevApi.dll
C:\windows\system32\MPR.dll
C:\windows\system32\mscms.dll
C:\windows\system32\POWRPROF.dll
C:\windows\system32\profapi.dll
C:\windows\System32\PROPSYS.dll
C:\windows\system32\Secur32.dll
C:\windows\system32\USERENV.dll
C:\windows\system32\uxtheme.dll
C:\windows\system32\version.DLL
C:\windows\system32\WINMM.dll
C:\windows\system32\WINSPOOL.DRV
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
C:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
C:\windows\syswow64\CFGMGR32.dll
C:\windows\syswow64\CLBCatQ.DLL
C:\windows\syswow64\COMDLG32.dll
C:\windows\syswow64\CRYPT32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\DEVOBJ.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\iertutil.dll
C:\windows\syswow64\IMM32.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll
C:\windows\syswow64\MSASN1.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\syswow64\normaliz.DLL
C:\windows\syswow64\NSI.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\PSAPI.DLL
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SETUPAPI.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\shlwapi.DLL
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\urlmon.dll
C:\windows\syswow64\user32.DLL
C:\windows\syswow64\USP10.dll
C:\windows\syswow64\WININET.dll
C:\windows\syswow64\WS2_32.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_ec80f00e8593ece5\COMCTL32.dll
[C:\windows\SysWOW64\RunDll32.exe (35)]
C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
C:\Program Files\Lenovo\Bluetooth Software\SysWOW64\BtMmHook.dll
C:\windows\AppPatch\AcLayers.DLL
C:\windows\AppPatch\AcWow64.DLL
C:\windows\system32\apphelp.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\uxtheme.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\SysWOW64\dwmapi.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\imagehlp.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\SysWOW64\MPR.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\SysWOW64\profapi.dll
C:\windows\syswow64\PSAPI.DLL
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\SysWOW64\USERENV.dll
C:\windows\syswow64\USP10.dll
C:\windows\SysWOW64\VERSION.dll
C:\windows\SysWOW64\WINSPOOL.DRV
[C:\Windows\vVX3000.exe (28)]
C:\windows\system32\dwmapi.dll
C:\windows\system32\IMM32.DLL
C:\windows\system32\oledlg.dll
C:\windows\system32\uxtheme.dll
C:\windows\system32\VERSION.dll
C:\windows\system32\WINSPOOL.DRV
C:\windows\system32\WINSTA.dll
C:\windows\syswow64\ADVAPI32.dll
C:\windows\syswow64\COMDLG32.dll
C:\windows\syswow64\CRYPTBASE.dll
C:\windows\syswow64\GDI32.dll
C:\windows\syswow64\kernel32.dll
C:\windows\syswow64\KERNELBASE.dll
C:\windows\syswow64\LPK.dll
C:\windows\syswow64\MSCTF.dll
C:\windows\syswow64\msvcrt.dll
C:\windows\SysWOW64\ntdll.dll
C:\windows\SysWOW64\nvinit.dll
C:\windows\syswow64\ole32.dll
C:\windows\syswow64\OLEAUT32.dll
C:\windows\syswow64\RPCRT4.dll
C:\windows\SysWOW64\sechost.dll
C:\windows\syswow64\SHELL32.dll
C:\windows\syswow64\SHLWAPI.dll
C:\windows\syswow64\SspiCli.dll
C:\windows\syswow64\USER32.dll
C:\windows\syswow64\USP10.dll
C:\windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_ec80f00e8593ece5\COMCTL32.dll
--------------------
Autostart folders:
[Startup (3)]
desktop.ini
Dropbox.lnk
oawl99f.lnk
[User Startup (3)]
desktop.ini
Dropbox.lnk
oawl99f.lnk
[Common Startup (3)]
Adobe Gamma Loader.lnk
Bluetooth.lnk
desktop.ini
[User Common Startup (3)]
Adobe Gamma Loader.lnk
Bluetooth.lnk
desktop.ini
--------------------
Task Scheduler jobs (5):
Adobe Flash Player Updater.job
GoogleUpdateTaskMachineCore1ce80169cac8ff2.job
GoogleUpdateTaskMachineUA1cef16f91ad9948.job
Online Backup Update Notifier.job
SOS Online Backup - bill@williamthomas-furniture.com.job
--------------------
IniMapping values:
System NT shell = explorer.exe
--------------------
On-reboot actions:
BootExecute = autocheck autochk *
--------------------
Shell commands:
.bat - Windows Batch File - "%1" %*
.cmd - Windows Command Script - "%1" %*
.com - MS-DOS Application - "%1" %*
.exe - Application - "%1" %*
.hta - HTML Application - C:\Windows\SysWOW64\mshta.exe "%1" %*
.js - JavaScript File - C:\Windows\System32\WScript.exe "%1" %*
.jse - JScript Encoded File - C:\Windows\System32\WScript.exe "%1" %*
.pif - Shortcut to MS-DOS Program - "%1" %*
.scr - Screen saver - "%1" /S
.txt - Text Document - C:\windows\system32\NOTEPAD.EXE %1
.vbe - VBScript Encoded File - "C:\windows\System32\WScript.exe" "%1" %*
.vbs - VBScript Script File - "C:\windows\System32\WScript.exe" "%1" %*
.wsf - Windows Script File - "C:\windows\System32\WScript.exe" "%1" %*
.wsh - Windows Script Host Settings File - "C:\windows\System32\WScript.exe" "%1" %*
--------------------
Services:
[NT Services (75)]
@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103 = C:\windows\System32\svchost.exe -k secsvcs
@%SystemRoot%\system32\audiosrv.dll,-200 = C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
@%SystemRoot%\system32\audiosrv.dll,-204 = C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
@%SystemRoot%\system32\bfe.dll,-1001 = C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
@%systemroot%\system32\browser.dll,-100 = C:\windows\System32\svchost.exe -k netsvcs
@%SystemRoot%\system32\cryptsvc.dll,-1001 = C:\windows\system32\svchost.exe -k NetworkService
@%SystemRoot%\system32\dhcpcore.dll,-100 = C:\windows\system32\svchost.exe -k LocalServiceNetworkRestricted
@%SystemRoot%\System32\dnsapi.dll,-101 = C:\windows\system32\svchost.exe -k NetworkService
@%systemroot%\system32\dps.dll,-500 = C:\windows\System32\svchost.exe -k LocalServiceNoNetwork
@%SystemRoot%\system32\dwm.exe,-2000 = C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
@%SystemRoot%\system32\efssvc.dll,-100 = C:\windows\System32\lsass.exe
@%systemroot%\system32\fdrespub.dll,-100 = C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
@%SystemRoot%\system32\FirewallAPI.dll,-23090 = C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
@%systemroot%\system32\FntCache.dll,-100 = C:\windows\system32\svchost.exe -k LocalService
@%SystemRoot%\system32\ikeext.dll,-501 = C:\windows\system32\svchost.exe -k netsvcs
@%SystemRoot%\system32\iphlpsvc.dll,-500 = C:\windows\System32\svchost.exe -k NetSvcs
@%SystemRoot%\system32\lmhsvc.dll,-101 = C:\windows\system32\svchost.exe -k LocalServiceNetworkRestricted
@%systemroot%\system32\mmcss.dll,-100 = C:\windows\system32\svchost.exe -k netsvcs
@%SystemRoot%\System32\nlasvc.dll,-1 = C:\windows\System32\svchost.exe -k NetworkService
@%SystemRoot%\system32\nsisvc.dll,-200 = C:\windows\system32\svchost.exe -k LocalService
@%SystemRoot%\system32\pcasvc.dll,-1 = C:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted
@%SystemRoot%\System32\polstore.dll,-5010 = C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
@%systemroot%\system32\profsvc.dll,-300 = C:\windows\system32\svchost.exe -k netsvcs
@%SystemRoot%\system32\samsrv.dll,-1 = C:\windows\system32\lsass.exe
@%SystemRoot%\system32\schedsvc.dll,-100 = C:\windows\system32\svchost.exe -k netsvcs
@%systemroot%\system32\SearchIndexer.exe,-103 = C:\windows\system32\SearchIndexer.exe /Embedding
@%SystemRoot%\system32\Sens.dll,-200 = C:\windows\system32\svchost.exe -k netsvcs
@%SystemRoot%\System32\shsvcs.dll,-12288 = C:\windows\System32\svchost.exe -k netsvcs
@%systemroot%\system32\spoolsv.exe,-1 = C:\windows\System32\spoolsv.exe
@%SystemRoot%\system32\sppsvc.exe,-101 = C:\windows\system32\sppsvc.exe
@%systemroot%\system32\srvsvc.dll,-100 = C:\windows\system32\svchost.exe -k netsvcs
@%SystemRoot%\system32\sysmain.dll,-1000 = C:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted
@%SystemRoot%\System32\themeservice.dll,-8192 = C:\windows\System32\svchost.exe -k netsvcs
@%SystemRoot%\system32\trkwks.dll,-1 = C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
@%SystemRoot%\system32\umpnpmgr.dll,-100 = C:\windows\system32\svchost.exe -k DcomLaunch
@%SystemRoot%\system32\umpo.dll,-100 = C:\windows\system32\svchost.exe -k DcomLaunch
@%SystemRoot%\system32\vaultsvc.dll,-1003 = C:\windows\system32\lsass.exe
@%Systemroot%\system32\wbem\wmisvc.dll,-205 = C:\windows\system32\svchost.exe -k netsvcs
@%SystemRoot%\system32\wevtsvc.dll,-200 = C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
@%SystemRoot%\system32\wiaservc.dll,-9 = C:\windows\system32\svchost.exe -k imgsvc
@%systemroot%\system32\wkssvc.dll,-100 = C:\windows\System32\svchost.exe -k NetworkService
@%SystemRoot%\System32\wlansvc.dll,-257 = C:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted
@%SystemRoot%\System32\wscsvc.dll,-200 = C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
@%systemroot%\system32\wuaueng.dll,-105 = C:\windows\system32\svchost.exe -k netsvcs
@%SystemRoot%\System32\wwansvc.dll,-257 = C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
@%windir%\system32\RpcEpMap.dll,-1001 = C:\windows\system32\svchost.exe -k RPCSS
@comres.dll,-2450 = C:\windows\system32\svchost.exe -k LocalService
@gpapi.dll,-112 = C:\windows\system32\svchost.exe -k netsvcs
@oleres.dll,-5010 = C:\windows\system32\svchost.exe -k rpcss
@oleres.dll,-5012 = C:\windows\system32\svchost.exe -k DcomLaunch
Adobe Acrobat Update Service = "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Apple Mobile Device = "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
Application Virtualization Client = "C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe"
Bluetooth Service = C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
Bonjour Service = "C:\Program Files\Bonjour\mDNSResponder.exe"
Canon Inkjet Printer/Scanner/Fax Extended Survey Program = C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
Client Virtualization Handler = "C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE"
ESET Service = "C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe"
Google Update Service (gupdate) = "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
Intel(R) Management and Security Application Local Management Service = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
Intel(R) Management and Security Application User Notification Service = "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
Intel(R) PROSet/Wireless Event Log = C:\Program Files\Intel\WiFi\bin\EvtEng.exe
Intel(R) PROSet/Wireless Registry Service = C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
Intel(R) Rapid Storage Technology = "C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
MBAMScheduler = "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe"
MBAMService = "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"
Microsoft .NET Framework NGEN v4.0.30319_X64 = C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Microsoft .NET Framework NGEN v4.0.30319_X86 = C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
MSCamSvc = "C:\Program Files\Microsoft LifeCam\MSCamS64.exe"
NVIDIA Driver Helper Service = C:\windows\system32\nvvsvc.exe
NVIDIA Update Service Daemon = C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
RealNetworks Downloader Resolver Service = "C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe"
UMVPFSrv = C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
vToolbarUpdater15.3.0 = C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe
Windows Live ID Sign-in Assistant = "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
[SafeBoot services (Minimal boot)]
* CD-ROM Drive *
{4D36E965-E325-11CE-BFC1-08002BE10318}
* DiskDrive *
{4D36E967-E325-11CE-BFC1-08002BE10318}
* Driver *
sermouse.sys
vga.sys
vgasave.sys
volmgr.sys
volmgrx.sys
WudfPf
WudfRd
* Driver Group *
Base
Boot Bus Extender
Boot file system
File system
Filter
PCI Configuration
PNP Filter
Primary disk
SCSI Class
System Bus Extender
* Floppy disk drive *
{4D36E980-E325-11CE-BFC1-08002BE10318}
* Hdc *
{4D36E96A-E325-11CE-BFC1-08002BE10318}
* Human Interface Devices *
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
* IEEE 1394 Bus host controllers *
{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}
* Keyboard *
{4D36E96B-E325-11CE-BFC1-08002BE10318}
* Mouse *
{4D36E96F-E325-11CE-BFC1-08002BE10318}
* PCMCIA Adapters *
{4D36E977-E325-11CE-BFC1-08002BE10318}
* SBP2 IEEE 1394 Devices *
{D48179BE-EC20-11D1-B6B8-00C04FA372A7}
* SCSIAdapter *
{4D36E97B-E325-11CE-BFC1-08002BE10318}
* SecurityDevices *
{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}
* Service *
AppInfo
AppMgmt
CryptSvc
DcomLaunch
EFS
EventLog
HelpSvc
KeyIso
Netlogon
NTDS
PlugPlay
Power
ProfSvc
RpcEptMapper
RpcSs
sacsvr
SWPRV
TabletInputService
TBS
TrustedInstaller
VDS
vmms
WinDefend
WinMgmt
WudfSvc
* Standard floppy disk controller *
{4D36E969-E325-11CE-BFC1-08002BE10318}
* System *
{4D36E97D-E325-11CE-BFC1-08002BE10318}
* Universal Serial Bus controllers *
{36FC9E60-C465-11CF-8056-444553540000}
* Volume *
{71A27CDD-812A-11D0-BEC7-08002BE2092F}
* Volume shadow copy *
{533C5B84-EC70-11D2-9505-00C04F79DEAF}
[SafeBoot services (Minimal boot + network support)]
* CD-ROM Drive *
{4D36E965-E325-11CE-BFC1-08002BE10318}
* DiskDrive *
{4D36E967-E325-11CE-BFC1-08002BE10318}
* Driver *
bowser
dfsc
ipnat.sys
MPSDrv
mrxsmb
mrxsmb10
mrxsmb20
ndiscap
nsiproxy.sys
rdbss
rdpencdd.sys
sermouse.sys
vga.sys
vgasave.sys
volmgr.sys
volmgrx.sys
WudfPf
WudfRd
WudfUsbccidDriver
* Driver Group *
Base
Boot Bus Extender
Boot file system
File system
Filter
NDIS
NDIS Wrapper
NetBIOSGroup
NetDDEGroup
Network
NetworkProvider
PCI Configuration
PNP Filter
PNP_TDI
Primary disk
SCSI Class
Streams Drivers
System Bus Extender
TDI
* Floppy disk drive *
{4D36E980-E325-11CE-BFC1-08002BE10318}
* Hdc *
{4D36E96A-E325-11CE-BFC1-08002BE10318}
* Human Interface Devices *
{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
* IEEE 1394 Bus host controllers *
{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}
* Keyboard *
{4D36E96B-E325-11CE-BFC1-08002BE10318}
* Mouse *
{4D36E96F-E325-11CE-BFC1-08002BE10318}
* Net *
{4D36E972-E325-11CE-BFC1-08002BE10318}
* NetClient *
{4D36E973-E325-11CE-BFC1-08002BE10318}
* NetService *
{4D36E974-E325-11CE-BFC1-08002BE10318}
* NetTrans *
{4D36E975-E325-11CE-BFC1-08002BE10318}
* PCMCIA Adapters *
{4D36E977-E325-11CE-BFC1-08002BE10318}
* SBP2 IEEE 1394 Devices *
{D48179BE-EC20-11D1-B6B8-00C04FA372A7}
* SCSIAdapter *
{4D36E97B-E325-11CE-BFC1-08002BE10318}
* SecurityDevices *
{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}
* Service *
AFD
AppInfo
AppMgmt
BFE
Browser
CryptSvc
DcomLaunch
Dhcp
DnsCache
Dot3Svc
Eaphost
EFS
EventLog
HelpSvc
IKEEXT
KeyIso
LanmanServer
LanmanWorkstation
LmHosts
Messenger
MPSSvc
NativeWifiP
Ndisuio
NetBIOS
NetBT
Netlogon
NetMan
netprofm
NlaSvc
Nsi
NTDS
PlugPlay
PolicyAgent
Power
ProfSvc
rdsessmgr
RpcEptMapper
RpcSs
sacsvr
SCardSvr
SharedAccess
SWPRV
TabletInputService
TBS
Tcpip
TrustedInstaller
VaultSvc
VDS
vmms
WinDefend
WinMgmt
Wlansvc
WudfSvc
* Smart card readers *
{50DD5230-BA8A-11D1-BF5D-0000F805F530}
* Standard floppy disk controller *
{4D36E969-E325-11CE-BFC1-08002BE10318}
* System *
{4D36E97D-E325-11CE-BFC1-08002BE10318}
* Universal Serial Bus controllers *
{36FC9E60-C465-11CF-8056-444553540000}
* Volume *
{71A27CDD-812A-11D0-BEC7-08002BE2092F}
* Volume shadow copy *
{533C5B84-EC70-11D2-9505-00C04F79DEAF}
[SafeBoot: Alternate shell]
cmd.exe (not enabled)
--------------------
Driver filters:
[Class filters]
* Disk drives *
- Upper filters
LHDmgr.sys
PartMgr.sys
* DVD/CD-ROM drives *
- Upper filters
GEARAspiWDM.sys
* Imaging devices *
- Upper filters
ksthunk.sys
* Infrared devices *
- Upper filters
IRENUM.sys
* Keyboards *
- Upper filters
kbdclass.sys
* Medium Changer devices *
- Upper filters
GEARAspiWDM.sys
* Mice and other pointing devices *
- Upper filters
mouclass.sys
* Smart card readers *
- Upper filters
scfilter.sys
* Sound, video and game controllers *
- Upper filters
ksthunk.sys
* Storage Volumes *
- Lower filters
fvevol.sys
rdyboost.sys
* Tape drives *
- Upper filters
GEARAspiWDM.sys
[Device filters]
* @machine.inf,%*pnp0c0d.devicedesc%;ACPI Lid *
- Lower filters
DelayMan.sys
* @machine.inf,%rdp_kbd.devicedesc%;Terminal Server Keyboard Driver *
- Upper filters
kbdclass.sys
* @machine.inf,%rdp_mou.devicedesc%;Terminal Server Mouse Driver *
- Upper filters
mouclass.sys
* @netrasa.inf,%mp-bh-dispname%;WAN Miniport (Network Monitor) *
- Lower filters
NdisTapi.sys
* @netrasa.inf,%mp-ip-dispname%;WAN Miniport (IP) *
- Lower filters
NdisTapi.sys
* @netrasa.inf,%mp-ipv6-dispname%;WAN Miniport (IPv6) *
- Lower filters
NdisTapi.sys
* @oem15.inf,%nic_mpciex_1000_bgn%;Intel(R) WiFi Link 1000 BGN *
- Upper filters
vwifibus.sys
* @oem18.inf,%btaudio.devicedesc%;Bluetooth Hands-free Audio *
- Lower filters
btwavdt.sys
* @oem20.inf,%wc_avcontrol_description%;Bluetooth Remote Control *
- Lower filters
btwavdt.sys
* @oem22.inf,%brcmbtusbtwoone.devicedesc%;Broadcom Bluetooth 2.1 USB *
- Lower filters
btwampfl.sys
* @oem26.inf,%ps2.syndevicedesc%;Synaptics PS/2 Port TouchPad *
- Upper filters
SynTP.sys
* @oem55.inf,%vdfmodem%;Vodafone Mobile Broadband Modem (Huawei) *
- Lower filters
hwdatacard.sys
* @oem55.inf,%vdfmodem%;Vodafone Mobile Broadband Modem (Huawei) *
- Lower filters
hwdatacard.sys
* @oem59.inf,%busfilter.devicedesc%;USB Composite Device *
- Upper filters
ew_usbenumfilter.sys
* @oem6.inf,%pci\ven_8086&dev_0101.devicedesc%;2nd generation Intel(R) Core(TM) processor family PCI Express Controller - 0101 *
- Upper filters
nvpciflt.sys
* @oem64.inf,%vdfmodemdesc%;Vodafone Mobile Broadband Modem (Huawei) *
- Lower filters
huawei_cdcacm.sys
* @tdibth.inf,%rfcomm.displayname%;Bluetooth Device (RFCOMM Protocol TDI) *
- Upper filters
BthEnum.sys
* Canon PowerShot SD1300 IS *
- Lower filters
WinUsb.sys
* Sansa c250 *
- Lower filters
WinUsb.sys
--------------------
Print monitors (9):
Canon BJ Language Monitor MG5300 series - CNMLMAT.DLL
Canon BJ Language Monitor MG5300 series XPS - CNMXLMAT.DLL
Canon BJNP Port - CNMN6PPM.DLL
Local Port - localspl.dll
Microsoft Shared Fax Monitor - FXSMON.DLL
PCL hpz3lw71 - hpz3lw71.dll
Standard TCP/IP Port - tcpmon.dll
USB Monitor - usbmon.dll
WSD Port - WSDMon.dll
--------------------
WinLogon autoruns:
UserInit = userinit.exe,
VmApplet = SystemPropertiesPerformance.exe /pagefile
AppInit_DLLs = C:\windows\SysWOW64\nvinit.dll
[Group policy extensions (16)]
Wireless Group Policy = wlgpclnt.dll
Folder Redirection = fdeploy.dll
Microsoft Disk Quota = %SystemRoot%\System32\dskquota.dll
QoS Packet Scheduler = gptext.dll
Internet Explorer Zonemapping = C:\Windows\SysWOW64\iedkcs32.dll
Windows Search Group Policy Extension = %SystemRoot%\System32\srchadmin.dll
Internet Explorer User Accelerators = C:\Windows\SysWOW64\iedkcs32.dll
Security = scecli.dll
Deployed Printer Connections = %systemroot%\system32\gpprnext.dll
Internet Explorer Branding = C:\Windows\SysWOW64\iedkcs32.dll
802.3 Group Policy = dot3gpclnt.dll
TCPIP = gptext.dll
Internet Explorer Machine Accelerators = C:\Windows\SysWOW64\iedkcs32.dll
IP Security = %SystemRoot%\System32\polstore.dll
Enterprise QoS = gptext.dll
CP = gptext.dll
--------------------
Policies:
[All users]
* Primary policies *
- Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown\cDefaultExecMenuItems (78)
tWhiteList = Close
GeneralInfo
Quit
FirstPage
PrevPage
NextPage
LastPage
ActualSize
FitPage
FitWidth
FitHeight
SinglePage
OneColumn
TwoPages
TwoColumns
ZoomViewIn
ZoomViewOut
ShowHideBookmarks
ShowHideThumbnails
GoToPage
ZoomTo
GeneralPrefs
SaveAs
FullScreenMode
OpenOrganizer
Scan
Web2PDF:OpnURL
AcroSendMail:SendMail
Spelling:Check Spelling
PageSetup
Find
FindSearch
GoBack
GoForward
FitVisible
ShowHideArticles
ShowHideFileAttachment
ShowHideAnnotManager
ShowHideFields
ShowHideOptCont
ShowHideModelTree
ShowHideSignatures
InsertPages
ExtractPages
ReplacePages
DeletePages
CropPages
RotatePages
AddFileAttachment
FindCurrentBookmark
BookmarkShowLocation
GoBackDoc
GoForwardDoc
DocHelpUserGuide
HelpReader
rolReadPage
HandMenuItem
ZoomDragMenuItem
CollectionPreview
CollectionHome
CollectionDetails
CollectionShowRoot
&Pages
Co&ntent
&Forms
Action &Wizard
Recognize &Text
P&rotection
&Sign && Certify
Doc&ument Processing
Print Pro&duction
Ja&vaScript
&Accessibility
Analy&ze
&Annotations
D&rawing Markups
Revie&w
- Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown\cDefaultFindAttachmentPerms (73)
tSearchAttachmentsWhiteList = 3g2
3gp
3gpp
3gpp2
aac
ac3
aif
aiff
ani
asf
avi
bmp
cdr
cur
divx
djvu
doc
docx
dv
emf
eps
flv
f4v
gif
ico
iff
jbig2
jp2
jpeg
jpg
m2v
m4a
m4b
m4p
m4v
mid
mkv
mov
mpa
mp2
mp3
mp4
mts
nsv
ogg
ogm
ogv
pbm
pgm
png
ppm
ppt
pptx
ps
psd
qt
rtf
riff
svg
tif
ts
txt
ram
rm
rmvb
vob
wav
wma
wmf
wmv
xmb
xls
xlsx
- Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown\cDefaultLaunchAttachmentPerms (105)
tBuiltInPermList = version:1
.ade:3
.adp:3
.app:3
.arc:3
.arj:3
.asp:3
.bas:3
.bat:3
.bz:3
.bz2:3
.cab:3
.chm:3
.class:3
.cmd:3
.com:3
.command:3
.cpl:3
.crt:3
.csh:3
.desktop:3
.dll:3
.exe:3
.fxp:3
.gz:3
.hex:3
.hlp:3
.hqx:3
.hta:3
.inf:3
.ini:3
.ins:3
.isp:3
.its:3
.job:3
.js:3
.jse:3
.ksh:3
.lnk:3
.lzh:3
.mad:3
.maf:3
.mag:3
.mam:3
.maq:3
.mar:3
.mas:3
.mat:3
.mau:3
.mav:3
.maw:3
.mda:3
.mdb:3
.mde:3
.mdt:3
.mdw:3
.mdz:3
.msc:3
.msi:3
.msp:3
.mst:3
.ocx:3
.ops:3
.pcd:3
.pi:3
.pif:3
.prf:3
.prg:3
.pst:3
.rar:3
.reg:3
.scf:3
.scr:3
.sct:3
.sea:3
.shb:3
.shs:3
.sit:3
.tar:3
.taz:3
.tgz:3
.tmp:3
.url:3
.vb:3
.vbe:3
.vbs:3
.vsmacros:3
.vss:3
.vst:3
.vsw:3
.webloc:3
.ws:3
.wsc:3
.wsf:3
.wsh:3
.z:3
.zip:3
.zlo:3
.zoo:3
.pdf:2
.fdf:2
.jar:3
.pkg:3
.tool:3
.term:3
- Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown\cDefaultLaunchURLPerms (32)
tFlashContentSchemeWhiteList = http
https
ftp
rtmp
rtmpe
rtmpt
rtmpte
rtmps
mailto
tSponsoredContentSchemeWhiteList = http
https
tSchemePerms = version:2
shell:3
hcp:3
ms-help:3
ms-its:3
ms-itss:3
its:3
mk:3
mhtml:3
help:3
disk:3
afp:3
disks:3
telnet:3
ssh:3
acrobat:2
mailto:2
file:1
rlogin:3
javascript:4
data:3
- Software\Policies\Microsoft\Peernet (1)
Disabled = dword: 0
- Software\Policies\Microsoft\Windows\CurrentVersion\Identities (2)
@ =
Locked Down = dword: 0
- Software\Policies\Microsoft\Windows\Network Connections (1)
NC_PersonalFirewallConfig = dword: 0
- Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator (1)
@ =
- Software\Policies\Microsoft\Windows\safer\codeidentifiers (1)
authenticodeenabled = dword: 0
- Software\Policies\Microsoft\Windows NT\Terminal Services\Client (3)
fEnableUsbNoAckIsochWriteToDevice = dword: 80
fEnableUsbBlockDeviceBySetupClass = dword: 1
fEnableUsbSelectDeviceByInterface = dword: 1
- Software\Policies\Microsoft\Windows NT\Terminal Services\Client\UsbBlockDeviceBySetupClasses (1)
1000 = {3376f4ce-ff8d-40a2-a80f-bb4359d1415c}
- Software\Policies\Microsoft\Windows NT\Terminal Services\Client\UsbSelectDeviceByInterfaces (1)
1000 = {6bdd1fc6-810f-11d0-bec7-08002be2092f}
- Software\Policies\Microsoft\Windows NT\Windows File Protection (1)
KnownDllList = nlhtml.dll
* Alternate policies *
- Software\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop (2)
NoAddingComponents = dword: 1
NoComponents = dword: 1
- Software\Microsoft\Windows\CurrentVersion\policies\Attachments (1)
ScanWithAntiVirus = dword: 3
- Software\Microsoft\Windows\CurrentVersion\policies\Explorer (3)
NoActiveDesktop = dword: 1
NoActiveDesktopChanges = dword: 1
ForceActiveDesktopOn = dword: 0
- Software\Microsoft\Windows\CurrentVersion\policies\NonEnum (3)
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = dword: 1
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} = dword: 1073741857
{0DF44EAA-FF21-4412-828E-260A8728E7F1} = dword: 32
- Software\Microsoft\Windows\CurrentVersion\policies\System (16)
ConsentPromptBehaviorAdmin = dword: 5
ConsentPromptBehaviorUser = dword: 3
EnableInstallerDetection = dword: 1
EnableLUA = dword: 1
EnableSecureUIAPaths = dword: 1
EnableUIADesktopToggle = dword: 0
EnableVirtualization = dword: 1
PromptOnSecureDesktop = dword: 1
ValidateAdminCodeSignatures = dword: 0
dontdisplaylastusername = dword: 0
legalnoticecaption =
legalnoticetext =
scforceoption = dword: 0
shutdownwithoutlogon = dword: 1
undockwithoutlogon = dword: 1
FilterAdministratorToken = dword: 0
- Software\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats (7)
CF_TEXT = dword: 1
CF_BITMAP = dword: 2
CF_OEMTEXT = dword: 7
CF_DIB = dword: 8
CF_PALETTE = dword: 9
CF_UNICODETEXT = dword: 13
CF_DIBV5 = dword: 17
--------------------
Browser Helper Objects (8):
AVG SafeGuard toolbar = {95B7759C-8C7F-4BF1-B163-73684A933233} = C:\Program Files (x86)\AVG SafeGuard toolbar\15.3.0.11\AVG SafeGuard toolbar_toolbar.dll
Groove GFS Browser Helper = {72853161-30C5-4D22-B7F9-0BBC1D38A37E} = C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
Java(tm) Plug-In 2 SSV Helper = {DBC80044-A445-435b-BC74-9C25C1C588A9} = C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
Java(tm) Plug-In SSV Helper = {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} = C:\Program Files (x86)\Java\jre7\bin\ssv.dll
RealNetworks Download and Record Plugin for Internet Explorer = {3049C3E9-B461-4BC5-8870-4C09146192CA} = C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
Rich Media Downloader = {A7DF592F-6E2A-45C4-9A87-4BD217D714ED} = C:\Users\Bill\AppData\Local\Rich Media Player\BrowserExtensions\IE\RichMediaDownloader.dll
URLRedirectionBHO = {B4F3A835-0E21-4959-BA22-42B3008E02FF} = C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
Windows Live ID Sign-in Helper = {9030D464-4C02-4ABF-8ECC-5164760863C6} = C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
--------------------
ActiveX objects (8):
(no name) - {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
ClearIconCache - {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\windows\system32\cmd.exe /D /C start C:\windows\system32\ie4uinit.exe -ClearIconCache
DOTNETFRAMEWORKS - {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
IE4_SHELLID - {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
MailNews - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} - C:\windows\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
Theme Component - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - C:\windows\system32\regsvr32.exe /s /n /i:/UserInstall C:\windows\system32\themeui.dll
WMPACCESS - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\windows\system32\unregmp2.exe /ShowWMP
--------------------
Internet Explorer toolbars:
[This user]
* ShellBrowser (1) *
(no name) - ITBar7Layout - (no file)
* WebBrowser (1) *
(no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - (no file)
--------------------
Internet Explorer buttons/tools (5):
@C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
Send to OneNote - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
OneNote Lin&ked Notes - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
Rich Media Downloader - {A7DF592F-6E2A-45C4-9A87-4BD217D714ED} - C:\Users\Bill\AppData\Local\Rich Media Player\BrowserExtensions\IE\RichMediaDownloader.dll
Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
--------------------
Internet Explorer menu extensions:
[This user (6)]
Add to Google Photos Screensa&ver - res://C:\windows\system32\GPhotos.scr/200
E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000
Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html
Se&nd to OneNote - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105
Send image to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
Send page to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
--------------------
Internet Explorer Bands (2):
Groove Folder Synchronization - {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
- {EFA24E64-B078-11D0-89E4-00C04FC9E26E} -
--------------------
URL search hooks:
[This user (1)]
Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll
--------------------
Explorer clones:
C:\windows\explorer.exe
C:\windows\system32\explorer.exe
--------------------
ContextMenuHandlers:
[* (10)]
BriefcaseMenu = {85BBD920-42A0-1069-A2E4-08002B30309D} = C:\windows\system32\syncui.dll
DropboxExt = {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} = C:\Users\Bill\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
ESET Smart Security - Context Menu Shell Extension = {B089FE88-FB52-11D3-BDF1-0050DA34150D} = C:\Program Files\ESET\ESET Smart Security\x86\shellExt.dll
OnlineProtectMenu = {5717060c-0509-11e0-b88e-001d60af2322} = C:\Program Files (x86)\SOS Online Backup\CtxMenu.dll
Open With = {09799AFB-AD67-11d1-ABCD-00C04FC30936} = C:\windows\system32\shell32.dll
Open With EncryptionMenu = {A470F8CF-A1E8-4f65-8335-227475AA5C46} = C:\windows\system32\shell32.dll
Sharing = {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = C:\windows\system32\ntshrui.dll
Start Menu Pin = {a2a9545d-a0c2-42b4-9708-a0b2badd77c8} = C:\windows\system32\shell32.dll
Taskband Pin = {90AA3A4E-1CBA-4233-B8BB-535773D48449} = C:\windows\system32\shell32.dll
XXX Groove GFS Context Menu Handler XXX = {6C467336-8281-4E60-8204-430CED96822D} = C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
[Drive (7)]
Disk Copy Extension = {59099400-57FF-11CE-BD94-0020AF85B590} = C:\windows\system32\diskcopy.dll
EnhancedStorageShell = {2854F705-3548-414C-A113-93E27C808C85} = C:\windows\system32\EhStorShell.dll
ESET Smart Security - Context Menu Shell Extension = {B089FE88-FB52-11D3-BDF1-0050DA34150D} = C:\Program Files\ESET\ESET Smart Security\x86\shellExt.dll
Portable Devices Menu = {D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} = C:\windows\system32\wpdshext.dll
Previous Versions Property Page = {596AB062-B4D2-4215-9F74-E9109B0A8153} = C:\windows\system32\twext.dll
Sharing = {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = C:\windows\system32\ntshrui.dll
ShellFolder for CD Burning = {fbeb8a05-beee-4442-804e-409d6c4515e9} = C:\windows\system32\shell32.dll
[Folder (5)]
BriefcaseMenu = {85BBD920-42A0-1069-A2E4-08002B30309D} = C:\windows\system32\syncui.dll
ESET Smart Security - Context Menu Shell Extension = {B089FE88-FB52-11D3-BDF1-0050DA34150D} = C:\Program Files\ESET\ESET Smart Security\x86\shellExt.dll
Library Location = {3dad6c5d-2167-4cae-9914-f99e41c12cfa} = C:\windows\system32\shell32.dll
OnlineProtectMenu = {5717060c-0509-11e0-b88e-001d60af2322} = C:\Program Files (x86)\SOS Online Backup\CtxMenu.dll
XXX Groove GFS Context Menu Handler XXX = {6C467336-8281-4E60-8204-430CED96822D} = C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
[CompressedFolder (1)]
Compressed (zipped) Folder Context Menu = {b8cdcb65-b1bf-4b42-9428-1dfdb7ee92af} = C:\windows\system32\zipfldr.dll
[Directory (5)]
DropboxExt = {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} = C:\Users\Bill\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
EncryptionMenu = {A470F8CF-A1E8-4f65-8335-227475AA5C46} = C:\windows\system32\shell32.dll
Previous Versions Property Page = {596AB062-B4D2-4215-9F74-E9109B0A8153} = C:\windows\system32\twext.dll
Sharing = {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = C:\windows\system32\ntshrui.dll
XXX Groove GFS Context Menu Handler XXX = {6C467336-8281-4E60-8204-430CED96822D} = C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
[Directory\Background (5)]
DropboxExt = {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} = C:\Users\Bill\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
Gadgets = {6B9228DA-9C15-419e-856C-19E768A13BDC} = %ProgramFiles%\Windows Sidebar\sbdrop.dll
New = {D969A300-E7FF-11d0-A93B-00A0C90F2719} = C:\windows\system32\shell32.dll
Sharing = {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = C:\windows\system32\ntshrui.dll
XXX Groove GFS Context Menu Handler XXX = {6C467336-8281-4E60-8204-430CED96822D} = C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
[InternetShortcut (1)]
Internet Shortcut = {FBF23B40-E3F0-101B-8488-00AA003E56F8} = C:\Windows\SysWOW64\ieframe.dll
[AllFileSystemObjects (4)]
CopyAsPathMenu = {f3d06e7c-1e45-4a26-847e-f9fcdee59be0} = C:\windows\system32\shell32.dll
Previous Versions Property Page = {596AB062-B4D2-4215-9F74-E9109B0A8153} = C:\windows\system32\twext.dll
SendTo = {7BA4C740-9E81-11CF-99D3-00AA004AE837} = C:\windows\system32\shell32.dll
XXX Groove GFS Context Menu Handler XXX = {6C467336-8281-4E60-8204-430CED96822D} = C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
--------------------
ColumnHandlers (1):
PDF Shell Extension - {F9DB5320-233E-11D1-9F84-707F02C10627} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
--------------------
ShellExecuteHooks (1):
Groove GFS Stub Execution Hook = {B5A7F190-DDA6-4420-B3BA-52453494E6CD} = C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
--------------------
Approved Shell Extensions:
[All users (39)]
- {00C6D95F-329C-409a-81D7-C46C66EA7F33} - C:\windows\System32\shdocvw.dll
- {00F33137-EE26-412F-8D71-F84E4C2C6625} - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
- {06A2568A-CED6-4187-BB20-400B8C02BE5A} -
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} - {506F4668-F13E-4AA1-BB04-B43203AB3CC0} - C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL
{D66DC78C-4F61-447F-942B-3FB6980118CF} - {D66DC78C-4F61-447F-942B-3FB6980118CF} - C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL
Code Download Agent - {7D559C10-9FE9-11d0-93F7-00AA0059CE02} - C:\Windows\SysWOW64\webcheck.dll
ESET Smart Security - Context Menu Shell Extension - {B089FE88-FB52-11D3-BDF1-0050DA34150D} - C:\Program Files\ESET\ESET Smart Security\x86\shellExt.dll
Groove Explorer Icon Overlay 1 (GFS Unread Stub) - {99FD978C-D287-4F50-827F-B2C658EDA8E7} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
Groove Explorer Icon Overlay 2 (GFS Stub) - {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) - {920E6DB1-9907-4370-B3A0-BAFC03D81399} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
Groove Explorer Icon Overlay 3 (GFS Folder) - {16F3DD56-1AF5-4347-846D-7C10C4192619} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
Groove Explorer Icon Overlay 4 (GFS Unread Mark) - {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
Groove GFS Context Menu Handler - {6C467336-8281-4E60-8204-430CED96822D} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
Groove GFS Explorer Bar - {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
Groove GFS Stub Icon Handler - {A449600E-1DC6-4232-B948-9BD794D62056} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
Groove Namespace Extension - {3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
Groove XML Icon Handler - {387E725D-DC16-4D76-B310-2C93ED4752A0} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
MF ADTS Property Handler - {80009818-f38f-4af1-87b5-eadab9433e58} - C:\windows\System32\mf.dll
Microsoft Office HTML Icon Handler - {42042206-2D85-11D3-8CFF-005004838597} - C:\Program Files (x86)\Microsoft Office\Office14\msohevi.dll
Microsoft Office Metadata Handler - {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
Microsoft Office Thumbnail Handler - {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
Microsoft OneNote Namespace Extension for Windows Desktop Search - {0875DCB6-C686-4243-9432-ADCCF0B9F2D7} - C:\Program Files (x86)\Microsoft Office\Office14\ONFILTER.DLL
Microsoft Outlook Custom Icon Handler - {0006F045-0000-0000-C000-000000000046} - C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL
Microsoft Outlook Desktop Icon Handler - {00020D75-0000-0000-C000-000000000046} - C:\PROGRA~2\MICROS~2\Office14\MLSHEXT.DLL
Shell Extensions for RealOne Player - {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} - c:\program files (x86)\real\realplayer\rpshell.dll
Subscription Folder - {F5175861-2688-11d0-9C5E-00AA00A45957} - C:\Windows\SysWOW64\webcheck.dll
Subscription Mgr - {ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} - C:\Windows\SysWOW64\webcheck.dll
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} -
WebCheck SyncMgr Handler - {7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} - C:\Windows\SysWOW64\webcheck.dll
WebCheckWebCrawler - {08165EA0-E946-11CF-9C87-00AA005127ED} - C:\Windows\SysWOW64\webcheck.dll
Windows Live Photo Gallery Autoplay Drop Target - {2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} -
Windows Live Photo Gallery Autoplay Drop Target Shim - {00F30F90-3E96-453B-AFCD-D71989ECC2C7} - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
Windows Live Photo Gallery Editor Drop Target - {00F374B7-B390-4884-B372-2FC349F2172B} -
Windows Live Photo Gallery Editor Drop Target Shim - {00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
Windows Live Photo Gallery Viewer Drop Target - {00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} -
Windows Live Photo Gallery Viewer Drop Target Shim - {00F346CB-35A4-465B-8B8F-65A29DBAB1F6} - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
WLMD Message Handler - {0563DB41-F538-4B37-A92D-4659049B7766} -
--------------------
Registry 'Run' keys:
[User Run]
DW6 = "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe"
[System Run]
Adobe ARM = "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
APSDaemon = "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
BCSSync = "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
CanonSolutionMenuEx = C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
IAStorIcon = C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
IJNetworkScannerSelectorEX = C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE
iTunesHelper = "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
LifeCam = "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
NUSB3MON = "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
QuickTime Task = "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
SMessaging = C:\Program Files (x86)\SOS Online Backup\SMessaging.exe
SOSUAUI = "C:\Program Files (x86)\SOS Online Backup\sosuploadagent.exe" -showui
SunJavaUpdateSched = "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
TkBellExe = "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
UpdateP2GShortCut = "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
UpdatePRCShortCut = "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
VeriFaceManager = C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
vProt = "C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe"
YouCam Mirage = "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
YouCam Tray = "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s
--------------------
Protocols:
[Pluggable MIME filters (4)]
application/octet-stream = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} = mscoree.dll
application/x-complus = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} = mscoree.dll
application/x-msdownload = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} = mscoree.dll
text/xml = {807573E5-5146-11D5-A672-00B0D022E945} = C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
[Protocol handlers (23)]
about = {3050F406-98B5-11CF-BB82-00AA00BDCE0B} = C:\Windows\SysWOW64\mshtml.dll
cdl = {3dd53d40-7b8b-11D0-b013-00aa0059ce02} = C:\Windows\SysWOW64\urlmon.dll
dvd = {12D51199-0DB5-46FE-A120-47A3D7D937CC} = C:\Windows\SysWOW64\msvidctl.dll
file = {79eac9e7-baf9-11ce-8c82-00aa004ba90b} = C:\Windows\SysWOW64\urlmon.dll
ftp = {79eac9e3-baf9-11ce-8c82-00aa004ba90b} = C:\Windows\SysWOW64\urlmon.dll
http = {79eac9e2-baf9-11ce-8c82-00aa004ba90b} = C:\Windows\SysWOW64\urlmon.dll
https = {79eac9e5-baf9-11ce-8c82-00aa004ba90b} = C:\Windows\SysWOW64\urlmon.dll
its = {9D148291-B9C8-11D0-A4CC-0000F80149F6} = C:\windows\System32\itss.dll
javascript = {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} = C:\Windows\SysWOW64\mshtml.dll
livecall = {828030A1-22C1-4009-854F-8E305202313F} = C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll
local = {79eac9e7-baf9-11ce-8c82-00aa004ba90b} = C:\Windows\SysWOW64\urlmon.dll
mailto = {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} = C:\Windows\SysWOW64\mshtml.dll
mhtml = {05300401-BCBC-11d0-85E3-00C04FD85AB4} = C:\windows\system32\inetcomm.dll
mk = {79eac9e6-baf9-11ce-8c82-00aa004ba90b} = C:\Windows\SysWOW64\urlmon.dll
ms-help = {314111c7-a502-11d2-bbca-00c04f8ec294} = C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll
ms-its = {9D148291-B9C8-11D0-A4CC-0000F80149F6} = C:\windows\System32\itss.dll
msnim = {828030A1-22C1-4009-854F-8E305202313F} = C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll
res = {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} = C:\Windows\SysWOW64\mshtml.dll
tv = {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} = C:\Windows\SysWOW64\msvidctl.dll
vbscript = {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} = C:\Windows\SysWOW64\mshtml.dll
viprotocol = {B658800C-F66E-4EF3-AB85-6C0C227862A9} = C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.3.0\ViProtocol.dll
wlmailhtml = {03C514A3-1EFB-4856-9F99-10D7BE1653C0} = C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
wlpg = {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} = C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
--------------------
WOW compatibility:
[KnownDlls (32-bit) (28)]
advapi32.dll
clbcatq.dll
COMDLG32.dll
difxapi.dll
gdi32.dll
IERTUTIL.dll
IMAGEHLP.dll
IMM32.dll
kernel32.dll
LPK.dll
MSCTF.dll
MSVCRT.dll
NORMALIZ.dll
NSI.dll
ole32.dll
OLEAUT32.dll
PSAPI.DLL
rpcrt4.dll
sechost.dll
Setupapi.dll
SHELL32.dll
SHLWAPI.dll
URLMON.dll
user32.dll
USP10.dll
WININET.dll
WLDAP32.dll
WS2_32.dll
--------------------
Winsock LSP:
[Protocols (9)]
MSAFD Tcpip [TCP/IP] - {E70F1AA0-AB8B-11CF-8CA3-00805F48A192} - C:\windows\system32\mswsock.dll
MSAFD Tcpip [UDP/IP] - {E70F1AA0-AB8B-11CF-8CA3-00805F48A192} - C:\windows\system32\mswsock.dll
MSAFD Tcpip [TCP/IPv6] - {F9EAB0C0-26D4-11D0-BBBF-00AA006C34E4} - C:\windows\system32\mswsock.dll
MSAFD Tcpip [UDP/IPv6] - {F9EAB0C0-26D4-11D0-BBBF-00AA006C34E4} - C:\windows\system32\mswsock.dll
RSVP TCPv6 Service Provider - {9D60A9E0-337A-11D0-BD88-0000C082E69A} - C:\windows\system32\mswsock.dll
RSVP TCP Service Provider - {9D60A9E0-337A-11D0-BD88-0000C082E69A} - C:\windows\system32\mswsock.dll
RSVP UDPv6 Service Provider - {9D60A9E0-337A-11D0-BD88-0000C082E69A} - C:\windows\system32\mswsock.dll
RSVP UDP Service Provider - {9D60A9E0-337A-11D0-BD88-0000C082E69A} - C:\windows\system32\mswsock.dll
MSAFD RfComm [Bluetooth] - {9FC48064-7298-43E4-B7BD-181F2089792A} - C:\windows\system32\mswsock.dll
[Namespace Providers (10)]
Network Location Awareness Legacy (NLAv1) Namespace - {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83} -
E-mail Naming Shim Provider - {964ACBA2-B2BC-40EB-8C6A-A6DB40161CAE} -
PNRP Cloud Namespace Provider - {03FE89CE-766D-4976-B9C1-BB9BC42C7B4D} -
PNRP Name Namespace Provider - {03FE89CD-766D-4976-B9C1-BB9BC42C7B4D} -
Tcpip - {22059D40-7E9E-11CF-AE5A-00AA00A7112B} -
NTDS - {3B2637EE-E580-11CF-A555-00C04FD8D4AC} - C:\windows\System32\winrnr.dll
Bluetooth Namespace - {06AA63E0-7D60-41FF-AFB2-3EE6D2D9392D} - C:\windows\system32\wshbth.dll
mdnsNSP - {B600E6E9-553B-4A19-8696-335E5C896153} - C:\Program Files (x86)\Bonjour\mdnsNSP.dll
WindowsLive NSP - {4177DDE9-6028-479E-B7B7-03591A63FF3A} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
WindowsLive Local NSP - {229F2A2C-5F18-4A06-8F89-3A372170624D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
--------------------
Hijack points:
[Reset web settings URLs]
SearchAssistant =
CustomizeSearch =
START_PAGE_URL =
SEARCH_PAGE_URL =
MS_START_PAGE_URL =
[Internet Explorer URLs]
* This user *
- Internet Explorer\Main (4)
Default_Page_Url = Google
Local Page = C:\windows\system32\blank.htm
Search Page = Bing
Start Page = Laptops, Notebooks & Netbooks - Laptops For Those Who Do | Lenovo | US
* All users *
- Internet Explorer\Main (5)
Default_Page_Url = MSN.com
Default_Search_Url = Bing
Local Page = C:\Windows\SysWOW64\blank.htm
Search Page = Bing
Start Page = MSN.com
- Internet Explorer\AboutURLs (5)
blank = res://mshtml.dll/blank.htm
DesktopItemNavigationFailure = res://ieframe.dll/navcancl.htm
NavigationCanceled = res://ieframe.dll/navcancl.htm
NavigationFailure = res://ieframe.dll/navcancl.htm
PostNotCached = res://ieframe.dll/repost.htm
[Default URL prefixes]
default = http://
ftp = ftp://
home = http://
mosaic = http://
www = http://