# Virus



## sweetrose (Sep 7, 2012)

for Eddie


----------



## sweetrose (Sep 7, 2012)

hope this is ok.


----------



## Cookiegal (Aug 27, 2003)

What is this about? I don't see any thread where you're working with Eddie or anyone else.


----------



## sweetrose (Sep 7, 2012)

im waithing for Eddie to get back to me on it,,,


----------



## Cookiegal (Aug 27, 2003)

Where? You don't seem to have a thread here like I said.


----------



## sweetrose (Sep 7, 2012)

do i need one


----------



## Cookiegal (Aug 27, 2003)

Of course you need to have a thread if you want assistance with something. All you've posted here is "virus for Eddie". I don't even know what that's supposed to mean.

If you need help to remove a virus then post the logs requested in the sticky post at the top of this forum and wait for someone to assist you.


----------



## sweetrose (Sep 7, 2012)

ok thanks


----------



## eddie5659 (Mar 19, 2001)

She emailed me, I worked on a thread for her a few months back 

Hi Ann

Is this the same computer as before? If so, as its been a while, can you post these for me. You'll have to get them again, as we removed the others before 

Download *Security Check* from *here*.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called *checkup.txt*; please post the contents of that document.

-----

Download *OTL* to your Desktop


Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath *Output* at the top change it to *Standard Output*.
Select 
*All Users*
*LOP Check*
*Purity Check*
Under the *Standard Registry* box change it to *All*

Please copy the text in the code box below and paste it in the *Custom Scans/Fixes* box in OTL:


```
netsvcs
activex
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%windir%\Installer\*.*
%windir%\system32\tasks\*.*
%windir%\system32\tasks\*.* /64
%systemroot%\Fonts\*.exe
%systemroot%\*. /mp /s
/md5start
consrv.dll
explorer.exe
winlogon.exe
regedit.exe
Userinit.exe
svchost.exe
services.exe
user32.dll
ATAPI.SYS
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
%Temp%\smtmp\* \s
%Temp%\smtmp\1\*.*
%Temp%\smtmp\2\*.*
%Temp%\smtmp\3\*.*
%Temp%\smtmp\4\*.*
dir "%systemdrive%\*" /S /A:L /C
CREATERESTOREPOINT
```

Click the *Run Scan* button. Do not change any settings unless otherwise told to do so. The scan wont take long.
A black box will appear, this is part of the custom scan, so don't be alarmed 
*IF OTL SAYS 'NOT RESPONDING' DON'T USE THE MOUSE. IT WILL CARRY ON SCANNING AFTER A FEW MINUTES*

When the scan completes, it will open two notepad windows. *OTL.Txt* and *Extras.Txt*. These are saved in the same location as OTL.

Please copy *(Edit->Select All, Edit->Copy)* the contents of these files, one at a time and post them in your topic


eddie


----------



## sweetrose (Sep 7, 2012)

glad you got here eddie,,,thanks,will do it now


----------



## Cookiegal (Aug 27, 2003)

There are no threads Eddie. Perhaps on another site?

Anyway, it doesn't matter now.


----------



## eddie5659 (Mar 19, 2001)

Its okay Cookie, about to explain in a second 

Ann, as you now have two user names:

frincis and emjo

You'll have to either use just the one and lose the replies, or a better suggestion would be to merge them to the one name.

As you're now logged in as frincis, would you prefer to have that one?

eddie


----------



## sweetrose (Sep 7, 2012)

will stay as frincis on here eddie,,sorry about all the mesing about,


----------



## eddie5659 (Mar 19, 2001)

No problem, I'll see about the merge. Just carry on as normal, may take a bit of time


----------



## sweetrose (Sep 7, 2012)

thanks Edie


----------



## eddie5659 (Mar 19, 2001)

No problem 

Remember, Friday night's I won't be online, but most other nights I will be


----------



## sweetrose (Sep 7, 2012)

DID YOU want me to post you the one from chexup,text on here


----------



## sweetrose (Sep 7, 2012)

i remember that


----------



## eddie5659 (Mar 19, 2001)

Yep, if you post the Security Check log here, that would be great 

Also, you say you think you have a virus. Can you tell me what you're experiencing, as this will also help


----------



## sweetrose (Sep 7, 2012)

my net gets slow.and it keeps comeing up dead jim


----------



## sweetrose (Sep 7, 2012)

Results of screen317's Security Check version 0.99.64 
Windows 7 Service Pack 1 x64 (UAC is enabled) 
Internet Explorer 10 
*``````````````Antivirus/Firewall Check:``````````````* 
Windows Firewall Enabled! 
AVG AntiVirus Free Edition 2013 
Antivirus up to date! 
*`````````Anti-malware/Other Utilities Check:`````````* 
Java 7 Update 17 
*Java version out of Date!* 
Google Chrome 27.0.1453.110 
Google Chrome 27.0.1453.94 
Google Chrome Plugins... 
*````````Process Check: objlist.exe by Laurent````````* 
AVG avgwdsvc.exe 
*`````````````````System Health check`````````````````* 
Total Fragmentation on Drive C: 8% 
*````````````````````End of Log``````````````````````*


----------



## eddie5659 (Mar 19, 2001)

Oki doki, that could be malware related for the slowness, so lets see what we have 

Ah, looks like your Java is out of date. Are you running the OTL program at the moment? If you are, let me know, and I'll reply afterwards. If not, I'll post my update now. Will wait for the reply


----------



## sweetrose (Sep 7, 2012)

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ann\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.87 Gb Total Physical Memory | 0.49 Gb Available Physical Memory | 25.97% Memory free
3.74 Gb Paging File | 1.80 Gb Available in Paging File | 48.10% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 79.76 Gb Free Space | 68.49% Space Free | Partition Type: NTFS
Drive D: | 116.05 Gb Total Space | 0.35 Gb Free Space | 0.31% Space Free | Partition Type: NTFS

Computer Name: ANN-TOSH | User Name: ann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/12 19:54:24 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ann\Downloads\OTL.exe
PRC - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
PRC - [2013/04/29 00:58:42 | 004,408,368 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
PRC - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
PRC - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/12/21 12:09:14 | 000,894,920 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe
PRC - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
PRC - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2010/06/03 17:09:00 | 000,304,560 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- c:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2009/07/28 21:26:42 | 000,062,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
PRC - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

========== Modules (No Company Name) ==========

MOD - [2013/05/29 06:27:38 | 000,393,168 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppgooglenaclpluginchrome.dll
MOD - [2013/05/29 06:27:37 | 013,136,336 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll
MOD - [2013/05/29 06:27:35 | 004,051,408 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll
MOD - [2013/05/29 06:26:40 | 000,599,504 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\libglesv2.dll
MOD - [2013/05/29 06:26:39 | 000,124,368 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\libegl.dll
MOD - [2013/05/29 06:26:36 | 001,597,392 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\ffmpegsumo.dll
MOD - [2012/05/25 05:25:00 | 000,921,600 | ---- | M] () -- C:\Program Files (x86)\Yahoo!\Messenger\yui.dll

========== Services (SafeList) ==========

SRV:*64bit:* - [2010/09/28 13:30:28 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:*64bit:* - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:*64bit:* - [2010/02/05 18:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:*64bit:* - [2009/07/28 15:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:*64bit:* - [2009/07/14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/12/21 12:09:14 | 000,894,920 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe -- (vToolbarUpdater13.3.2)
SRV - [2012/12/06 19:40:43 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2010/05/11 09:40:52 | 000,124,368 | ---- | M] (Toshiba Europe GmbH) [Auto | Running] -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe -- (TemproMonitoringService)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- c:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/28 17:44:40 | 000,249,200 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)
SRV - [2009/10/06 10:21:50 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)

========== Driver Services (SafeList) ==========

DRV:*64bit:* - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV:*64bit:* - [2013/03/29 02:53:48 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:*64bit:* - [2013/03/21 03:08:24 | 000,240,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:*64bit:* - [2013/02/08 05:37:56 | 000,116,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:*64bit:* - [2013/02/08 05:37:54 | 000,311,096 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
DRV:*64bit:* - [2013/02/08 05:37:50 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:*64bit:* - [2013/02/08 05:37:42 | 000,206,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:*64bit:* - [2013/02/08 05:37:40 | 000,045,880 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:*64bit:* - [2012/12/21 12:09:14 | 000,030,568 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)
DRV:*64bit:* - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:*64bit:* - [2012/03/01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:*64bit:* - [2011/10/01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:*64bit:* - [2011/10/01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:*64bit:* - [2010/11/20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:*64bit:* - [2010/11/20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:*64bit:* - [2010/09/24 16:11:18 | 000,349,800 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,235,520 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbwwan.sys -- (ZTEusbwwan)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zteusbvoice.sys -- (ZTEusbvoice)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,011,776 | ---- | M] (MBB Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter)
DRV:*64bit:* - [2010/05/20 14:40:28 | 000,075,776 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vodafone_K380x-z_dc_enum.sys -- (vodafone_K380x-z_dc_enum)
DRV:*64bit:* - [2010/04/28 12:32:20 | 000,932,384 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)
DRV:*64bit:* - [2010/03/22 11:55:20 | 000,046,192 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)
DRV:*64bit:* - [2010/03/10 19:51:32 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:*64bit:* - [2010/02/21 01:24:36 | 010,300,800 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:*64bit:* - [2010/01/07 10:05:46 | 000,232,992 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:*64bit:* - [2009/07/30 20:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:*64bit:* - [2009/07/14 16:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:*64bit:* - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:*64bit:* - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:*64bit:* - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:*64bit:* - [2009/06/22 18:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:*64bit:* - [2009/06/20 03:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:*64bit:* - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:*64bit:* - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:*64bit:* - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:*64bit:* - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:*64bit:* - [2009/06/04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&...AtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE:*64bit:* - HKLM\..\SearchScopes,DefaultScope = {56369BA8-0140-7F16-6997-7A636D1E1A62}
IE:*64bit:* - HKLM\..\SearchScopes\{56369BA8-0140-7F16-6997-7A636D1E1A62}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE:*64bit:* - HKLM\..\SearchScopes\{ABA5AE01-9B23-4AC7-9BA7-E0345C1287FB}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&...AtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKLM\..\SearchScopes,DefaultScope = {24345616-2C3A-A6E8-D18D-6EBD213B3971}
IE - HKLM\..\SearchScopes\{24345616-2C3A-A6E8-D18D-6EBD213B3971}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKLM\..\SearchScopes\{A25208D0-8D9E-4B0D-B6DE-CCB82D68D3C2}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&...AtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {8E145907-CFA8-49D4-98B8-A9C1C7C85C30}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www.delta-search.com/?q={searchTerms}&affID=119556&babsrc=SP_ss&mntrId=663388252CBA0AA8
IE - HKCU\..\SearchScopes\{400E7EA1-093B-4D0E-90AC-CAAEF713611E}: "URL" = http://rover.ebay.com/rover/1/710-44557-9400-9/4?satitle={searchTerms}
IE - HKCU\..\SearchScopes\{56369BA8-0140-7F16-6997-7A636D1E1A62}: "URL" = http://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=021113&q={searchTerms}&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{8E145907-CFA8-49D4-98B8-A9C1C7C85C30}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKCU\..\SearchScopes\{CFA8133F-6AFA-4D5A-8C2B-E6E9626D8E06}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U4&apn_dtid=OSJ000YYUK&apn_uid=11562A4A-C609-471F-8C27-4F32C225FE77&apn_sauid=9084271E-6BF3-4FBA-AE9C-4484D76A606E
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=mkg028
IE - HKCU\..\SearchScopes\{E0F1151B-5874-4D8B-8E18-506FA493AB23}: "URL" = http://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

[2012/11/03 15:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Mysearchdial (Enabled)
CHR - default_search_provider: search_url = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.delta-search.com/?affID=119556&babsrc=HP_ss&mntrId=663388252CBA0AA8
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll
CHR - plugin: king.com - Game controller for firefox (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\plugins\npmidas.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U17 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: McAfee Security Scanner + (Enabled) = C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll
CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Java Deployment Toolkit 7.0.170.2 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: New Tab = C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.2_0\

O1 HOSTS File: ([2013/03/07 19:09:17 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:*64bit:* - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {DCC39ACE-709B-44EA-B062-5F6BE2774644} - No CLSID value found.
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3:*64bit:* - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:*64bit:* - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3D15F113-3692-4089-B3A3-77DC82321FEB}: NameServer = 10.203.129.68 10.203.129.68
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8303406A-D415-481D-984A-0CB67A97EB51}: DhcpNameServer = 194.168.4.100 194.168.8.100
O18:*64bit:* - Protocol\Handler\skype4com - No CLSID value found
O18:*64bit:* - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:*64bit:* - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:*64bit:* - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/01/24 19:10:57 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:*64bit:* - HKLM\..comfile [open] -- "%1" %*
O35:*64bit:* - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:*64bit:* - HKLM\...com [@ = ComFile] -- "%1" %*
O37:*64bit:* - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/06/10 19:35:36 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2013/06/07 19:03:19 | 000,000,000 | ---D | C] -- C:\Users\ann\AppData\Roaming\mysearchdial
[2013/06/05 21:54:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Image Converter
[2013/06/05 20:47:35 | 000,000,000 | ---D | C] -- C:\Users\ann\AppData\Roaming\DSite
[2013/05/16 17:30:35 | 000,000,000 | R--D | C] -- C:\Users\ann\Saved Games
[2013/05/16 15:48:12 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013/05/16 15:48:11 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/05/16 15:48:10 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013/05/16 15:48:09 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013/05/16 15:48:09 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013/05/16 15:48:09 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/05/16 15:48:09 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/05/16 15:48:09 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013/05/16 15:48:09 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013/05/16 15:48:09 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013/05/16 15:48:09 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013/05/16 15:48:08 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013/05/16 15:48:06 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013/05/16 15:48:06 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013/05/16 15:48:05 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013/05/16 07:42:19 | 000,265,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys
[2013/05/16 07:42:19 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2013/05/16 07:41:52 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll
[2013/05/16 07:41:51 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll
[2013/05/16 07:41:50 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll
[2013/05/16 07:41:50 | 000,111,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe
[2013/05/16 07:40:57 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wwanprotdim.dll
[2013/05/15 15:59:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MyPC Backup
[2013/05/15 15:59:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer

========== Files - Modified Within 30 Days ==========

[2013/06/12 19:53:14 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/12 19:53:13 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/12 19:51:14 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/12 19:45:13 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001UA.job
[2013/06/12 19:44:07 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/12 19:43:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/06/12 19:43:32 | 1504,354,304 | -HS- | M] () -- C:\hiberfil.sys
[2013/06/12 18:18:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/06/12 07:45:01 | 000,000,848 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001Core.job
[2013/06/07 19:03:42 | 000,000,397 | ---- | M] () -- C:\Users\Public\Desktop\MySearchDial.url
[2013/06/07 19:03:42 | 000,000,387 | ---- | M] () -- C:\Users\Public\Desktop\Online Games.url
[2013/06/07 19:03:18 | 000,423,709 | ---- | M] () -- C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx
[2013/06/06 20:50:18 | 000,002,366 | ---- | M] () -- C:\Users\ann\Desktop\Google Chrome.lnk
[2013/05/26 09:16:06 | 000,002,968 | ---- | M] () -- C:\Windows\SysWow64\userawacs.cfg
[2013/05/26 09:16:00 | 000,000,110 | ---- | M] () -- C:\Windows\SysWow64\usergui.cfg
[2013/05/26 09:15:30 | 000,000,851 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2013/05/16 17:28:23 | 000,275,712 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/05/16 15:51:30 | 000,733,400 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/05/16 15:51:30 | 000,616,694 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/05/16 15:51:30 | 000,106,816 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

========== Files Created - No Company Name ==========

[2013/06/07 19:03:56 | 000,423,709 | ---- | C] () -- C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx
[2013/06/07 19:03:42 | 000,000,397 | ---- | C] () -- C:\Users\Public\Desktop\MySearchDial.url
[2013/06/07 19:03:42 | 000,000,387 | ---- | C] () -- C:\Users\Public\Desktop\Online Games.url
[2013/06/02 08:00:20 | 004,989,512 | ---- | C] () -- C:\Users\ann\Documents\043.JPG
[2013/01/22 21:20:46 | 000,735,726 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/11/03 21:45:18 | 000,000,000 | ---- | C] () -- C:\Windows\ToDisc.INI
[2012/09/02 13:24:38 | 000,027,520 | ---- | C] () -- C:\Users\ann\AppData\Local\dt.dat
[2011/08/31 08:34:31 | 000,001,072 | ---- | C] () -- C:\Users\ann\Pictures - Shortcut.lnk
[2011/07/21 20:34:13 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{931E4FAA-EDCB-4C4C-9A5F-F55CE7BD62A6}
[2B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D6A0DD73-6EF2-9A8D-6F60-4F338F922B37}" = BBC iPlayer Desktop
"{D7B31233-EE2B-4911-AA3F-2A8C28843D3B}" = SkyPlayer for Windows Media Center
"{DBB7021A-3437-446F-ACE5-7261644A972C}" = Toshiba TEMPRO
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0FAA369-B0E3-48B8-9447-4873103B0012}" = TOSHIBA ConfigFree
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}" = TOSHIBA Media Controller Plug-in
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FDE58148-57E7-43BF-879A-29CCE818C078}" = eBay
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1" = BBC iPlayer Desktop
"InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"InstallShield_{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}" = TOSHIBA ReelTime
"InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TOSHIBA Recovery Media Creator Reminder
"InstallShield_{C14518AF-1A0F-4D39-8011-69BAA01CD380}" = TOSHIBA Bulletin Board
"InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORMCLauncher
"InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
"king.com" = king.com (remove only)
"mefeediatest" = MeFeedia
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"WinLiveSuite" = Windows Live Essentials
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Search Defender" = Yahoo! Search Protection

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 6/12/2013 10:05:40 AM | Computer Name = ann-TOSH | Source = MsiInstaller | ID = 10005
Description =

Error - 6/12/2013 10:06:21 AM | Computer Name = ann-TOSH | Source = Application Error | ID = 1000
Description = Faulting application name: avgmfapx.exe, version: 13.0.0.3345, time
stamp: 0x51adece0 Faulting module name: avgmfapx.exe, version: 13.0.0.3345, time
stamp: 0x51adece0 Exception code: 0xc0000005 Fault offset: 0x0033b3b7 Faulting process
id: 0xc78 Faulting application start time: 0x01ce677516387f4c Faulting application
path: C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe Faulting module path: C:\Program
Files (x86)\AVG\AVG2013\avgmfapx.exe Report Id: 41c427ab-d369-11e2-9f46-1c750875a867

Error - 6/12/2013 12:17:14 PM | Computer Name = ann-TOSH | Source = VmbService | ID = 0
Description = conflictManagerTypeValue

Error - 6/12/2013 12:17:15 PM | Computer Name = ann-TOSH | Source = VmbService | ID = 0
Description = userProfileData

Error - 6/12/2013 12:17:19 PM | Computer Name = ann-TOSH | Source = CVHSVC | ID = 100
Description = Information only. Error: Cannot connect to SoftGrid Service Type: 95::SoftGridConfigurationFailure.

Error - 6/12/2013 2:43:58 PM | Computer Name = ann-TOSH | Source = VmbService | ID = 0
Description = conflictManagerTypeValue

Error - 6/12/2013 2:43:58 PM | Computer Name = ann-TOSH | Source = VmbService | ID = 0
Description = userProfileData

Error - 6/12/2013 2:43:59 PM | Computer Name = ann-TOSH | Source = CVHSVC | ID = 100
Description = Information only. Error: Cannot connect to SoftGrid Service Type: 95::SoftGridConfigurationFailure.

Error - 6/12/2013 2:51:51 PM | Computer Name = ann-TOSH | Source = MsiInstaller | ID = 10005
Description =

Error - 6/12/2013 2:52:27 PM | Computer Name = ann-TOSH | Source = Application Error | ID = 1000
Description = Faulting application name: avgmfapx.exe, version: 13.0.0.3345, time
stamp: 0x51adece0 Faulting module name: avgmfapx.exe, version: 13.0.0.3345, time
stamp: 0x51adece0 Exception code: 0xc0000005 Fault offset: 0x0033b3b7 Faulting process
id: 0x274 Faulting application start time: 0x01ce679d7e101364 Faulting application
path: C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe Faulting module path: C:\Program
Files (x86)\AVG\AVG2013\avgmfapx.exe Report Id: 39c47cd9-d391-11e2-bef7-1c750875a867

[ Media Center Events ]
Error - 3/23/2013 8:21:47 AM | Computer Name = ann-TOSH | Source = MCUpdate | ID = 0
Description = 12:21:47 - Error connecting to the internet. 12:21:47 - Unable 
to contact server..

[ System Events ]
Error - 6/12/2013 2:33:16 AM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/12/2013 2:34:45 AM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7022
Description = The Client Virtualization Handler service hung on starting.

Error - 6/12/2013 3:18:16 AM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/12/2013 9:54:36 AM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/12/2013 9:56:07 AM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7022
Description = The Client Virtualization Handler service hung on starting.

Error - 6/12/2013 10:44:25 AM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/12/2013 12:18:41 PM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7022
Description = The Client Virtualization Handler service hung on starting.

Error - 6/12/2013 1:32:18 PM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/12/2013 2:43:51 PM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/12/2013 2:45:21 PM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7022
Description = The Client Virtualization Handler service hung on starting.

< End of report >


----------



## eddie5659 (Mar 19, 2001)

Hi Ann

Just got half way thru the log and it looks like you've copied half of one and half of the other log by mistake.

Can you repost both of them, as there is a lot of data missing. I've seen some stuff that needs removing, but the full pictuure will help 

They should be in the *C:\Users\ann\Downloads* folder, called *OTL.Txt* and *Extras.Txt*


----------



## sweetrose (Sep 7, 2012)

ok and sorry


----------



## sweetrose (Sep 7, 2012)

TL Extras logfile created on: 6/12/2013 8:07:24 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ann\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.87 Gb Total Physical Memory | 0.49 Gb Available Physical Memory | 25.97% Memory free
3.74 Gb Paging File | 1.80 Gb Available in Paging File | 48.10% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 79.76 Gb Free Space | 68.49% Space Free | Partition Type: NTFS
Drive D: | 116.05 Gb Total Space | 0.35 Gb Free Space | 0.31% Space Free | Partition Type: NTFS

Computer Name: ANN-TOSH | User Name: ann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

========== Shell Spawning ==========

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

========== Security Center Settings ==========

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1412BE22-E1A9-4D70-8F7E-BEB85A1FE5D4}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{21B39B7C-EC7C-4C51-A06E-896E2935D40B}" = rport=445 | protocol=6 | dir=out | app=system | 
"{29C3F8C3-9757-4BFF-B324-CEEB9ED7C1DD}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{30B0BFCF-3F21-40B0-AA26-2E5896A958E5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{33792BBA-C9D4-4D6F-842E-25F05F3A9F0F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{34C727E6-9892-4574-AD93-D7B8134DA417}" = lport=445 | protocol=6 | dir=in | app=system | 
"{38B5FB50-EB6B-44DC-9E00-0384780A4325}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{46F9721C-178C-4DCC-96CF-5E18772135CB}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{5082C9BC-FAEA-4EBD-BA22-97E178834F96}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{54B8C867-6E2A-487D-97B0-6C77478FA7BE}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 | 
"{6EF28F76-D038-48F9-96C5-D433491C4AF2}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{78F08269-0EFD-4F18-ADCE-2E3D26774690}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{8D8FB2ED-D3BF-45E5-A75F-BFFB19B0B464}" = rport=138 | protocol=17 | dir=out | app=system | 
"{975099ED-4C57-4AE2-B937-56FA064F72F3}" = rport=137 | protocol=17 | dir=out | app=system | 
"{B0A5DD16-037D-48B7-AE76-CA26424E4342}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{B444328F-CE2B-4D05-8CCC-96322272B652}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{B7356F99-CCBA-4E8F-A81A-A9713EA4C2FF}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{C0BA9C19-CD83-40AA-93D2-F75EB64E68F8}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{CCEDB825-B97E-44C9-8A4E-1AF9BFDDAF07}" = rport=139 | protocol=6 | dir=out | app=system | 
"{DF936C66-0894-4846-9114-7A61677E56D5}" = lport=138 | protocol=17 | dir=in | app=system | 
"{E4B53DBE-C6DF-4515-AFA3-043984C3E021}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{EC41A175-7796-4DFA-94B4-297D9F87094A}" = lport=139 | protocol=6 | dir=in | app=system | 
"{F513725B-CD53-4D8E-909D-F1BEF2CEAD59}" = lport=137 | protocol=17 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08A22D04-17CE-4A7A-BCF1-FDFB348480D0}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe | 
"{0DE0975C-5416-404F-A842-4A065DD2D901}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{128B173F-FA18-4B73-A789-848A7257C2B0}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{12D09296-4B2E-47C6-B41A-81CD1CCFD17E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{1D452E3F-A193-4772-AFF1-8DB6973F1A05}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | 
"{29BF7CC7-0008-4E54-8CA8-3A20EBD573AB}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe | 
"{3ED5BAF3-2695-4DA7-94E4-DD727033025A}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe | 
"{43A895AD-489E-4446-969A-5510ADB0A54C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{51F9A07A-9881-45A0-A3A8-E9033DCC5419}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{68120DFB-60FC-49A3-89F5-423573878A45}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6D5ADA39-5C3A-4015-A4FC-9A2114585A98}" = protocol=1 | dir=in | [email protected],-28543 | 
"{734A3211-F0CE-4342-A417-47C663E9CF5C}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{75874067-8379-47AB-89E1-E892D6E2DCD5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{7B411E3F-AA61-48EA-9F55-41CB30258FA8}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{7F372D1F-1334-4F5F-B9C6-DFD35E969B1B}" = protocol=6 | dir=out | app=system | 
"{82C2DCEF-E2B9-4F2B-B8AA-CDB5A2386881}" = protocol=6 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe | 
"{84D7CD5D-6398-45FF-9CA2-D96D424A19E8}" = protocol=1 | dir=out | [email protected],-28544 | 
"{866CD8E1-1C55-45DB-819E-74A6AFFD33B1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{88687B91-A55E-40F2-B094-777CE0B418C2}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe | 
"{899F55BB-BEB1-4E2D-ABD1-11A10640EEF6}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{8C08978B-0B9A-4762-8C65-3368E7CC6AB6}" = protocol=6 | dir=in | app=c:\program files (x86)\veetle\player\veetlenet.exe | 
"{9DA46FA7-CB5E-4D75-A554-7940F1378723}" = protocol=58 | dir=in | [email protected],-28545 | 
"{A4A77545-33F8-4203-B550-D0C1816603CB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{AC202B83-0ED5-4344-87D3-86ACC9C51F98}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{BCA06683-48A8-4703-9782-5AB9F5123392}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{D2E58FDF-3995-45A9-B4B6-7167F2EB5A05}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E835A3FB-BB37-4D6A-8F4A-15CEF74B330C}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{EB514913-C1D4-4B65-B28A-58186C498630}" = protocol=58 | dir=out | [email protected],-28546 | 
"{F4FD7919-F3AE-4C14-9466-D94F1FD243C4}" = protocol=17 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe | 
"{FB134EBA-E271-49E4-98C2-59534D0361B7}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"TCP Query User{2C014738-CF28-4716-AECB-4537428831E1}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe | 
"TCP Query User{A4A79F94-B537-4C4A-BA99-744CFD03BC4B}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe | 
"TCP Query User{FD348C6C-CDD3-4199-AF50-DA1BB0B2277A}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"UDP Query User{01B91CC4-112A-4323-915B-1E5D2E6F2C1C}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"UDP Query User{08DD9E07-785F-4CF1-BA32-D5D5354D6466}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe | 
"UDP Query User{7FE535F1-7014-4799-B09F-A110BF5F04EF}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{02A5BD31-16AC-45DF-BE9F-A3167BC4AFB2}" = Windows Live Family Safety
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{0D87AE67-14EB-4C10-88A5-DA6C3181EB18}" = Windows Live Family Safety
"{119EEB4B-F32F-4D71-B9C0-E42403F91C9A}" = AVG 2013
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{24811C12-F4A9-4D0F-8494-A7B8FE46123C}" = TOSHIBA ReelTime
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{90140000-006D-0409-1000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A9614BE8-EDB6-4151-81F0-DF2B9F4D8ABE}" = AVG 2013
"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Media Creator
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{C14518AF-1A0F-4D39-8011-69BAA01CD380}" = TOSHIBA Bulletin Board
"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORMCLauncher
"{EE936C"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
"AVG" = AVG 2013
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0FF68F26-416C-4954-ACA5-6AD5F9DE99C1}" = Nero Multimedia Suite 10 Essentials
"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"{14DC0059-00F1-4F62-BD1A-AB23CD51A95E}" = Adobe AIR
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5E6F6CF3-BACC-4144-868C-E14622C658F3}" = TOSHIBA Web Camera Application
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}" = Vodafone Mobile Broadband Lite
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TOSHIBA Recovery Media Creator Reminder
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}" = Toshiba Manuals
"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{983CD6FE-8320-4B80-A8F6-0D0366E0AA22}" = TOSHIBA Media Controller
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet TV for Windows Media Center
"{9D3D8C60-A55F-4fed-B2B9-173001290E16}" = Realtek WLAN Driver
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC6569FA-6919-442A-8552-073BE69E247A}" = TOSHIBA Service Station
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B95B1BA9-F887-4B3C-8D3A-CCD4C4675120}" = Microsoft Default Manager
"{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}" = TOSHIBA Assist
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D6A0DD73-6EF2-9A8D-6F60-4F338F922B37}" = BBC iPlayer Desktop
"{D7B31233-EE2B-4911-AA3F-2A8C28843D3B}" = SkyPlayer for Windows Media Center
"{DBB7021A-3437-446F-ACE5-7261644A972C}" = Toshiba TEMPRO
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0FAA369-B0E3-48B8-9447-4873103B0012}" = TOSHIBA ConfigFree
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}" = TOSHIBA Media Controller Plug-in
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FDE58148-57E7-43BF-879A-29CCE818C078}" = eBay
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1" = BBC iPlayer Desktop
"InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"InstallShield_{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}" = TOSHIBA ReelTime
"InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TOSHIBA Recovery Media Creator Reminder
"InstallShield_{C14518AF-1A0F-4D39-8011-69BAA01CD380}" = TOSHIBA Bulletin Board
"InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORMCLauncher
"InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
"king.com" = king.com (remove only)
"mefeediatest" = MeFeedia
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"WinLiveSuite" = Windows Live Essentials
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Search Defender" = Yahoo! Search Protection

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 6/12/2013 10:05:40 AM | Computer Name = ann-TOSH | Source = MsiInstaller | ID = 10005
Description =

Error - 6/12/2013 10:06:21 AM | Computer Name = ann-TOSH | Source = Application Error | ID = 1000
Description = Faulting application name: avgmfapx.exe, version: 13.0.0.3345, time
stamp: 0x51adece0 Faulting module name: avgmfapx.exe, version: 13.0.0.3345, time
stamp: 0x51adece0 Exception code: 0xc0000005 Fault offset: 0x0033b3b7 Faulting process
id: 0xc78 Faulting application start time: 0x01ce677516387f4c Faulting application
path: C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe Faulting module path: C:\Program
Files (x86)\AVG\AVG2013\avgmfapx.exe Report Id: 41c427ab-d369-11e2-9f46-1c750875a867

Error - 6/12/2013 12:17:14 PM | Computer Name = ann-TOSH | Source = VmbService | ID = 0
Description = conflictManagerTypeValue

Error - 6/12/2013 12:17:15 PM | Computer Name = ann-TOSH | Source = VmbService | ID = 0
Description = userProfileData

Error - 6/12/2013 12:17:19 PM | Computer Name = ann-TOSH | Source = CVHSVC | ID = 100
Description = Information only. Error: Cannot connect to SoftGrid Service Type: 95::SoftGridConfigurationFailure.

Error - 6/12/2013 2:43:58 PM | Computer Name = ann-TOSH | Source = VmbService | ID = 0
Description = conflictManagerTypeValue

Error - 6/12/2013 2:43:58 PM | Computer Name = ann-TOSH | Source = VmbService | ID = 0
Description = userProfileData

Error - 6/12/2013 2:43:59 PM | Computer Name = ann-TOSH | Source = CVHSVC | ID = 100
Description = Information only. Error: Cannot connect to SoftGrid Service Type: 95::SoftGridConfigurationFailure.

Error - 6/12/2013 2:51:51 PM | Computer Name = ann-TOSH | Source = MsiInstaller | ID = 10005
Description =

Error - 6/12/2013 2:52:27 PM | Computer Name = ann-TOSH | Source = Application Error | ID = 1000
Description = Faulting application name: avgmfapx.exe, version: 13.0.0.3345, time
stamp: 0x51adece0 Faulting module name: avgmfapx.exe, version: 13.0.0.3345, time
stamp: 0x51adece0 Exception code: 0xc0000005 Fault offset: 0x0033b3b7 Faulting process
id: 0x274 Faulting application start time: 0x01ce679d7e101364 Faulting application
path: C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe Faulting module path: C:\Program
Files (x86)\AVG\AVG2013\avgmfapx.exe Report Id: 39c47cd9-d391-11e2-bef7-1c750875a867

[ Media Center Events ]
Error - 3/23/2013 8:21:47 AM | Computer Name = ann-TOSH | Source = MCUpdate | ID = 0
Description = 12:21:47 - Error connecting to the internet. 12:21:47 - Unable 
to contact server..

[ System Events ]
Error - 6/12/2013 2:33:16 AM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/12/2013 2:34:45 AM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7022
Description = The Client Virtualization Handler service hung on starting.

Error - 6/12/2013 3:18:16 AM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/12/2013 9:54:36 AM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/12/2013 9:56:07 AM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7022
Description = The Client Virtualization Handler service hung on starting.

Error - 6/12/2013 10:44:25 AM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/12/2013 12:18:41 PM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7022
Description = The Client Virtualization Handler service hung on starting.

Error - 6/12/2013 1:32:18 PM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/12/2013 2:43:51 PM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/12/2013 2:45:21 PM | Computer Name = ann-TOSH | Source = Service Control Manager | ID = 7022
Description = The Client Virtualization Handler service hung on starting.

< End of report >


----------



## sweetrose (Sep 7, 2012)

hope you have it al now


----------



## eddie5659 (Mar 19, 2001)

That's the Extra.txt one, which is now complete 

Can you post the OTL.txt one as well


----------



## sweetrose (Sep 7, 2012)

will look for it


----------



## sweetrose (Sep 7, 2012)

OTL.txtTL logfile created on: 6/12/2013 8:07:24 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ann\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.87 Gb Total Physical Memory | 0.49 Gb Available Physical Memory | 25.97% Memory free
3.74 Gb Paging File | 1.80 Gb Available in Paging File | 48.10% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 79.76 Gb Free Space | 68.49% Space Free | Partition Type: NTFS
Drive D: | 116.05 Gb Total Space | 0.35 Gb Free Space | 0.31% Space Free | Partition Type: NTFS

Computer Name: ANN-TOSH | User Name: ann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/12 19:54:24 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ann\Downloads\OTL.exe
PRC - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
PRC - [2013/04/29 00:58:42 | 004,408,368 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
PRC - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
PRC - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/12/21 12:09:14 | 000,894,920 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe
PRC - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
PRC - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2010/06/03 17:09:00 | 000,304,560 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- c:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2009/07/28 21:26:42 | 000,062,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
PRC - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

========== Modules (No Company Name) ==========

MOD - [2013/05/29 06:27:38 | 000,393,168 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppgooglenaclpluginchrome.dll
MOD - [2013/05/29 06:27:37 | 013,136,336 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll
MOD - [2013/05/29 06:27:35 | 004,051,408 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll
MOD - [2013/05/29 06:26:40 | 000,599,504 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\libglesv2.dll
MOD - [2013/05/29 06:26:39 | 000,124,368 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\libegl.dll
MOD - [2013/05/29 06:26:36 | 001,597,392 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\ffmpegsumo.dll
MOD - [2012/05/25 05:25:00 | 000,921,600 | ---- | M] () -- C:\Program Files (x86)\Yahoo!\Messenger\yui.dll

========== Services (SafeList) ==========

SRV:*64bit:* - [2010/09/28 13:30:28 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:*64bit:* - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:*64bit:* - [2010/02/05 18:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:*64bit:* - [2009/07/28 15:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:*64bit:* - [2009/07/14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/12/21 12:09:14 | 000,894,920 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe -- (vToolbarUpdater13.3.2)
SRV - [2012/12/06 19:40:43 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2010/05/11 09:40:52 | 000,124,368 | ---- | M] (Toshiba Europe GmbH) [Auto | Running] -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe -- (TemproMonitoringService)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- c:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/28 17:44:40 | 000,249,200 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)
SRV - [2009/10/06 10:21:50 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)

========== Driver Services (SafeList) ==========

DRV:*64bit:* - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV:*64bit:* - [2013/03/29 02:53:48 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:*64bit:* - [2013/03/21 03:08:24 | 000,240,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:*64bit:* - [2013/02/08 05:37:56 | 000,116,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:*64bit:* - [2013/02/08 05:37:54 | 000,311,096 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
DRV:*64bit:* - [2013/02/08 05:37:50 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:*64bit:* - [2013/02/08 05:37:42 | 000,206,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:*64bit:* - [2013/02/08 05:37:40 | 000,045,880 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:*64bit:* - [2012/12/21 12:09:14 | 000,030,568 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)
DRV:*64bit:* - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:*64bit:* - [2012/03/01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:*64bit:* - [2011/10/01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:*64bit:* - [2011/10/01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:*64bit:* - [2010/11/20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:*64bit:* - [2010/11/20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:*64bit:* - [2010/09/24 16:11:18 | 000,349,800 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,235,520 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbwwan.sys -- (ZTEusbwwan)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zteusbvoice.sys -- (ZTEusbvoice)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,011,776 | ---- | M] (MBB Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter)
DRV:*64bit:* - [2010/05/20 14:40:28 | 000,075,776 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vodafone_K380x-z_dc_enum.sys -- (vodafone_K380x-z_dc_enum)
DRV:*64bit:* - [2010/04/28 12:32:20 | 000,932,384 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)
DRV:*64bit:* - [2010/03/22 11:55:20 | 000,046,192 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)
DRV:*64bit:* - [2010/03/10 19:51:32 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:*64bit:* - [2010/02/21 01:24:36 | 010,300,800 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:*64bit:* - [2010/01/07 10:05:46 | 000,232,992 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:*64bit:* - [2009/07/30 20:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:*64bit:* - [2009/07/14 16:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:*64bit:* - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:*64bit:* - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:*64bit:* - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:*64bit:* - [2009/06/22 18:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:*64bit:* - [2009/06/20 03:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:*64bit:* - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:*64bit:* - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:*64bit:* - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:*64bit:* - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:*64bit:* - [2009/06/04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&...AtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE:*64bit:* - HKLM\..\SearchScopes,DefaultScope = {56369BA8-0140-7F16-6997-7A636D1E1A62}
IE:*64bit:* - HKLM\..\SearchScopes\{56369BA8-0140-7F16-6997-7A636D1E1A62}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE:*64bit:* - HKLM\..\SearchScopes\{ABA5AE01-9B23-4AC7-9BA7-E0345C1287FB}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&...AtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKLM\..\SearchScopes,DefaultScope = {24345616-2C3A-A6E8-D18D-6EBD213B3971}
IE - HKLM\..\SearchScopes\{24345616-2C3A-A6E8-D18D-6EBD213B3971}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKLM\..\SearchScopes\{A25208D0-8D9E-4B0D-B6DE-CCB82D68D3C2}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&...AtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {8E145907-CFA8-49D4-98B8-A9C1C7C85C30}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www.delta-search.com/?q={searchTerms}&affID=119556&babsrc=SP_ss&mntrId=663388252CBA0AA8
IE - HKCU\..\SearchScopes\{400E7EA1-093B-4D0E-90AC-CAAEF713611E}: "URL" = http://rover.ebay.com/rover/1/710-44557-9400-9/4?satitle={searchTerms}
IE - HKCU\..\SearchScopes\{56369BA8-0140-7F16-6997-7A636D1E1A62}: "URL" = http://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=021113&q={searchTerms}&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{8E145907-CFA8-49D4-98B8-A9C1C7C85C30}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKCU\..\SearchScopes\{CFA8133F-6AFA-4D5A-8C2B-E6E9626D8E06}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U4&apn_dtid=OSJ000YYUK&apn_uid=11562A4A-C609-471F-8C27-4F32C225FE77&apn_sauid=9084271E-6BF3-4FBA-AE9C-4484D76A606E
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=mkg028
IE - HKCU\..\SearchScopes\{E0F1151B-5874-4D8B-8E18-506FA493AB23}: "URL" = http://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

[2012/11/03 15:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Mysearchdial (Enabled)
CHR - default_search_provider: search_url = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.delta-search.com/?affID=119556&babsrc=HP_ss&mntrId=663388252CBA0AA8
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll
CHR - plugin: king.com - Game controller for firefox (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\plugins\npmidas.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U17 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: McAfee Security Scanner + (Enabled) = C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll
CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Java Deployment Toolkit 7.0.170.2 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: New Tab = C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.2_0\

O1 HOSTS File: ([2013/03/07 19:09:17 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:*64bit:* - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {DCC39ACE-709B-44EA-B062-5F6BE2774644} - No CLSID value found.
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3:*64bit:* - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:*64bit:* - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3D15F113-3692-4089-B3A3-77DC82321FEB}: NameServer = 10.203.129.68 10.203.129.68
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8303406A-D415-481D-984A-0CB67A97EB51}: DhcpNameServer = 194.168.4.100 194.168.8.100
O18:*64bit:* - Protocol\Handler\skype4com - No CLSID value found
O18:*64bit:* - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:*64bit:* - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:*64bit:* - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/01/24 19:10:57 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:*64bit:* - HKLM\..comfile [open] -- "%1" %*
O35:*64bit:* - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:*64bit:* - HKLM\...com [@ = ComFile] -- "%1" %*
O37:*64bit:* - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/06/10 19:35:36 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2013/06/07 19:03:19 | 000,000,000 | ---D | C] -- C:\Users\ann\AppData\Roaming\mysearchdial
[2013/06/05 21:54:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Image Converter
[2013/06/05 20:47:35 | 000,000,000 | ---D | C] -- C:\Users\ann\AppData\Roaming\DSite
[2013/05/16 17:30:35 | 000,000,000 | R--D | C] -- C:\Users\ann\Saved Games
[2013/05/16 15:48:12 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013/05/16 15:48:11 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/05/16 15:48:10 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013/05/16 15:48:09 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013/05/16 15:48:09 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013/05/16 15:48:09 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/05/16 15:48:09 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/05/16 15:48:09 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013/05/16 15:48:09 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013/05/16 15:48:09 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013/05/16 15:48:09 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013/05/16 15:48:08 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013/05/16 15:48:06 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013/05/16 15:48:06 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013/05/16 15:48:05 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013/05/16 07:42:19 | 000,265,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys
[2013/05/16 07:42:19 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2013/05/16 07:41:52 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll
[2013/05/16 07:41:51 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll
[2013/05/16 07:41:50 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll
[2013/05/16 07:41:50 | 000,111,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe
[2013/05/16 07:40:57 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wwanprotdim.dll
[2013/05/15 15:59:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MyPC Backup
[2013/05/15 15:59:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer

========== Files - Modified Within 30 Days ==========

[2013/06/12 19:53:14 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/12 19:53:13 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/12 19:51:14 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/12 19:45:13 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001UA.job
[2013/06/12 19:44:07 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/12 19:43:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/06/12 19:43:32 | 1504,354,304 | -HS- | M] () -- C:\hiberfil.sys
[2013/06/12 18:18:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/06/12 07:45:01 | 000,000,848 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001Core.job
[2013/06/07 19:03:42 | 000,000,397 | ---- | M] () -- C:\Users\Public\Desktop\MySearchDial.url
[2013/06/07 19:03:42 | 000,000,387 | ---- | M] () -- C:\Users\Public\Desktop\Online Games.url
[2013/06/07 19:03:18 | 000,423,709 | ---- | M] () -- C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx
[2013/06/06 20:50:18 | 000,002,366 | ---- | M] () -- C:\Users\ann\Desktop\Google Chrome.lnk
[2013/05/26 09:16:06 | 000,002,968 | ---- | M] () -- C:\Windows\SysWow64\userawacs.cfg
[2013/05/26 09:16:00 | 000,000,110 | ---- | M] () -- C:\Windows\SysWow64\usergui.cfg
[2013/05/26 09:15:30 | 000,000,851 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2013/05/16 17:28:23 | 000,275,712 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/05/16 15:51:30 | 000,733,400 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/05/16 15:51:30 | 000,616,694 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/05/16 15:51:30 | 000,106,816 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

========== Files Created - No Company Name ==========

[2013/06/07 19:03:56 | 000,423,709 | ---- | C] () -- C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx
[2013/06/07 19:03:42 | 000,000,397 | ---- | C] () -- C:\Users\Public\Desktop\MySearchDial.url
[2013/06/07 19:03:42 | 000,000,387 | ---- | C] () -- C:\Users\Public\Desktop\Online Games.url
[2013/06/02 08:00:20 | 004,989,512 | ---- | C] () -- C:\Users\ann\Documents\043.JPG
[2013/01/22 21:20:46 | 000,735,726 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/11/03 21:45:18 | 000,000,000 | ---- | C] () -- C:\Windows\ToDisc.INI
[2012/09/02 13:24:38 | 000,027,520 | ---- | C] () -- C:\Users\ann\AppData\Local\dt.dat
[2011/08/31 08:34:31 | 000,001,072 | ---- | C] () -- C:\Users\ann\Pictures - Shortcut.lnk
[2011/07/21 20:34:13 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{931E4FAA-EDCB-4C4C-9A5F-F55CE7BD62A6}
[2011/07/21 20:05:23 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{8532B172-6F57-4CBE-8E80-FAD83C06C6D3}
[2011/07/15 15:48:15 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{796EF731-ABE6-49A6-8D8F-75DAAE534B52}
[2011/07/15 15:28:59 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0B3B4E74-A96D-457B-A3AC-15AF58ED515A}
[2011/07/15 15:07:30 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{9A0EA9CA-EE6E-4B14-AEA4-EF4E0BE4F54A}
[2011/07/12 17:08:10 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{AEEDA0C4-B094-40CA-9072-BDC6E4E10BF3}
[2011/07/12 17:04:33 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0D85A837-7B6B-4379-9BE0-29398598E6DE}
[2011/07/11 19:15:42 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{718D1F67-3F23-4AD2-9624-60761184FA16}
[2011/07/11 19:10:51 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{8885552C-C46F-41CE-AF17-7D809AA70F9B}
[2011[2011/07/12 17:04:33 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0D85A837-7B6B-4379-9BE0-29398598E6DE}
[2011/07/11 19:15:42 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{718D1F67-3F23-4AD2-9624-60761184FA16}
[2011/07/11 19:10:51 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{8885552C-C46F-41CE-AF17-7D809AA70F9B}
[2011/07/11 12:00:50 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0272CA41-FCD0-43E5-BDC1-7D36C50B266C}
[2011/07/11 11:58:10 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{F10292BA-458D-48F4-BB5C-6E00413FB3D2}
[2011/07/05 14:29:26 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{1054FAA8-0F34-4A0D-B2D5-E525DD0BA91E}
[2011/07/04 14:18:16 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{812C46D8-1501-4AFA-8AC1-2D540FA281AD}
[2011/07/04 14:09:23 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{B1AB7382-9FDE-4896-B0A9-D0E584BCBEB7}
[2011/07/04 14:03:38 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{FA6271DC-C11C-4274-A832-ECB58B2FC3D7}
[2011/07/03 13:26:22 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{F129A5BC-03A3-4024-A684-6141D5EB5FB4}
[2011/04/16 08:19:44 | 000,004,608 | ---- | C] () -- C:\Users\ann\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/31 21:30:17 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011/01/31 18:17:23 | 000,007,605 | ---- | C] () -- C:\Users\ann\AppData\Local\Resmon.ResmonCfg
[2010/08/11 11:43:50 | 000,159,464 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4

========== ZeroAccess Check ==========

[2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 06:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 05:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Custom Scans ==========

< Results of screen317's Security Check version 0.99.64 >

< Windows 7 Service Pack 1 x64 (UAC is enabled) >

< Internet Explorer 10 >

< *``````````````Antivirus/Firewall Check:``````````````* >
Invalid Switch: b][]

< Windows Firewall Enabled! >

< AVG AntiVirus Free Edition 2013 >

< Antivirus up to date! >

< *`````````Anti-malware/Other Utilities Check:`````````* >
Invalid Switch: b][]

< Java 7 Update 17 >

< *Java version out of Date!* >
Invalid Switch: color]

< Google Chrome 27.0.1453.110 >

< Google Chrome 27.0.1453.94 >

< Google Chrome Plugins... >

< *````````Process Check: objlist.exe by Laurent````````* >
Invalid Switch: b][]

< AVG avgwdsvc.exe >

< *`````````````````System Health check`````````````````* >
Invalid Switch: b][]

< Total Fragmentation on Drive C: 8% >

< *````````````````````End of Log``````````````````````* >
Invalid Switch: b][]

========== Alternate Data Streams ==========

@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:373E1720
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0B4227B4
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP1B5B4F1

< End of report >


----------



## sweetrose (Sep 7, 2012)

is this it


----------



## eddie5659 (Mar 19, 2001)

It is, but the Custom scan is a bit messed up for some reason. Let me go through what you have, but in the meantime, can you re-run OTL exactly as you did before (I'll post it again for the settings) and post the log. There will only be the one that appears 

Make sure you copy everything from the top of the box (netsvcs) all the way down to (CREATERESTOREPOINT) 


Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath *Output* at the top change it to *Standard Output*.
Select 
*All Users*
*LOP Check*
*Purity Check*
Under the *Standard Registry* box change it to *All*

Please copy the text in the code box below and paste it in the *Custom Scans/Fixes* box in OTL:


```
netsvcs
activex
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%windir%\Installer\*.*
%windir%\system32\tasks\*.*
%windir%\system32\tasks\*.* /64
%systemroot%\Fonts\*.exe
%systemroot%\*. /mp /s
/md5start
consrv.dll
explorer.exe
winlogon.exe
regedit.exe
Userinit.exe
svchost.exe
services.exe
user32.dll
ATAPI.SYS
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
%Temp%\smtmp\* \s
%Temp%\smtmp\1\*.*
%Temp%\smtmp\2\*.*
%Temp%\smtmp\3\*.*
%Temp%\smtmp\4\*.*
dir "%systemdrive%\*" /S /A:L /C
CREATERESTOREPOINT
```

Click the *Run Scan* button. Do not change any settings unless otherwise told to do so. The scan wont take long.
A black box will appear, this is part of the custom scan, so don't be alarmed 
*IF OTL SAYS 'NOT RESPONDING' DON'T USE THE MOUSE. IT WILL CARRY ON SCANNING AFTER A FEW MINUTES*

When the scan completes, it will open one notepad window. *OTL.Txt*. This is saved in the same location as OTL.

Please copy *(Edit->Select All, Edit->Copy)* the contents of this file and post it in your topic


----------



## sweetrose (Sep 7, 2012)

ok wil try again


----------



## eddie5659 (Mar 19, 2001)

Okay, firstly lets update Java. We'll do this first and then check to see if its installed okay. After that, we'll do the removal of some malware 

Now, click on the following link to get the latest Java:

http://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1880261.html

Accept the agreement:










Click to download the offline install, called *jre-7u21-windows-i586.exe*











Close any programs you may have running - especially your web browser.

Go to *Start* > *Control Panel*, double-click on *Add/Remove *programs and remove all older versions of Java.

Check any item with Java Runtime Environment *(JRE or J2SE)* in the name, You should see this:

*Java 7 Update 17
*

Click the Remove or Change/Remove button

Repeat as many times as necessary to remove each Java version.

Reboot your computer once all Java components are removed.

Then from your desktop (or your Download folder) double-click on the download to install the newest version.(Vista or Win 7 users, right click on the * jre-7u21-windows-i586.exe* and select "Run as an Administrator.")
*Don't install any of the toolbars that are offered.*

----------

Then, after doing that, re-run the Security Check as follows:


Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called *checkup.txt*; please post the contents of that document.

I'll be back tomorrow, need sleep as I have a bit of a cold *sniffle*


----------



## sweetrose (Sep 7, 2012)

ok and its night from me too


----------



## Cookiegal (Aug 27, 2003)

Just wanted to let you know that I've merged the emjo account into the Frincis one. That means that all posts made by emjo will now show as having been made by Frincis.

Please carry on as usual.


----------



## sweetrose (Sep 7, 2012)

OTL logfile created on: 6/12/2013 10:08:09 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ann\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.87 Gb Total Physical Memory | 0.34 Gb Available Physical Memory | 18.04% Memory free
3.74 Gb Paging File | 1.39 Gb Available in Paging File | 37.12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 79.76 Gb Free Space | 68.49% Space Free | Partition Type: NTFS
Drive D: | 116.05 Gb Total Space | 0.35 Gb Free Space | 0.31% Space Free | Partition Type: NTFS

Computer Name: ANN-TOSH | User Name: ann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/12 22:06:22 | 000,890,839 | ---- | M] () -- C:\Users\ann\Downloads\SecurityCheck (1).exe
PRC - [2013/06/12 19:54:24 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ann\Downloads\OTL.exe
PRC - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
PRC - [2013/04/29 00:58:42 | 004,408,368 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
PRC - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
PRC - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/12/21 12:09:14 | 000,894,920 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe
PRC - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/11/20 13:17:00 | 000,302,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\cmd.exe
PRC - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
PRC - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2010/06/03 17:09:00 | 000,304,560 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- c:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2009/07/28 21:26:42 | 000,062,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
PRC - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

========== Modules (No Company Name) ==========

MOD - [2013/06/12 22:06:22 | 000,890,839 | ---- | M] () -- C:\Users\ann\Downloads\SecurityCheck (1).exe
MOD - [2013/05/29 06:27:38 | 000,393,168 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppgooglenaclpluginchrome.dll
MOD - [2013/05/29 06:27:37 | 013,136,336 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll
MOD - [2013/05/29 06:27:35 | 004,051,408 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll
MOD - [2013/05/29 06:26:40 | 000,599,504 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\libglesv2.dll
MOD - [2013/05/29 06:26:39 | 000,124,368 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\libegl.dll
MOD - [2013/05/29 06:26:36 | 001,597,392 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\ffmpegsumo.dll
MOD - [2012/05/25 05:25:00 | 000,921,600 | ---- | M] () -- C:\Program Files (x86)\Yahoo!\Messenger\yui.dll

========== Services (SafeList) ==========

SRV:*64bit:* - [2010/09/28 13:30:28 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:*64bit:* - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:*64bit:* - [2010/02/05 18:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:*64bit:* - [2009/07/28 15:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:*64bit:* - [2009/07/14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/12/21 12:09:14 | 000,894,920 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe -- (vToolbarUpdater13.3.2)
SRV - [2012/12/06 19:40:43 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2010/05/11 09:40:52 | 000,124,368 | ---- | M] (Toshiba Europe GmbH) [Auto | Running] -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe -- (TemproMonitoringService)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- c:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/28 17:44:40 | 000,249,200 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)
SRV - [2009/10/06 10:21:50 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)

========== Driver Services (SafeList) ==========

DRV:*64bit:* - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV:*64bit:* - [2013/03/29 02:53:48 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:*64bit:* - [2013/03/21 03:08:24 | 000,240,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:*64bit:* - [2013/02/08 05:37:56 | 000,116,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:*64bit:* - [2013/02/08 05:37:54 | 000,311,096 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
DRV:*64bit:* - [2013/02/08 05:37:50 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:*64bit:* - [2013/02/08 05:37:42 | 000,206,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:*64bit:* - [2013/02/08 05:37:40 | 000,045,880 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:*64bit:* - [2012/12/21 12:09:14 | 000,030,568 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)
DRV:*64bit:* - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:*64bit:* - [2012/03/01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:*64bit:* - [2011/10/01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:*64bit:* - [2011/10/01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:*64bit:* - [2010/11/20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:*64bit:* - [2010/11/20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:*64bit:* - [2010/09/24 16:11:18 | 000,349,800 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,235,520 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbwwan.sys -- (ZTEusbwwan)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zteusbvoice.sys -- (ZTEusbvoice)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,011,776 | ---- | M] (MBB Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter)
DRV:*64bit:* - [2010/05/20 14:40:28 | 000,075,776 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vodafone_K380x-z_dc_enum.sys -- (vodafone_K380x-z_dc_enum)
DRV:*64bit:* - [2010/04/28 12:32:20 | 000,932,384 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)
DRV:*64bit:* - [2010/03/22 11:55:20 | 000,046,192 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)
DRV:*64bit:* - [2010/03/10 19:51:32 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:*64bit:* - [2010/02/21 01:24:36 | 010,300,800 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:*64bit:* - [2010/01/07 10:05:46 | 000,232,992 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:*64bit:* - [2009/07/30 20:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:*64bit:* - [2009/07/14 16:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:*64bit:* - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:*64bit:* - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:*64bit:* - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:*64bit:* - [2009/06/22 18:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:*64bit:* - [2009/06/20 03:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:*64bit:* - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:*64bit:* - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:*64bit:* - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:*64bit:* - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:*64bit:* - [2009/06/04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&...AtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE:*64bit:* - HKLM\..\SearchScopes,DefaultScope = {56369BA8-0140-7F16-6997-7A636D1E1A62}
IE:*64bit:* - HKLM\..\SearchScopes\{56369BA8-0140-7F16-6997-7A636D1E1A62}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE:*64bit:* - HKLM\..\SearchScopes\{ABA5AE01-9B23-4AC7-9BA7-E0345C1287FB}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&...AtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKLM\..\SearchScopes,DefaultScope = {24345616-2C3A-A6E8-D18D-6EBD213B3971}
IE - HKLM\..\SearchScopes\{24345616-2C3A-A6E8-D18D-6EBD213B3971}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKLM\..\SearchScopes\{A25208D0-8D9E-4B0D-B6DE-CCB82D68D3C2}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&...AtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {8E145907-CFA8-49D4-98B8-A9C1C7C85C30}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www.delta-search.com/?q={searchTerms}&affID=119556&babsrc=SP_ss&mntrId=663388252CBA0AA8
IE - HKCU\..\SearchScopes\{400E7EA1-093B-4D0E-90AC-CAAEF713611E}: "URL" = http://rover.ebay.com/rover/1/710-44557-9400-9/4?satitle={searchTerms}
IE - HKCU\..\SearchScopes\{56369BA8-0140-7F16-6997-7A636D1E1A62}: "URL" = http://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=021113&q={searchTerms}&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{8E145907-CFA8-49D4-98B8-A9C1C7C85C30}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKCU\..\SearchScopes\{CFA8133F-6AFA-4D5A-8C2B-E6E9626D8E06}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U4&apn_dtid=OSJ000YYUK&apn_uid=11562A4A-C609-471F-8C27-4F32C225FE77&apn_sauid=9084271E-6BF3-4FBA-AE9C-4484D76A606E
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=mkg028
IE - HKCU\..\SearchScopes\{E0F1151B-5874-4D8B-8E18-506FA493AB23}: "URL" = http://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

[2012/11/03 15:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Mysearchdial (Enabled)
CHR - default_search_provider: search_url = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.delta-search.com/?affID=119556&babsrc=HP_ss&mntrId=663388252CBA0AA8
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll
CHR - plugin: king.com - Game controller for firefox (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\plugins\npmidas.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U17 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: McAfee Security Scanner + (Enabled) = C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll
CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Java Deployment Toolkit 7.0.170.2 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: New Tab = C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.2_0\

O1 HOSTS File: ([2013/03/07 19:09:17 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:*64bit:* - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {DCC39ACE-709B-44EA-B062-5F6BE2774644} - No CLSID value found.
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3:*64bit:* - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:*64bit:* - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3D15F113-3692-4089-B3A3-77DC82321FEB}: NameServer = 10.203.129.68 10.203.129.68
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8303406A-D415-481D-984A-0CB67A97EB51}: DhcpNameServer = 194.168.4.100 194.168.8.100
O18:*64bit:* - Protocol\Handler\skype4com - No CLSID value found
O18:*64bit:* - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:*64bit:* - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:*64bit:* - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/01/24 19:10:57 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:*64bit:* - HKLM\..comfile [open] -- "%1" %*
O35:*64bit:* - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:*64bit:* - HKLM\...com [@ = ComFile] -- "%1" %*
O37:*64bit:* - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

ActiveX:*64bit:* {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:*64bit:* {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:*64bit:* {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
ActiveX:*64bit:* {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:*64bit:* {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:*64bit:* {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:*64bit:* {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:*64bit:* {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:*64bit:* {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:*64bit:* {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:*64bit:* {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:*64bit:* {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:*64bit:* {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:*64bit:* {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:*64bit:* {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -UserConfig
ActiveX:*64bit:* {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:*64bit:* {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:*64bit:* {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:*64bit:* {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:*64bit:* {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:*64bit:* {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:*64bit:* {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:*64bit:* >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:*64bit:* >{9EA736BE-1114-43B5-AF2C-C0B967ADA449} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - 
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

MsConfig:64bit - StartUpFolder: C:^Users^ann^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^BBC iPlayer Desktop.lnk - C:\Program Files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe - ()
MsConfig:64bit - StartUpFolder: C:^Users^ann^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^TRDCReminder.lnk - C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe - (TOSHIBA Europe)
MsConfig:64bit - StartUpReg: *00TCrdMain* - hkey= - key= - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *Adobe ARM* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *Adobe Reader Speed Launcher* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *Google Update* - hkey= - key= - C:\Users\ann\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
MsConfig:64bit - StartUpReg: *HotKeysCmds* - hkey= - key= - C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
MsConfig:64bit - StartUpReg: *HWSetup* - hkey= - key= - C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)
MsConfig:64bit - StartUpReg: *IgfxTray* - hkey= - key= - C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
MsConfig:64bit - StartUpReg: *IncrediMail* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *KeNotify* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *Magentic* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *mcui_exe* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *Microsoft Default Manager* - hkey= - key= - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: *MobileBroadband* - hkey= - key= - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
MsConfig:64bit - StartUpReg: *NBAgent* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *Persistence* - hkey= - key= - C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
MsConfig:64bit - StartUpReg: *RtHDVBg* - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
MsConfig:64bit - StartUpReg: *RtHDVCpl* - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
MsConfig:64bit - StartUpReg: *SmartFaceVWatcher* - hkey= - key= - C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *SmoothView* - hkey= - key= - C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *SVPWUTIL* - hkey= - key= - C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA CORPORATION)
MsConfig:64bit - StartUpReg: *SynTPEnh* - hkey= - key= - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)
MsConfig:64bit - StartUpReg: *TOSHIBA Online Product Information* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *Toshiba Registration* - hkey= - key= - C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe (Toshiba Europe GmbH)
MsConfig:64bit - StartUpReg: *Toshiba TEMPRO* - hkey= - key= - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH)
MsConfig:64bit - StartUpReg: *TosNC* - hkey= - key= - C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *TosReelTimeMonitor* - hkey= - key= - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *TosSENotify* - hkey= - key= - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *TosVolRegulator* - hkey= - key= - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *TPwrMain* - hkey= - key= - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *TWebCamera* - hkey= - key= - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA CORPORATION.)
MsConfig:64bit - StartUpReg: *XoftSpySE* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *YSearchProtection* - hkey= - key= - C:\Program Files (x86)\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
MsConfig:64bit - State: "startup" - Reg Error: Key error.

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/06/12 22:07:58 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/06/10 19:35:36 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2013/06/07 19:03:19 | 000,000,000 | ---D | C] -- C:\Users\ann\AppData\Roaming\mysearchdial
[2013/06/05 21:54:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Image Converter
[2013/06/05 20:47:35 | 000,000,000 | ---D | C] -- C:\Users\ann\AppData\Roaming\DSite
[2013/05/16 17:30:35 | 000,000,000 | R--D | C] -- C:\Users\ann\Saved Games
[2013/05/16 15:48:12 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013/05/16 15:48:11 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/05/16 15:48:10 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013/05/16 15:48:09 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013/05/16 15:48:09 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013/05/16 15:48:09 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/05/16 15:48:09 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/05/16 15:48:09 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013/05/16 15:48:09 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013/05/16 15:48:09 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013/05/16 15:48:09 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013/05/16 15:48:08 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013/05/16 15:48:06 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013/05/16 15:48:06 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013/05/16 15:48:05 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013/05/16 07:42:19 | 000,265,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys
[2013/05/16 07:42:19 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2013/05/16 07:41:52 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll
[2013/05/16 07:41:51 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll
[2013/05/16 07:41:50 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll
[2013/05/16 07:41:50 | 000,111,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe
[2013/05/16 07:40:57 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wwanprotdim.dll
[2013/05/15 15:59:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MyPC Backup
[2013/05/15 15:59:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer

========== Files - Modified Within 30 Days ==========

[2013/06/12 22:18:20 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/06/12 21:51:00 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/12 21:45:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001UA.job
[2013/06/12 19:53:14 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/12 19:53:13 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/12 19:44:07 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/12 19:43:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/06/12 19:43:32 | 1504,354,304 | -HS- | M] () -- C:\hiberfil.sys
[2013/06/12 07:45:01 | 000,000,848 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001Core.job
[2013/06/07 19:03:42 | 000,000,397 | ---- | M] () -- C:\Users\Public\Desktop\MySearchDial.url
[2013/06/07 19:03:42 | 000,000,387 | ---- | M] () -- C:\Users\Public\Desktop\Online Games.url
[2013/06/07 19:03:18 | 000,423,709 | ---- | M] () -- C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx
[2013/06/06 20:50:18 | 000,002,366 | ---- | M] () -- C:\Users\ann\Desktop\Google Chrome.lnk
[2013/05/26 09:16:06 | 000,002,968 | ---- | M] () -- C:\Windows\SysWow64\userawacs.cfg
[2013/05/26 09:16:00 | 000,000,110 | ---- | M] () -- C:\Windows\SysWow64\usergui.cfg
[2013/05/26 09:15:30 | 000,000,851 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2013/05/16 17:28:23 | 000,275,712 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/05/16 15:51:30 | 000,733,400 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/05/16 15:51:30 | 000,616,694 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/05/16 15:51:30 | 000,106,816 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

========== Files Created - No Company Name ==========

[2013/06/07 19:03:56 | 000,423,709 | ---- | C] () -- C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx
[2013/06/07 19:03:42 | 000,000,397 | ---- | C] () -- C:\Users\Public\Desktop\MySearchDial.url
[2013/06/07 19:03:42 | 000,000,387 | ---- | C] () -- C:\Users\Public\Desktop\Online Games.url
[2013/06/02 08:00:20 | 004,989,512 | ---- | C] () -- C:\Users\ann\Documents\043.JPG
[2013/01/22 21:20:46 | 000,735,726 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/11/03 21:45:18 | 000,000,000 | ---- | C] () -- C:\Windows\ToDisc.INI
[2012/09/02 13:24:38 | 000,027,520 | ---- | C] () -- C:\Users\ann\AppData\Local\dt.dat
[2011/08/31 08:34:31 | 000,001,072 | ---- | C] () -- C:\Users\ann\Pictures - Shortcut.lnk
[2011/07/21 20:34:13 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{931E4FAA-EDCB-4C4C-9A5F-F55CE7BD62A6}
[2011/07/21 20:05:23 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{8532B172-6F57-4CBE-8E80-FAD83C06C6D3}
[2011/07/15 15:48:15 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{796EF731-ABE6-49A6-8D8F-75DAAE534B52}
[2011/07/15 15:28:59 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0B3B4E74-A96D-457B-A3AC-15AF58ED515A}
[2011/07/15 15:07:30 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{9A0EA9CA-EE6E-4B14-AEA4-EF4E0BE4F54A}
[2011/07/12 17:08:10 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{AEEDA0C4-B094-40CA-9072-BDC6E4E10BF3}
[2011/07/12 17:04:33 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0D85A837-7B6B-4379-9BE0-29398598E6DE}
[2011/07/11 19:15:42 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{718D1F67-3F23-4AD2-9624-60761184FA16}
[2011/07/11 19:10:51 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{8885552C-C46F-41CE-AF17-7D809AA70F9B}
[2011/07/11 12:00:50 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0272CA41-FCD0-43E5-BDC1-7D36C50B266C}
[2011/07/11 11:58:10 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{F10292BA-458D-48F4-BB5C-6E00413FB3D2}
[2011/07/05 14:29:26 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{1054FAA8-0F34-4A0D-B2D5-E525DD0BA91E}
[2011/07/04 14:18:16 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{812C46D8-1501-4AFA-8AC1-2D540FA281AD}
[2011/07/04 14:09:23 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{B1AB7382-9FDE-4896-B0A9-D0E584BCBEB7}
[2011/07/04 14:03:38 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{FA6271DC-C11C-4274-A832-ECB58B2FC3D7}
[2011/07/03 13:26:22 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{F129A5BC-03A3-4024-A684-6141D5EB5FB4}
[2011/04/16 08:19:44 | 000,004,608 | ---- | C] () -- C:\Users\ann\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/31 21:30:17 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011/01/31 18:17:23 | 000,007,605 | ---- | C] () -- C:\Users\ann\AppData\Local\Resmon.ResmonCfg
[2010/08/11 11:43:50 | 000,159,464 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4

========== ZeroAccess Check ==========

[2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 06:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 05:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Custom Scans ==========

< %SYSTEMDRIVE%\*. >
[2012/10/13 15:05:40 | 000,000,000 | -H-D | M] -- C:\$AVG
[2012/11/14 16:20:34 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2013/06/12 19:52:10 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2009/07/14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2010/12/16 08:05:05 | 000,000,000 | ---D | M] -- C:\Intel
[2013/01/02 21:58:54 | 000,000,000 | ---D | M] -- C:\JRT
[2009/07/14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2013/05/15 20:14:27 | 000,000,000 | R--D | M] -- C:\Program Files
[2013/06/09 07:50:09 | 000,000,000 | ---D | M] -- C:\Program Files (x86)
[2013/06/10 19:35:36 | 000,000,000 | ---D | M] -- C:\ProgramData
[2013/02/27 22:55:23 | 000,000,000 | ---D | M] -- C:\Qoobox
[2013/06/12 22:30:48 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012/11/05 16:45:53 | 000,000,000 | ---D | M] -- C:\Temp
[2011/01/31 18:08:38 | 000,000,000 | ---D | M] -- C:\Toshiba
[2012/11/14 16:19:46 | 000,000,000 | R--D | M] -- C:\Users
[2013/06/10 19:37:09 | 000,000,000 | ---D | M] -- C:\Windows
[2013/06/12 22:07:58 | 000,000,000 | ---D | M] -- C:\_OTL

< %PROGRAMFILES%\*.exe >

< %LOCALAPPDATA%\*.exe >

< %windir%\Installer\*.* >
[2010/10/19 12:48:24 | 000,147,968 | ---- | M] () -- C:\Windows\Installer\10000.msi
[2010/10/19 12:48:36 | 003,664,384 | ---- | M] () -- C:\Windows\Installer\10018.msi
[2010/10/19 12:48:38 | 003,734,016 | ---- | M] () -- C:\Windows\Installer\1001c.msi
[2010/10/19 12:48:43 | 001,819,136 | ---- | M] () -- C:\Windows\Installer\10028.msi
[2010/10/19 12:49:02 | 002,631,168 | ---- | M] () -- C:\Windows\Installer\10068.msi
[2010/10/19 12:28:44 | 004,675,072 | ---- | M] () -- C:\Windows\Installer\11c79.msi
[2010/03/31 06:07:15 | 002,376,704 | ---- | M] () -- C:\Windows\Installer\161d3.msi
[2012/10/03 10:14:29 | 000,163,840 | ---- | M] () -- C:\Windows\Installer\16d06d.msi
[2009/06/01 21:00:00 | 004,505,600 | ---- | M] () -- C:\Windows\Installer\17235.msi
[2010/10/19 12:26:14 | 031,928,832 | ---- | M] () -- C:\Windows\Installer\17244.msi
[2008/08/08 14:46:10 | 000,242,176 | ---- | M] () -- C:\Windows\Installer\17249.msi
[2010/09/10 08:55:10 | 011,352,064 | ---- | M] () -- C:\Windows\Installer\17312.msi
[2010/09/10 08:55:19 | 002,075,136 | ---- | M] () -- C:\Windows\Installer\17318.msi
[2010/09/10 08:55:19 | 008,941,568 | ---- | M] () -- C:\Windows\Installer\1731f.msi
[2010/09/10 08:55:11 | 001,350,656 | ---- | M] () -- C:\Windows\Installer\17326.msi
[2010/09/10 08:55:11 | 002,951,680 | ---- | M] () -- C:\Windows\Installer\17359.msi
[2010/09/10 08:55:20 | 001,616,896 | ---- | M] () -- C:\Windows\Installer\17360.msi
[2010/09/10 08:55:19 | 001,617,408 | ---- | M] () -- C:\Windows\Installer\17367.msi
[2010/09/10 08:55:20 | 001,616,384 | ---- | M] () -- C:\Windows\Installer\1736e.msi
[2010/09/10 08:55:15 | 001,616,896 | ---- | M] () -- C:\Windows\Installer\17375.msi
[2010/09/10 08:55:14 | 001,615,872 | ---- | M] () -- C:\Windows\Installer\1737c.msi
[2010/09/10 08:55:12 | 001,615,872 | ---- | M] () -- C:\Windows\Installer\17383.msi
[2010/09/10 08:55:11 | 001,616,384 | ---- | M] () -- C:\Windows\Installer\1738a.msi
[2010/09/10 08:55:11 | 001,616,896 | ---- | M] () -- C:\Windows\Installer\17391.msi
[2010/09/10 08:55:11 | 002,101,760 | ---- | M] () -- C:\Windows\Installer\17397.msi
[2011/02/09 20:27:24 | 000,039,936 | R--- | M] () -- C:\Windows\Installer\17d3c4.msp
[2011/02/09 20:25:16 | 004,427,776 | R--- | M] () -- C:\Windows\Installer\17d3dc.msp
[2011/02/09 20:25:28 | 002,932,736 | R--- | M] () -- C:\Windows\Installer\17d3f5.msp
[2011/02/09 20:25:38 | 000,136,704 | R--- | M] () -- C:\Windows\Installer\17d3ff.msp
[2011/02/09 20:25:43 | 001,139,712 | R--- | M] () -- C:\Windows\Installer\17d410.msp
[2011/02/09 20:26:20 | 003,314,688 | R--- | M] () -- C:\Windows\Installer\17d445.msp
[2011/02/09 20:28:03 | 005,870,080 | R--- | M] () -- C:\Windows\Installer\17d47f.msp
[2011/02/09 20:28:34 | 002,958,336 | R--- | M] () -- C:\Windows\Installer\17d49e.msp
[2011/02/09 20:28:49 | 014,617,088 | R--- | M] () -- C:\Windows\Installer\17d4d5.msp
[2011/02/09 20:28:53 | 003,733,504 | R--- | M] () -- C:\Windows\Installer\17d4e6.msp
[2011/02/09 20:28:58 | 000,205,312 | R--- | M] () -- C:\Windows\Installer\17d4f8.msp
[2011/02/09 20:29:11 | 000,113,664 | R--- | M] () -- C:\Windows\Installer\17d53a.msp
[2011/02/09 20:29:18 | 001,830,400 | R--- | M] () -- C:\Windows\Installer\17d549.msp
[2011/02/09 20:25:33 | 000,624,640 | R--- | M] () -- C:\Windows\Installer\17d561.msp
[2011/02/09 20:26:48 | 000,468,480 | R--- | M] () -- C:\Windows\Installer\17d570.msp
[2011/02/09 20:29:53 | 000,636,928 | R--- | M] () -- C:\Windows\Installer\17d58c.msp
[2011/02/09 20:29:59 | 000,510,976 | R--- | M] () -- C:\Windows\Installer\17d596.msp
[2011/02/09 20:30:06 | 002,144,256 | R--- | M] () -- C:\Windows\Installer\17d5a7.msp
[2011/02/09 20:30:11 | 000,060,416 | R--- | M] () -- C:\Windows\Installer\17d5b2.msp
[2011/02/09 20:30:17 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\17d5bd.msp
[2011/02/09 20:30:26 | 000,024,576 | R--- | M] () -- C:\Windows\Installer\17d5cd.msp
[2012/08/23 19:20:36 | 000,022,016 | ---- | M] () -- C:\Windows\Installer\1a455.msi
[2012/03/15 14:26:06 | 004,212,736 | R--- | M] () -- C:\Windows\Installer\1c0d51.msp
[2012/04/22 22:46:00 | 001,187,328 | R--- | M] () -- C:\Windows\Installer\1c0d5a.msp
[2011/07/11 17:33:14 | 023,254,016 | R--- | M] () -- C:\Windows\Installer\1c4e31.msp
[2009/07/22 01:01:04 | 000,251,904 | ---- | M] () -- C:\Windows\Installer\1d2fbc.msi
[2011/10/26 17:36:14 | 002,829,312 | R--- | M] () -- C:\Windows\Installer\1ee340.msp
[2011/03/25 09:16:38 | 005,135,872 | R--- | M] () -- C:\Windows\Installer\1f92c8.msp
[2011/04/13 11:48:16 | 035,326,464 | R--- | M] () -- C:\Windows\Installer\1f92df.msp
[2011/04/19 04:21:02 | 000,235,520 | ---- | M] () -- C:\Windows\Installer\1f92f1.msi
[2011/04/19 04:54:14 | 000,227,328 | ---- | M] () -- C:\Windows\Installer\1f92f8.msi
[2012/11/18 13:57:04 | 000,031,232 | ---- | M] () -- C:\Windows\Installer\20548.msi
[2011/06/28 21:27:28 | 004,028,928 | R--- | M] () -- C:\Windows\Installer\21953a.msp
[2013/03/19 21:35:14 | 000,883,712 | ---- | M] () -- C:\Windows\Installer\21de3f.msi
[2013/04/27 19:15:10 | 010,502,144 | ---- | M] () -- C:\Windows\Installer\227daa.msi
[2013/05/03 14:46:03 | 000,026,112 | ---- | M] () -- C:\Windows\Installer\22ea6.msi
[2010/03/30 19:18:13 | 033,000,960 | ---- | M] () -- C:\Windows\Installer\2bde33.msi
[2011/11/22 01:42:40 | 033,189,888 | R--- | M] () -- C:\Windows\Installer\2c32f6.msp
[2013/05/26 09:11:35 | 009,187,328 | ---- | M] () -- C:\Windows\Installer\2eba8.msi
[2011/07/26 19:36:38 | 001,629,696 | ---- | M] () -- C:\Windows\Installer\314d79.msi
[2012/01/22 10:20:42 | 001,707,520 | R--- | M] () -- C:\Windows\Installer\31c2ab.msp
[2013/02/07 00:39:06 | 001,039,872 | R--- | M] () -- C:\Windows\Installer\3250f6.msp
[2011/12/26 07:24:12 | 008,835,072 | R--- | M] () -- C:\Windows\Installer\32d13c.msp
[2012/10/16 15:15:30 | 003,809,280 | ---- | M] () -- C:\Windows\Installer\33828f.msi
[2010/12/16 08:17:52 | 064,684,544 | ---- | M] () -- C:\Windows\Installer\38339.msi
[2010/12/16 08:20:58 | 048,625,664 | ---- | M] () -- C:\Windows\Installer\38345.msi
[2010/12/16 08:22:37 | 029,130,752 | ---- | M] () -- C:\Windows\Installer\3834a.msi
[2010/12/16 08:23:31 | 016,698,880 | ---- | M] () -- C:\Windows\Installer\38351.msi
[2010/12/16 08:25:02 | 002,356,736 | ---- | M] () -- C:\Windows\Installer\38358.msi
[2009/07/22 01:31:26 | 000,209,408 | ---- | M] () -- C:\Windows\Installer\4195e.msi
[2011/04/20 16:23:29 | 020,248,064 | ---- | M] () -- C:\Windows\Installer\4230f.msi
[2013/05/27 17:41:57 | 020,627,456 | ---- | M] () -- C:\Windows\Installer\42e83.msi
[2011/05/18 23:06:22 | 038,672,896 | R--- | M] () -- C:\Windows\Installer\47b7fb.msp
[2011/04/07 04:12:06 | 194,340,864 | R--- | M] () -- C:\Windows\Installer\47b81b.msp
[2011/01/24 18:16:02 | 000,014,336 | R--- | M] () -- C:\Windows\Installer\4bb46e.msp
[2012/01/12 03:01:16 | 021,030,912 | R--- | M] () -- C:\Windows\Installer\4bb498.msp
[2011/02/07 22:54:02 | 005,963,776 | ---- | M] () -- C:\Windows\Installer\4c5112.msi
[2011/02/07 22:55:32 | 005,818,368 | ---- | M] () -- C:\Windows\Installer\4c5118.msi
[2010/03/18 22:41:24 | 001,901,056 | ---- | M] () -- C:\Windows\Installer\4ee852.msi
[2012/09/06 11:16:24 | 025,810,944 | R--- | M] () -- C:\Windows\Installer\53b37.msp
[2012/09/10 10:35:36 | 015,580,672 | R--- | M] () -- C:\Windows\Installer\53b4c.msp
[2011/02/11 08:59:10 | 023,633,408 | R--- | M] () -- C:\Windows\Installer\56fd4.msp
[2011/04/13 07:35:03 | 008,544,256 | ---- | M] () -- C:\Windows\Installer\594d2.msi
[2011/10/27 20:53:44 | 003,552,768 | ---- | M] () -- C:\Windows\Installer\59e6ad.msi
[2011/10/27 20:53:58 | 003,027,968 | ---- | M] () -- C:\Windows\Installer\59e6b3.msi
[2011/01/11 07:03:16 | 002,761,728 | ---- | M] () -- C:\Windows\Installer\5b5ac.msi
[2011/04/28 09:57:38 | 002,721,280 | R--- | M] () -- C:\Windows\Installer\61a19a.msp
[2013/06/07 14:38:37 | 002,859,008 | ---- | M] () -- C:\Windows\Installer\62370.msi
[2011/11/04 09:47:50 | 000,061,440 | ---- | M] () -- C:\Windows\Installer\74b8d.ipi
[2013/01/11 13:18:27 | 008,708,096 | ---- | M] () -- C:\Windows\Installer\77879.msi
[2011/12/15 14:54:16 | 039,732,736 | R--- | M] () -- C:\Windows\Installer\78c3fa.msp
[2012/01/19 14:20:42 | 011,997,696 | R--- | M] () -- C:\Windows\Installer\78c407.msp
[2011/08/31 21:28:21 | 008,822,784 | ---- | M] () -- C:\Windows\Installer\7acd2d.msi
[2011/08/31 21:29:05 | 000,039,936 | R--- | M] () -- C:\Windows\Installer\7acd3f.msp
[2011/08/31 21:28:06 | 004,425,728 | R--- | M] () -- C:\Windows\Installer\7acd75.msp
[2011/08/31 21:28:10 | 002,933,248 | R--- | M] () -- C:\Windows\Installer\7acd8e.msp
[2011/08/31 21:28:13 | 000,136,704 | R--- | M] () -- C:\Windows\Installer\7acd98.msp
[2011/08/31 21:28:15 | 001,139,200 | R--- | M] () -- C:\Windows\Installer\7acda9.msp
[2011/08/31 21:28:18 | 000,715,264 | R--- | M] () -- C:\Windows\Installer\7acdb6.msp
[2011/08/31 21:28:26 | 003,313,152 | R--- | M] () -- C:\Windows\Installer\7acdda.msp
[2011/08/31 21:29:40 | 005,872,128 | R--- | M] () -- C:\Windows\Installer\7ace1b.msp
[2011/08/31 21:29:41 | 002,956,288 | R--- | M] () -- C:\Windows\Installer\7ace3a.msp
[2011/08/31 21:30:20 | 014,623,744 | R--- | M] () -- C:\Windows\Installer\7ace71.msp
[2011/08/31 21:30:22 | 003,731,968 | R--- | M] () -- C:\Windows\Installer\7ace82.msp
[2011/08/31 21:30:24 | 000,205,824 | R--- | M] () -- C:\Windows\Installer\7ace94.msp
[2011/08/31 21:30:29 | 003,103,744 | R--- | M] () -- C:\Windows\Installer\7acea7.msp
[2011/08/31 21:30:30 | 001,828,864 | R--- | M] () -- C:\Windows\Installer\7aceb6.msp
[2011/08/31 21:28:07 | 000,029,184 | R--- | M] () -- C:\Windows\Installer\7acec1.msp
[2011/08/31 21:28:12 | 000,626,688 | R--- | M] () -- C:\Windows\Installer\7acecf.msp
[2011/08/31 21:28:35 | 000,468,480 | R--- | M] () -- C:\Windows\Installer\7acede.msp
[2011/08/31 21:30:37 | 000,636,416 | R--- | M] () -- C:\Windows\Installer\7acefe.msp
[2011/08/31 21:30:42 | 000,509,952 | R--- | M] () -- C:\Windows\Installer\7acf08.msp
[2011/08/31 21:30:43 | 002,146,816 | R--- | M] () -- C:\Windows\Installer\7acf19.msp
[2011/08/31 21:30:44 | 000,060,416 | R--- | M] () -- C:\Windows\Installer\7acf24.msp
[2011/08/31 21:30:44 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\7acf2f.msp
[2011/08/31 21:30:46 | 000,030,720 | R--- | M] () -- C:\Windows\Installer\7acf39.msp
[2011/08/31 21:30:47 | 000,024,576 | R--- | M] () -- C:\Windows\Installer\7acf50.msp
[2013/02/14 10:58:46 | 005,850,624 | R--- | M] () -- C:\Windows\Installer\816330.msp
[2012/04/17 19:32:51 | 000,026,112 | ---- | M] () -- C:\Windows\Installer\87dba.msi
[2010/10/19 12:48:14 | 000,074,240 | ---- | M] () -- C:\Windows\Installer\87dc3.msi
[2012/04/17 19:32:51 | 000,039,936 | R--- | M] () -- C:\Windows\Installer\87dc8.msp
[2012/04/17 19:33:01 | 009,553,408 | ---- | M] () -- C:\Windows\Installer\87dd8.msi
[2010/10/19 12:48:18 | 009,433,088 | ---- | M] () -- C:\Windows\Installer\87df0.msi
[2012/04/17 19:33:08 | 004,426,240 | R--- | M] () -- C:\Windows\Installer\87dff.msp
[2010/10/19 12:48:21 | 007,710,720 | ---- | M] () -- C:\Windows\Installer\87e04.msi
[2012/04/17 19:33:11 | 002,932,224 | R--- | M] () -- C:\Windows\Installer\87e18.msp
[2010/10/19 12:48:25 | 000,429,056 | ---- | M] () -- C:\Windows\Installer\87e1d.msi
[2012/04/17 19:33:12 | 000,136,704 | R--- | M] () -- C:\Windows\Installer\87e22.msp
[2010/10/19 12:48:26 | 004,004,864 | ---- | M] () -- C:\Windows\Installer\87e27.msi
[2012/04/17 19:33:17 | 001,139,712 | R--- | M] () -- C:\Windows\Installer\87e33.msp
[2011/02/09 20:26:05 | 002,310,656 | ---- | M] () -- C:\Windows\Installer\87e38.msi
[2012/04/17 19:33:18 | 000,715,264 | R--- | M] () -- C:\Windows\Installer\87e40.msp
[2010/10/19 12:48:30 | 008,332,288 | ---- | M] () -- C:\Windows\Installer\87e48.msi
[2012/04/17 19:33:28 | 003,312,128 | R--- | M] () -- C:\Windows\Installer\87e64.msp
[2011/08/31 21:28:34 | 022,647,296 | ---- | M] () -- C:\Windows\Installer\87e6c.msi
[2012/04/17 19:33:49 | 005,535,744 | R--- | M] () -- C:\Windows\Installer\87e7f.msp
[2010/10/19 12:48:40 | 013,850,624 | ---- | M] () -- C:\Windows\Installer\87e86.msi
[2012/04/17 19:33:56 | 005,868,544 | R--- | M] () -- C:\Windows\Installer\87e9d.msp
[2010/10/19 12:48:42 | 008,313,856 | ---- | M] () -- C:\Windows\Installer\87ea2.msi
[2012/04/17 19:34:56 | 002,957,312 | R--- | M] () -- C:\Windows\Installer\87ebc.msp
[2010/10/19 12:48:49 | 034,193,408 | ---- | M] () -- C:\Windows\Installer\87ec7.msi
[2012/04/17 19:35:07 | 014,624,256 | R--- | M] () -- C:\Windows\Installer\87ef2.msp
[2010/10/19 12:48:44 | 011,846,656 | ---- | M] () -- C:\Windows\Installer\87efa.msi
[2012/04/17 19:35:38 | 003,734,016 | R--- | M] () -- C:\Windows\Installer\87f03.msp
[2010/10/19 12:48:50 | 000,775,168 | ---- | M] () -- C:\Windows\Installer\87f0c.msi
[2012/04/17 19:35:40 | 000,205,824 | R--- | M] () -- C:\Windows\Installer\87f15.msp
[2012/04/17 19:35:45 | 006,363,136 | ---- | M] () -- C:\Windows\Installer\87f2d.msi
[2012/04/17 19:35:46 | 000,276,480 | R--- | M] () -- C:\Windows\Installer\87f6a.msp
[2010/10/19 12:48:53 | 006,195,200 | ---- | M] () -- C:\Windows\Installer\87f72.msi
[2012/04/17 19:35:58 | 003,105,792 | R--- | M] () -- C:\Windows\Installer\87f7d.msp
[2010/10/19 12:48:54 | 003,454,976 | ---- | M] () -- C:\Windows\Installer\87f83.msi
[2012/04/17 19:35:58 | 001,829,376 | R--- | M] () -- C:\Windows\Installer\87f8c.msp
[2011/02/09 20:25:21 | 000,067,072 | ---- | M] () -- C:\Windows\Installer\87f91.msi
[2012/04/17 19:35:59 | 000,029,184 | R--- | M] () -- C:\Windows\Installer\87f97.msp
[2010/10/19 12:48:56 | 001,492,992 | ---- | M] () -- C:\Windows\Installer\87f9c.msi
[2012/04/17 19:35:59 | 000,625,664 | R--- | M] () -- C:\Windows\Installer\87fa5.msp
[2010/10/19 12:48:56 | 001,070,592 | ---- | M] () -- C:\Windows\Installer\87faa.msi
[2012/04/17 19:35:59 | 000,468,480 | R--- | M] () -- C:\Windows\Installer\87fb4.msp
[2011/08/31 21:28:38 | 006,661,632 | ---- | M] () -- C:\Windows\Installer\87fba.msi
[2012/04/17 19:36:01 | 005,124,096 | R--- | M] () -- C:\Windows\Installer\87fc4.msp
[2010/10/19 12:48:58 | 003,410,944 | ---- | M] () -- C:\Windows\Installer\87fca.msi
[2012/04/17 19:36:06 | 000,635,904 | R--- | M] () -- C:\Windows\Installer\87fd0.msp
[2010/10/19 12:48:59 | 004,175,360 | ---- | M] () -- C:\Windows\Installer\87fd5.msi
[2012/04/17 19:36:07 | 000,509,952 | R--- | M] () -- C:\Windows\Installer\87fda.msp
[2010/10/19 12:48:59 | 004,250,112 | ---- | M] () -- C:\Windows\Installer\87fe0.msi
[2012/04/17 19:36:13 | 002,146,304 | R--- | M] () -- C:\Windows\Installer\87feb.msp
[2010/10/19 12:49:00 | 000,153,600 | ---- | M] () -- C:\Windows\Installer\87ff1.msi
[2012/04/17 19:36:13 | 000,060,416 | R--- | M] () -- C:\Windows\Installer\87ff6.msp
[2010/10/19 12:49:00 | 000,029,696 | ---- | M] () -- C:\Windows\Installer\87ffc.msi
[2012/04/17 19:36:13 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\88001.msp
[2010/10/19 12:49:02 | 000,074,240 | ---- | M] () -- C:\Windows\Installer\88006.msi
[2012/04/17 19:36:14 | 000,030,720 | R--- | M] () -- C:\Windows\Installer\8800b.msp
[2012/04/17 19:36:14 | 000,065,536 | ---- | M] () -- C:\Windows\Installer\88010.msi
[2010/10/19 12:49:03


----------



## sweetrose (Sep 7, 2012)

056,832 | ---- | M] () -- C:\Windows\Installer\8801b.msi
[2012/04/17 19:36:14 | 000,024,576 | R--- | M] () -- C:\Windows\Installer\88022.msp
[2013/01/10 23:15:44 | 000,179,200 | ---- | M] () -- C:\Windows\Installer\88cfd8.msi
[2013/06/12 22:30:03 | 000,887,296 | ---- | M] () -- C:\Windows\Installer\99b4ef.msi
[2011/01/11 08:48:54 | 000,235,008 | ---- | M] () -- C:\Windows\Installer\aae2f.msi
[2011/01/11 09:19:42 | 000,226,816 | ---- | M] () -- C:\Windows\Installer\aae36.msi
[2011/04/16 08:44:26 | 002,770,944 | ---- | M] () -- C:\Windows\Installer\bf333.msi
[2008/09/30 22:07:10 | 006,042,112 | ---- | M] () -- C:\Windows\Installer\c8b63.msi
[2009/07/21 01:29:14 | 006,057,984 | ---- | M] () -- C:\Windows\Installer\c8b6a.msi
[2012/10/10 05:44:54 | 012,961,280 | R--- | M] () -- C:\Windows\Installer\cace1.msp
[2010/10/19 12:30:29 | 006,678,016 | ---- | M] () -- C:\Windows\Installer\d06d.msi
[2009/09/01 15:52:12 | 000,321,024 | ---- | M] () -- C:\Windows\Installer\d072.msi
[2010/10/19 12:31:04 | 000,784,384 | ---- | M] () -- C:\Windows\Installer\d077.msi
[2008/08/08 14:11:02 | 000,232,960 | ---- | M] () -- C:\Windows\Installer\d086.msi
[2009/07/12 12:16:26 | 000,223,232 | ---- | M] () -- C:\Windows\Installer\d08c.msi
[2010/12/16 08:09:37 | 009,901,568 | ---- | M] () -- C:\Windows\Installer\e65c.msi
[2010/12/16 08:10:11 | 007,710,208 | ---- | M] () -- C:\Windows\Installer\e665.msi
[2010/12/16 08:10:40 | 003,914,240 | ---- | M] () -- C:\Windows\Installer\e68e.msi
[2010/10/04 14:39:46 | 002,894,336 | ---- | M] () -- C:\Windows\Installer\e693.msi
[2010/11/25 10:12:14 | 000,510,464 | R--- | M] () -- C:\Windows\Installer\f026db.msp
[2010/07/16 09:41:36 | 001,732,608 | R--- | M] () -- C:\Windows\Installer\f026e2.msp
[2012/12/06 17:56:22 | 003,725,312 | R--- | M] () -- C:\Windows\Installer\f62c1.msp
[2009/11/11 17:44:10 | 000,332,288 | ---- | M] () -- C:\Windows\Installer\ff87.msi
[2009/11/12 14:14:38 | 000,496,640 | ---- | M] () -- C:\Windows\Installer\ff8c.msi
[2010/10/19 12:45:13 | 008,992,256 | ---- | M] () -- C:\Windows\Installer\ffa5.msi
[2010/10/19 12:48:12 | 004,227,072 | ---- | M] () -- C:\Windows\Installer\ffd4.msi
[2010/10/19 12:48:13 | 002,081,792 | ---- | M] () -- C:\Windows\Installer\ffd8.msi
[2010/10/19 12:48:16 | 002,856,448 | ---- | M] () -- C:\Windows\Installer\ffe4.msi
[2010/10/19 12:48:16 | 000,053,248 | ---- | M] () -- C:\Windows\Installer\ffe8.msi
[2010/10/19 12:48:16 | 000,037,888 | ---- | M] () -- C:\Windows\Installer\ffec.msi
[2010/10/19 12:48:23 | 004,680,704 | ---- | M] () -- C:\Windows\Installer\fff8.msi
[2010/10/19 12:48:24 | 002,343,936 | ---- | M] () -- C:\Windows\Installer\fffc.msi
[2012/04/17 19:38:34 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{0D87AE67-14EB-4C10-88A5-DA6C3181EB18}.SchedServiceConfig.rmi
[2011/02/09 20:28:53 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{46A5FBE9-ADB3-4493-A1CC-B4CFFD24D26A}.SchedServiceConfig.rmi
[2011/08/31 21:32:57 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{CEA21F20-DBF4-464C-8B81-28B8508AFDDD}.SchedServiceConfig.rmi
[2010/10/19 12:49:48 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}.SchedServiceConfig.rmi
[35 C:\Windows\Installer\*.tmp files -> C:\Windows\Installer\*.tmp -> ]

< %windir%\system32\tasks\*.* >

< %windir%\system32\tasks\*.* /64 >
[2012/12/06 19:40:45 | 000,003,768 | ---- | M] () -- C:\Windows\SysNative\tasks\Adobe Flash Player Updater
[2010/12/16 08:19:51 | 000,003,492 | ---- | M] () -- C:\Windows\SysNative\tasks\ConfigFree Startup Programs
[2011/02/11 09:37:19 | 000,003,532 | ---- | M] () -- C:\Windows\SysNative\tasks\CreateChoiceProcessTask
[2013/05/03 14:46:22 | 000,003,636 | ---- | M] () -- C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineCore
[2013/05/03 14:46:24 | 000,003,888 | ---- | M] () -- C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineUA
[2013/05/06 07:40:48 | 000,003,470 | ---- | M] () -- C:\Windows\SysNative\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001Core
[2013/05/06 07:40:48 | 000,003,866 | ---- | M] () -- C:\Windows\SysNative\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001UA
[2011/10/14 12:28:55 | 000,003,230 | ---- | M] () -- C:\Windows\SysNative\tasks\SidebarExecute
[2013/06/11 22:25:53 | 000,003,918 | ---- | M] () -- C:\Windows\SysNative\tasks\User_Feed_Synchronization-{E019A65C-E9A7-40E3-9249-44A4DA15A9C8}
[2013/01/29 20:12:31 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{00BC1703-9104-4547-9046-82BF662A6C0D}
[2012/12/22 20:59:36 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{012F9B8D-0852-4DAC-ADDB-B4615E2D666E}
[2012/10/21 14:54:23 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{017D6C9E-60F2-4368-A830-2C4CAFBDFF4A}
[2012/12/30 23:04:25 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{02714F41-C704-4F29-A44E-3FDEFA9E5EA0}
[2011/03/04 20:24:29 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{02F9E465-5EC7-4745-897D-A644C49C723C}
[2012/12/31 23:48:10 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{0399096D-B561-461D-815B-C940EC26C754}
[2012/12/08 19:40:21 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{03DD895F-8646-4633-B817-4ECC9B1D1152}
[2012/12/27 08:38:57 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{042DB467-970C-40AF-87BF-26EB331A1C24}
[2012/09/29 06:30:51 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{04BFC6C6-B40C-4EA5-8CAF-8E2338CC6C5A}
[2012/11/06 00:10:53 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{0533830A-3A30-43E1-A26C-F24F31313F24}
[2013/01/30 09:29:31 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{05ABE415-C563-439D-9ED4-D68FAECB01B2}
[2012/11/17 15:27:29 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{05BE0178-0E9D-4EB5-8DC2-C92365F8B69F}
[2013/01/10 09:15:02 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{07113C9E-5C56-4C56-A139-A3EC393CA716}
[2013/01/02 19:55:26 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{07AE9ACD-2430-4E16-9F0F-51215130F06F}
[2012/12/29 17:00:40 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{0805CAA0-8E69-4E51-B914-E3492272A1AF}
[2013/02/06 08:38:14 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{0812F4DB-A953-4F07-BA53-6FC21275436B}
[2013/01/08 23:14:49 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{084FBF19-2634-4221-A03B-8E3253D9343F}
[2013/02/04 13:21:54 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{09153206-56AE-45AB-98D8-9172D82C523A}
[2012/12/19 23:08:51 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{0A7E78C5-278D-44AE-BEC1-D4A7072E6E6F}
[2012/11/18 23:37:13 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{0B5FBC82-1762-430A-9388-EDE9926FE67D}
[2012/10/27 22:00:52 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{0C12FFCA-5219-41A1-98B3-0A293116D452}
[2012/10/14 15:49:47 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{0DA69CBB-BC0A-4C01-AA6E-B1C75810EC34}
[2012/12/30 15:25:27 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{0E81D74D-28EB-4A17-8C35-2C7E5BB62A38}
[2012/10/20 12:47:46 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{0ED0F7DF-D3C8-436E-B7B1-E7D11715A2F1}
[2012/11/27 20:32:41 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{0FFFB3B1-22D0-40F0-B42A-FB758CBB4BFB}
[2013/02/06 19:38:17 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{105293E5-6DE0-40D5-98D3-E18F92CEBB23}
[2013/01/02 00:21:08 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{10947E19-03DE-4D66-A3B2-8756AA1F2216}
[2012/11/20 16:46:45 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{11F5A7DC-745D-482D-817C-A13D23C56D3C}
[2011/03/04 20:24:31 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{12628E57-5773-436C-8A72-2EE57BEC00FE}
[2012/12/16 15:43:37 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{12874D8B-073C-4DC2-A8F4-A9DFD691A76B}
[2013/04/10 21:54:45 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{129EC48D-627D-44EC-9469-5CDB19E76F28}
[2012/12/17 16:58:21 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{12A88BCC-7290-490F-863C-A45D8A158B58}
[2013/01/07 19:58:28 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{12DC0B2D-E732-4ACC-8DD4-A645CC173D57}
[2013/01/30 10:24:27 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{130B31A5-4E1C-4D4F-9CD8-F368204F209B}
[2012/11/26 16:53:38 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{133C02EA-5F56-4AB1-90E3-42F1EBDF09F4}
[2013/01/02 21:33:51 | 000,003,102 | ---- | M] () -- C:\Windows\SysNative\tasks\{13F58323-D6D4-4637-B35E-56C58B6E4096}
[2013/01/08 11:52:30 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{14059F30-0D1B-49F6-B507-DE7212F7B848}
[2012/12/25 22:14:40 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{14123AFB-31E2-437C-AFF5-469E6951673B}
[2013/01/10 09:01:43 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{14475078-D516-41AB-AD4A-8173DBD176FE}
[2012/10/27 13:23:45 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{14B0E181-6CFD-4EBD-B893-D1F128CF3F0B}
[2012/10/11 10:54:51 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{14D2F3A1-30D3-41B7-B72E-ABD0AC4AE082}
[2012/11/20 12:47:51 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{160BAFD7-1E6D-4485-9D96-8AC699E90A8D}
[2013/01/25 09:21:33 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{161BF736-D33C-4936-AA30-EDA6EADD6061}
[2012/10/09 07:36:08 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{1672E0C9-DCD2-43B5-80BA-80493F7DDF49}
[2013/03/05 21:40:50 | 000,003,116 | ---- | M] () -- C:\Windows\SysNative\tasks\{1721BF00-F4AD-4345-B3E1-F74184695C78}
[2011/03/04 20:22:57 | 000,002,758 | ---- | M] () -- C:\Windows\SysNative\tasks\{18238F68-53A9-476F-AB6C-30D10382853D}
[2013/01/28 16:50:39 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{1A4B5791-B0A0-4C50-B0BA-D2100D3DF90F}
[2013/01/19 14:05:56 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{1AC7D1A8-2B3F-46B7-AEF3-2FAB757FEF94}
[2013/02/01 20:39:56 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{1B7D42BA-32C0-496B-8597-9C838B317B76}
[2012/12/01 16:54:58 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{1BA546E1-C9AB-478B-BAD3-2FC99EF05AC8}
[2012/12/01 19:54:55 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{1D36548F-DE8F-481C-A49B-E95C69A04CDC}
[2012/09/23 09:26:46 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{1D36A951-77E4-4A40-8728-337F4C232478}
[2012/11/01 23:49:28 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{1DC038B8-7381-4665-8FB4-224C3FDD3AB6}
[2012/10/14 13:48:24 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{1E08134F-A5A0-4D99-8ED4-C238C7751F1C}
[2013/01/26 19:19:47 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{1EAAA1BC-86F9-4DB9-A699-4268C5EAAA8E}
[2012/09/27 08:02:55 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{1FAB4F31-9F23-45B0-9FA9-FEDB7A82E3D9}
[2013/02/04 00:14:39 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{2054E632-BF3A-4F41-83B4-9438E558583E}
[2013/02/05 17:05:13 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{2186CA69-80AD-456A-B5B9-B70F47DD5A55}
[2012/09/26 11:01:08 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{22DED5C5-F88E-4E1B-BC0B-F40641719530}
[2012/12/19 16:44:44 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{24E37E6C-754F-49F8-BBE4-6F0D435679C5}
[2012/10/06 15:59:21 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{259797BC-62E3-4D7A-B0F5-5BAEE58CA893}
[2013/01/30 08:49:44 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{267A4A57-801E-4FFA-B0CC-6A9698D4BCBF}
[2013/01/02 23:57:43 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{26A90B35-2654-4FB7-ACB1-B9F26C49D344}
[2013/01/25 20:33:07 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{271E62AE-546D-4B07-A307-6E9F1A5ADCB1}
[2011/03/04 20:24:25 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{27C39371-3922-4011-BC48-98A189CFABAD}
[2013/01/18 15:56:47 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{27D1B98C-D2E5-4DE5-AEB3-E5A635766751}
[2012/09/05 19:16:33 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{2813EEFC-48D4-4D02-99CF-668256F9E207}
[2013/01/22 13:30:01 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{2852D9BA-B2DE-4BF2-A126-B62DE9D85DC6}
[2012/09/24 15:50:11 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{2942FF2B-7888-47C5-BB1E-B32FD0A5C0E7}
[2013/01/09 16:34:08 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{29CE92B7-D4FF-4C01-A8E4-187F215FF499}
[2013/01/07 00:04:24 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{29D783E9-F790-4A0E-9B9E-EE35AD8DFC70}
[2012/10/25 22:32:08 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{2A4626EC-2963-469B-96F0-5E884FC1CDA2}
[2013/01/07 16:45:40 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{2BBF0C34-7A59-4F44-BC43-76BD32FE5B25}
[2012/12/21 00:13:11 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{2C26CFC9-1FEF-44AD-A51D-57CDF47AB65A}
[2013/01/14 12:04:10 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{2E34895B-6A54-4253-98F4-57C934AAC630}
[2012/10/13 14:03:24 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{2E39F65C-63BA-430D-9253-842FA9440873}
[2012/09/28 15:42:09 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{2E9B3DE8-B029-47EA-AD44-B1FAFE897164}
[2012/10/08 18:40:08 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{306C4584-CC14-4C37-8923-09F306837177}
[2012/12/18 13:57:21 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{3351422F-4729-43FF-9941-5B69BDDF34CC}
[2012/12/16 22:49:47 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{33A37774-1F76-434D-A89B-1644525668F6}
[2012/10/04 07:45:45 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{33E050AF-A547-4105-9346-F3BAAFEB1E0F}
[2013/02/01 13:43:14 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{34EB1460-E0FB-4560-8727-EF7894FD8D72}
[2012/12/22 19:00:20 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{34EDDE88-B588-4084-AE65-D2057278E0E1}
[2013/01/14 09:12:46 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{3531A692-426D-495E-90D7-12E7CA85E903}
[2012/10/11 15:57:26 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{3571D328-3D80-4C80-B719-F32941DC1E66}
[2013/01/19 16:51:02 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{36C76AA6-3E80-4647-BD61-DFE2209945F0}
[2012/12/25 14:43:23 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{36FE49AA-4B8E-4AFB-BB7E-CE8D16C71E3E}
[2012/10/05 22:54:45 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{37A031D1-6247-4C29-AD79-CBEB0552DCF2}
[2013/01/09 12:08:34 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{37F04637-ACEB-43BB-A855-A5012A85DC27}
[2012/11/04 14:47:39 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{38103F34-9331-462E-A218-44DDDF92D17C}
[2012/09/13 22:11:11 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{3893ABC4-9F02-4244-BE66-3C228AF60450}
[2013/01/12 19:15:14 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{38F4C17A-C863-4F3E-AE1B-2D25CDA114A5}
[2011/03/04 20:24:23 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{3905D924-A7C9-456C-A408-BF5607CA8533}
[2012/11/03 21:45:03 | 000,002,986 | ---- | M] () -- C:\Windows\SysNative\tasks\{396818F6-9DDB-43F7-AA4C-AC9FFEA27D2B}
[2013/01/28 08:53:28 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{39AF257D-1D8C-4A0B-884F-4A79A48B7302}
[2012/10/26 23:01:04 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{39D1A89B-6ED4-4D5D-B251-5248C8132122}
[2012/11/27 23:32:06 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{3A164BD9-46B1-4F02-9124-027C9A39AE5C}
[2012/11/07 00:08:19 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{3BCE4C5D-0C05-4896-9FCC-7CC4B1F7E2AC}
[2012/09/27 12:19:11 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{3BE470C5-A4AE-4CA6-AFF8-56889AD59AFA}
[2012/12/30 14:37:26 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{3DCFBD3B-2825-46E3-871D-58BAE0310B11}
[2011/03/04 20:24:21 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{3DE3B054-11C2-4C87-8600-B4AF7E2124BF}
[2013/02/08 13:43:14 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{3EBD1BC6-6B10-46EA-9EA9-6574BD59714B}
[2012/10/28 23:44:12 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{3EF1354F-0C94-483D-AC3D-F19818DF41C3}
[2013/02/03 16:24:45 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{40516EA8-36C2-4A15-8B32-B79920FE8C30}
[2013/02/05 00:13:17 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{40C39350-6229-45D6-BD26-92CEDB7E2A94}
[2012/11/01 17:13:55 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{4205F4BA-A49B-4254-AA46-142224D3A4DD}
[2012/11/17 16:53:52 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{42F09B25-42B5-47CA-A799-9F91B4093AFD}
[2012/10/28 10:21:36 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{445107DF-18A9-454C-BD6B-6BEC1268FCE9}
[2012/12/29 23:30:21 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{445250AC-AA2D-4B81-8E17-D3829338D1AD}
[2013/01/03 16:44:13 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{4657C8B3-4A9E-497B-8AB3-420DF55E9867}
[2012/12/28 23:17:51 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{46B83C9F-F719-4DA5-8003-0BB43DB68D26}
[2011/03/04 20:31:17 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{46C7F9A1-4814-4F04-A0A1-4AF33943DB1E}
[2012/10/12 16:11:05 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{46CAD249-CCD8-4647-A872-CFEF98870630}
[2013/01/13 16:31:30 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{47783290-E027-4380-A0C8-CB01B5ABEEB3}
[2012/12/24 12:24:40 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{482ECA03-70D4-4D85-82DE-9C0BDEE1E3C0}
[2012/09/22 18:30:25 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{48B57778-3C17-4F8F-9F37-1670C988C758}
[2011/03/04 20:31:14 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{48BF65CC-01F2-4BD4-8209-65A8AD69FDF9}
[2012/09/24 18:55:08 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{495E6B96-71C0-494D-80E9-5C65755FB78A}
[2012/12/28 11:56:17 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{4987590D-C840-4312-A840-BFD99612807D}
[2013/01/22 16:43:09 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{49FD10F0-B558-4BEB-AB53-13087FCFEE31}
[2012/09/18 22:20:21 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{4A8A566A-B20E-4FE7-9E68-C7C5BF544CD7}
[2013/01/20 23:30:20 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{4ADFD596-FB78-4D0D-BCC9-F757446B5ECC}
[2012/11/30 08:47:50 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{4AF78990-B897-4B49-A5D0-C1190E5AA8C7}
[2012/11/17 23:27:49 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{4B26B4DF-C4A3-460C-897C-E018CD47D976}
[2012/11/01 00:19:39 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{4B656564-2E3B-4576-BE25-B0DC9544116E}
[2012/12/02 14:41:45 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{4B91AC63-0589-480E-BC9A-D9AD17A9EA40}
[2013/02/07 16:58:42 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{4BD66EAA-D4AB-42F9-8CDB-A541A73B8D0F}
[2012/11/29 20:42:47 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{4C843453-2C3C-4326-B2C9-987D379CDE11}
[2012/10/05 07:22:57 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{4CA73161-73DA-4B1A-965D-AB09C94B4AEA}
[2012/10/22 15:39:11 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{4CE8C8E1-A97C-4160-BE86-0DEA65FE56F9}
[2013/02/06 09:17:45 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{4DA1C0D6-8AF0-477C-878E-4247E2FDF788}
[2012/12/05 22:51:11 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{4EBEB8EB-5818-486B-B405-05B262C6F13D}
[2012/09/26 09:40:48 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{4EC488AC-AE47-4D9A-8865-FD961022DCB9}
[2012/12/02 16:52:56 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{4FFAFD86-7FFF-40D6-B381-C8677361A590}
[2012/09/30 09:22:18 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{504A7FEB-609B-4BE0-88A0-834DB4D30410}
[2012/10/30 16:53:59 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{5069546F-EDCB-4E3A-884E-7E734FACBBB6}
[2013/01/11 13:22:48 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{51028A2B-7C4C-437E-9216-58223E758B20}
[2012/10/08 11:01:14 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{517A620A-A28E-42DA-97FE-CB8141300E83}
[2012/11/28 23:53:00 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{51D369E2-205E-46D8-BF4A-E23DD4B6525F}
[2012/12/29 12:04:14 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{52040BF0-3098-49D5-A724-B6693506FE91}
[2012/10/23 10:20:56 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{522321CC-5F9C-47A3-B7E8-DD55669E3933}
[2012/12/06 16:50:47 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{543CED65-6E55-4E4C-A59C-95204F0506E5}
[2012/09/23 19:53:25 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{54881447-6145-4A8D-868B-A7F71C105A09}
[2013/01/13 18:59:56 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{54EAB814-8382-4549-8909-6CD4F5CFED30}
[2012/10/19 07:09:37 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{556AA807-AAFA-43F0-8E63-FAB31146F3DA}
[2013/01/06 09:19:46 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{556E78A5-83BF-4DCC-9B18-A2C7D6DABB4F}
[2012/11/24 22:34:37 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{557E3971-5316-459B-B599-2B69A1DC0CE3}
[2012/12/24 00:48:35 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{55C7E8D8-C5DA-4291-A5C4-431DC903310B}
[2013/01/25 23:23:47 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{55E36EC6-8BB1-4174-8002-C81B7868C11F}
[2012/10/24 22:48:05 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{55F154E4-EDEE-46D1-97A9-AB5F14E78F9C}
[2013/01/24 09:03:48 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{5666C2A9-464C-49D6-ABD0-67FC0FEA921E}
[2013/01/16 22:14:12 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{56C5C122-C325-47EA-A233-854A704E7E35}
[2013/01/14 17:00:12 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{57FA0B87-0653-44A5-AD14-71CA8A1E1D47}
[2013/01/07 23:35:51 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{5820667B-847A-4E78-8B7E-18DCB446FD0C}
[2012/11/15 08:29:52 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{588BF048-020A-4C6D-BCF1-A86B9ADD3BCE}
[2013/01/21 20:15:28 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{596BFEB0-1DD2-40EC-BBA7-9B96703DE3EC}
[2013/01/12 14:22:30 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{5A1469AB-D47E-49F3-B7A7-6F1B028D8205}
[2012/12/09 13:53:09 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{5A1894AC-1EBE-4D75-9063-F750FE701A98}
[2013/01/15 16:34:04 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{5A1ACF51-A7C6-44DC-A6FB-D78AEDE68FA9}
[2012/12/10 11:33:38 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{5A2D0513-03C5-47D6-A15A-6C04F24EF95D}
[2012/12/01 13:47:07 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{5A96CAC3-057F-4708-A668-6A9DECDF4389}
[2012/12/29 13:36:32 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{5B47F55D-BA01-4EC2-89F2-584BAFEC8DA9}
[2013/01/31 23:45:53 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{5B4B49BC-C968-4885-958E-3C0A75114C41}
[2012/10/07 08:01:16 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{5C39F11D-42E1-4141-B7AC-796321F09D3B}
[2013/01/08 17:13:50 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{5EF0C674-BCF7-4E37-9AD6-2EE3CA6A7193}
[2011/03/04 20:31:11 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{5FE44986-DC3C-406B-A653-4DFBE4C0F4FF}
[2012/12/05 15:28:11 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{60562019-F0FD-4E7B-A682-C88029E364A5}
[2012/11/25 22:54:13 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{62BBD555-5375-4937-8737-F72E628BC377}
[2012/12/05 13:13:35 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{638628E8-D0BC-4A37-8B8C-5F62A8E479C1}
[2012/10/03 07:49:02 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{64E1A5E1-710B-4037-B2ED-C57646D542F3}
[2013/02/04 20:28:03 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{64E5D35C-F1E8-44EB-9E5D-4C7BD368701D}
[2012/12/10 23:39:29 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{64E99B8C-F79E-4319-9A7A-A219BFC7A93A}
[2013/01/17 00:18:13 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{65358CA2-ABE8-407E-9B74-73CF75B3F970}
[2012/12/22 22:57:34 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{65D6027D-8020-4758-9336-A453887EEE70}
[2012/12/15 16:36:36 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{65FE42EC-C6CF-46F7-A76B-454AB7E24E65}
[2012/09/20 16:00:29 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{6659EC54-42B5-4BFC-9D8E-40CAD8E0E459}
[2012/11/02 23:26:54 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{680BA847-F3A3-46AF-A7AB-59D11B038A4B}
[2012/11/05 16:47:09 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{69DEDC30-2B86-486A-8534-BF6AC0D0DB0C}
[2013/01/06 10:28:24 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{6B162686-3443-4A94-A858-55972E0BB848}
[2012/10/23 07:33:09 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{6B49ABEA-6BAB-47A3-AEFA-E1F89E7762C3}
[2012/10/09 10:53:31 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{6BF7C3DF-84E5-4783-93C9-C7A2641FA800}
[2012/09/20 07:42:04 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{6C1AFD85-9C42-4FF4-A498-4DE3D20AD152}
[2012/12/07 23:43:22 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{6CB8A641-C8DE-4834-878B-B80A3A41C74D}
[2012/12/09 14:47:34 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{6D5F8847-4597-4E51-9190-7BE69DA0DBC9}
[2012/10/26 15:53:29 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{6DC48EB0-B07B-4A1A-9BF2-6BC1F75D0FB7}
[2012/12/02 23:15:27 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{6DED2CB6-AAED-4432-A762-2BB13EE71D55}
[2013/02/02 16:23:55 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{6E752EC7-A0FB-42E9-807C-5AAECF128885}
[2013/01/05 16:48:20 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{6E8B0A82-EA3E-4F8A-84A8-308F473D5EED}
[2012/12/21 12:13:17 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{6EDC9BE6-32A9-475B-A6AE-2CCD8590B870}
[2012/10/24 16:01:58 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{6F4114E9-E80A-4EEE-8534-4B34AEE51F88}
[2013/01/17 23:56:58 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{7014BAA4-1A18-4778-B2C4-9A3BD8A9B57E}
[2012/11/18 14:58:55 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{71E0A457-68E9-427B-BC73-54D4A5F0FB76}
[2012/09/27 23:00:25 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{72328F97-34EE-4D10-BC50-D32AD0FEDD77}
[2012/12/20 17:11:45 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{72E0B780-960B-4BEE-A743-DBC16889CD53}
[2012/10/30 22:57:20 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{7403633C-0362-4CFF-B5F1-F2A5A788D63D}
[2012/12/14 08:57:23 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{75102181-062A-47DC-B2FF-3BEFDF3D4942}
[2012/12/27 18:38:26 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{7523EE6D-84A3-4131-BF28-D2C941CB07D7}
[2012/10/29 16:57:45 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{76667402-C360-4AD2-A244-0D3816BDE340}
[2012/10/16 11:03:11 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{76945B4F-EEC1-44DB-A740-4C971E5CA06A}
[2013/02/05 20:28:59 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{76992151-4E93-44A2-8821-9966CA1D8641}
[2012/10/01 10:54:17 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{779295CC-2470-41D7-8E30-2D53C545F83E}
[2012/12/25 15:36:46 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{7796504C-D3B6-4115-9F80-430D1B17BCDB}
[2012/12/08 23:27:05 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{78377B0C-3BF3-42A1-93FB-7881F9C29B9A}
[2012/09/16 08:30:02 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{78D246C5-C9FF-44F2-B869-434593E7DD8F}
[2012/11/25 14:41:54 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{79B3F670-DF64-446C-A830-5A4E8A3CC1DF}
[2013/01/06 14:52:41 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{79D4FDFC-8FAE-4159-B3AB-8963F25FFF80}
[2012/12/15 21:34:27 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{7A2F8FA9-5F83-4272-AB32-3E20C9BC79E5}
[2012/10/10 16:06:12 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{7A49342F-CD74-4B45-B7D2-B5FE59D3DFF2}
[2013/02/02 19:34:11 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{7A5D11ED-576B-4FBD-92C7-9EEFB47D5FB3}
[2012/11/30 16:54:32 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{7ADF8D71-56DA-4CB8-A944-6A8B23C66997}
[2012/10/06 22:56:35 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{7B0D1417-3A48-48F7-93FE-2684A1DFE999}
[2012/10/21 07:49:59 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{7B11BB2F-7EAC-4FEA-A958-8A8CBEA299A1}
[2012/11/28 16:53:34 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{7B7A2ACB-C8D2-42CB-B0B1-AAF5FBA5EFED}
[2012/10/18 07:17:37 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{7CE94A6D-870E-44B8-98CC-987866536ACB}
[2012/09/28 22:55:35 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{7D095AD1-2234-43D4-AAF5-E05C02246D13}
[2013/02/05 09:39:12 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{7D3D34A2-70D8-4AB0-815D-994F70A703A2}
[2012/10/29 23:47:21 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{7D719BB7-E965-4FB9-B514-1DD91A62F803}
[2012/10/08 11:13:48 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{7DFA6198-44C6-44D7-B522-EBAA01E4F8F4}
[2012/12/18 23:26:34 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{7F46382B-A73C-4454-8A02-DE5CDBDDFD95}
[2013/01/17 20:33:18 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{80304483-7D12-4F7C-9FB8-5BC1B4BA8BB8}
[2012/11/28 20:35:25 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{80C8C0DC-13DA-4859-AE0E-D6DEAD02783A}
[2012/12/17 13:38:37 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{8138E522-B01E-4C3D-A4EA-17D40344359B}
[2012/09/17 23:02:25 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{830253D4-408C-45B5-AFCA-5C773112E23C}
[2012/12/03 16:58:30 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{84016759-5D36-4B8F-86C1-D3D6CDB8513F}
[2012/09/15 22:43:17 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{8460004D-B02F-4C8D-B2C5-59C76314D487}
[2012/09/22 23:22:24 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{855EC570-55C9-451A-9122-A318EE4BF0A4}
[2013/01/26 23:02:27 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{86F22850-ABF7-45CE-A6AB-1F7FB28945AD}
[2012/09/17 16:07:11 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{877D0096-9888-47C8-9BF0-35F8419A2A77}
[2013/01/22 23:29:26 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{87C4718F-B5BF-4BC9-9710-4BA03C933F6D}
[2013/01/04 09:09:35 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{897C9BFE-AA3C-4F34-8C49-290F4B3ECBF1}
[2013/02/02 23:15:38 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{899F6AAE-061B-4673-85A6-FEC7AF26C2E5}
[2012/09/19 16:02:38 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{89A04B6C-41BD-42FC-8AA1-FB87093F6635}
[2012/10/16 10:22:57 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{89D178BE-A228-4EA6-94DC-50A6CD05A967}
[2013/01/02 16:46:19 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{8A39EBEF-B474-45CB-8326-C5E7933E0F8B}
[2012/10/31 17:00:31 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{8A74AA99-6B36-4C2C-8827-F1639858D848}
[2013/01/25 13:44:27 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{8AAE2191-D1CD-4941-BDCC-6E9672B44E0A}
[2013/01/22 19:49:47 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{8B44C92A-00D2-45BB-A039-E9751D9BAE69}
[2012/12/09 18:52:25 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{8B99CA76-0209-4ED4-86DC-B9390D68C780}
[2013/01/15 23:44:37 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{8BFCFDE2-C8EB-45C8-AD77-3A03070C93E3}
[2012/09/26 07:20:36 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{8C005AFC-22BB-4239-9DC9-08489544BBFD}
[2012/10/19 07:43:36 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{8C437078-D3B6-48B9-93BD-1BCF19612697}
[2012/12/19 13:28:40 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{8D8F3827-D61D-4586-86A2-C32526205776}
[2013/01/15 13:10:10 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{8DF1A5CB-B739-490C-B7A3-26BA46E2890A}
[2013/01/27 20:04:03 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{8FC35B70-A73F-4175-BAB9-43FE6B67134A}
[2013/01/10 16:37:31 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{908EE60B-3DD9-47A2-8303-3B5E2D66A6D0}
[2012/12/09 23:53:08 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{90E32E5F-A9D0-488C-9D60-C46340AEB37F}
[2013/01/31 15:53:32 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{911E4677-605D-42A7-BA2B-3C28D44E4138}
[2012/11/14 16:59:17 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{912FF90D-AA9E-40AC-BDAA-2CB6984ABF08}
[2013/01/16 20:36:27 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{914F5F2F-A73D-4BC0-9269-5F080C387FA2}
[2012/09/21 19:30:32 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{91558693-2495-451F-9018-0C46DAA1176D}
[2012/10/21 22:16:36 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{921D7CB4-AB36-4672-A933-A9BF6E532375}
[2012/10/30 11:51:19 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{92EE84B9-72EC-4000-B858-514FF4770CE0}
[2012/12/30 16:09:18 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{93948657-1A51-4479-8ACE-1645AE850B55}
[2012/10/11 23:15:29 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{93A81C3E-DF53-4815-8D07-40C32B59DF58}
[2012/11/02 16:22:41 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{9426BDE9-7E3B-4EED-9118-4A46A67AC0B7}
[2012/11/04 23:14:38 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{9431609A-136C-4EBA-A72E-8C406057E543}
[2012/12/23 09:29:39 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{947A6BBE-928A-497C-8C94-C00B9AF023EE}
[2012/11/03 22:39:45 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{948922B3-153F-4479-A39A-A12A8E3A4E9F}
[2012/09/20 19:56:40 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{949E8D62-425C-440B-AD3A-1F40B0F678F4}
[2013/01/26 14:12:57 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{95A31BD1-77C0-42E3-BD88-9564E9F95A15}
[2012/10/01 16:10:18 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{96126849-28B0-48A9-8656-59785189AF89}
[2013/02/09 08:47:25 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{965229DB-C2B3-473A-9A21-74E369A248B6}
[2013/02/03 15:10:00 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{967F1871-F8DB-4314-AB10-83E1A0AD4193}
[2012/12/01 22:46:07 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{96F85CC2-02EC-4161-9273-86E083955918}
[2013/01/11 16:56:50 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{979641A5-B2D8-48AB-9D4C-723AD4031693}
[2013/01/10 11:52:26 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{97BB82C1-F452-461C-8678-62A2C96AE80F}
[2013/01/16 17:01:06 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{97C6A0E4-F336-4BE7-80E1-72FBA1D4D4D4}
[2012/12/21 16:38:44 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{97DCB832-345F-4307-AF25-2939D236125C}
[2012/10/05 15:58:06 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{9857A2ED-6A1F-4378-8DBB-6DD2C4BF046E}
[2012/09/26 22:36:20 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{98C88D62-41D0-42B1-BE8A-D485E0966125}
[2012/10/27 16:14:24 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{98E0E235-72C0-4DBB-8424-C42707A6B358}
[2013/01/07 11:49:34 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{98E2D4A1-3BE7-45C5-8B14-5CA974340777}
[2012/12/06 23:53:33 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{9900D95B-941F-487A-B475-B1879CA682F3}
[2012/09/17 19:00:45 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{990AC902-0FED-42E9-92F3-BA95813C5D9B}
[2012/10/18 11:04:16 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{99BDA781-8B18-4F52-B16B-7F7F03A41A24}
[2013/02/07 23:39:49 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{9A185BB0-311D-4A55-8840-412B86D593B8}
[2013/01/04 16:37:44 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{9A96E387-EA24-47B5-80E5-D1179E5FBF0C}
[2013/01/06 09:49:34 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{9B894420-0131-4820-A4B3-374225F4D929}
[2012/11/08 08:41:11 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{9B9828E9-1413-4A86-9766-1891EAE88C51}
[2012/12/26 19:19:57 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{9BB7C8E8-EC19-48A9-95FB-FD979679BE67}
[2013/01/24 23:02:36 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{9C161872-1C69-4123-BDB6-D1D4047D89E2}
[2012/12/04 08:44:34 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{9D6D1C63-B7DF-4B8D-B5A1-6D1DDDCAD287}
[2013/02/08 16:46:44 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{9DED70FA-D259-4388-842C-52A9F9DB3033}
[2013/01/12 23:23:02 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{9FBECA74-39A0-4FE2-8071-9922E8176C3C}
[2012/10/19 16:06:17 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{A13F0025-DA88-42D6-B2F0-A9738578D454}
[2012/10/03 22:34:43 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{A14A3709-8141-429A-82FB-5DE593041DC3}
[2012/10/13 23:17:39 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{A1C93020-F1B7-4ABA-B061-9A75938C0B10}
[2012/09/22 15:48:47 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{A1D657F6-767C-4716-909B-F714373994CE}
[2012/11/06 16:56:11 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{A2042059-1242-48F6-A605-760CED93F289}
[2012/11/20 13:40:49 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{A29A70A8-58DD-4BE5-B94D-211D05ADB801}
[2013/01/21 09:11:13 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{A3E00ABA-7E79-4320-9A9E-40878EA3A954}
[2013/01/24 09:42:55 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{A3EC8D01-657B-4E73-80DC-A4764A5B0732}
[2012/10/15 22:28:27 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{A4424D35-0A06-4B71-921A-F5C685D69736}
[2012/10/21 16:10:40 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{A46EC343-21ED-4914-B487-307B694892CB}
[2012/10/14 09:25:09 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{A474880F-3FDF-4BFE-A604-7F1F8379D4C9}
[2012/11/30 20:12:41 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{A4808DBF-FCA4-4F17-AD8C-9E610463D268}
[2012/10/09 23:06:25 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{A4C5A257-7C79-4744-B414-4B4F1070A49E}
[2012/09/16 18:48:08 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{A563E28C-6E44-47E4-9234-BBC273559977}
[2012/09/15 06:04:43 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{A57EC87D-A6DC-455E-9685-1273B1791678}
[2013/02/04 12:48:44 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{A64B7B2B-5452-4A63-B285-6D069F2E23A4}
[2012/11/03 16:55:15 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{A7B7CFB2-02AC-4E2F-86A4-7E19B883562D}
[2013/01/13 23:39:03 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{A82E06DE-5F0D-4795-8212-354F18511C8B}
[2013/01/10 23:40:07 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{A9893523-C825-4C3C-883B-9CCC8306D0B4}
[2013/01/30 20:36:05 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{AB41B841-6D8F-40C8-A9D7-B0E1537B1B32}
[2013/02/08 15:20:21 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{ABA529A6-BECB-416F-A158-1C65E960FAC4}
[2012/10/30 16:16:32 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{AC1CCE5C-3137-4CC1-A70E-E7CD58F19FDE}
[2013/02/01 09:24:36 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{AC52691B-F433-4656-9A9E-9CB5BC126A40}
[2012/12/31 09:24:40 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{AD439006-9B77-40D8-9B9F-FA352A7736B7}
[2012/11/19 16:48:57 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{ADA6D8AD-5ECD-47E0-ADC0-A8E7B995E8A6}
[2013/01/30 23:48:28 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{AE73A040-DFC1-4A1B-A81E-09BC7855A689}
[2011/03/04 20:31:00 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{AF4FC14D-0075-449B-9463-7B6913D344ED}
[2013/01/30 13:32:40 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{AFF57B91-18F5-49E2-883F-5DEB16639827}
[2012/12/05 16:57:35 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{B0F3E5B8-9DCA-46C5-A9AD-F2183C12752B}
[2013/01/18 23:34:03 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{B114FBD2-1DA8-4BC5-AE78-B00633E58C4A}
[2013/01/15 09:10:07 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{B1AC5A3E-B979-4118-912A-95672B901949}
[2013/01/30 16:47:34 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{B2A5C632-7B01-43D7-915F-AF76A81BBE28}
[2012/12/09 16:52:53 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{B39A7CFB-CD7D-404B-AC73-C6F7CB9340C4}
[2012/10/07 13:22:36 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{B47D5112-AB09-4181-9CC5-8D9F99E2D61F}
[2013/01/20 14:58:48 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{B53DE880-F38B-4C57-A2D3-1C50FCB621FA}
[2012/09/05 22:56:00 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{B64EE87B-0F44-4707-BE33-76B5635D3214}
[2012/10/08 23:44:56 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{B68B39F9-F0B5-4F1B-9DA3-59C1F94AA939}
[2012/12/11 23:48:32 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{B6EA583C-E588-4524-A546-D3AC47428555}
[2013/01/18 19:27:37 | 000,003,140 | ---- | M] () -- C:\Windows\SysNative\tasks\{B7B6A4BF-0AAD-4095-AB47-A92AB231B215}
[2013/01/05 14:10:49 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{B7BA53C2-4643-433A-AFC1-B5D02014CD4C}
[2012/11/18 10:24:22 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{B8EA589A-F7A7-4D8E-9112-0FE73C379952}
[2012/12/30 19:21:22 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{BAB8B572-04FE-4CB1-BB8B-0BA991406543}
[2012/12/18 17:01:15 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{BB2BA7A5-BF50-4E2F-AFCA-D9E64E380942}
[2012/09/30 13:47:17 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{BBBA5219-9C32-45C3-A5A3-6921C4A4AB95}
[2012/10/24 07:43:57 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{BC6175B1-F290-4B52-9406-6C5FC5B67482}
[2012/10/07 09:32:42 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{BC9A7D74-62FB-4F02-B532-FFF2F4F1B68B}
[2012/12/27 16:24:02 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{BCDA932D-71EB-413A-8B86-4342FFD212D8}
[2012/12/28 08:12:43 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{BDA1C6C9-09A3-4826-A3EF-AE964DA3ABE1}
[2012/09/18 19:31:12 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{BDBC6AA9-5917-4E39-B456-61BA623E1A03}
[2011/03/04 20:31:19 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{BDEBE6CF-8B1D-460A-A137-CF78433F9C03}
[2012/09/21 13:47:48 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{BE29141A-32A4-4270-A25B-A0D6346196D7}
[2012/11/15 20:09:17 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{BE66DAC4-7578-49B3-8433-411E9B5643AB}
[2013/01/11 20:33:07 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{BF1564DF-5D9F-49AC-AD49-0A4065267ED6}
[2013/02/01 23:53:01 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{BF1A83D1-AC1B-4487-9C78-A8716F3B8E4A}
[2012/10/15 15:45:39 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{BF34634F-610F-4E32-B0D5-23F3A93FFB5C}
[2013/02/01 16:37:33 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{C0D589EA-50AF-44DE-B3FF-F17A401F669E}
[2012/12/11 17:03:49 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{C16D6542-D09C-46EC-BA22-C96516FA62DA}
[2013/01/01 17:02:26 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{C38A5A6A-7E62-4531-986D-07CE0894A2F5}
[2012/11/20 09:20:16 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{C4EDC788-ECF5-4D59-AC09-469B261578C9}
[2012/10/17 11:09:20 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{C536A61C-1F54-493F-A908-2B8D4FC329BF}
[2012/12/18 08:35:24 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{C5806AC9-C150-4D7A-AD40-F3A1ECB9EBFE}
[2013/01/14 13:13:00 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{C73EB754-B89C-4F53-9A83-5ABE256CBE01}
[2012/09/17 14:23:33 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{C745B2B2-EEE7-4329-8BBD-DEA6F61EF13F}
[2013/02/08 20:30:19 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{C867517B-6D88-4324-87C8-1A150F455FA7}
[2012/11/30 00:09:12 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{C89D08DA-B271-44A0-BAB3-D4C7E157B541}
[2013/01/29 16:36:57 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{C909516B-6912-4D4D-91C6-CF22669701D1}
[2012/12/02 10:27:10 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{CA040947-5FBD-4E6D-A2CC-DE2B9C68C485}
[2012/11/15 16:53:02 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{CB8B2A16-9AF6-4FAC-A183-9E071C88AB9B}
[2012/11/29 17:09:40 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{CBFA0DC4-2880-4E74-B8BD-ABDCB4B61568}
[2013/04/15 08:00:54 | 000,003,164 | ---- | M] () -- C:\Windows\SysNative\tasks\{CC5001D5-9895-4BDE-ADD4-91469E526892}
[2012/12/12 15:53:42 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{CCB1141E-9981-4E13-8C57-96E5D746DDE3}
[2012/12/21 11:26:01 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{CD69430A-876E-4BD2-9AF0-B83B0558B508}
[2012/10/19 21:27:46 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{CF6D1AAC-770A-4337-AB0E-8B45307BBE50}
[2013/01/13 10:21:38 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{D0571D80-AF10-4159-B7F0-FBA4119C9637}
[2012/11/25 19:29:28 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{D1650CAE-D385-475F-B1F8-33C52AB11845}
[2013/01/15 00:00:41 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{D2D18017-8964-4FC2-B960-A83BADD5752E}
[2013/01/13 14:31:49 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{D3178701-DB08-4EB4-976E-E269DF72B799}
[2012/10/21 09:25:42 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{D3B4B5BA-E4E7-44F3-A15F-2427D8ACE965}
[2012/09/29 22:57:21 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{D4077877-A9D3-44AF-9F6C-3E70624D5F7B}
[2012/11/30 23:39:07 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{D457D20C-8A7A-44E6-9B66-2695A8635AB4}
[2012/12/04 16:45:58 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{D767EAC8-B50E-4053-9758-1894739ADA58}
[2013/01/22 00:01:11 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{D86FC274-ED38-441D-AE6C-C4AFFD7B6884}
[2013/02/06 23:53:00 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{D9E70FA0-A583-4460-A5EC-205D89D3AA66}
[2012/12/07 16:42:24 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{DA062007-7997-45C2-BDA8-2A976343D9FA}
[2012/10/09 18:37:47 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{DAD18EC0-0E9E-4D6E-9278-8AC46D16DF1C}
[2012/09/21 22:09:11 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{DC136D4C-5CE8-4CCE-B28D-15988AD2C560}
[2012/12/24 22:15:14 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{DC2034E3-23B4-418F-AD0C-9CA023C49719}
[2011/03/04 20:24:27 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{DC47D7E7-06B3-4F66-98DF-79FEFA78DA16}
[2013/01/29 11:38:11 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{DC69A2CC-FF32-4239-ADBD-743C0C39E476}
[2012/10/06 13:17:38 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{DC8B20D0-9190-4C9A-A78D-F7F1710C0587}
[2012/10/01 23:16:39 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{DE225B6C-3CA0-476D-A9C4-1C41C55790C9}
[2012/12/22 13:50:15 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{DEF9583B-46EA-4546-B8EA-E83828A3C44D}
[2012/09/23 13:27:08 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{DF4A47BC-B0CB-42D8-B54A-DF15E36921FE}
[2012/11/25 16:54:15 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{DFA950F6-C038-445B-9E3C-8C621E159167}
[2012/12/02 19:41:05 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{E0273E95-EF1D-4855-B806-4BE4C154FF06}
[2013/01/12 16:40:44 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{E156E0FD-C392-4435-9F4B-E6D3F27D5027}
[2011/03/04 20:32:06 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{E1A11369-3857-48CD-A739-5876D056A9F4}
[2013/01/20 00:15:01 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{E1E65C77-688C-4DDA-AF3F-5185EA4E2958}
[2012/12/25 17:14:56 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{E200B99F-6199-49A6-8E21-FEC21249989F}
[2012/10/13 18:14:29 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{E2614C8F-C69A-4A46-8561-DC301110FA1B}
[2013/01/18 12:05:46 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{E290C2AF-DB71-4B35-BC9B-60F761876A22}
[2012/09/23 08:47:50 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{E449ECDA-ABC9-4153-82F2-867CDBA02232}
[2013/01/28 20:36:51 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{E4EB7EBD-6D78-4E22-B68C-2A67A2F63AB8}
[2011/03/04 20:31:06 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{E51B6117-4776-4B59-AEDD-4AE9F56DC6B1}
[2012/09/23 23:11:53 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{E55E0C53-D68E-4BD7-AD86-A60A2D36446B}
[2012/12/10 16:57:22 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{E583451E-41D9-4DD0-9FE5-BB64252E4957}
[2012/11/27 00:20:36 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{E6927B70-B02F-400D-809B-43CE08761EDA}
[2012/11/08 16:57:47 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{E6D60D1F-C54A-42FC-8242-1F81AF0FEC42}
[2012/12/04 23:38:15 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{E7072ED1-E2E6-46F0-A066-33E7B16D278C}
[2012/12/23 15:08:55 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{E73E0F40-B1B3-4972-9D7B-6DD900FA9A73}
[2012/11/07 16:52:16 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{E811FA29-B844-45A5-A100-999F8662BBC5}
[2012/09/15 17:48:08 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{E8B3670D-4588-40B6-9A16-51CCCF813AEE}
[2013/01/05 19:05:18 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{E8D69631-7E89-4C73-BC34-BC0D12A07F11}
[2012/11/26 19:47:50 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{E9972B4C-A09C-467C-A05D-48BE923B5ADA}
[2012/12/22 08:06:24 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{EB8C0CD5-9F49-46CB-B6C2-449E0A809202}
[2012/12/15 13:42:15 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{EBEA5EB9-C006-4084-A500-689508B271F1}
[2012/10/25 15:47:28 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{EC8965A1-07B2-4528-AFC3-8EA6BDE92837}
[2013/02/04 16:23:24 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{ED2EB6BB-193B-42B0-B695-0C96BCAF0DCE}
[2012/09/19 19:30:08 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{ED3635A3-9076-4642-9978-6E32D5F5EB15}
[2011/03/04 20:20:21 | 000,003,290 | ---- | M] () -- C:\Windows\SysNative\tasks\{EE2C010C-D6FA-4EBA-93E3-566CCAFA38E7}
[2012/10/04 16:11:20 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{EE3C9484-0251-4F91-94BD-2FCE8917E185}
[2012/10/16 22:18:13 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{EEA55960-BD38-4A7F-8019-4C536AC78ACA}
[2012/10/13 15:28:03 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{EFDF3337-C855-4B63-BE36-4F71C86C1078}
[2011/03/04 20:24:12 | 000,003,386 | ---- | M] () -- C:\Windows\SysNative\tasks\{F05DC8AE-14FF-4A7B-BAD0-A548CEA190B5}
[2012/12/28 16:09:42 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{F0B71CEB-C034-4030-BDDB-F5247724F553}
[2012/10/10 22:48:57 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{F0D2AD24-9B54-454D-A45A-3ABB3EC1C7A9}
[2012/12/16 10:23:02 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{F3119022-3A9B-4019-98F7-8E22196FED9F}
[2012/10/28 16:25:16 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{F37B161E-B58E-4064-A6A2-BBFC78119ECF}
[2013/01/29 09:02:58 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{F41AA588-4C1E-482E-B72B-0009BBF81DD1}
[2013/01/25 16:51:09 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{F42BBB8E-AEF8-4841-BEFF-9780E4CE09D3}
[2012/09/28 07:46:37 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{F49E1563-1AE0-4536-84F6-ECD1E5FBA4DF}
[2013/01/10 19:46:06 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{F4FE9A19-1EB9-4542-8C77-2CB45473CCFA}
[2013/01/20 09:28:05 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{F5E7BA63-48AC-4196-B907-FAC4E85F51A7}
[2012/10/17 15:37:46 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{F6F7A0B0-70F1-4A75-8227-A3641A53B74D}
[2012/11/24 19:54:26 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{F74218E2-3E63-4870-B668-839B6E19AECF}
[2013/02/06 17:31:01 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{F7C0633A-1B08-4370-962B-19EE9A87E01B}
[2013/01/04 23:30:09 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{F86FFABA-93B4-4B29-B4B0-3C3A6A2BC174}
[2012/10/14 22:30:57 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{F89E1210-88BB-485B-88A6-1757C5F515BD}
[2012/12/08 16:59:00 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{F900E470-8C42-4DB4-B0CF-12367023E5F0}
[2013/01/15 19:42:40 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{F9AA89E0-904A-412E-8EF0-62DB32BFF047}
[2012/09/19 23:04:48 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{F9BCF7B2-359D-4A60-994A-FF0EAA20C2FB}
[2012/11/19 20:24:34 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{FAFD0C33-3167-4A63-8A5D-ACAE566A42E2}
[2013/01/23 16:46:33 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{FBB77A98-A1F1-40F2-9284-AF9CF50A64FE}
[2013/01/26 17:03:51 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{FC0BA82E-16B8-4489-AE84-E7470F2F4F41}
[2012/10/11 07:48:53 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{FC39DE98-9520-4AAF-AD0D-3F99E47B2282}
[2012/12/20 11:39:36 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{FD310B47-7F2C-47AB-BF1C-69341301DC7E}
[2012/09/24 22:53:27 | 000,003,100 | ---- | M] () -- C:\Windows\SysNative\tasks\{FD69BBF3-1C70-43CF-A806-7891476AE74E}
[2012/12/14 16:38:06 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{FE4B534A-0526-4B59-927E-D6869FF5FFAC}
[2013/01/11 23:21:42 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{FF3DEE7D-9A02-4CD1-A13F-BE3685B1A097}
[2012/12/14 23:27:43 | 000,003,088 | ---- | M] () -- C:\Windows\SysNative\tasks\{FF42B429-AF1A-4B5E-BEF1-BA0477DFA612}

< %systemroot%\Fonts\*.exe >

< %systemroot%\*. /mp /s >

< MD5 for: ATAPI.SYS >
[2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\erdnt\cache64\atapi.sys
[2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

< MD5 for: EXPLORER.EXE >
[2011/02/26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/02/25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\erdnt\cache86\explorer.exe
[2011/02/25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011/02/25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\SoftwareDistribution\Download\dc27c38d9b7eaf96642aee3cb3400730\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2010/11/20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\SoftwareDistribution\Download\dc27c38d9b7eaf96642aee3cb3400730\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2010/11/20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: REGEDIT.EXE >
[2009/07/14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\erdnt\cache86\regedit.exe
[2009/07/14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe
[2009/07/14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe
[2009/07/14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe
[2009/07/14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe

< MD5 for: SERVICES.EXE >
[2009/07/14 02:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\erdnt\cache64\services.exe
[2009/07/14 02:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\SysNative\services.exe
[2009/07/14 02:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SVCHOST.EXE >
[2009/07/14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\erdnt\cache86\svchost.exe
[2009/07/14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe
[2009/07/14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\erdnt\cache64\svchost.exe
[2009/07/14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\SysNative\svchost.exe
[2009/07/14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USER32.DLL >
[2010/11/20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\erdnt\cache86\user32.dll
[2010/11/20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SoftwareDistribution\Download\dc27c38d9b7eaf96642aee3cb3400730\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010/11/20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010/11/20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010/11/20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\erdnt\cache64\user32.dll
[2010/11/20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SoftwareDistribution\Download\dc27c38d9b7eaf96642aee3cb3400730\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
[2010/11/20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010/11/20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

< MD5 for: USERINIT.EXE >
[2010/11/20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\erdnt\cache86\userinit.exe
[2010/11/20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SoftwareDistribution\Download\dc27c38d9b7eaf96642aee3cb3400730\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010/11/20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\erdnt\cache64\userinit.exe
[2010/11/20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SoftwareDistribution\Download\dc27c38d9b7eaf96642aee3cb3400730\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
[2010/11/20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010/11/20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\erdnt\cache64\winlogon.exe
[2010/11/20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SoftwareDistribution\Download\dc27c38d9b7eaf96642aee3cb3400730\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2010/11/20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010/11/20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

< %Temp%\smtmp\* \s >

< %Temp%\smtmp\1\*.* >

< %Temp%\smtmp\2\*.* >

< %Temp%\smtmp\3\*.* >

< %Temp%\smtmp\4\*.* >

< dir "%systemdrive%\*" /S /A:L /C >
Volume in drive C is WINDOWS
Volume Serial Number is 6633-8FED
Directory of C:\
14/07/2009 06:08 <JUNCTION> Documents and Settings [C:\Users]
0 File(s) 0 bytes
Directory of C:\ProgramData
14/07/2009 06:08 <JUNCTION> Application Data [C:\ProgramData]
14/07/2009 06:08 <JUNCTION> Desktop [C:\Users\Public\Desktop]
14/07/2009 06:08 <JUNCTION> Documents [C:\Users\Public\Documents]
14/07/2009 06:08 <JUNCTION> Favorites [C:\Users\Public\Favorites]
14/07/2009 06:08 <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
14/07/2009 06:08 <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users
14/07/2009 06:08 <SYMLINKD> All Users [C:\ProgramData]
14/07/2009 06:08 <JUNCTION> Default User [C:\Users\Default]
0 File(s) 0 bytes
Directory of C:\Users\All Users
14/07/2009 06:08 <JUNCTION> Application Data [C:\ProgramData]
14/07/2009 06:08 <JUNCTION> Desktop [C:\Users\Public\Desktop]
14/07/2009 06:08 <JUNCTION> Documents [C:\Users\Public\Documents]
14/07/2009 06:08 <JUNCTION> Favorites [C:\Users\Public\Favorites]
14/07/2009 06:08 <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
14/07/2009 06:08 <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\ann
31/01/2011 17:56 <JUNCTION> Application Data [C:\Users\ann\AppData\Roaming]
31/01/2011 17:56 <JUNCTION> Local Settings [C:\Users\ann\AppData\Local]
31/01/2011 17:56 <JUNCTION> My Documents [C:\Users\ann\Documents]
31/01/2011 17:56 <JUNCTION> NetHood [C:\Users\ann\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
31/01/2011 17:56 <JUNCTION> PrintHood [C:\Users\ann\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
31/01/2011 17:56 <JUNCTION> Recent [C:\Users\ann\AppData\Roaming\Microsoft\Windows\Recent]
31/01/2011 17:56 <JUNCTION> SendTo [C:\Users\ann\AppData\Roaming\Microsoft\Windows\SendTo]
31/01/2011 17:56 <JUNCTION> Start Menu [C:\Users\ann\AppData\Roaming\Microsoft\Windows\Start Menu]
31/01/2011 17:56 <JUNCTION> Templates [C:\Users\ann\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\ann\AppData\Local
31/01/2011 17:56 <JUNCTION> Application Data [C:\Users\ann\AppData\Local]
31/01/2011 17:56 <JUNCTION> History [C:\Users\ann\AppData\Local\Microsoft\Windows\History]
31/01/2011 17:56 <JUNCTION> Temporary Internet Files [C:\Users\ann\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\ann\Documents
31/01/2011 17:56 <JUNCTION> My Music [C:\Users\ann\Music]
31/01/2011 17:56 <JUNCTION> My Pictures [C:\Users\ann\Pictures]
31/01/2011 17:56 <JUNCTION> My Videos [C:\Users\ann\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Default
14/07/2009 06:08 <JUNCTION> Application Data [C:\Users\Default\AppData\Roaming]
14/07/2009 06:08 <JUNCTION> Local Settings [C:\Users\Default\AppData\Local]
14/07/2009 06:08 <JUNCTION> My Documents [C:\Users\Default\Documents]
14/07/2009 06:08 <JUNCTION> NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
14/07/2009 06:08 <JUNCTION> PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
14/07/2009 06:08 <JUNCTION> Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
14/07/2009 06:08 <JUNCTION> SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
14/07/2009 06:08 <JUNCTION> Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
14/07/2009 06:08 <JUNCTION> Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default\AppData\Local
14/07/2009 06:08 <JUNCTION> Application Data [C:\Users\Default\AppData\Local]
14/07/2009 06:08 <JUNCTION> History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
14/07/2009 06:08 <JUNCTION> Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Default\Documents
14/07/2009 06:08 <JUNCTION> My Music [C:\Users\Default\Music]
14/07/2009 06:08 <JUNCTION> My Pictures [C:\Users\Default\Pictures]
14/07/2009 06:08 <JUNCTION> My Videos [C:\Users\Default\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Public\Documents
14/07/2009 06:08 <JUNCTION> My Music [C:\Users\Public\Music]
14/07/2009 06:08 <JUNCTION> My Pictures [C:\Users\Public\Pictures]
14/07/2009 06:08 <JUNCTION> My Videos [C:\Users\Public\Videos]
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
48 Dir(s) 86,973,313,024 bytes free

========== Alternate Data Streams ==========

@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:373E1720
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0B4227B4
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP1B5B4F1

< End of report >


----------



## eddie5659 (Mar 19, 2001)

Cookiegal said:


> Just wanted to let you know that I've merged the emjo account into the Frincis one. That means that all posts made by emjo will now show as having been made by Frincis.
> 
> Please carry on as usual.


Thanks Cookie :up:

Ann, can you update Java as here, and post a new Security Check log 

Going through the new logs you posted now


----------



## Cookiegal (Aug 27, 2003)

You're welcome Eddie.


----------



## sweetrose (Sep 7, 2012)

thanks cookiegal.....sorry about all that.......4
Eddie im doing it now for you


----------



## eddie5659 (Mar 19, 2001)

oki doki


----------



## sweetrose (Sep 7, 2012)

Results of screen317's Security Check version 0.99.64 
Windows 7 Service Pack 1 x64 (UAC is enabled) 
Internet Explorer 10 
*``````````````Antivirus/Firewall Check:``````````````* 
Windows Firewall Enabled! 
AVG AntiVirus Free Edition 2013 
Antivirus up to date! 
*`````````Anti-malware/Other Utilities Check:`````````* 
Java 7 Update 21 
Google Chrome 27.0.1453.110 
Google Chrome 27.0.1453.94 
Google Chrome Plugins... 
*````````Process Check: objlist.exe by Laurent````````* 
AVG avgwdsvc.exe 
*`````````````````System Health check`````````````````* 
Total Fragmentation on Drive C: 9% 
*````````````````````End of Log``````````````````````*


----------



## eddie5659 (Mar 19, 2001)

Excellent 

Okay, onto the next thing....

Run OTL 

Under the *Custom Scans/Fixes* box at the bottom, paste in the following


```
:OTL
DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&a...1548855096&ir=
IE:64bit: - HKLM\..\SearchScopes\{56369BA8-0140-7F16-6997-7A636D1E1A62}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0 B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&a...1548855096&ir=
IE - HKLM\..\SearchScopes\{24345616-2C3A-A6E8-D18D-6EBD213B3971}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0 B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&a...1548855096&ir=
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www.delta-search.com/?q={searchTerms}&affID=119556&babsrc=SP_ss&mntrId=663388252CBA0AA8
IE - HKCU\..\SearchScopes\{8E145907-CFA8-49D4-98B8-A9C1C7C85C30}: "URL" = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0 B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
IE - HKCU\..\SearchScopes\{CFA8133F-6AFA-4D5A-8C2B-E6E9626D8E06}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U4&ap n_dtid=OSJ000YYUK&apn_uid=11562A4A-C609-471F-8C27-4F32C225FE77&apn_sauid=9084271E-6BF3-4FBA-AE9C-4484D76A606E
O2 - BHO: (no name) - {DCC39ACE-709B-44EA-B062-5F6BE2774644} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
[2013/06/07 19:03:19 | 000,000,000 | ---D | C] -- C:\Users\ann\AppData\Roaming\mysearchdial
[2013/06/07 19:03:42 | 000,000,397 | ---- | M] () -- C:\Users\Public\Desktop\MySearchDial.url
[2013/06/07 19:03:18 | 000,423,709 | ---- | M] () -- C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx
[35 C:\Windows\Installer\*.tmp files -> C:\Windows\Installer\*.tmp -> ]
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:373E1720
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0B4227B4
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:D1B5B4F1
:Files
ipconfig /flushdns /c
:Commands
[emptytemp]
[purity] 
[CREATERESTOREPOINT]
```

Then click the *Run Fix* button at the top 
Click OK.
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply.The log is saved in the same location as OTL.


----------



## sweetrose (Sep 7, 2012)

Results of screen317's Security Check version 0.99.64 
Windows 7 Service Pack 1 x64 (UAC is enabled) 
Internet Explorer 10 
*``````````````Antivirus/Firewall Check:``````````````* 
*Windows Security Center service is not running! This report may not be accurate!* 
Windows Firewall Enabled! 
AVG AntiVirus Free Edition 2013 
Antivirus up to date! 
*`````````Anti-malware/Other Utilities Check:`````````* 
Java 7 Update 21 
Google Chrome 27.0.1453.110 
Google Chrome 27.0.1453.94 
Google Chrome Plugins... 
*````````Process Check: objlist.exe by Laurent````````* 
AVG avgwdsvc.exe 
*`````````````````System Health check`````````````````* 
Total Fragmentation on Drive C: 8% 
*````````````````````End of Log``````````````````````*


----------



## sweetrose (Sep 7, 2012)

All processes killed
========== OTL ==========
Error: No service named esgiguard was found to stop!
Service\Driver key esgiguard not found.
File C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56369BA8-0140-7F16-6997-7A636D1E1A62}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56369BA8-0140-7F16-6997-7A636D1E1A62}\ not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{24345616-2C3A-A6E8-D18D-6EBD213B3971}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24345616-2C3A-A6E8-D18D-6EBD213B3971}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8E145907-CFA8-49D4-98B8-A9C1C7C85C30}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8E145907-CFA8-49D4-98B8-A9C1C7C85C30}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CFA8133F-6AFA-4D5A-8C2B-E6E9626D8E06}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFA8133F-6AFA-4D5A-8C2B-E6E9626D8E06}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DCC39ACE-709B-44EA-B062-5F6BE2774644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DCC39ACE-709B-44EA-B062-5F6BE2774644}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ae07101b-46d4-4a98-af68-0333ea26e113} not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ae07101b-46d4-4a98-af68-0333ea26e113} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ not found.
File Protocol\Handler\skype4com - No CLSID value found not found.
Folder C:\Users\ann\AppData\Roaming\mysearchdial\ not found.
File C:\Users\Public\Desktop\MySearchDial.url not found.
File C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx not found.
File/Folder C:\Windows\Installer\*.tmp not found.
Unable to delete ADS C:\ProgramData\TEMP:373E1720 .
Unable to delete ADS C:\ProgramData\TEMP:0B4227B4 .
Unable to delete ADS C:\ProgramData\TEMP:5C321E34 .
Unable to delete ADS C:\ProgramData\TEMP1B5B4F1 .
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\ann\Downloads\cmd.bat deleted successfully.
C:\Users\ann\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========[EMPTYTEMP]

User: All Users

User: ann
->Temp folder emptied: 2257 bytes
->Temporary Internet Files folder emptied: 135844 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 467825 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2093 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 06132013_211713

Files\Folders moved on Reboot...
File\Folder C:\Users\ann\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File\Folder C:\Users\ann\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


----------



## sweetrose (Sep 7, 2012)

i did a reboot


----------



## eddie5659 (Mar 19, 2001)

Thanks 

Now, before we run some other tools, I noticed you have a large amount of tasks running. As the sizes seem to be the same, I'll just look at a few, as a snapshot.

So, can you do the following for me:

Run *OTL*

Hit *None* button.










It will then look like this:










Under the *Custom Scans/Fixes* box at the bottom, paste in the following


```
type C:\Windows\SysNative\tasks\{00BC1703-9104-4547-9046-82BF662A6C0D} /c
type C:\Windows\SysNative\tasks\{017D6C9E-60F2-4368-A830-2C4CAFBDFF4A} /c
type C:\Windows\SysNative\tasks\{02F9E465-5EC7-4745-897D-A644C49C723C} /c
type C:\Windows\SysNative\tasks\{13F58323-D6D4-4637-B35E-56C58B6E4096} /c
type C:\Windows\SysNative\tasks\{1721BF00-F4AD-4345-B3E1-F74184695C78} /c
type C:\Windows\SysNative\tasks\{18238F68-53A9-476F-AB6C-30D10382853D} /c
type C:\Windows\SysNative\tasks\{396818F6-9DDB-43F7-AA4C-AC9FFEA27D2B} /c
type C:\Windows\SysNative\tasks\{B7B6A4BF-0AAD-4095-AB47-A92AB231B215} /c
type C:\Windows\SysNative\tasks\{CC5001D5-9895-4BDE-ADD4-91469E526892} /c
type C:\Windows\SysNative\tasks\{EE2C010C-D6FA-4EBA-93E3-566CCAFA38E7} /c
```

Hit *Run Scan* button.

It will produce a log for you, please post that log in your next reply. The log is saved in the same location as OTL.

eddie


----------



## sweetrose (Sep 7, 2012)

ok and sorry Eddie


----------



## eddie5659 (Mar 19, 2001)

That's okay, just saw the hundreds you have, so just checking they're okay


----------



## sweetrose (Sep 7, 2012)

rror: Unable to interpret <type C:\Windows\SysNative\tasks\{00BC1703-9104-4547-9046-82BF662A6C0D} /c> in the current context!
Error: Unable to interpret <type C:\Windows\SysNative\tasks\{017D6C9E-60F2-4368-A830-2C4CAFBDFF4A} /c> in the current context!
Error: Unable to interpret <type C:\Windows\SysNative\tasks\{02F9E465-5EC7-4745-897D-A644C49C723C} /c> in the current context!
Error: Unable to interpret <type C:\Windows\SysNative\tasks\{13F58323-D6D4-4637-B35E-56C58B6E4096} /c> in the current context!
Error: Unable to interpret <type C:\Windows\SysNative\tasks\{1721BF00-F4AD-4345-B3E1-F74184695C78} /c> in the current context!
Error: Unable to interpret <type C:\Windows\SysNative\tasks\{18238F68-53A9-476F-AB6C-30D10382853D} /c> in the current context!
Error: Unable to interpret <type C:\Windows\SysNative\tasks\{396818F6-9DDB-43F7-AA4C-AC9FFEA27D2B} /c> in the current context!
Error: Unable to interpret <type C:\Windows\SysNative\tasks\{B7B6A4BF-0AAD-4095-AB47-A92AB231B215} /c> in the current context!
Error: Unable to interpret <type C:\Windows\SysNative\tasks\{CC5001D5-9895-4BDE-ADD4-91469E526892} /c> in the current context!
Error: Unable to interpret <type C:\Windows\SysNative\tasks\{EE2C010C-D6FA-4EBA-93E3-566CCAFA38E7> in the current context!

OTL by OldTimer - Version 3.2.69.0 log created on 06132013_214946


----------



## sweetrose (Sep 7, 2012)

hundreds................oh


----------



## eddie5659 (Mar 19, 2001)

Did you press Run Scan? It looks like you may have tried the fix, but you just need to press *Run Scan* 

Try it again


----------



## sweetrose (Sep 7, 2012)

i did run it,,,,,,,,,ok will do it again


----------



## sweetrose (Sep 7, 2012)

L logfile created on: 6/13/2013 9:59:29 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ann\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.87 Gb Total Physical Memory | 0.54 Gb Available Physical Memory | 29.14% Memory free
3.74 Gb Paging File | 1.89 Gb Available in Paging File | 50.66% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 80.11 Gb Free Space | 68.80% Space Free | Partition Type: NTFS
Drive D: | 116.05 Gb Total Space | 0.35 Gb Free Space | 0.31% Space Free | Partition Type: NTFS

Computer Name: ANN-TOSH | User Name: ann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/12 19:54:24 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ann\Downloads\OTL.exe
PRC - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
PRC - [2013/04/29 00:58:42 | 004,408,368 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
PRC - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
PRC - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/12/21 12:09:14 | 000,894,920 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe
PRC - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
PRC - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2010/06/03 17:09:00 | 000,304,560 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- c:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2009/07/28 21:26:42 | 000,062,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
PRC - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

========== Modules (No Company Name) ==========

MOD - [2013/05/29 06:27:38 | 000,393,168 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppgooglenaclpluginchrome.dll
MOD - [2013/05/29 06:27:37 | 013,136,336 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll
MOD - [2013/05/29 06:27:35 | 004,051,408 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll
MOD - [2013/05/29 06:26:40 | 000,599,504 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\libglesv2.dll
MOD - [2013/05/29 06:26:39 | 000,124,368 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\libegl.dll
MOD - [2013/05/29 06:26:36 | 001,597,392 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\ffmpegsumo.dll
MOD - [2012/05/25 05:25:00 | 000,921,600 | ---- | M] () -- C:\Program Files (x86)\Yahoo!\Messenger\yui.dll

========== Services (SafeList) ==========

SRV:*64bit:* - [2010/09/28 13:30:28 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:*64bit:* - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:*64bit:* - [2010/02/05 18:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:*64bit:* - [2009/07/28 15:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:*64bit:* - [2009/07/14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/12/21 12:09:14 | 000,894,920 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe -- (vToolbarUpdater13.3.2)
SRV - [2012/12/06 19:40:43 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2010/05/11 09:40:52 | 000,124,368 | ---- | M] (Toshiba Europe GmbH) [Auto | Running] -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe -- (TemproMonitoringService)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- c:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/28 17:44:40 | 000,249,200 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)
SRV - [2009/10/06 10:21:50 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE:*64bit:* - HKLM\..\SearchScopes,DefaultScope = {56369BA8-0140-7F16-6997-7A636D1E1A62}
IE:*64bit:* - HKLM\..\SearchScopes\{ABA5AE01-9B23-4AC7-9BA7-E0345C1287FB}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKLM\..\SearchScopes,DefaultScope = {24345616-2C3A-A6E8-D18D-6EBD213B3971}
IE - HKLM\..\SearchScopes\{A25208D0-8D9E-4B0D-B6DE-CCB82D68D3C2}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {8E145907-CFA8-49D4-98B8-A9C1C7C85C30}
IE - HKCU\..\SearchScopes\{400E7EA1-093B-4D0E-90AC-CAAEF713611E}: "URL" = http://rover.ebay.com/rover/1/710-44557-9400-9/4?satitle={searchTerms}
IE - HKCU\..\SearchScopes\{56369BA8-0140-7F16-6997-7A636D1E1A62}: "URL" = http://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=021113&q={searchTerms}&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=mkg028
IE - HKCU\..\SearchScopes\{E0F1151B-5874-4D8B-8E18-506FA493AB23}: "URL" = http://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

[2012/11/03 15:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Mysearchdial (Enabled)
CHR - default_search_provider: search_url = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.delta-search.com/?affID=119556&babsrc=HP_ss&mntrId=663388252CBA0AA8
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll
CHR - plugin: king.com - Game controller for firefox (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\plugins\npmidas.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U17 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: McAfee Security Scanner + (Enabled) = C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll
CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Java Deployment Toolkit 7.0.170.2 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll

O1 HOSTS File: ([2013/03/07 19:09:17 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:*64bit:* - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:*64bit:* - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3D15F113-3692-4089-B3A3-77DC82321FEB}: NameServer = 10.203.129.68 10.203.129.68
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8303406A-D415-481D-984A-0CB67A97EB51}: DhcpNameServer = 194.168.4.100 194.168.8.100
O18:*64bit:* - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:*64bit:* - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:*64bit:* - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/01/24 19:10:57 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:*64bit:* - HKLM\..comfile [open] -- "%1" %*
O35:*64bit:* - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:*64bit:* - HKLM\...com [@ = ComFile] -- "%1" %*
O37:*64bit:* - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Custom Scans ==========

< >

< type C:\Windows\SysNative\tasks\{00BC1703-9104-4547-9046-82BF662A6C0D} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Author>SkypeSetup</Author>
</RegistrationInfo>
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"C:\Program Files\Internet Explorer\iexplore.exe"</Command>
<Arguments>http://ui.skype.com/ui/0/5.10.0.116/en/go/help.faq.installer?LastError=1603</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<GroupId>S-1-5-32-545</GroupId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< type C:\Windows\SysNative\tasks\{017D6C9E-60F2-4368-A830-2C4CAFBDFF4A} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Author>SkypeSetup</Author>
</RegistrationInfo>
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"C:\Program Files (x86)\Internet Explorer\iexplore.exe"</Command>
<Arguments>http://ui.skype.com/ui/0/5.10.0.116/en/go/help.faq.installer?LastError=1603</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<GroupId>S-1-5-32-545</GroupId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< type C:\Windows\SysNative\tasks\{02F9E465-5EC7-4745-897D-A644C49C723C} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Author>SkypeSetupLight</Author>
</RegistrationInfo>
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"c:\users\ann\appdata\local\google\chrome\application\chrome.exe"</Command>
<Arguments>http://ui.skype.com/ui/0/5.1.0.112/en/abandoninstall?source=lightinstaller&page=tsDownload&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;ienotdefaultbrowser2</Arguments>
</Exec>
</Actions>
<Principalsipal id="Author">
<GroupId>S-1-5-32-545</GroupId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< type C:\Windows\SysNative\tasks\{13F58323-D6D4-4637-B35E-56C58B6E4096} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo />
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>C:\Windows\system32\pcalua.exe</Command>
<Arguments>-a C:\Users\ann\Downloads\JRT.exe -d C:\Users\ann\Downloads</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<UserId>ann-TOSH\ann</UserId>
<LogonType>InteractiveToken</LogonType>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< type C:\Windows\SysNative\tasks\{1721BF00-F4AD-4345-B3E1-F74184695C78} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo />
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>C:\Windows\system32\pcalua.exe</Command>
<Arguments>-a C:\Users\ann\Downloads\HijackThis.exe -d C:\Users\ann\Downloads</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<UserId>ann-TOSH\ann</UserId>
<LogonType>InteractiveToken</LogonType>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< type C:\Windows\SysNative\tasks\{18238F68-53A9-476F-AB6C-30D10382853D} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo />
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>C:\Program Files (x86)\Skype\Phone\Skype.exe</Command>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<GroupId>S-1-5-32-545</GroupId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< type C:\Windows\SysNative\tasks\{396818F6-9DDB-43F7-AA4C-AC9FFEA27D2B} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo />
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>C:\Program Files (x86)\TOSHIBA\TOSHIBA Disc Creator\ToDisc.exe</Command>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<UserId>ann-TOSH\ann</UserId>
<LogonType>InteractiveToken</LogonType>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< type C:\Windows\SysNative\tasks\{B7B6A4BF-0AAD-4095-AB47-A92AB231B215} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo />
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>C:\Windows\system32\pcalua.exe</Command>
<Arguments>-a C:\Users\ann\Downloads\esetsmartinstaller_enu.exe -d C:\Users\ann\Downloads</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<UserId>ann-TOSH\ann</UserId>
<LogonType>InteractiveToken</LogonType>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< type C:\Windows\SysNative\tasks\{CC5001D5-9895-4BDE-ADD4-91469E526892} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Author>SkypeSetupLight</Author>
</RegistrationInfo>
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIse</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"c:\users\ann\appdata\local\google\chrome\application\chrome.exe"</Command>
<Arguments>http://ui.skype.com/ui/0/6.3.0.105/en/abandoninstall?source=lightinstaller&page=tsPlugin</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<GroupId>S-1-5-32-545</GroupId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< type C:\Windows\SysNative\tasks\{EE2C010C-D6FA-4EBA-93E3-566CCAFA38E7 >

< End of report >


----------



## eddie5659 (Mar 19, 2001)

That's the one 

Let me have a look, back in a min


----------



## sweetrose (Sep 7, 2012)

sorry its a long one


----------



## eddie5659 (Mar 19, 2001)

That's okay, got there in the end 

They're legit, but we'll remove them at the end as there is a lot of them. Normally see a maximum of 10 

Onto the next tools. I'll let you do these in your leisure, as each may take a while to scan 

Please download Malwarebytes' Anti-Malware from *Here*

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to *Update Malwarebytes' Anti-Malware* and *Launch Malwarebytes' Anti-Malware*, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "*Perform Quick Scan*", then click *Scan*.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that *everything is checked*, and click *Remove Selected*.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.
Extra Note:
*If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediatly.*

*Download and scan with* *SUPERAntiSpyware* Free Edition for Home Users
Double-click *SUPERAntiSpyware.exe* and use the default settings for installation.
An icon will be created on your desktop. Double-click that icon to launch the program.
If asked to update the program definitions, click "*Yes*". If not, update the definitions before scanning by selecting "*Check for Updates*". (_If you encounter any problems while downloading the updates, manually download and unzip them from here._)
Under "*Configuration and Preferences*", click the *Preferences* button.
Click the *Scanning Control* tab.
Under *Scanner Options* make sure the following are checked _(leave all others unchecked)_:
_Close browsers before scanning._
_Scan for tracking cookies._
_Terminate memory threats before quarantining._

Click the "*Home*" button to leave the control center screen.
On the right, under "*Complete Scan*", choose *Perform Complete Scan*.
Click *Scan your computer*.
On the left, select all *fixed drives*.
Click "*Start Complete Scan*" to start the scan. Please be patient while it scans your computer.
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "*Continue*".
Make sure everything has a checkmark next to it and click "*Next*".
A notification will appear that "_Quarantine and Removal is Complete_". Click "*Remove Threats*" and then click the "*Finish*" button to return to the main menu.
If asked if you want to reboot, click "*Yes*".
To retrieve the removal information after reboot, launch SUPERAntispyware again.
_Click *View Scan Logs*.
[*]Under Scanner Logs, double-click *SUPERAntiSpyware Scan Log*.
[*]If there are several logs, click the current dated log and press *View log*. A text file will open in your default text editor.
[*]Please copy and paste the Scan Log results in your next reply._
_[*]Click *Close* to exit the program._
_








Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Please download *AdwCleaner* by Xplode onto your desktop.

Double click on *AdwCleaner.exe* to run the tool.
Click on *Search*.
A logfile will automatically open after the scan has finished.
Please post the contents of that logfile with your next reply.
You can find the logfile at *C:\AdwCleaner[R1].txt* as well.

Please include the *MBAM log, SUPERAntiSpyware Scan Log, checkup.txt, JRT.txt and adwCleaner[R1].txt *in your next reply

eddie_


----------



## sweetrose (Sep 7, 2012)

think i will do all that this week end Eddie,,,,,


----------



## eddie5659 (Mar 19, 2001)

Oki doki 

I'll log on later and see how its going. Goodnight


----------



## sweetrose (Sep 7, 2012)

night eddie...i will be lost with out you now


----------



## eddie5659 (Mar 19, 2001)

I'll be here Saturday, probably in the afternoon sometime


----------



## sweetrose (Sep 7, 2012)

ok,will do some tomorrow....


----------



## sweetrose (Sep 7, 2012)

alwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.06.14.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16614
ann :: ANN-TOSH [administrator]

14/06/2013 15:32:55
mbam-log-2013-06-14 (15-32-55).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 213271
Time elapsed: 7 minute(s), 37 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
C:\ProgramData\IBUpdaterService (PUP.InstallBrain) -> Quarantined and deleted successfully.

Files Detected: 1
C:\ProgramData\IBUpdaterService\repository.xml (PUP.InstallBrain) -> Quarantined and deleted successfully.

(end)


----------



## sweetrose (Sep 7, 2012)

UPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/15/2013 at 02:48 PM

Application Version : 5.6.1020

Core Rules Database Version : 10536
Trace Rules Database Version: 8348

Scan type : Quick Scan
Total Scan Time : 00:14:23

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned : 556
Memory threats detected : 0
Registry items scanned : 60522
Registry threats detected : 0
File items scanned : 10527
File threats detected : 265

Adware.Tracking Cookie
C:\Users\ann\AppData\Roaming\Microsoft\Windows\Cookies\FTGT8AZ0.txt [ /bs.serving-sys.com ]
C:\Users\ann\AppData\Roaming\Microsoft\Windows\Cookies\T8DB4HEG.txt [ /mywebsearch.com ]
C:\Users\ann\AppData\Roaming\Microsoft\Windows\Cookies\VRYXWMI5.txt [ /c.atdmt.com ]
C:\Users\ann\AppData\Roaming\Microsoft\Windows\Cookies\XSGGXE7E.txt [ /serving-sys.com ]
.invitemedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.imrworldwide.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.imrworldwide.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.amazon-adsystem.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.collective-media.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.legolas-media.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.amazon-adsystem.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adtechus.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.atwola.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.atwola.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
in.getclicky.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lfstmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ads.audience2media.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.tacoda.at.atwola.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lfstmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.2mdn.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.kontera.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lfstmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lfstmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.dmtracker.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
fr.sitestat.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
fr.sitestat.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.at.atwola.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.tacoda.at.atwola.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.tacoda.at.atwola.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.atwola.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.eyeviewads.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.screensaversandwallpapersfree.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.screensaversandwallpapersfree.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.xiti.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
tracking.hostgator.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lfstmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.statcounter.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adxpansion.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.screensaversandwallpapersfree.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.screensaversandwallpapersfree.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.screensaversandwallpapersfree.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.smileycentral.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.britishredcross.solution.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.britishredcross.solution.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.britishredcross.solution.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lfstmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.mmotraffic.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.mmotraffic.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
media-d.optimalfusion.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.unrulymedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ict.infinity-tracking.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ict.infinity-tracking.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
tracking.hostgator.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ads.audience2media.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad2.adfarm1.adition.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
leads.383media.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
leads.383media.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.gotquestions.org [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.gotquestions.org [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.gotquestions.org [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
track.adform.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
secureads.audience2media.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.ladbrokesaccount.solution.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.ladbrokesaccount.solution.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.ladbrokesaccount.solution.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.clickbooth.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.thisistotalessex.co.uk [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
secureads.audience2media.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.mktrack.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
eas.apm.emediate.eu [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.clickfuse.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.burstbeacon.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.clickfuse.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.getclicky.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.chengdu.medialand.tw [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.chengdu.medialand.tw [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.www.femalefirst.co.uk [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.femalefirst.co.uk [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.femalefirst.co.uk [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.femalefirst.co.uk [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.femalefirst.co.uk [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.femalefirst.co.uk [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.femalefirst.co.uk [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.femalefirst.co.uk [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.femalefirst.co.uk [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.aimfar.solution.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.server.cpmstar.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.server.cpmstar.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.server.cpmstar.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
media-mgmt.armorgames.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.server.cpmstar.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.yieldmanager.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
search2.virginmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
search2.virginmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.virginmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.virginmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.virginmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.search2.virginmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.search2.virginmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
da.virginmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
da.virginmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.virginmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.liveperson.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.wowmedia.eu [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lfstmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
accounts.google.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ox-d.enveromedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
z.blogads.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lfstmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.at.atwola.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.realmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
visittrackingrequestpublisher.apphb.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.legolas-media.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lfstmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.myfuncards.dl.mywebsearch.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.myfuncards.dl.mywebsearch.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lfstmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lfstmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.liveperson.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.media6degrees.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.media6degrees.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
cwadserver.herokuapp.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.cwadserver.herokuapp.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.cwadserver.herokuapp.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.77tracking.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.77tracking.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.77tracking.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.holidaydiscountcentre.co.uk [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.holidaydiscountcentre.co.uk [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad.zanox.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ads2.adverline.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.liveperson.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.liveperson.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad.adserver01.de [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad.adserver01.de [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lucidmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.mm.chitika.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.media6degrees.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.media6degrees.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.media6degrees.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.media6degrees.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.media6degrees.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.media6degrees.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
server.adformdsp.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adformdsp.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adform.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.apmebf.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ads6.hermoment.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ads1.hermoment.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.totalrecipesearch.dl.mywebsearch.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.totalrecipesearch.dl.mywebsearch.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.bizrate.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.bizrate.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.uk.at.atwola.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.uk.at.atwola.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.uk.at.atwola.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
accounts.google.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.accounts.google.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.accounts.google.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
accounts.google.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.statcounter.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.citbconstructionskills.solution.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.citbconstructionskills.solution.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.citbconstructionskills.solution.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.bs.serving-sys.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.bs.serving-sys.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.clickfuse.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.pro-market.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.pro-market.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.pro-market.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.pro-market.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.revsci.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.mywebsearch.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.mywebsearch.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.virginmedia.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
bs.serving-sys.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
track.adform.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adform.net [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
bs.serving-sys.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
bs.serving-sys.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.apmebf.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.alzheimerssociety.solution.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.alzheimerssociety.solution.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.alzheimerssociety.solution.weborama.fr [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
bs.serving-sys.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.insightexpressai.com [ C:\USERS\ANN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]


----------



## sweetrose (Sep 7, 2012)

Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by ann on 15/06/2013 at 17:06:24.58
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\babylon
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\cr_installer
Failed to delete: [Registry Key] HKEY_CURRENT_USER\Software\datamngr
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\datamngr
Failed to delete: [Registry Key] HKEY_CURRENT_USER\Software\datamngr_toolbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\pc optimizer pro
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\performersoft
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\smartbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\Software\crossrider
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\Software\pricegong
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\prod.cap
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\datamngrui_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\datamngrui_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\giant savings-internalinstaller_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\giant savings-internalinstaller_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\giant savings_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\giant savings_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\quickshare_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\quickshare_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\sweetim_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\sweetim_rasmancs
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\datamngr

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\babylon"
Successfully deleted: [Folder] "C:\ProgramData\fighters"
Successfully deleted: [Folder] "C:\ProgramData\tarma installer"
Successfully deleted: [Folder] "C:\Users\ann\AppData\Roaming\babylon"
Successfully deleted: [Folder] "C:\Users\ann\AppData\Roaming\drivercure"
Successfully deleted: [Folder] "C:\Users\ann\AppData\Roaming\fighters"
Successfully deleted: [Folder] "C:\Users\ann\AppData\Roaming\performersoft"
Successfully deleted: [Folder] "C:\Users\ann\AppData\Roaming\registry mechanic"
Successfully deleted: [Folder] "C:\Users\ann\appdata\local\coupon caddy"
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0005A007-49AB-4A03-BA3D-64A9DD112C5E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{00161B38-768E-4BC2-B42D-BBA0D867EED4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{00202B20-2606-448F-91EF-48E631AC6491}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{007E2E29-F0DB-4E36-AD01-D1BD30FAC508}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{00A6082A-1B68-4238-B7FA-86BA07EDD341}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{00A7A699-7B4D-431B-B8AA-971C3BE5C5F9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{00C49AF1-184E-487D-B20B-9B9C3BD01729}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{00FA32D0-67AC-4C94-9439-244BCC522F29}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{012AC077-FBA2-4BD9-A422-6908493BA70F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{016305BD-9B42-4906-924F-5F7E5F0D4650}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{01742609-ADEA-4F15-94F8-A834753B786A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{01A60DAB-422B-46F7-A911-5E088F5D68C5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{01B0D38E-225F-4D08-AE67-B8B109CB1059}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{01B4CC21-2CCE-428F-BA89-BD683B8DA3A5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{01EBA070-6EF0-4A55-9677-0712B30F578C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{024D05B3-01CB-4A69-8188-13CC9A9E562A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{02717CB1-9F31-4136-80B5-5B2ED624FB2F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{028960DD-EC70-4324-848F-BCDF7EB4FB65}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{02E3BE57-47E9-4031-BC35-6F0DD5C5C951}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{02F57778-A85C-41AC-82C5-17A9F004014E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{033705FC-FFE2-4676-A15E-E9F928E88440}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{033ADB2A-0A38-4ADF-A900-43F1E419B414}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{034D8155-C921-4D46-9262-6346C9DBB1B3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{037407D2-C6C3-4668-9401-258A832FA7D1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{037AA6EE-E68B-4C01-8185-2D8C59475B48}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0386CB76-1C1C-4B9C-8798-0931B8A3EA65}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{03916011-93E2-419B-BC45-AFE488261132}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0397D453-2DC1-4918-A02E-0B232C15F367}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{03A9F77E-1ED0-4D7A-A520-C7539F09E5F0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{03CE423B-4762-4BDA-8ADB-C95D13D93839}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{03D9914B-5AEE-44F9-8FE6-BE2A8A7813A0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{03F99AC8-4899-4E96-9A82-CB25006177E7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{04398876-E09E-4595-AFD9-D34F62B7D3DA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0461AFBC-D295-489C-BB7B-685CFDCBB372}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{04960C36-AA4F-4F5D-BFC9-1D63BD152EBA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{04BDB623-67B3-4240-9E40-D7982C966832}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{04C83964-1E92-43FC-9110-B8988732E067}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{04F173AE-D787-4E86-B6A6-B943F7EFCDE8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{04F67EF3-B21C-424E-A854-9494E7747D9A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{05002219-1B94-4EC7-AB20-3758E3AECDC1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{050FDD5C-33FD-41DC-B085-7FE3EF988709}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{05413472-B06C-4277-B5C3-62F4D996E6F6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{05672A4E-8C04-49D7-B4D0-06A9F086FE00}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{05B07E58-6CB4-4580-B55D-5CBA50D87719}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{05D615CC-6029-4187-AAF6-F3C00A7F66A3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{05E594F1-1330-4DCB-81E8-4BEAE633D768}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{05F70FFA-616E-4B35-A054-786FAF0972AE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{060C5D27-F6E6-4D99-8442-44A026A76B5B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0610CD45-3145-4637-BD42-248D0A10BE9A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{063041B0-9A1C-40B9-9B84-7EC81676F756}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{06425220-62C7-4F8C-83BF-49EBAB2E4032}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{065C0C3E-458B-4691-81A6-AEA32E1D45F8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{072A9D63-14DF-421F-BC74-2D8A33B0D4F5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{07CFE6AD-696E-4074-A89A-BC897BF5C23A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{07EC50E3-6A8F-49CC-BD05-CDF173DABC9A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0808FB98-4D3C-460B-B433-3E23ED9ECACE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{084F6632-22B4-4B2C-8752-2E6521B52ED9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0893ACE6-9382-4FD3-BF70-7182ABF5CDFB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{08D3EF8A-7A7C-4B52-8CBF-B0A6639C7A79}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{08E13216-8C3A-4F49-A3AA-1485B15EDA8E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{08F0AE1D-A02F-4B86-8125-C0A06F3D658A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{09527887-56EF-44B7-B19F-C49F11DB916F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{097A9D80-AFE1-41E8-B4A1-CDEDE0424AC9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{09A5EDE9-873E-4000-93AC-0C48EC793BB3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{09B872DA-E571-4038-A096-CC4D2AEE4B1F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{09FB77D1-E5CF-4BE8-B4A2-278D44A768E2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0AAFA2A1-83D6-49CB-939C-9627EDF51B24}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0AEE13FE-3E07-4997-AF40-BA5BC42F4165}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0AF5FBF7-8050-49A5-8B59-37B521FA49CE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0B19467F-240C-4C17-817F-0D256ACB5057}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0B2A07B4-1AD7-4DBF-83D8-0A068D3E901F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0B4CD1D1-E4AC-4A82-9F3D-84FA5A1AEFB6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0B68AB34-3A86-41FB-BCA5-EC62140F22B2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0B79730D-4CA0-4FAA-9BB8-BB680B8827A4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0BB64C90-95CB-4857-AD2D-5EF6EECA3A93}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0C29674F-6046-4A8C-A42A-C5681D5A9E16}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0C926E95-F352-482E-B201-C84C8C658C3A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0CB4A594-30FE-4DFC-99DD-525892BEA255}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0CC95FCD-86B1-4E62-8193-CFF297A2F8A8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0CD02C55-E131-4799-9260-A50552F986F2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0CE01AF6-EE12-45B8-9CBD-75612608D022}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0D2467DA-F3C4-4768-AF65-2183F2DC8F48}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0D277B08-6192-4B81-A5C2-80169BEE9EE4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0D337343-DE6E-477D-8374-E4DEE3E499FA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0D54E970-272B-43D4-94C3-32C2FBFE8373}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0D675988-C1D7-41F9-8E70-72A118516EC7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0DCDD43E-BDBF-4625-94BA-22B27D9EA059}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0DD4A55A-DBD5-4D12-93E5-5381A2735568}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0E2AE797-564C-46EF-B936-AC3B754FBD69}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0E42ED26-D79F-4EC3-9E2A-E52AD5C3A0A4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0E5D6E12-4120-449C-805E-CF215267E0CA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0E9EFC22-077F-4386-9322-FDF5D0E8A362}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0EB31518-D9D0-425B-AF83-7B7E9B7014CA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0EDCC10C-E1FB-4771-B855-4DA73D60E540}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0EE5C8AC-5164-42F5-8E3F-B2C4F04F9803}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0F536735-5E8B-420D-9897-C0FAFE4BC7B0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{0FC8D90B-B13B-42A9-92DB-6AE037326005}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{10053BCD-AA97-4DDE-864F-06489D71B80E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{100B0BB7-89AC-4CC5-908B-D36D5824741A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{102769ED-CF7B-4860-8EA8-DE6F0A68C724}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{102B125C-37A6-4557-A491-39C8BB650B11}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1047B91C-0984-4B57-AA7A-80740CCA80F5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1058E6FA-6663-4D7C-929E-40BFB5C9DFA3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{107265E1-6467-47F9-B58A-D9E9318E1A45}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{107E62F3-24F1-450B-AE27-8443601BE996}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{10801D86-6C2F-429D-82B5-65999C211C24}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{10D892BF-CDCD-4BFA-84BB-591D1E6CCEDB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{10FF1E2F-98D4-4169-B691-7966F48DC308}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{11451887-CD06-48B6-8E65-3DB08C15EF87}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{114B8771-B04C-4F02-89FB-BC7E316B9D41}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{115F875E-C8BB-4ED8-B066-1A6E5D18C539}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{116BAFFC-4FD6-4E90-BC75-4E5D08604859}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{11779ABE-B0A0-460D-B18D-7EC4EB1D5E7D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{11936F45-D07A-4A56-8957-18241D68286C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{11B11F4F-349A-4F42-8F70-FEFCDBB636D0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{128D4B7D-0A31-4CFC-BBA9-B6D0B17E1EF9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{13295C49-C5A2-4133-AE29-ACFBE60E3F3A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{138A08A8-C6E4-4A63-A6BE-07AC4E80414D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{138D416B-88EA-4DEE-9DF4-A174216B913B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{13D3E409-2A63-49D9-9FD2-F7BF79252A8B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{13E51D79-DD7C-4CF6-9A73-866C28E013C4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{13FE6663-72EF-48FC-B5FD-15932BC34B26}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{142E338F-2B09-4285-A81B-CF01FCFF7030}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{147164D5-3A67-4E37-BEF3-526DBF96EECF}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{14743BA3-A347-4FAB-B8C7-DE5419A83D47}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1511C448-9B11-48AF-B446-A45C2AB8C63C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{157400D7-5C5B-44E9-A68E-089A2A475287}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{15883B08-93C6-4067-93E8-F6F175D3DA66}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{15A028B6-0BB5-473F-882F-37F93D239DBD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{15B04F19-5C34-4990-B20D-FEF246AF0E1C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{167AD287-3A6E-4692-A2E9-A3F9F392E12C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1687D0D3-A049-4753-A443-5A0441839CA9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{16B98FED-6EE1-4BF8-A375-6416FB8F4125}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{17065003-8D52-4D7A-8C72-84732DAD25B1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{170EB47B-8808-4C0C-952C-5CA0EC2A4C61}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1751D007-4052-4286-BB0A-028D80965A7C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{17868ED5-5419-4582-A8EB-712E7FC94F0D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{182A1243-B062-4B38-9757-E7E920D25689}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{18B1C1C1-3805-410B-9CFE-04C3CF48D904}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{18F70F43-911F-4311-BC75-AE244513B85A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1903F71C-D929-42E7-92CA-332198277C74}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{19561725-A881-4623-9E53-87ECA01C1642}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1972A8C0-279C-4F0F-8926-DEA7EF8BF4DC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{197DEA6F-8AB8-4532-A88C-118214A843D6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{19A84496-8A0B-4AA0-BCC8-86151179F293}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{19D1AF21-5928-4AB1-B8AB-36E49A9C2B83}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{19EEF927-54BD-4B4C-964A-A0F10CCE6EB4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1A09BBEB-55FC-4A72-9892-7333D32FBBF9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1A0C6226-5E8A-4BAC-A470-82F1DAC20D3C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1A11FB65-27D7-4E4A-A8F2-156B1C00CC32}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1A492234-6176-4A56-99D7-5573FB17B7B2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1A4F6C3E-DD9E-4718-A9B0-DEF0BE8617B5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1A7024A1-4C2F-4779-8548-85704931B470}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1AA78A0F-DD84-4B5C-A715-6445980258C7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1AAF3997-AFCC-477A-9B06-85770C2BFEE8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1B07A914-6798-4FBA-A500-8875FC676BE2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1B0BCB94-4D85-4D15-AF18-0E75E5C712D7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1B102234-C72E-494D-8DDA-A112DE989B91}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1B1D5913-0B81-40CD-AFFD-B61EE15E901A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1B628056-6679-4EF1-8FD2-1B3A3100AE74}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1CC79483-EB0D-44D3-8D6A-BFBA5E569BE1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1CCB2089-5AAD-496C-A9A4-D05DF1B3D2F8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1CF33D3A-7BA4-41BE-88EE-3B71724DE5F0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1D016DC6-36EC-4BE8-BF5E-E641EF87CDDA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1D09A184-A8EE-4C59-83F5-5F006BA2A173}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1D1EC66E-E4DA-4564-8CF4-E8D38395944F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1D8914C2-C433-4534-B1BE-656EBB53BC64}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1DA4A656-612D-4E26-8276-FCD8B8FC7A8C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1DB8A5D1-D4BC-49EA-8144-1CB3455C62ED}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1DBC1DFA-ED2F-4C4D-96D1-58A92E682712}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1DD0891B-B275-4749-8FE8-15A9DE79A23C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1DE12D90-1B88-42F5-A57F-71931B4CAD85}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1DE1D352-04E0-4BCE-956C-30992EE67FB7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1DF464DC-322A-4504-9A1F-1BC6D5D6B3A2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1E07DCB5-D853-4F5C-AF8B-AC734944A87B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1EC0D0F7-40AB-4237-B017-8B2620225D3C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1ECD08E7-D657-4B2A-9215-3212A3004823}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1EE53187-F03F-487F-AC1D-9B9941DC3B71}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1F4FCEEB-66C4-4F53-855A-91739C13995B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1F872070-C57E-4CEA-831E-3581585EBC8D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{1FDDBE8B-C69A-42C8-8331-BCE321E4BAC4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2031B729-32EF-4A10-9BF0-CB6712D2E06F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2032383E-9B96-46E7-9ABB-813040944975}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{20477DF0-97D2-4463-951E-C9B56B1A3ACF}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{206E3871-67AA-4E1D-811F-2D8A4356EF7F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{20811C07-CB47-4F5D-85CE-F65AC4844FC7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{20987D23-CB68-4AFF-B253-67F45689D27A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{20E41A4C-392F-45C3-9FA4-EEEF206F457D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{20F10AE0-E283-43DE-AC16-2E55610BC325}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2104EFF2-790C-4BE6-BF12-18FF8BDFE4F2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{210DBAB2-B8F0-45D5-942C-BD4A8BE1FA5B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{212FFB3D-CA2A-49CD-BA72-1698945DEF76}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{216B05B6-05F8-44B9-BD63-D18E741F2379}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{218735D1-6470-49C5-8A75-72B39C710B0C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{21889B7B-D2BA-4FF6-BEAD-592DCBAA7F91}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{21D43416-6BB6-4C7C-B9C0-CB988B01ADDE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{224195E2-4E2B-4490-9496-C4677A7374B8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{224A87D8-5DB5-49ED-A4AA-60883908C395}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{22664522-2F07-434D-81B5-302410E2E96A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{22B3D25B-23D0-4D9E-B1B3-31BD520A5735}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{237059CD-9E28-4B80-8193-3FB73C825653}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{239D903C-F4DA-4CE2-B2A9-12B6E4B2C0D9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{239DEF90-FDBC-418B-8D80-227CA69B9944}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{23B416DC-E775-42BA-A079-783618E7FF15}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{23C75EA4-96EB-4580-9CA9-36EB78D5E766}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{242D9857-26B5-4705-9103-5DDB314747A6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{248491DE-2D6B-474F-A6AB-AFBE28392A43}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{24ABBCC0-50E4-46D3-9560-A8B82B2955F7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{24E59612-9EDB-47C5-8BD5-8045CD6ADCEC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{24EA74D9-FFB5-4E4E-8338-33E289E224A7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2530B279-5515-47E4-B09C-CF205D11BA3E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{255E3173-949F-44D3-A17B-07AFB423305F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{261C6069-26BA-40ED-90B0-9491DE3375D1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{263664EF-C811-4613-927B-97340AAD3266}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{264B31AC-8647-49F8-BB6F-133FBD3F234C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{265420C3-BE78-4C87-99B7-C680ED7F581F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{268922BE-9566-44C0-8633-BAE3BEF277CB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2689C88E-26E2-4AD2-BE79-EB7043092F3C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{270308F9-433C-4526-890B-43A63C778555}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2738D9F2-BF79-49A4-91AD-4077CC7F65FA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{273A8E97-3EE1-4597-92CD-D92801C87AA0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2744346C-985C-4438-A5AD-700389BA0A1B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{276ABBA3-EA87-47ED-B14A-5D046F2AA725}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2778F048-4C29-40B1-B67B-73E1F719C248}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{278557FF-3BB4-447D-AE2F-1D358E0716E9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{27C34C0A-EEDE-4E0A-9245-D6486B34A805}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{27C66BCB-4A0D-4E57-85AF-BCF02D533E22}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{27C752C4-9660-409C-B349-18F807B615A6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2807ED7F-589B-45FB-8D0A-21025F13F338}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{282D0613-8D60-4E23-B5EF-D8B43F005F36}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2872648A-13EC-4CF7-9B1A-777C7D2A1C1C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{28B6DE8F-478E-425F-84A6-F5F373D88D6E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{28F13F61-B31F-4C24-B0C2-F29A0978947C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{28FB8386-8C05-47FC-AB3A-6A82E3D5C947}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{290A39A9-D952-4481-8A8B-66D8C23A9080}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{29189238-5432-4407-88C7-BF494A3FBF4F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2929F484-C79C-485B-B853-F854C0FEFD96}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{293E3149-8D31-41C4-B7E2-6825920A1064}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2A1B6540-51F0-409C-9F60-6F530FA5E0D9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2A21265E-D511-4428-A2A7-B87EF6CADF94}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2ADB46EB-D746-4329-99CA-C297AD86B934}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2AEE3212-07AC-4F82-A2CA-C3652CB3C6F6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2AF6910E-88F0-4945-A227-C8EC02684039}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2B237A3E-B091-4C71-B098-AF8B87CB12B2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2B25A7E3-9DE6-4937-A667-98A92A84206C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2B454B50-EB86-466E-ACB6-90658A267DE5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2B655C4E-16B1-48BB-992C-C4885C49E5B7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2B6A13A4-BEEA-4FDF-B728-AFF06A71D3B3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2B844A28-4DA1-414E-8B58-F6EE88C087A5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2BA30B15-09B4-46C8-920E-31ACD66FC964}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2C1A34FE-3051-43BD-8D45-AC905366F92A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2D2A25DE-0707-49F7-AD06-BA31F18783B9}
Successfully leted: [Empty Folder] C:\Users\ann\appdata\local\{2D54D111-023B-4E6E-9CF4-C16047AFBB38}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2D69D821-F4F2-48FB-98A2-F1BD7F035EEB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2D9BF89C-2087-4662-8931-C7492049B401}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2DB9D2A8-4E79-496A-8422-F8ED13D9113B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2DE0B587-D92E-4C5A-86B1-4B889010288B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2E07D402-5A53-40C4-926A-384353C1FD2B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2E1B6712-32C7-4D8F-9B29-6F663886651A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2E4CA13F-E60D-46C0-BAB7-7DC69A886E35}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2EB2F631-4FD5-4782-BFDD-C1EAF79FE5BC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2ED23ED5-86A6-4D3E-81A3-BB26FC48162F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2F52D396-48DD-4A82-B138-76BAE47A8F9A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2F52EA4C-4CBB-4384-9665-51BF3CC78786}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2F6A1FA7-EFBF-40C6-9F56-53C6D1C74D1B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2F71548E-CF0E-406A-BCC9-2D2E61E9E502}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{2FCCB193-8E4F-49AA-A156-2596A06A655A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{303E4139-097E-429B-82A5-2B4791152CF6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{304B8E1E-EAB2-45D8-99BA-B2D1F7D38A39}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3063CF18-BD42-4DA7-8CDF-0AA6E99EA9B9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{307FFF44-78DB-4CB9-9CD9-47F70A31CF41}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{30B73067-36F6-47B1-8B7B-FCC8B09FF694}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{30D0BE2F-BFDE-40D6-B4C8-8D1176F4FB3C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{31135201-E9EF-4DF7-885C-19152DCC6B56}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{313BEA56-66D1-4DDB-9D09-AFCEC540058C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{31492B5C-5AC2-4558-B9E7-D3F7E0B4EEEB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{31784F6E-7F55-4842-8CF9-820C4C1C3013}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{31AB04AD-10A2-4442-B266-1640FE9DA8BE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{31F18C97-2C2B-49B6-9D3A-88D3AA599737}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{31F7EFCF-94A4-47EB-9393-5788C1ED06B7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{320D46DD-04FB-4997-95AC-E256AD4C0966}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{322ECAFE-E320-433F-9109-775150A2A760}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{326EEF8B-77B8-4417-9319-ECB6491685BB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{329D164A-FC54-4007-9327-DD80880272F3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{32A31C8A-6B55-4C14-AAD4-AE188AD7E424}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{32C0FAE9-7584-45FA-A4AC-802CCA6BCE48}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{32F0C7C7-76E7-4E4B-8B03-D081EABED1DC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3353FF12-F380-4543-8D57-745807F0456A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{33564D6D-C3AF-4FBD-8FD0-3B798C86B218}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3368A5FF-3414-469A-9A9F-4A9A886F8EB6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{33AC6200-1D20-4D3B-AD96-7A37064D5CC8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{33B157A1-5E48-455C-A4AF-36904CC95949}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{33E3D6FC-A32C-430D-9EE9-45CFED78BF2B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{341194AA-7B15-42DF-99DD-863C7CA66256}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{342AF483-FB92-49D4-B37D-C38C47A5336C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{342C79D0-05A8-43B4-97F6-8985B4047A13}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3482E7C9-4BE3-4611-AFC3-1618782B1112}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{34948496-8C94-497F-923F-2258B18DA71F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{349D1177-F8CB-4228-B7C0-7DB5E1642C14}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{34A6211F-EE1F-40D2-9215-E529C5AC3FB7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{34B9FCF8-FAF7-4AC4-A53B-1E225E022C3C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{34BF87DF-BF02-4240-87DD-760C0A4A9C37}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{34C0F732-691E-4A42-9D5B-AAF47082CA3B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{34F62BD2-A20D-4F07-86D6-F7C5A70011FB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{35A90642-05F7-4559-BA27-578FAF02A9ED}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{35C168D2-6411-45A7-BD0C-697EB4DFE17A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{360C662B-089A-4A21-BD98-873D1D6D5056}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{363B13CF-F79B-4BC6-B118-E506D96B375F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{36498ECF-CA31-4F7C-ACD1-BC20918CF42E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3664D179-E5E5-4C66-8CC2-DCCA3A4D5E7A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{36CA1960-05FB-4D0B-82E4-EB0EBCD27514}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{36F2E445-04B6-4F1A-83EF-F99518C5ED4D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3732EB27-1095-42B3-8B59-8A631F0C371B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3754A7A6-FE0F-4055-8E28-81EFE4195062}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{376F2DE9-CD1F-4246-A82F-4B6BC56D4B06}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{383ECE36-288C-4171-8002-BDB46B72BDC7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{388FA854-23DB-43A0-94E3-D5CDF4111EE1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3895ECB0-1B9C-42AA-BAFC-3D23E52E9102}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{38AEF9A4-F8B7-4A84-89CC-E3AFB14C3141}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{38DB0678-82AF-478F-A242-7D111BEF015E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{38F9E222-5529-4EDE-82C5-1487D46A1D51}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{39129812-5EDC-420F-9550-5CBD1B2EB019}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{391A8ABA-E945-4E2D-ABA6-496041B499C8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{39206EE6-28B7-44F9-9607-7ECEB67A2DA1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3950C5DA-1339-4301-A016-89EDACA1B558}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{395ABE81-9566-463C-8E0A-2C02B26905CF}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{397FD563-8CAC-44A3-885A-A1DDAF25FBE0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3995D867-32B1-43D0-A63D-F42E32343711}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{39B3DC4B-6B31-4156-A175-B8D63EC4E407}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{39BA7724-6A69-4AB3-A447-5FB6C1403E7E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{39FEB974-5284-4B1A-A4AC-071C309279EA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3A326B17-D660-4905-BEBF-D400B54939C9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3A4089D7-769E-4794-9777-096C5BCF77A9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3A6CFE89-EDB1-450D-A0BF-2D5ED4200A4E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3A93B0F2-FAEC-4DB4-A6CD-D48889B4C672}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3AC91806-63C4-4436-87D5-B04598F25B32}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3ADB8B28-ADB0-4C2B-96BD-EA452101551F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3AE265EC-E3A8-4792-B197-C704B03CD9DE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3AFF5743-1539-4185-9A3B-5E9375BAA4E4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3B00BFB9-035B-4F7E-9F8D-F3B2187E60D4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3B3B32D8-52DC-48DB-8892-63E2CA257F02}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3B780A6C-764C-430C-8D12-9F8F7129FEF5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3BA9BA28-3A4C-4D72-851B-80E61D6FA0AD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3BEB47A9-5341-41B7-97F8-453DED771FAA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3C3789EA-4F55-4AA3-B4D6-C8B3BBFC2B27}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3C63A56C-15F7-47D6-A4C2-E8AB40B89B1F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3C9A4AFA-F981-4943-980C-AA083F68ADCB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3C9DFA52-079E-481D-810F-7E38A12B6264}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3CA61E47-AA07-4FB0-8585-D081758C03D1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3CD1D5D0-8888-4D45-AF49-08D0DB65FF27}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3D323102-F8C0-4C1F-8C7B-BAD96751B324}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3D46447B-43FF-45A8-9447-0B6F7909AFBE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3D486CFB-D8FA-4BA1-A919-2C71E7E66165}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3D615AD9-61BD-4ED4-9366-B753CE2E1388}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3D9C01D2-46DA-45F6-9B1C-7FF4E14A3D94}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3DEB8836-B9BF-4B94-846E-8860AA3E2679}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3E6B6D66-8D79-412E-A1AD-4080D785D261}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3EAE435E-4C70-4EFA-8FB8-A3ADF315B636}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3EE1C2B2-B0A6-4D95-86C9-3061E9D33BEC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3EF1A9D0-4C03-42F4-8140-16F11FCC5846}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3F0856EF-EBBD-41C0-B900-392B90EC71A4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3F10D6DC-E5C4-41BA-A7CD-849B0F59E8D9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3F2F00CA-6859-4796-87DE-02F036EC5611}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3F3F153D-3ED9-401B-A1D0-869E47F0DB20}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3F5A1E68-C29D-46FC-8494-26C995B85E9E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3F89D26F-3109-4A89-920C-408484FF2B0D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3F931E24-C257-457F-838D-5995BCC49F74}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3F9B403E-7501-47C4-B039-55D0B77F4002}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{3F9EA86C-26CA-4E5B-9984-4CDC5D63522A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{40119FC8-6FB0-41F3-8BD0-76B46CD4482A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{406D4799-3293-403C-A9EE-6A67FAE13943}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{409656A8-3460-4BE3-B011-05931562AFFF}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{416C80D4-B420-4528-A55D-66171DE860E2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{41748FE2-F38F-46BF-B8B7-66D31CB108F9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{417DA5B1-B044-49DD-9EBB-E4DDA9BD6B7B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4190B24B-09D7-495E-AE69-696AEBD5FDF0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{41B0A555-0D2B-4F1F-A7A1-124A2E3EE5FC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{41B6C847-3C46-4874-8077-A19116383EB4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{41C5CB53-9990-4240-A6B9-089E89366DE0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{41DE35C4-489C-4CB1-85F3-EEC07EC37EAD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{42437999-6D4D-433C-B503-2D31727312BD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4255BF65-F683-421E-AD72-13A0DC0EC592}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{42658F25-89E6-434F-AA16-7CF540327ADC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4273EE1B-460F-4BBD-A4C1-5EDC935770B2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{42D09F10-DA5F-4144-9B6F-11A4D936B733}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{436BDC5D-5022-4EBC-8CEC-E1902224573D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{43916BB1-8025-45C2-80DE-BB0F98914BD4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{447790E4-DB48-4CF2-99B8-37816135363A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{449EE203-BA58-43D1-AF5D-CB60142C5600}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{44A394AE-2145-4AA6-97F6-C7592A7B07D0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{44D4AB12-EF45-4D43-8705-5D4C26656FC1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{44EBDB29-93B1-4E1E-B2CD-EA62A1644734}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{456D1126-5B34-428B-A27C-349A6DC9BC9D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{45DFE8EC-BEF9-4AB4-AA16-62B0D02BC5BC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{460503F4-599D-4215-BD5A-3672ABC6772A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{460A7B71-DFFB-460C-A62D-2A758B7F7F75}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{462CB449-E685-44A2-A763-1D7492EBB8CA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{46D4597E-DBDD-4196-8B04-62A5A97DE527}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{470105B2-BE5B-4756-BA2F-C4AF8963F297}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{474F9F34-4C38-4E5D-88A7-46DD1A9A1740}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{47662DA0-AC89-4B01-9F77-DF09A92F2AC5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4774EE5B-231A-4E1B-B44E-3C270BA24469}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4779D993-34D7-4881-9FAA-728A4007CA69}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4790C1BF-2F4E-494E-ACC2-F7BB67C85AE8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{47D2915F-F43E-43E2-8771-E922A40974B0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{47EC8A49-1F68-4E4E-9700-B284F7759D65}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{48045630-8176-4E72-A25E-EB7186647CF6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{48262BC2-77E2-4A0D-AA87-ED8029196B09}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{48490012-AEC8-4601-B597-928E46601D10}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{484C775F-596D-4C12-B44E-3C5855E16BFD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{48C42CBE-8507-4767-8770-D018E263304A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{48C6B562-4174-471C-AF72-B15E6646F1EC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{48F5AA5C-D23B-4C21-9646-1A9AC4099F9B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{490D3790-45D8-44D6-AE95-7F60B4CC9764}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{49269504-7A16-4F7F-BA4E-81E7D562329C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{493611B3-77CC-4F3C-81D8-B9F1128A61B1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{49962E65-90B6-4044-81CD-F4EDE2D2B6D4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{49984788-9568-401B-87B6-48BC01B316F0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{49AB974D-F012-4F4D-9BE4-9DEED983F810}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{49CF6A43-8049-4D49-A84A-5E6EE2593621}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{49F54CFE-AFD2-43EA-825D-6448E9C43B15}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4A43418A-9E5D-49D8-A654-44EA50C5254A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4B1E6004-8AE6-42C0-8DA4-5B20FFE6AC4F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4B31DAF3-948B-4E53-A68F-5128D3BF98E4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4B64E8A8-31D0-4964-A864-47C09472AD22}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4B6D50C2-ABB4-4D8D-996C-F9129C2BBCD4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4BBCD0D6-09AC-41F0-BA05-F92B2FE61C37}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4BE65805-5FB9-496C-B2A7-7A204CA65FFD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4BFB38B0-B8FD-493D-9EB4-CA74824CAF60}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4C06B151-A636-4BB5-B6D2-EAA45DA92BAA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4C414840-B44E-450C-9157-0471B36FA465}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4C46DF2F-B7FE-4A18-A981-3CA65EA24CDA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4C4B1624-D240-4838-B9CC-86F03D13601D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4CAB7B0F-5723-4866-8E23-5E10E1CBDEDD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4CAEEDD3-7746-4B91-AE2A-E0DE7315AA89}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4CCAD39C-FBE6-40A5-A656-7557ED77ABAF}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4CE5606C-F121-4A1C-982A-A7934E80EC2C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4CF440DE-600C-4823-92FA-3774FD207E3D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4D11FD96-A7FC-48FD-95B4-22E714A3E246}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4D12AB91-BB99-44EE-AF77-DD2D51A52566}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4D7673AC-BFB8-4CCD-A0B0-1E7480BE161A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4DB57595-2511-4014-B4D5-393D8E749D34}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4DB6C84B-E796-431F-9FD5-B8D95781F28E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4E7C220F-5027-4336-AF72-E5A07F6244B3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4E9FE9C1-BFCA-4DA3-A23B-47B141D4A0C4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4EAE2DCB-3EAA-4180-B143-21C6095885AB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4EAE583A-962D-4EAE-A5BB-16092F4C156F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4EBC1D7B-C6B9-40E5-8207-142AC0297606}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4EBD3B6F-D8BC-4C94-8D5B-9B5C36B84854}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4F0C0D77-0ED4-411A-AE15-8EEF35347AC9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4F3139A6-8995-4658-A0A2-B0D184F2F0F2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4FCA1740-AB94-4AE0-B305-D1B377E0E122}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4FF33371-0AFD-4731-B0A6-26DBC6B18578}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{4FF6E3DB-92F3-4034-9398-AE566EE92EED}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{503562C3-AAC0-4910-907A-3CA92BE30C68}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5036C70B-C1FF-460C-97ED-13AE0855B473}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{504E70A0-8180-427A-BBA9-1FEE909AC607}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5079D146-7BF4-4FCC-B7BE-6320B3695DB0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{50F9E228-E55C-4810-BC3E-7591833B9C0E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{50FE2B75-FF50-41CF-9BB6-E233B40A12AC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{51056B31-C5FD-4D86-A89C-F9DDD1227319}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5106F439-788B-4F11-B702-C323F0ECE2BE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{51590E52-5341-4022-B783-45EC05CD3BEB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{518A8D22-D433-4D70-AB55-C7FD15511618}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{52784B1C-4D42-4D53-A429-24F2D13EF90E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{527D2D1E-EE19-40A2-B03A-D5F6A9753634}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{528A2833-D5AC-420D-9E14-6AC159B29B32}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{52C3B347-F30C-4541-8161-0F88A0BF2554}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{53733195-41B5-41B4-9DC1-1EF316A47FBE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{53900BF0-1070-4044-8918-A4E8E7C50F57}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5399B4BE-3499-46F0-BB3B-04BC5E7B1738}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{54110A5A-CBC2-41B2-B56E-0202928509DE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{542FD79C-910A-48EF-A953-A2E915390A67}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{545F48E0-6186-4444-A68F-296ED67AF412}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{548E6FD7-3F5A-4E2C-B4E5-A8C7D582795D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{549259C7-1094-4576-BE15-14B96A511007}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{549270E2-841E-4590-9EC1-454011025AA6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{54DE85A5-4A4C-4E12-9B9D-1820AD15D8F5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{558E61F6-D2CD-4961-A40B-5C175D38C7D1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{55AA1DDB-378E-42F0-8EC4-5B76DD6CFA88}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{55B10CF1-1968-4A9B-B30F-79443D3DE599}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{55BB163B-A942-4F81-A3B0-7A268C65AB4A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{55C390B1-32FA-4E18-882D-26BCE455C54F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{55D7289A-847E-44CE-8D2D-12F77F31A885}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{560D4C3A-7022-4C6F-9C42-3F0FD0DB9134}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{561B3F6F-5FD9-4ECA-AAAE-223E4EA7B31C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5624C31E-8207-44D8-B9F5-38912F45991E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5647119D-0DC0-4D88-B23D-12D9513CE1B1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{567A6C6F-68F3-476E-89DB-6AC883F4F51C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{56848D6D-7AE7-45E5-89A6-C81BA11BAFA1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{56E98A08-8418-4E2D-803E-DF57CB255068}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5747C6F3-55C4-4844-A053-7F237244A2F8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{575C6CC4-BB2F-4C80-A530-D8B7766C68AF}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{576B93BD-F0D5-4060-8C57-99E0425D5A66}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{57915645-4FA3-4CCA-B747-025CB9FCD441}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{579185E0-91B6-4986-B909-0510D38711EC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{57FC5D50-933D-44A2-B111-230499C9DCDA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{57FE1DE1-7665-44E2-B66F-63600A9A64E1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5836DE8A-ADBD-4E74-AD07-85C63ED0C862}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{58516B48-343B-46F2-982B-1FA5A3C39224}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{585F500D-C7B3-4463-9B61-86AA023CAEE7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{587299E7-45B2-421A-B5EC-113A77B9D239}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{589375DD-C439-4603-8569-7E0C9EB5D55C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{58BC36B7-2281-4AF4-88AD-7ED7449423F3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{592844A9-B59A-4658-AB02-E5CB16ACFC5D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{593AE062-7192-46EB-92C6-9E929D5AB3E2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{59926AD8-1A25-4938-A733-00DE022E3680}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{59C27587-A781-45CF-A5DF-17AA76FDA9BE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{59D010D6-5C4C-4E3A-9AD5-B2513E753350}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5A3F9F42-200F-439B-8C2F-2A0B14585EDA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5A573522-0EB2-415E-9B89-9C81A50F19A0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5A68C1FA-5F23-4497-A9F2-7873FDA67AF8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5A6AFB31-FA8B-4DEE-AB68-3BE1C5376E20}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5A7C3282-406B-4EC8-802B-87D86D74C444}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5AC71F89-31CA-4870-ADE2-5CB3E3773F6C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5B0A2EBF-3B63-4E2E-BAD6-C1A660737381}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5B1A21C9-C023-4F9B-ADF5-A3CC7F293791}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5B5C693E-F2DC-4842-903C-F592A895C708}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5B61D54E-9E77-489A-ACDE-6DE2514FBC4E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5BEF40FA-E3A7-4021-8560-962F1DE5ABD4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5C211E41-C599-4686-8F05-73AF10E44043}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5C34F7C3-561D-4E25-B3C1-E16F9ABC4E6C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5C438E84-1641-4600-A178-AC6AF8735E11}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5C5D944B-91D4-4142-81B7-FE7C11F2D059}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5C832AD2-C0A6-4D92-9DFD-B4CA339FBE91}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5C89CABC-0E21-43EE-9089-85C6537202BB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5C8CDAF4-9702-48D0-B2A9-42D8C8CEB9EA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5C9BD352-349E-483D-9211-3F24ACEE8B6C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5C9FE371-2186-4E92-97AE-EA9D948E8BF5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5CA443B3-AE9D-4618-9F3D-F2D097057B82}
Successfully deleteted: [Empty Folder] C:\Users\ann\appdata\local\{5D789BC0-4341-43CE-A0D5-B7DDD3B293F6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5DCDC982-D57D-4BD9-B8DE-9F02399EE7A7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5DE8B730-E31D-480E-8314-307E91F89093}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5E22C0CB-DF2F-4177-9E41-FCCCD8BC4600}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5E56A983-90CD-4CCA-B083-F108F937C368}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5E5F0BCA-B5A5-46C7-81B4-8556B925DC5B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5E8F4BAA-DF37-462B-82F7-7BFBD86BE2C6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5EDAC3D3-576F-4CD8-A5D1-1EA86ACAC112}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5EDF53C7-D7D5-4B45-A3A1-A14AC5207F31}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5EDFD616-B74E-4CA7-8101-F52096B9ABB9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5F15C79D-B3CC-4806-8521-D40521EB77F1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5F39E75B-246F-499F-A77E-EB6FB57DF412}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5F5A5E9C-45A7-4CDB-B471-5794892E9770}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5F63CA70-88C7-465C-A347-C6961B872BDB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5F99EC8A-473B-48D3-8D6D-11EC90235554}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{5FF70D4E-0BEF-476F-B6A3-8A0382BDE980}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6004BD0C-B94F-4B04-9D18-26FF22298BB7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6018F290-E0F7-4451-896F-C1D934ADE12D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6061ED47-C51C-4D43-A88F-0221A72F1261}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{609274DE-865C-4943-A733-2219FCB95293}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{60D20314-BF67-4A7E-A1C9-B78F4CE7485F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{60DB823A-09FE-45E3-881E-C10626E51645}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6114946F-ADD8-4FC2-88EF-46A057D00D04}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{61482192-9FFB-45D8-B9AC-A795A68D21ED}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{616BCBFD-1A4B-44FF-B1A5-E5AAB4B6F4B4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{61AA0B05-6810-4816-AF50-B6F57D4E1F8B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{61E19418-0074-4FD0-9A07-82B59725EC16}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{61E558E7-C756-4526-9A98-E7611AE5953C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{620E6955-A306-4047-954F-8D5B2EF6C4BD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{62E251CB-FDC4-4115-9CF4-084DDDD4E77F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{63200B68-6A64-4C1C-817E-88486021E391}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{63D2D3AE-0443-4A12-B0F5-2AEE0F02F316}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{63FE14DF-DE4F-4755-A2E8-99DFED907621}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{64366A57-5DA3-4C31-B5E7-8CB6D755DFAD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{643BEB87-DD32-439D-BD0B-887446FF7854}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{64743EC7-99F2-4336-B293-20659A7F984C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{64871150-740A-47D3-98D9-B61A60A1D599}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{64911D03-C545-4A6E-AF3C-238D9DDBC248}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{65728259-EAA6-4149-98C0-36C96239ECC1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6586402F-4FB5-4292-AA59-7A729BBBA4FE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6587D627-5763-4C97-A869-EC0BA5497AEC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{65B2CFAA-4549-46AC-B3DF-F172E1A4DA25}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{65C09C44-358C-49CD-A1EF-617384C914C6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{662953FA-FECD-41A7-A249-41327EEEE9E0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{662FCE8C-02FB-42BC-A71A-E60F8E29502E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{66B84793-9682-4955-A035-3E640B528E5C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{66C8B426-9885-4AF9-81D9-37185593B88C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{66E0DA3C-CE65-475C-B8C0-9CE5B63A56A3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{66EE2380-77D2-4F0F-80A5-B76FB1CFC236}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{66EECFAC-BB45-42FE-B9F2-8C0E5AFE4197}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{66F75EAC-DB35-4A91-9E5A-14FEAB7B1D0E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{67077770-D3E7-400C-A2FD-9FCDF4047648}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{670796E8-C850-4CB4-A617-E9F5BD6CFDB7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{671F27CA-1930-4EA8-BAF1-5612837FEBD3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{67332A0F-CFCB-40B8-92F6-49B3D667E4F7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6760FB80-CAC9-4B14-B99F-A668952476FA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{67928F54-4485-484D-BFDB-453476FCB6CD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{67B896EA-BA9B-412E-8674-21D25E15E67D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{67E97E25-1BFE-4AD6-A683-52D4ED1F2F69}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{680E8DE0-FEC9-49D3-8906-482706ADA60D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{68189B7D-533A-49A4-8980-0FAE92B16E79}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{687CE392-B6C3-4B50-9F95-B15AE83D2BF2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{68CD6E46-8B03-46C3-85DB-AD5720C063DE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{68E44939-20A1-449E-9AB1-550E9C4FDB42}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{690CF682-F5F2-4306-A446-130DCACE497A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{69187A1A-41C9-49F5-8DA3-030402E53190}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{696E47B7-84F0-49AB-935E-1A98980E33D6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6972AF04-443B-4653-A9C2-2CF4BB0F5887}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{69D20A00-AFC0-4AA2-95DC-816909523F13}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{69EDAAC2-FF62-46BB-8D4C-F629EA31F406}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{69F6B80C-66E3-4AB2-8E93-8E119D906822}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6A4E8FEE-F199-4DA0-9DEE-6564EEE630E6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6A817974-DCA1-4944-8FFE-56DEBE4EF3C2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6B519094-CAE7-44AD-A65F-856DC2718DEF}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6B5B10ED-59DE-491C-A154-17AECBE2A9CD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6B6E9BBA-0BAB-4C69-8B89-2EE91F65C790}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6BC96A13-9C30-4533-B680-4CD678D1205E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6C36C963-86CB-408A-88AC-59C8B9F12D5E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6C50081E-9DF9-493C-9E71-71A69AE7BF14}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6C8C41F0-C363-42C9-922F-145D7735618A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6CA8F23E-0B83-4242-8FC8-9A45147517D3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6CD0A3EF-EAB0-4916-B8EC-79CCBFE18092}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6CD3B95D-C880-4A3A-B6AE-59792DC67B75}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6CF79AA1-0C37-4F0A-8314-D8D1443DBBA7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6D124B47-EC47-4E0C-B88A-A8B119369B2B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6D175E30-2369-43F0-BA80-4E2512DCAA20}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6D677F6A-6737-4FD4-9017-336C19915D50}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6D7299F5-756C-47B5-A56A-F03D70AF5584}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6D809133-2277-4F3F-B667-1F0DB3620244}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6DA05E62-C058-4669-8D59-66A89FB19233}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6DC39134-1AD6-4292-B5FD-113F8B9E4BAE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6DD3B1A0-B1FC-4F46-B8D7-606AE84BA225}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6F6E60A9-F797-44B7-A996-F6E0A8ECFB61}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6F72A3DA-C5D1-4811-8305-67949FA92C64}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6F8A3D08-4FE3-4525-9956-445A84C9F6C6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6FAB7322-BC77-48F2-83B5-57161454A834}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6FD3E7C6-7093-4567-A62C-C6DBAEC79678}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{6FE10223-001B-45A8-B2EC-046AF8B19D17}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{70070604-67D5-42F3-B675-E29EB1B150D9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{702BA501-5703-43A8-8E32-1FD1DF19E86A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7030B4E3-74B9-4CA9-89CE-261945EF5BE6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{705BCA62-B4F8-41A3-8396-B3C07548A4EE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{708F3BCB-18AC-4984-AFAF-EC6D953F69C4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{70C2B97E-7AE8-4B6C-8E66-36B1ED3521F4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{712175F5-D1DB-4FD4-95FE-4855BF749B4E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{712FD391-A9A5-4070-BBA0-A1CBF0DAA97E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{716CB563-148C-4FB7-9F54-64380FB8D3E8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{717F8C46-47F1-43CD-9D14-E830178FE09A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{71C0F2DE-E4F9-4E9A-8E0A-54E03205543D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{71C17C4E-403B-4834-8044-175A5F3818D2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{71CD9E13-D6E4-401C-BE29-034EBAEB7BE8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{71D418E0-3EFB-4E08-A681-AC239BD471C5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{71FCA75A-C994-40B5-8D72-9EE0A265E0D4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7218B6FF-0188-44B5-933B-A2CDAE3A96AC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{726AB920-3866-4C2E-9A7A-1D74F36F8859}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{728AFC14-F01F-4341-ABF0-DFC3CDBACE53}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{72CE867B-69F3-47AB-B246-588788624A37}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{72D63CE3-8ABD-44BB-8D5C-2AE905CD685D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{733CF24B-1C8E-4985-8583-226E12150E15}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7341167F-A632-466E-9B4B-34481BC65D53}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{734EFF20-8337-43E0-BEAB-6F93F49DD679}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{736D6C8F-638C-495A-904F-7628A2B5200B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{73D1DD29-C169-4D76-9FB7-E05D1226B6E9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{740675D2-2D1A-4CC9-BACC-7D0B36A1E651}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{744A7B9D-996E-4526-95A1-8A6A9C255819}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{74C221BA-ACFD-48C7-986D-51E6B80B1B1C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{74F5B781-DEBA-40A2-8933-33C81ED876E9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{755DBD0B-F8AB-4888-ABF0-1FE27CA4EA93}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{755F9B2E-F160-4AB6-B866-CCB0BCAC9EF1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{757695E1-CDEC-4270-90B1-DCFCC43B6022}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7585792A-7FA9-4FF2-A064-90378C185997}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{760ED3BF-BC3E-462C-8926-F8E77F55B330}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7636D497-D5E9-4CA4-9A6E-3DC125FA777C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{76504F95-D474-4C3B-9C41-72D678F6092B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{76B8F975-4416-4443-BAC0-188C0E9CA978}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{76DF92E7-8319-4B3F-B8D2-499B76A2D196}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{76DFCEC5-2B10-4CA3-B3E3-EECD342C1A73}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{76FCCCDF-DCEF-4704-905B-CF65EBE1CE44}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7722EC2E-D1A4-4924-9C35-8B4D9273F97B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7740049B-D5D4-4348-A17C-D609F7B4E297}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{777EAA80-7156-4BE7-9A71-EEDBCA1BD5ED}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{779A00C7-C207-418B-AE9D-C27CC3C4BFEC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{77A98390-881A-4999-9808-9FD9187F8350}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{77CA41A6-D4DE-4817-BDB7-D9AC3A363CFD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{77DB492E-5328-44B3-94F3-C87F3B4692CE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{77ED3FE3-7086-4471-9140-A72399CBB0E8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7802042A-5509-4C3D-8673-61CD27A5DA80}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7819855D-7D51-4C63-8D51-5A9FA1D5FF30}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{782D9C72-56B4-49CD-BEF8-09CD736F8D09}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7837BF70-6176-4E6F-B4B3-E5E4E3919BC0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{787E91F5-A653-4725-8885-FBF787D6638D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{788E82B2-4212-4079-B408-8F506A6BD377}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{78D075AF-EB05-4382-AC0C-295774AD15D3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{78EC496F-F47E-4DE4-874B-661237906A22}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{78FCD248-0299-4834-A4C4-536CA39DDD60}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{792833E8-9092-47FA-8AB1-3A5D5991AB76}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{796BBB57-DBA8-4B7C-BF77-1D136795EA72}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7980138B-52F0-4449-866D-A5784882E36A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7A4603AB-2A89-4FB0-B67A-63F4F2E39193}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7A4FDBF8-7900-4A79-A5E2-6F19EBFD7455}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7A91ACDC-FCD0-4515-A2CB-56E6F945E7C8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7A99B971-A21A-49FB-AF3C-615A6F7BBA5C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7ACDFB89-0D2A-43E5-8FB3-94032960318E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7ADEA6C7-C9B7-44DE-9690-93FE623BF9D7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7AFC242F-B9D3-4E4F-A50C-30206B94BC65}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7B05363E-04C1-4D58-993E-701A491CC463}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7B0A1A89-2CD8-4E3B-A8D9-A8CC6BB49938}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7B432E49-921F-468F-82AC-F43AC006433A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7B532A65-56C4-40CC-A328-91F7B8CB4038}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7B5499BB-2198-4D32-9566-8FD3A9C43303}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7B599392-97F9-433E-AEF0-4CC8C098B565}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7B7C9C94-2836-4E4E-96BD-B02AAF9E8285}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7BBA9F49-7E96-4D70-8C54-2DCCAB8B2DC4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7C5A2D91-DDBD-4A8F-B697-A839589022B8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7CB0B3C2-4B17-41D9-8D3D-60BAE42884F3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7D35E905-9A33-4D98-A22E-1188C8EF5EA7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7D5ABC9A-E622-48A2-AA73-419050872295}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7D788C5B-2D2F-4EFB-BB6D-B9D9CB3B1373}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7D7F7BBD-53BD-4FE2-891B-1F5AC55373E1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7DB0E5B2-F853-4758-B317-A6FFD8E9EEC8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7DEB8E1E-6505-4DA8-A2F6-CA0FB2838B62}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7E19A03D-E106-4117-AFBC-E50545520C15}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7E4C697A-1648-456C-B851-79DBAC92E202}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7EB4398F-4B21-4DCF-8615-1EAE2519E21D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7EB86856-208C-45EF-A20A-116D11ECB922}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7EDA4A88-ADE3-461A-9035-6326352D9EF4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7EE57CD9-9A50-49F5-AAB0-B3C475DD69DB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7EEB3C5C-9493-4BB1-B2D7-45A97A44222D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7F3EC1A7-9C32-41F2-8E5D-0713F7FA29B0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7F4B8F68-1C7A-455F-A641-60E6393A98DA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7F4D175F-B480-407C-AC02-D944538345AB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{7FD3DCC9-7613-42F8-AAB6-165D6C7B2FA2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{80247CBF-3AE9-484C-8BA4-670EDA4C89B5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{802A6053-CC27-4D5D-AFD4-E333A8637858}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8068E14A-A565-4ACB-B8B6-F90541255D7D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8180E39B-D9C9-469C-985A-B08280D2617F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{818B0254-79E8-4309-97D3-1947ACB42AC1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{81902891-4E91-4AE1-AD2E-A91B97B70593}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{81B256D0-EFD5-485F-88A6-3A3D663C6506}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{81D81969-0438-44C4-AD54-F8FB82CF2BF6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8207AD7C-5D6E-4880-8E04-E4F5706CC324}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{82B021BE-5A4A-4B27-82D9-5C2617F74688}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{82BF7747-38A2-4D7B-8C7E-CA76CE077856}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{82F3A811-CD12-4151-BC70-8D9CC659CCE1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{82F83A49-1237-41B1-B91D-B1AB408879B9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{830D6C81-592F-44BA-8A19-031FBDF88610}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{83919823-A622-44E2-AD24-E7D7E68F88E3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{83CCBD28-94D3-4C86-A6CD-0E8DA4BAF850}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{83D8272C-3941-4A2F-AB2D-FCE55855C28E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{83E23F0F-A56D-4E50-9EB0-66A71BEF87A0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{84DFFA2C-7035-40D0-9F62-C2AA29D32749}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8525A1F9-F73D-48D8-BE37-8AEB1E65917B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{852B52B8-65F1-4194-8D76-0AC82A7C213B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8546C424-C75F-48C3-9ED4-C2AF53CF5B61}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{854A9EA4-85AA-4E69-AC69-8B689A88B669}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{85838CDE-6D7A-4427-9FA5-9A10FB00F58C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{85E18120-8ADA-4ED2-9572-0B264310752E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{862EB913-1EB2-4CE5-9BBB-DC8884C3EA2C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{864698D9-26CA-4AC9-BB98-7F1CB9A490D9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{864FF473-A751-408F-8CCE-FF4CA7D70783}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{86A900E1-DE8F-468D-8FDE-0E71A9649416}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{875B2897-DB20-493A-A094-03443BDF182C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{875DFFFA-E870-468F-A37A-93ADC5077CCE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{87C9A912-00AF-4EF1-B7B1-E41EDE827ED7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8807C788-7A38-486C-A0D0-1AD08E4B349F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{880DC1AF-3B43-4051-80B0-442944422ED5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{883DD04D-9B56-4CAB-B379-24ED2F31AE8E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8874F9A4-DE17-49F7-B9A1-DA5D389D1A4B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{88A42FBF-CF51-4BC0-911A-6277A13633F2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{88D0F567-F44C-4894-B26A-EC7359293F71}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{88D970B3-3178-4B6F-BE15-A4695A85F76F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{88DD61FB-625C-4A90-8F5D-545203426F4B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{88E2E576-0872-4975-84F9-17FE96DBB54F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{890E4DDC-F1A0-44AB-9313-99D85B96CA7D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{89446218-0118-454A-BFCF-BA4A4B978771}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{89735C78-C3EF-4CE2-9ED0-53DDFCCF5A61}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{897B38F9-D239-49DA-8627-0085D9548AA2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{897FF76D-9081-46EB-AF01-1692DD795F23}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{899A3594-7C0E-420C-BA10-94773C69B4EC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{899E1D32-3AEE-40E4-ADC8-096D6E7349E7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{89A39853-A0FE-461C-BC26-18BC24709809}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{89D171EA-B5EE-45C6-A675-55C3B5FC5736}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{89EF1C04-2F80-42C3-B84D-452D0EBC63D1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8A0CA72B-41F7-4014-8376-7490F977AFBB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8A20D43D-0B3C-47BA-9E00-449DA367CCC5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8A345934-0994-415E-8209-7ED42BD1705A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8A6DF646-B9CA-40CA-BEEF-9F7D9A13BB37}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8A8DB9BD-51C8-4748-AD04-887424980C9C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8AC79820-1C09-469F-8424-2692A15EBFF8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8B3936C8-9EC9-434C-BE9A-B060E955DE30}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8B544F14-9020-4A3D-8931-04408CB60D6D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8B57BE8C-F977-4AAB-A58A-C953FDF9A9BB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8B6CC265-6592-4FC6-A097-6C5F8698781C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8BB99B85-4689-4E23-8FCF-B54FFF7D8BDB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8BD4A737-3118-4AD4-BF33-E614D25A09BD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8C41EE50-7152-4938-8B79-AB7DD370181B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8CB794BC-998E-47F9-807B-618622BC3E76}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8D8C4200-C2D4-495D-8B4D-A4F9851D4718}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8D8DB310-BE1D-41C8-8B43-DC3062539586}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8E01D584-C0DC-4F21-A248-F1C874E8C70C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8E0A19DB-0276-4238-9ECA-6A18D59F81A2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8E369149-689B-4CB3-8208-F6AEDFC0A353}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8EACDE6A-208C-473D-9029-7BE183C4ED9A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8EE89E36-A51F-4EA3-A1F3-B0E6752CEB9C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8F2E8E40-3274-4000-B70E-E564A978F7EE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8F7AE745-67C9-45B3-A013-412D63C8ECDC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8FA5C660-0CE4-4DCE-A26A-91D79659B99E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{8FA62A88-30E2-4CFB-9C02-69E44D6CD19D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{900FBDA5-38C6-4A9A-BC17-BEFD78EFF733}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{90180310-D6BD-42D3-85E1-9E32B6F9AE35}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{905CE99B-6B02-4F99-8F3D-17BA3A7E1385}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{907B8C90-F8B5-4CB6-9F35-06F02801F7EC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{90ABBDA2-0DCC-4A1B-A3AD-14F2DE03E6B1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{90DA17F8-A8CA-47B3-8B66-87C02FE29642}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9130E333-68A3-42DE-A7C7-F20763BCED12}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9179B51D-B412-4CFE-873B-7C371CD2050B}
Successfully deleted: [E[Empty Folder] C:\Users\ann\appdata\local\{91A79E8E-7EC4-453F-B91C-8FCF82B44078}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{91AF39CF-538C-40BC-80CF-E0BDCC6B611A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{91DFFFBE-EA49-458A-BB07-7EEEF726C6C8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{91F20E49-7DCA-4291-ABB2-6B88F2A93A52}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9282A56F-BB56-440E-9601-3C645B5BF5D9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9294CFA2-1A4C-4DA5-ACEA-65BBCD11C859}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{92AB334E-1CBA-45D7-AC61-D958B24D0A90}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{92F93E06-C3F5-43F4-87F9-01AE11522795}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9308B9CC-B86C-41BB-8B36-D9BF115EF0EA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{935BFC6E-43D4-4107-B276-4D40DDD000E5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{93BCEAB6-6A00-4F73-9DA7-D980F1454F4E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{93C79773-4E65-4A84-9584-0C79EC15851F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{93EBA13C-91B2-4E36-9FAD-36ADC66D1E04}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{940C940D-411C-404B-8E37-103D5F299A5E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9410DD64-A94D-4DC0-8B28-2E6E36166A7C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9413A21B-9F31-4034-B243-ACFEEDC3F03E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9470B238-AB85-4807-8854-5A2CC8AE8611}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{94CA8346-8BA9-4A6E-93C8-A6A08848D87E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{94D0AF61-DF1E-4928-9C3C-2B7E7D36E55C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{94D94370-15EB-431F-B051-DE41FA96589E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{94F39ED3-5F5C-4232-94DE-4F822D91D4E9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{954B6136-ED7B-4CBB-90E0-1994F60BBF01}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9586C8FE-C57F-4A23-BA28-97BE1000FAAF}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{95A6086F-E04E-44C1-92FF-E49511F5F37B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{96082406-5FBA-4662-A839-272D0C8CA488}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{967926C8-1B3A-4A73-AA94-F68A5AB652D1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{96EDADDF-D77C-4576-B776-C871EEA69369}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{96F173DB-274E-4819-8EC9-D6CDA0DF178D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{97245175-A810-42A4-961F-7F4531BAF872}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{97257381-437F-488C-8C66-5568F60BBC35}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9777FA55-32EA-43CA-B08D-97385040181B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{97AD96E7-0148-40BF-BE93-588A545DA63D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{97B12731-BA3A-4E71-B939-9326005A2186}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{983CCF09-3129-428C-B25E-2BD5C4E0BE7F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{983EE3D6-6227-4FF3-BC15-86B665808168}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{984FD713-2999-4226-B932-B76193D7DDF9}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{986FC7EE-6E8A-4414-A85D-43BA13F57B86}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9870238E-47CD-43B1-8A3A-449A36A638C0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{987A0B6C-7CB6-46F5-9380-B87C143BDFC2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{98869F03-2CCA-4B54-B1DD-536E866455B0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{988EC826-C2A8-4E48-8C22-C93E88C5275E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{98AD2DE6-D466-430E-A5C5-FE12D7BDA29C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{98B07B8D-A5A3-4550-8208-FCBA0A90B7D4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{993A9141-A639-4204-8EEB-9EE66F266D74}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{993C100B-58B2-485B-9D0A-1EA0ABADBD10}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{99EDDBB8-BA01-40A3-B288-96628102603F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9A0E6012-2F34-42DB-91E8-135FD2BB2834}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9A4B8FB7-32C0-49EE-B6EF-CD0D1087A113}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9A4D0091-26D6-4A11-9220-446C9BD698A1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9A66F4F7-D03E-417D-885A-D0EB6EBCC055}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9A77A327-3B5E-4674-8990-96472AF10A40}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9AB00F5F-574A-4F2B-A653-6C108731594B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9AD4EDA4-1BC6-4284-995D-209948239E3E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9B236C78-618A-46FB-90EF-28C5777E3209}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9B2FC0E9-954C-43A4-8C6D-FA28B0FEBEF7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9B3BBE90-EB9B-42EC-9EE9-CB871E7B266F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9B5A555D-4E12-4BAB-AA2B-FF64582B36EB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9B696A0A-D7AA-4A5C-822A-18F2A45AF352}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9BCDBB42-4930-4703-976A-1083E889FD75}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9BDC726A-0328-4BA4-BB32-626075B3BEF1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9BF13F20-91ED-4BA0-9978-3878DFAED85D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9C03901B-76D0-4BEB-A1FE-324AA631D49B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9C0AED6D-5663-4C00-B85E-FD21049C3C97}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9C316DAB-DCF6-4A0C-A01E-39220AF542AE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9D6D6FDE-9B98-4BAB-BF6F-9AFEA11E3024}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9D763838-ABE5-40F3-B94C-A2307DFD0577}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9E8E7999-5FCE-448C-A190-32C1F8C2295D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9E9AF723-7115-468B-9D99-EC5B51CEFD01}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9EFA11F7-6C69-42CF-9510-D61BCF98942E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9EFC866D-7EA8-4BD8-91DC-A52F9984F9DD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9F1F6247-3364-4396-9D5F-599197E74E07}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9F2E0373-D171-48AB-92DB-F4653F29589E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9F590331-E8D8-43B0-BDFB-CDD1127E1EA7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9F973846-978A-4D57-8394-C1993EA5596F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{9FDD0FF8-DE37-4916-9CCF-DA0265BE21DC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A00AB5E3-1CF7-4882-A4B9-31EA955689A1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A02428DE-78A8-43E9-8434-160AB4FB0275}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A05E93C2-3053-4C2F-B71E-52E7C3DEA418}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A05FBA85-4ACA-434A-815E-5027515F2CDF}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A078EDCB-8D2A-4099-9C41-9E7524D0D15D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A0D9C53B-2339-4D9B-A304-9B5243EFBF28}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A0F491EC-5A36-48D6-B3BD-51ACFC4998A6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A1499766-45D7-426C-9697-900A02ECD02B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A150BAE7-1111-4840-9FB6-D02F90BC1E61}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A15DB2A4-AE56-4BA7-8444-9803980D4139}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A17635CE-A9A7-4990-8A0A-B0797AA5EFC8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A18E99C8-0EF8-4E68-AF7C-CDC33EAA3714}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A19521E5-95D7-47D4-BCAD-D140BF166935}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A1A25AC3-C142-4FAA-BEAC-3A6B980A70F6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A1D8F4AC-1CBF-4C30-AD9C-7797A9527EA7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A1EE556C-2519-4C6C-8945-A38A665CE621}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A27FC96C-E3C4-4999-872B-960D97E88FCF}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A2C92D5A-9A9C-47E9-87B9-291203ACCBCA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A2CA9602-BC0D-41DF-A2AE-30D5334B55BA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A2F3D55E-078B-4111-9FC0-34C9996B8BC3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A3072BCF-3B01-440D-9D7B-02B2898C4533}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A32AACCA-6B45-4550-A34B-6B76D48F7A7B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A33DA9D8-AF45-435F-AB03-76412765B12A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A349BF4A-07E2-4D11-91DE-95A6D44E562C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A388472C-A24F-4C94-A68F-3F2453F36F9D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A389DA95-F956-46A3-AC81-07FFC6378A9D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A3A774E3-99C4-4371-999B-BD5246603826}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A3E15ABB-DD2A-45B7-BB2D-6EB528FBBF29}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A41DF2E2-0AF3-4688-BB0D-5F3143593737}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A4228BFA-C9C0-4382-AAD7-3261DB2BC4DE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A423928A-DDCF-4490-BD8B-C89A54DE49E6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A42FC0B4-744E-4062-B20D-351F1FE2F86E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A45DCD10-DA16-4738-AB13-8B0F30B246D4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A461B15E-51C1-4662-A323-5FF26E00A3E4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A4B5AB05-7E18-43CF-A2A7-B49C7DC9054F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A4C84847-CD6E-482F-A17F-287954706DAB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A4D59E04-CDF1-4B8A-8753-90B3763898E3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A4DED358-A5F6-4D59-9607-22FC8667AF76}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A4E22FBA-3C87-4A4B-9B3C-F948E64A4892}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A50682B9-6145-4F84-8706-05A0325FA468}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A50FD148-D57D-4BF3-B0BB-7679A6D0B07E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A52ABBB6-A69D-4C03-B2F2-7A5E9B662E89}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A5329780-D5F7-40EB-A602-371D07215A67}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A5449DFF-4F8C-4D60-8207-252BFB9C7CBD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A57A1C27-41FB-485E-8930-1DA5E77ADD48}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A5D19ECC-4E5E-4925-89AA-892BF620DC69}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A6488ED8-B30C-4337-8A6D-3C097859AF3B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A656D6C3-3F93-44DA-B274-17E4B5E3912C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A6814AB2-7ED3-4F08-8E70-F2733C10B42B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A6EBC363-93B0-4F52-9D80-C314FCDF50AC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A7334904-ABC0-4DD5-AFAB-963EE07F21BF}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A7AB8E24-42C7-4B7E-BAF8-2377B44C1D0E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A7AED4E1-94BE-4C7F-9B60-74B817810CA3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A7DC4486-8594-4C7D-83AF-0386E51E1BD5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A7F2EF13-5D18-4E2E-A186-D09D8C6EC607}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A8668021-2C8F-4BA3-B12C-F94CC61C1896}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A886DED8-DAE3-476D-A842-17B6532ABE17}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A8D8E45E-0094-4D05-9551-18CCDCD749B3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A935044D-C1E3-4274-8346-9F015E8042C8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A946114D-EBD5-49BC-938C-85B682FED217}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A94C41A8-06B3-414E-A3EB-03B8F0ACB2C3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A95DACA5-5238-41B1-B911-3D197E3E8CDB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A97EC8C7-220E-4DEA-9999-BE73B3FC9C6F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A996651A-3D0F-4551-962A-3C2D6B19E9A8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{A9B27934-4BB1-4FDD-875D-AB3089366CC5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{AA290E87-3A5B-426C-A2F1-63E5FBA89113}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{AA4247AE-3EF9-4FBD-B497-4B71FA739279}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{AA6BBADE-28C8-45EF-835C-69401E43B508}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{AA7A402C-00FD-4FD4-9B14-84770590318D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{AA913067-D430-4D6F-9193-2BDD3EB6350B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{AA9223D4-B018-4FDB-9137-5CA4F6B9FAB3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{AAAAD649-D973-4DF4-BC78-1E7BE2D4D46E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{AAEFB947-DEF3-4AE6-9AB8-1033039029D3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{AB59E3A1-B7C8-4415-BBDE-00214470A6DE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{ABA67966-8AB2-48A1-8C4F-F027ACCFDB50}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{ABAA511C-2586-403F-9453-9F5E11DC9F04}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{ABC72C07-0B07-4182-9F28-AEA79A2E3F17}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{AC11A1A9-BD96-4686-8961-62C0C00F9B8E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{ACFB3D68-04B6-482B-8B76-9848D7B458E2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{AD005372-D1E4-4A7E-8646-3695CD08E292}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{AD32D848-2FDB-4DA9-A019-DDD7DD31430D}
Successfully deleted: [Empty Folder] C:\ Users\ann\appdata\local\{AD8EBC24-F241-4AD5-B76B-A429AC05C38B}
Successfully deleted: [Empty Folder] ppdata\local\{E7A2C8E9-FDCF-4858-9F4C-969B180E88B2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{E7E76786-6620-4371-B804-6ABC3A044D76}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{E80F75E1-6D6F-4C9F-913F-C7C42BF5E7E1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{E813250B-00FD-4968-9540-1ED138D67DD3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{E8BD9FD2-26D2-4566-B24C-B3507A1CC4DD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{E8DF2362-894B-43CA-8BC2-73DB06D9440D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{E8E0006A-FFAD-4046-A57B-245C7956C400}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{E8F4787A-D5BC-4D34-9B5C-B282A0A8AB0C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{E9882D26-0E66-4D4F-8466-FA80985F7DAA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{E9C8CDDF-F862-4292-8DE7-CFAC3B01067C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{E9E48955-7FAE-4645-BB85-0E02E8F4BD0A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{E9FBD43D-BFFB-4A86-8333-1B0D21B1C71E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EA030656-0DBF-41A4-AA32-F7F1FD6EEFA1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EA19FEC0-A31E-4129-95C2-C1DDD2CB2639}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EA2F7C2E-B71D-478D-90DA-48F1A7DBDDD8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EA7CEF2E-59EF-4B83-96B4-17F0AFCD298A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EA9C5157-04DE-4D4A-B7AA-88881D6102DB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EAAA5CE2-C5AA-4233-9D4E-6FD18848108C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EB0AECA8-3F6D-4A7C-ACFC-89AC06747A61}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EB8E36C2-E4D9-4A32-8883-818659D85458}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EBCE58F2-630B-47C1-9143-6111E88366AE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EBFA8A8F-B6C8-4453-9EE2-8A492D957184}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EC0B195C-D815-4214-9D5A-B80346AC7FD2}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EC2F6E14-D058-4372-97FA-63360B26ACC3}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EC361E53-4C70-47AF-9A8D-26AEAAB3B0AB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EC412419-B0DE-4C11-9D7C-90157776DAD1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{ECE73489-A240-4775-85AC-A8FC6FCEF9C0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{ED2A48A0-CF5F-433B-AE4D-8EEFABB711AC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{ED4229BF-4537-45F1-8176-35F887059693}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{ED52BA72-014B-45E4-AFD5-0BD4B029B249}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{ED5D97A5-14D6-4FAA-90B5-99BC1EA0B4F5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EDA9F998-CEAB-4744-9543-E0305F87268E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EDDAD3F1-2D58-4095-9913-AF65F343BAD8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EDDF1671-A1F0-452E-8C7E-B1AB41D3C3EE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EDEB8C18-48B3-4686-9656-D4A9075320BF}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EE1AD678-3C35-4962-9121-F51966BACA6D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EE2C908C-24AA-4752-96C4-DF15E09D2A4E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EE35208C-AA78-4706-97F7-06F6BDCC2A07}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EE4DF673-16D0-4A2B-AD0D-082A25D9091F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EE4EBC00-8C83-4097-85C8-9AA06C07395E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EE50C29D-E813-469F-8022-A52E46A5B999}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EE8619A9-AE2D-4B8D-A6E4-A0460C257520}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EF39DB0B-DF73-42A9-A5EA-BDB3F1B3AFBA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EF3B1196-FBEF-4B0A-A9F4-6FACC4FE4277}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EF3C2B83-39A6-4BBD-8259-589AAF52C31B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EF4D36E9-8AD9-474E-B68C-D4B7A5F26273}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EF9DF90F-5988-4E40-BC07-14FA36747AEC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EFA96079-7972-4714-B0C2-6CF35986CCFE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{EFDB63B1-880F-43C2-AA64-F756D3D82362}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F033C149-7D98-49D7-B37A-76CFBB4F45AB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F071FB75-0E13-4E17-B74A-A3132B572DD5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F0DF25FD-41CF-433D-BF91-CF0C3D173DE7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F0F87494-D3F2-43C0-8520-B352DC074A61}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F0F92D0F-C8CF-4DD5-838B-0B1CF4FC64DD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F1466A1D-E281-4B24-8A4C-15C7BF1A91BC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F1634C78-E2A0-4C47-AB64-B1E1B7FE212B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F169BFF1-C7CF-4238-BF78-71E46FE7A00E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F17F9508-3517-4A86-96CE-BB69D0F053B8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F1BFA1D8-9B01-46E4-A193-C3F704D682F8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F2305E10-A6C8-41CD-A71E-6DB3BEB09B3E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F2C6A16D-0CAF-46C7-8210-D50397D463CB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F331C278-1E5F-46C4-BB6B-D6029762F5D1}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F33F4E90-4C7C-49F1-A52D-3EC23F84D657}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F36FF4B8-D21D-4E03-BC96-610097EAE3D6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F3842400-4E3E-41DB-A71C-97DD304C8CD5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F3E670E0-90B5-40FD-AE57-EDDCD777930E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F41BC795-3CBD-4420-B2BA-984034DA207B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F4364316-320D-42D0-BBAF-CADD0661BF3B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F4513E39-8F30-475D-B407-D22C37A7E1CD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F49FA9CE-C3F5-42E6-85C8-FF85B7F123E0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F55A08AF-FF34-44E7-997F-DD69A9E650AA}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F56A3C49-A8DF-4882-983B-DC383DF711D7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F5DF2199-EBC5-47AF-A98D-84AADCFFEB65}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F5F0BD7A-61A6-43B9-B036-6980FA934B5F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F6320EAA-7A34-4061-9BBA-9892C8EA6FB6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F656CE5F-4FF6-43C5-BAD8-1B6F1CC3187A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F6791456-53E1-4FB7-926D-75FA452FBCF5}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F67B7584-DD27-4A58-A26D-E6BD39FFEFB6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F68687E9-D1E1-4DEB-898F-1D7C04127A96}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F6B8903D-D289-4C22-89EB-59F3DEB1F4EC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F6C35198-1142-4751-9BD7-A84A42956979}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F6DCB04B-5430-4C56-971E-01B3035B2EFB}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F6EDA7E3-1191-4AF1-8775-25E938400F7A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F6EEC361-6782-44F7-B52C-5ADDAA779B70}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F7502D67-6875-4135-B014-A5A77ECFC897}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F76C4EB4-A2E0-4F40-839D-C7602F44E670}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F7F56A5D-66A7-45FE-A5BD-F40BA1E699A6}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F7FC2613-BDA9-47BC-972D-0AF5EEA3FC6E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F822B557-9FF2-4D28-9270-FA90AD75C687}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F834BD08-4F27-43AF-A96D-3A807B999A82}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F84E5CCD-F7D6-4479-98E0-22F6237C5FFC}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F860D93D-6FE4-4783-BD31-A5FAA60AF715}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F895664E-C16B-447B-8C10-5955A822B6E8}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F89B4ADF-A223-4D8D-9F0E-E5D6B862DA10}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F8E5ADA0-9C57-4471-B400-62991938AB35}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F8EEA43F-0BAD-4754-833F-6B9A8A71D9B4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F92043EA-6228-494C-80AD-2AD22CA3F007}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F99D8C83-9C9D-41A1-83FF-D911FEB26166}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F9A1E3EC-CF1D-474F-981F-11D680DC70BE}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{F9CC789A-3C0F-46CB-B3BC-7FCC18FE88FD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FA2FF11E-8C28-433D-9E83-6BE408A18081}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FA709C89-2115-46D9-959E-C2AAF7A00DC4}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FACE926B-59E8-47F3-9975-1B712313243B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FB1CE879-56C3-44DD-ABAC-78F1DC412873}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FBA4B4FE-FD9F-4018-ABFC-70C7B1330A06}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FBAD4B61-9FB6-42A1-814E-FDD0EFE9968A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FBF583FD-A57D-4F27-8E77-580873E63C82}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FC1922EF-88A1-45EF-8FD8-76CBBC25F391}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FC3950A2-8E64-4973-9A80-C99B72249733}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FC594EB2-7057-45BB-BF6B-D81ED7C17495}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FC5F8D86-26E8-46DD-B3FD-13F558541C2B}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FC914FE3-DB38-4B67-8371-9E528E5D9678}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FCDC0389-596E-4B0D-8FF0-6267FF74AF0C}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FCE35CF6-25DB-47AC-A0A0-4BF539C8737F}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FCE71036-454A-42D4-89A3-50B714AA9053}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FCF5C7FD-83A4-454E-B5E3-09DED1D27F0A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FD6EEB4B-E392-48AC-8B3E-6E52A7FAC2F7}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FDDD542F-F3C3-43FE-823A-4DAA91D54B52}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FE15DC47-F644-4A72-876A-225AF2C5535A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FE5E0F09-4604-47C2-AEAF-6E0E52D3EB7D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FEC1B258-F8B3-43F2-B96E-AB68E3A8C36A}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FECE62E8-675C-4254-BAEE-D8CCC3973F3E}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FEFA7207-7245-42B6-AC93-3FBF8FA1C167}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FFA4C5CE-DE53-42A4-9781-59B0788BBE55}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FFC24412-1BDC-4FAC-B4FF-7CDA637951BD}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FFC729BE-5713-4838-A8F9-89C782AF011D}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FFC76417-9725-4F1C-8417-F2219F4AD6B0}
Successfully deleted: [Empty Folder] C:\Users\ann\appdata\local\{FFF15D91-57BE-4992-A255-3B37B0F149C9}
Successfully deleted: [Folder] "C:\ProgramData\ask"

~~~ Chrome

Successfully deleted: [Registry Key] hkey_local_machine\software\policies\google\chrome\extensioninstallforcelist

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15/06/2013 at 17:16:41.42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


----------



## sweetrose (Sep 7, 2012)

wCleaner v2.303 - Logfile created 06/15/2013 at 18:57:18
# Updated 08/06/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : ann - ANN-TOSH
# Boot Mode : Normal
# Running from : C:\Users\ann\Downloads\adwcleaner.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Found : C:\ProgramData\ParetoLogic
Folder Found : C:\Users\ann\AppData\LocalLow\AVG Secure Search
Folder Found : C:\Users\ann\AppData\Roaming\DSite
Folder Found : C:\Users\ann\AppData\Roaming\ParetoLogic

***** [Registry] *****

Key Found : HKCU\Software\BabSolution
Key Found : HKCU\Software\BI
Key Found : HKCU\Software\DataMngr
Key Found : HKCU\Software\DataMngr_Toolbar
Key Found : HKCU\Software\InstallCore
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1631550F-191D-4826-B069-D9439253D926}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Found : HKCU\Software\mysearchdial
Key Found : HKCU\Software\5d0dddabc6ab915
Key Found : HKLM\Software\AVG Secure Search
Key Found : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Key Found : HKLM\SOFTWARE\Classes\AppID\{C3110516-8EFC-49D6-8B72-69354F332062}
Key Found : HKLM\SOFTWARE\Classes\esrv.mysearchdialESrvc
Key Found : HKLM\SOFTWARE\Classes\esrv.mysearchdialESrvc.1
Key Found : HKLM\Software\Classes\Installer\Features\F479A18A22A86E3429341589FF57D81A
Key Found : HKLM\Software\Classes\Installer\Features\FA20CB7A821113A4CB8FA1E38E303D3B
Key Found : HKLM\Software\Classes\Installer\Products\F479A18A22A86E3429341589FF57D81A
Key Found : HKLM\Software\Classes\Installer\Products\FA20CB7A821113A4CB8FA1E38E303D3B
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
Key Found : HKLM\Software\DataMngr
Key Found : HKLM\Software\InstallCore
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2BDF3E992C0908741B7C11F4B4E0F775
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B3BC4CF5ECE1F54BBA174C13A1AB907
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BEABAA33A5E68374DBF197F2A00CD011
Key Found : HKLM\SOFTWARE\Wow6432Node\5d0dddabc6ab915
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{219046AE-358F-4CF1-B1FD-2B4DE83642A8}
Key Found : HKLM\SOFTWARE\Classes\Interface\{01947140-417F-46B6-8751-A3A2B8345E1A}
Key Found : HKLM\SOFTWARE\Classes\Interface\{819FFE21-35C7-4925-8CDA-4E0E2DB94302}
Key Found : HKLM\SOFTWARE\Tarma Installer

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16611

[OK] Registry is clean.

-\\ Google Chrome v27.0.1453.110

File : C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.30] : keyword = "mywebsearch",
Found [l.34] : search_url = "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=84A3265C-6544-45B6-8A52-015E74708D17&n=77fce125&ind=2013061413&p=Z1chr999YYgb&si=trailerclips-2-v3&searchfor={searchTerms}",
Found [l.2072] : homepage = "hxxp://www.delta-search.com/?affID=119556&babsrc=HP_ss&mntrId=663388252CBA0AA8",
Found [l.2590] : urls_to_restore_on_startup = [ "hxxp://www.delta-search.com/?affID=119556&babsrc=HP_ss&mntrId=663388252CBA0AA8" ]

*************************

AdwCleaner[R5].txt - [4400 octets] - [15/06/2013 18:57:18]

########## EOF - C:\AdwCleaner[R5].txt - [4460 octets] ##########


----------



## eddie5659 (Mar 19, 2001)

Sorry for not being here at the weekend, I had to visit family.

Looks like there is a bit of stuff to remove, so lets get stuck in 


Close all open programs and internet browsers.
Double click on *adwcleaner.exe* to run the tool.
Click on *Delete*.
Confirm each time with *Ok*.
You will be prompted to restart your computer. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at *C:\AdwCleaner[S1].txt* as well.

----

Now, the following may remove some things, but this is just the first look, then we'll delve deeper 

We're going to use OTL exactly as you did before, when it removed some things 

Run OTL 

Under the *Custom Scans/Fixes* box at the bottom, paste in the following


```
:Commands
[CREATERESTOREPOINT]

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"=-
[-HKEY_CURRENT_USER\Software\AppDataLow\Software\searchqutoolbar]
[-HKEY_CURRENT_USER\Software\DataMngr]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Bandoo]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Searchqu 406 MediaBar]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\menuorder\start menu2\programs\bandoo]
[-HKEY_CURRENT_USER\Software\Trolltech]
[-HKEY_CURRENT_USER\Software\DataMngr_Toolbar]
[-HKEY_CURRENT_USER\Software\ilivid]
[-HKEY_CURRENT_USER\Software\searchqutoolbar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\DataMngr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Bandoo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\BandooCore.EXE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.BandooCore.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.BandooCore]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.ResourcesMngr.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.ResourcesMngr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.SettingsMngr.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.SettingsMngr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.StatisticMngr.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.StatisticMngr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}\1.0]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4e1d-BDD0-1E9C9B7799CC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7f000001-db8e-f89c-2fec-49bf726f8c12}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4fde-B055-AE7B0F4CF080}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFBD6D47-F5E5-49E4-8157-8BCFF11F3CC3}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Save video on Savevid.com]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\ilivid.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SetupDataMngr_searchqu_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SetupDataMngr_searchqu_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\datamngrUI_RASAPI 32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\datamngrUI_RASMAN CS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu 406 MediaBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\SearchquMediabarTb]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{27f69c85-64e1-43ce-98b5-3c9f22fb408e}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{b543ef05-9758-464e-9f37-4c28525b4a4c}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{8f5f1cb6-ea9e-40af-a5ca-c7fd63cc1971}\1.0]
[-HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\app management\arpcache\searchqu 406 mediabar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{a40dc6c5-79d0-4ca8-a185-8ff989af1115}\inprocserver32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{cc1ac828-bb47-4361-afb5-96eee259dd87}\inprocserver32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{fefd3af5-a346-4451-aa23-a3ad54915515}\inprocserver32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{5b4144e1-b61d-495a-9a50-cd1a95d86d15}\1.0]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{6a4bcaba-c437-4c76-a54e-af31b8a76cb9}\1.0]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{841d5a49-e48d-413c-9c28-eb3d9081d705}\1.0]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\internet explorer\low rights\elevationpolicy\{99079a25-328f-4bd4-be04-00955acaa0a7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\internet explorer\low rights\elevationpolicy\{d0a4be92-2216-42db-ab35-d72efb9f0176}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\shared tools\msconfig\startupreg\datamngr]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\searchqu.com]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\2B1E51D87B2D71A44BB42DDD5E894160]
[-HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\WhiteSmoke]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\2B1E51D87B2D71A44BB42DDD5E894160\InstallProperties]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CFA942DEC3AFA384B94ECC932BD3DC5A]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CFE82A48FED40644C984C808A1785C7F]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EFB5D9F3E46440D4A9C379467CEADEBB]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\2B1E51D87B2D71A44BB42DDD5E894160\InstallProperties]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\2B1E51D87B2D71A44BB42DDD5E894160\InstallProperties]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iLivid\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iLivid\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toobar]
"{99079a25-328f-4bd4-be04-00955acaa0a7}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3B0118C8-8D12-46CD-A083-2116D587A11F}"=-
"{C39DB3DF-7935-4821-9BD7-170D277DA935}"=-
"{6B2163BE-A595-4E6E-AAF0-E22A29D38262}"=-
"{A49227EB-05C7-449A-9BB6-18F653936F32}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3B0118C8-8D12-46CD-A083-2116D587A11F}"=-
"{C39DB3DF-7935-4821-9BD7-170D277DA935}"=-
"{6B2163BE-A595-4E6E-AAF0-E22A29D38262}"=-
"{A49227EB-05C7-449A-9BB6-18F653936F32}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3B0118C8-8D12-46CD-A083-2116D587A11F}"=-
"{C39DB3DF-7935-4821-9BD7-170D277DA935}"=-
"{6B2163BE-A595-4E6E-AAF0-E22A29D38262}"=-
"{A49227EB-05C7-449A-9BB6-18F653936F32}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\ProxyStubClsid32]
@="{B056521A-9B10-425E-B616-1FCD828DB3B1}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\ProxyStubClsid32]
@="{B056521A-9B10-425E-B616-1FCD828DB3B1}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
@="ISearchQueryHelper"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\ProxyStubClsid32]
@="{B056521A-9B10-425E-B616-1FCD828DB3B1}"

:Files
%APPDATA%\Mozilla\Firefox\Profiles\SearchquWebSearch.xml /S
%APPDATA%\Mozilla\Firefox\Profiles\searchqutoolbar /S
%APPDATA%\Mozilla\Firefox\Profiles\{99079a25-328f-4bd4-be04-00955acaa0a7} /S
%APPDATA%\Microsoft\Windows\Cookies\*@sweetim[1].txt
%APPDATA%\Microsoft\Windows\Cookies\Low\*@ilivid[1].txt
%APPDATA%\Microsoft\Windows\Cookies\Low\*@ilivid[2].txt
%APPDATA%\Microsoft\Windows\Cookies\Low\*@searchqu[1].txt
%APPDATA%\Microsoft\Windows\Cookies\Low\*@searchqu[2].txt
%APPDATA%\Microsoft\Windows\Cookies\Low\*@stats.ilivid[1].txt
%APPDATA%\Microsoft\Windows\Cookies\Low\*@sweetim[1].txt
%APPDATA%\Microsoft\Windows\Cookies\Low\*@www.sweetim[2].txt
%APPDATA%\Microsoft\Windows\Cookies\Low\*@www.sweetim[3].txt
%LOCALAPPDATA%\Ilivid Player /S
%LOCALAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\iLividSetupV1.exe /S
%LOCALAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\ilivid[1].7z /S
%LOCALAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SetupDataMngr_Searchqu[1].exe /S
%LOCALAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SweetImSetup.exe /S
%LOCALAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\BandooV6[1].exe /S
%LOCALAppData%\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\searchqu_net[1].htm /S
%TEMP%\BandooFiles
%TEMP%\BandooV6.exe
%TEMP%\SetupDataMngr_Searchqu.exe
%TEMP%\SweetIMReinstall
%TEMP%\SweetIMReinstall\SweetImSetup.exe
%TEMP%\ilivid.7z
%TEMP%\searchqu.ini
%TEMP%\searchqutoolbar-manifest.xml
%USERPROFILE%\AppData\LocalLow\searchquband
%USERPROFILE%\AppData\LocalLow\searchqutoolbar
%USERPROFILE%\Downloads\SweetImSetup.exe
%USERPROFILE%\Downloads\iLividSetupV1.exe
%USERPROFILE%\AppData\LocalLow\DataMngr
%USERPROFILE%\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3AJVC1WF\www.ilivid[1].xml
%USERPROFILE%\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\TYBUQFS4\www.searchqu[1].xml
C:\Windows\Prefetch\SEARCHQU TOOLBAR UNINSTALL.EX-4EFDDDEA.pf
C:\Program Files\Windows iLivid Toolbar
C:\Program Files\iLivid
C:\Windows\Prefetch\ILIVID*
C:\Windows\Prefetch\SEARCHQUMEDIABAR*
C:\Windows\Prefetch\SETUPDATAMNGR*
C:\Program Files (x86)\iLivid
C:\Program Files (x86)\Windows Savevid Toolbar
C:\Program Files (x86)\Savevid
ipconfig /flushdns /c

:Commands
[EMPTYTEMP]
```
Make sure you copy from the top which has this part:



> :Commands
> [CREATERESTOREPOINT]


All the way down to this part:



> :Commands
> [EMPTYTEMP]



Then click the *Run Fix* button at the top 
Click OK.
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply. The log is saved in the same location as OTL.

Make sure to

eddie


----------



## sweetrose (Sep 7, 2012)

yr message was going in my spam.thats wh i lost the link.
will have ago at this now


----------



## sweetrose (Sep 7, 2012)

# AdwCleaner v2.303 - Logfile created 06/17/2013 at 20:53:47
# Updated 08/06/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : ann - ANN-TOSH
# Boot Mode : Normal
# Running from : C:\Users\ann\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Deleted : C:\ProgramData\ParetoLogic
Folder Deleted : C:\Users\ann\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\ann\AppData\Roaming\DSite
Folder Deleted : C:\Users\ann\AppData\Roaming\ParetoLogic

***** [Registry] *****

Key Deleted : HKCU\Software\BabSolution
Key Deleted : HKCU\Software\BI
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1631550F-191D-4826-B069-D9439253D926}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\mysearchdial
Key Deleted : HKCU\Software\5d0dddabc6ab915
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C3110516-8EFC-49D6-8B72-69354F332062}
Key Deleted : HKLM\SOFTWARE\Classes\esrv.mysearchdialESrvc
Key Deleted : HKLM\SOFTWARE\Classes\esrv.mysearchdialESrvc.1
Key Deleted HKLM\Software\Classes\Installer\Features\F479A18A22A86E3429341589FF57D81A
Key Deleted : HKLM\Software\Classes\Installer\Features\FA20CB7A821113A4CB8FA1E38E303D3B
Key Deleted : HKLM\Software\Classes\Installer\Products\F479A18A22A86E3429341589FF57D81A
Key Deleted : HKLM\Software\Classes\Installer\Products\FA20CB7A821113A4CB8FA1E38E303D3B
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\InstallCore
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2BDF3E992C0908741B7C11F4B4E0F775
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B3BC4CF5ECE1F54BBA174C13A1AB907
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BEABAA33A5E68374DBF197F2A00CD011
Key Deleted : HKLM\SOFTWARE\Wow6432Node\5d0dddabc6ab915
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{219046AE-358F-4CF1-B1FD-2B4DE83642A8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{01947140-417F-46B6-8751-A3A2B8345E1A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{819FFE21-35C7-4925-8CDA-4E0E2DB94302}
Key Deleted : HKLM\SOFTWARE\Tarma Installer

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16611

[OK] Registry is clean.

-\\ Google Chrome v27.0.1453.110

File : C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.30] : keyword = "mywebsearch",
Deleted [l.34] : search_url = "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=84A3265C-6544[...]
Deleted [l.2072] : homepage = "hxxp://www.delta-search.com/?affID=119556&babsrc=HP_ss&mntrId=663388252CBA0AA8",
Deleted [l.2582] : urls_to_restore_on_startup = [ "hxxp://www.delta-search.com/?affID=119556&babsrc=HP_ss&mntrId[...]

*************************

AdwCleaner[R5].txt - [4521 octets] - [15/06/2013 18:57:18]
AdwCleaner[R6].txt - [4581 octets] - [17/06/2013 20:52:43]
AdwCleaner[S6].txt - [4496 octets] - [17/06/2013 20:53:47]

########## EOF - C:\AdwCleaner[S6].txt - [4556 octets] ##########


----------



## sweetrose (Sep 7, 2012)

All processes killed
Error: Unable to interpret <EATERESTOREPOINT]> in the current context!
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page deleted successfully.
Registry key HKEY_CURRENT_USER\Software\AppDataLow\Software\searchqutoolbar\ not found.
Registry key HKEY_CURRENT_USER\Software\DataMngr\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Bandoo\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Searchqu 406 MediaBar\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\menuorder\start menu2\programs\bandoo\ not found.
Registry key HKEY_CURRENT_USER\Software\Trolltech\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\DataMngr_Toolbar\ not found.
Registry key HKEY_CURRENT_USER\Software\ilivid\ not found.
Registry key HKEY_CURRENT_USER\Software\searchqutoolbar\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\DataMngr\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Bandoo\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\BandooCore.EXE\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1301A8A5-3DFB-4731-A162-B357D00C9644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1.exe\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.BandooCore.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.BandooCore\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.ResourcesMngr.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.ResourcesMngr\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.SettingsMngr.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.SettingsMngr\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.StatisticMngr.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.StatisticMngr\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{477F210A-2A86-4666-9C4B-1189634D2C84}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FF871E51-2655-4D06-AED5-745962A96B32}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}\1.0\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4e1d-BDD0-1E9C9B7799CC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{424624F4-C5DD-4e1d-BDD0-1E9C9B7799CC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7f000001-db8e-f89c-2fec-49bf726f8c12}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7f000001-db8e-f89c-2fec-49bf726f8c12}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4fde-B055-AE7B0F4CF080}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F9189560-573A-4fde-B055-AE7B0F4CF080}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFBD6D47-F5E5-49E4-8157-8BCFF11F3CC3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFBD6D47-F5E5-49E4-8157-8BCFF11F3CC3}\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Save video on Savevid.com\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\ilivid.exe\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SetupDataMngr_searchqu_RASAPI32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SetupDataMngr_searchqu_RASMANCS\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\datamngrUI_RASAPI 32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\datamngrUI_RASMAN CS\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu 406 MediaBar\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\SearchquMediabarTb\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{27f69c85-64e1-43ce-98b5-3c9f22fb408e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27f69c85-64e1-43ce-98b5-3c9f22fb408e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{b543ef05-9758-464e-9f37-4c28525b4a4c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b543ef05-9758-464e-9f37-4c28525b4a4c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{8f5f1cb6-ea9e-40af-a5ca-c7fd63cc1971}\1.0\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\app management\arpcache\searchqu 406 mediabar\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{a40dc6c5-79d0-4ca8-a185-8ff989af1115}\inprocserver32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{cc1ac828-bb47-4361-afb5-96eee259dd87}\inprocserver32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{fefd3af5-a346-4451-aa23-a3ad54915515}\inprocserver32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{5b4144e1-b61d-495a-9a50-cd1a95d86d15}\1.0\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{6a4bcaba-c437-4c76-a54e-af31b8a76cb9}\1.0\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{841d5a49-e48d-413c-9c28-eb3d9081d705}\1.0\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\internet explorer\low rights\elevationpolicy\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\internet explorer\low rights\elevationpolicy\{d0a4be92-2216-42db-ab35-d72efb9f0176}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d0a4be92-2216-42db-ab35-d72efb9f0176}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\shared tools\msconfig\startupreg\datamngr\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\searchqu.com\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\2B1E51D87B2D71A44BB42DDD5E894160\ not found.
Registry key HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\WhiteSmoke\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\2B1E51D87B2D71A44BB42DDD5E894160\InstallProperties\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CFA942DEC3AFA384B94ECC932BD3DC5A\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CFE82A48FED40644C984C808A1785C7F\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EFB5D9F3E46440D4A9C379467CEADEBB\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\2B1E51D87B2D71A44BB42DDD5E894160\InstallProperties\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\2B1E51D87B2D71A44BB42DDD5E894160\InstallProperties\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iLivid\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iLivid\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toobar not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{3B0118C8-8D12-46CD-A083-2116D587A11F} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B0118C8-8D12-46CD-A083-2116D587A11F}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{C39DB3DF-7935-4821-9BD7-170D277DA935} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C39DB3DF-7935-4821-9BD7-170D277DA935}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{6B2163BE-A595-4E6E-AAF0-E22A29D38262} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6B2163BE-A595-4E6E-AAF0-E22A29D38262}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A49227EB-05C7-449A-9BB6-18F653936F32} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A49227EB-05C7-449A-9BB6-18F653936F32}\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{3B0118C8-8D12-46CD-A083-2116D587A11F} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B0118C8-8D12-46CD-A083-2116D587A11F}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{C39DB3DF-7935-4821-9BD7-170D277DA935} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C39DB3DF-7935-4821-9BD7-170D277DA935}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{6B2163BE-A595-4E6E-AAF0-E22A29D38262} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6B2163BE-A595-4E6E-AAF0-E22A29D38262}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A49227EB-05C7-449A-9BB6-18F653936F32} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A49227EB-05C7-449A-9BB6-18F653936F32}\ not found.
Unable to set value : HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\ProxyStubClsid32\\@|"{B056521A-9B10-425E-B616-1FCD828DB3B1}" /E!
Unable to set value : HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\ProxyStubClsid32\\@|"{B056521A-9B10-425E-B616-1FCD828DB3B1}" /E!
Unable to set value : HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\\@|"ISearchQueryHelper" /E!
Unable to set value : HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\ProxyStubClsid32\\@|"{B056521A-9B10-425E-B616-1FCD828DB3B1}" /E!
========== FILES ==========
File/Folder C:\Users\ann\AppData\Roaming\Mozilla\Firefox\Profiles\SearchquWebSearch.xml not found.
File/Folder C:\Users\ann\AppData\Roaming\Mozilla\Firefox\Profiles\searchqutoolbar not found.
File/Folder C:\Users\ann\AppData\Roaming\Mozilla\Firefox\Profiles\{99079a25-328f-4bd4-be04-00955acaa0a7} not found.
File/Folder C:\Users\ann\AppData\Roaming\Microsoft\Windows\Cookies\*@sweetim[1].txt not found.
File/Folder C:\Users\ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@ilivid[1].txt not found.
File/Folder C:\Users\ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@ilivid[2].txt not found.
File/Folder C:\Users\ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@searchqu[1].txt not found.
File/Folder C:\Users\ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@searchqu[2].txt not found.
File/Folder C:\Users\ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@stats.ilivid[1].txt not found.
File/Folder C:\Users\ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@sweetim[1].txt not found.
File/Folder C:\Users\ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@www.sweetim[2].txt not found.
File/Folder C:\Users\ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@www.sweetim[3].txt not found.
File/Folder C:\Users\ann\AppData\Local\Ilivid Player not found.
File/Folder C:\Users\ann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\iLividSetupV1.exe not found.
File/Folder C:\Users\ann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ilivid[1].7z not found.
File/Folder C:\Users\ann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SetupDataMngr_Searchqu[1].exe not found.
File/Folder C:\Users\ann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SweetImSetup.exe not found.
File/Folder C:\Users\ann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BandooV6[1].exe not found.
File/Folder C:\Users\ann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\searchqu_net[1].htm not found.
File/Folder C:\Users\ann\AppData\Local\Temp\BandooFiles not found.
File/Folder C:\Users\ann\AppData\Local\Temp\BandooV6.exe not found.
File/Folder C:\Users\ann\AppData\Local\Temp\SetupDataMngr_Searchqu.exe not found.
File/Folder C:\Users\ann\AppData\Local\Temp\SweetIMReinstall not found.
File/Folder C:\Users\ann\AppData\Local\Temp\SweetIMReinstall\SweetImSetup.exe not found.
File/Folder C:\Users\ann\AppData\Local\Temp\ilivid.7z not found.
File/Folder C:\Users\ann\AppData\Local\Temp\searchqu.ini not found.
File/Folder C:\Users\ann\AppData\Local\Temp\searchqutoolbar-manifest.xml not found.
File/Folder C:\Users\ann\AppData\LocalLow\searchquband not found.
File/Folder C:\Users\ann\AppData\LocalLow\searchqutoolbar not found.
File/Folder C:\Users\ann\Downloads\SweetImSetup.exe not found.
File/Folder C:\Users\ann\Downloads\iLividSetupV1.exe not found.
File/Folder C:\Users\ann\AppData\LocalLow\DataMngr not found.
File/Folder C:\Users\ann\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3AJVC1WF\www.ilivid[1].xml not found.
File/Folder C:\Users\ann\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\TYBUQFS4\www.searchqu[1].xml not found.
File\Folder C:\Windows\Prefetch\SEARCHQU TOOLBAR UNINSTALL.EX-4EFDDDEA.pf not found.
File\Folder C:\Program FilesWindows iLivid Toolbar not found.
File\Folder C:\Program Files\iLivid not found.
File\Folder C:\Windows\Prefetch\ILIVID* not found.
File\Folder C:\Windows\Prefetch\SEARCHQUMEDIABAR* not found.
File\Folder C:\Windows\Prefetch\SETUPDATAMNGR* not found.
File\Folder C:\Program Files (x86)\iLivid not found.
File\Folder C:\Program Files (x86)\Windows Savevid Toolbar not found.
File\Folder C:\Program Files (x86)\Savevid not found.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\ann\Downloads\cmd.bat deleted successfully.
C:\Users\ann\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: ann
->Temp folder emptied: 13089850 bytes
->Temporary Internet Files folder emptied: 10469423 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 375737277 bytes
->Flash cache emptied: 689 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 10788535 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 391.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 06172013_211121

Files\Folders moved on Reboot...
File\Folder C:\Users\ann\AppData\Local\Temp\etilqs_46ZaALLzmiVO0WM not found!
File\Folder C:\Users\ann\AppData\Local\Temp\etilqs_9zwN4fRnzfzTp61 not found!
File\Folder C:\Users\ann\AppData\Local\Temp\etilqs_XrvszbPvgFxw1CN not found!
File\Folder C:\Users\ann\AppData\Local\Temp\etilqs_yHbgHaaH5AidWKF not found!
File\Folder C:\Users\ann\AppData\Local\Temp\etilqs_YjKCNy2Ct8Fh7wg not found!
File\Folder C:\Users\ann\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File\Folder C:\Users\ann\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat not found!
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0 moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1 moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2 moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3 moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Cache\data_4 moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Cache\data_5 moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Cache\index moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


----------



## sweetrose (Sep 7, 2012)

all done,,,,,


----------



## eddie5659 (Mar 19, 2001)

Hmmm, seems strange none were found, but still it can happen 

Lets run ComboFix and see if other stuf is lurking before we do the next step:

*Delete any copies of Combofix that you have.*

Download ComboFix from one of these locations:

*Link 1*
*Link 2*

** IMPORTANT !!! As you download it rename it to frincis123.exe and save it to your Desktop *


Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

Click on *this link* to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
*Remember to re-enable the protection again afterwards before connecting to the Internet.*

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.








Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:










Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the *C:\ComboFix.txt* in your next reply.

eddie


----------



## sweetrose (Sep 7, 2012)

where is the ComboFix


----------



## eddie5659 (Mar 19, 2001)

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Just click on the link, and it should go to the Downloads folder, where the OTL is


----------



## sweetrose (Sep 7, 2012)

omboFix 13-06-18.02 - ann 18/06/2013 18:50:05.2.1 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.1913.899 [GMT 1:00]
Running from: c:\users\ann\Downloads\ComboFix.exe
AV: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
FW: AVG Internet Security 2013 *Disabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}
SP: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-05-18 to 2013-06-18 )))))))))))))))))))))))))))))))
.
.
2013-06-18 18:04 . 2013-06-18 18:04	--------	d-----w-	c:\windows\system32\config\systemprofile\AppData\Local\temp
2013-06-18 18:04 . 2013-06-18 18:04	--------	d-----w-	c:\users\Public\AppData\Local\temp
2013-06-18 18:04 . 2013-06-18 18:04	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-06-17 19:53 . 2013-06-17 19:54	121	----a-w-	c:\windows\DeleteOnReboot.bat
2013-06-14 17:20 . 2013-06-16 12:17	--------	d-----w-	c:\program files\SUPERAntiSpyware
2013-06-14 16:56 . 2013-06-14 16:56	--------	d-----w-	c:\users\ann\AppData\Roaming\SUPERAntiSpyware.com
2013-06-14 14:24 . 2013-06-15 03:47	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2013-06-13 06:48 . 2013-04-26 05:51	751104	----a-w-	c:\windows\system32\win32spl.dll
2013-06-13 06:47 . 2013-05-13 05:50	52224	----a-w-	c:\windows\system32\certenc.dll
2013-06-13 06:47 . 2013-05-13 04:45	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2013-06-13 06:47 . 2013-05-13 03:08	43008	----a-w-	c:\windows\SysWow64\certenc.dll
2013-06-13 06:47 . 2013-03-31 22:52	1887232	----a-w-	c:\windows\system32\d3d11.dll
2013-06-13 06:47 . 2013-04-25 23:30	1505280	----a-w-	c:\windows\SysWow64\d3d11.dll
2013-06-12 21:34 . 2013-06-12 21:34	--------	d-----w-	c:\program files (x86)\Common Files\Java
2013-06-12 21:33 . 2013-06-12 21:33	95648	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-12 21:33 . 2013-06-12 21:33	--------	d-----w-	c:\program files (x86)\Java
2013-06-12 21:07 . 2013-06-12 21:07	--------	d-----w-	C:\_OTL
2013-06-10 18:35 . 2013-06-10 18:35	--------	d-sh--w-	c:\programdata\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2013-06-05 20:54 . 2013-06-05 20:54	--------	d-----w-	c:\program files (x86)\Image Converter
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-13 07:07 . 2011-02-12 17:27	75825640	----a-w-	c:\windows\system32\MRT.exe
2013-06-12 21:33 . 2012-09-28 13:10	866720	----a-w-	c:\windows\SysWow64\npDeployJava1.dll
2013-06-12 21:33 . 2010-10-19 11:24	788896	----a-w-	c:\windows\SysWow64\deployJava1.dll
2013-05-02 09:16 . 2011-08-31 20:32	22240	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-04-17 05:31 . 2013-04-23 20:29	9317456	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{1CED3CB3-364A-4189-AA23-F470851547DB}\mpengine.dll
2013-04-13 05:49 . 2013-05-16 06:42	135168	----a-w-	c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 06:42	350208	----a-w-	c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 06:42	308736	----a-w-	c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 06:42	111104	----a-w-	c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 06:42	474624	----a-w-	c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 06:42	2176512	----a-w-	c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 06:35	1656680	----a-w-	c:\windows\system32\drivers\ntfs.sys
2013-04-10 06:01 . 2013-05-16 06:42	265064	----a-w-	c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 06:01 . 2013-05-16 06:42	983400	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 03:30 . 2013-05-16 06:40	3153920	----a-w-	c:\windows\system32\win32k.sys
2013-03-29 01:53 . 2013-03-29 01:53	246072	----a-w-	c:\windows\system32\drivers\avgidsdrivera.sys
2013-03-21 02:08 . 2013-03-21 02:08	240952	----a-w-	c:\windows\system32\drivers\avgtdia.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll" [2012-03-21 1523512]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\progra~2\Yahoo!\MESSEN~1\YahooMessenger.exe" [2012-05-25 6595928]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-04-19 18678376]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2013-04-28 4408368]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
2;2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 massfilter;MBB Mass Storage Filter Driver;c:\windows\system32\DRIVERS\massfilter.sys;c:\windows\SYSNATIVE\DRIVERS\massfilter.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys;c:\windows\SYSNATIVE\DRIVERS\ZTEusbvoice.sys [x]
R3 ZTEusbwwan;ZTE MBN Miniport;c:\windows\system32\DRIVERS\ZTEusbwwan.sys;c:\windows\SYSNATIVE\DRIVERS\ZTEusbwwan.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x]
S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x]
S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [x]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [x]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [x]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [x]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe;c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [x]
S2 VmbService;Vodafone Mobile Broadband Service;c:\program files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe;c:\program files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [x]
S2 vToolbarUpdater13.3.2;vToolbarUpdater13.3.2;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys;c:\windows\SYSNATIVE\DRIVERS\rtl8192Ce.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 vodafone_K380x-z_dc_enum;vodafone_K380x-z_dc_enum;c:\windows\system32\DRIVERS\vodafone_K380x-z_dc_enum.sys;c:\windows\SYSNATIVE\DRIVERS\vodafone_K380x-z_dc_enum.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-06 18:40]
.
2013-06-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-28 09:48]
.
2013-06-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-28 09:48]
.
2013-06-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001Core.job
- c:\users\ann\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-11 08:40]
.
2013-06-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001UA.job
- c:\users\ann\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-11 08:40]
.
.
--------- X64 Entries -----------
.
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mStart Page = 
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{3D15F113-3692-4089-B3A3-77DC82321FEB}: NameServer = 10.203.129.68 10.203.129.68
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\SysWOW64\Macromed\Flash\FlashUtil11c_ActiveX.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-mefeediatest - c:\program files (x86)\mefeediatest\uninstall.exe
AddRemove-WildTangentGameProvider-toshiba-genres - c:\program files (x86)\TOSHIBA Games\Game Explorer Categories - genres\Uninstall.exe
AddRemove-WildTangentGDF-toshiba-clubpenguin - c:\program files (x86)\TOSHIBA Games\Web Link - Club Penguin\Uninstall.exe
AddRemove-WildTangentGDF-toshiba-darkorbit - c:\program files (x86)\TOSHIBA Games\Web Link - Dark Orbit\Uninstall.exe
AddRemove-WildTangentGDF-toshiba-seafight - c:\program files (x86)\TOSHIBA Games\Web Link - Seafight\Uninstall.exe
AddRemove-WildTangentGDF-toshiba-shaiya - c:\program files (x86)\TOSHIBA Games\Web Link - Shaiya\Uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:ea,8c,b3,e4,21,26,cd,01
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-06-18 19:12:43
ComboF


----------



## sweetrose (Sep 7, 2012)

Completion time: 2013-06-18 19:12:43
ComboFix-quarantined-files.txt 2013-06-18 18:12
.
Pre-Run: 85,635,686,400 bytes free
Post-Run: 85,091,651,584 bytes free
.
- - End Of File - - DD8CB36213CCAB5280E342483B3883DD
A36C5E4F47E84449FF07ED3517B43A31


----------



## eddie5659 (Mar 19, 2001)

Thanks 

Okay, we're going to use SystemLook, but I have a feeling there will be long logs, so we'll do them in stages 

Please download *SystemLook* from one of the links below and save it to your Desktop.
*Download Mirror #1
Download Mirror #2*

Double-click *SystemLook.exe* to run it.
Copy the content of the following codebox into the main textfield:


```
:filefind
*InstallBrain*.*
*mywebsearch*.*
*MySearchDial*.*
*delta-search*.*
*babylon*.*
*datamngr*.*
*smartbar*.*
*crossrider*.*
*pricegong*.*
*pc optimizer pro*.*
*PCoptimizer*.*
*drivercure*.*
*performersoft*.*
*registry mechanic*.*
*coupon caddy*.*
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found at on your Desktop entitled *SystemLook.txt*

eddie


----------



## sweetrose (Sep 7, 2012)

doing it now


----------



## sweetrose (Sep 7, 2012)

SystemLook 30.07.11 by jpshortstuff
Log created at 20:38 on 18/06/2013 by ann
Administrator - Elevation successful

========== filefind ==========

Searching for "*InstallBrain*.*"
No files found.

Searching for "*mywebsearch*.*"
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_dailybibleguide.dl.mywebsearch.com_0.localstorage	--a---- 3072 bytes	[07:36 16/04/2013]	[07:36 16/04/2013] C7FF2521E38BEC2F1480C5099BAED672
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_dailybibleguide.dl.mywebsearch.com_0.localstorage-journal	--a---- 3608 bytes	[07:36 16/04/2013]	[07:36 16/04/2013] 97C01FCB9282637E3887DA61B46EE538
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filmfanatic2.dl.mywebsearch.com_0.localstorage	--a---- 3072 bytes	[17:47 14/06/2013]	[17:47 14/06/2013] 0D8C912C01E24454F2F7FBB16C3AE1C0
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filmfanatic2.dl.mywebsearch.com_0.localstorage-journal	--a---- 3608 bytes	[17:47 14/06/2013]	[17:47 14/06/2013] 1E58D48AE975BBE93028D96B2970F118

Searching for "*MySearchDial*.*"
C:\_OTL\MovedFiles\06132013_205817\C_Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx	--a---- 423709 bytes	[18:03 07/06/2013]	[18:03 07/06/2013] 21627461E16CB190014945AEAAFAEC53
C:\_OTL\MovedFiles\06132013_205817\C_Users\Public\Desktop\MySearchDial.url	--a---- 397 bytes	[18:03 07/06/2013]	[18:03 07/06/2013] 4DA4BCDA5E7FB7461C06CF84D3964FBA

Searching for "*delta-search*.*"
No files found.

Searching for "*babylon*.*"
No files found.

Searching for "*datamngr*.*"
No files found.

Searching for "*smartbar*.*"
No files found.

Searching for "*crossrider*.*"
No files found.

Searching for "*pricegong*.*"
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\IncrediMail_MediaBar_2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll	--a---- 390520 bytes	[10:13 06/10/2011]	[10:13 06/10/2011] 64CCC4B888265C203E80621D3F1742A7
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\IncrediMail_MediaBar_2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGong_16.png	--a---- 1101 bytes	[09:22 28/03/2010]	[09:22 28/03/2010] B5ECF14044E4FD55F61A7499D5687118

Searching for "*pc optimizer pro*.*"
No files found.

Searching for "*PCoptimizer*.*"
No files found.

Searching for "*drivercure*.*"
No files found.

Searching for "*performersoft*.*"
No files found.

Searching for "*registry mechanic*.*"
No files found.

Searching for "*coupon caddy*.*"
No files found.

-= EOF =-


----------



## eddie5659 (Mar 19, 2001)

Thanks, onto the next one 

Can you do exactly as you just did but with this code:


```
:folderfind
*InstallBrain*
*mywebsearch*
*MySearchDial*
*delta-search*
*babylon*
*datamngr*
*smartbar*
*crossrider*
*pricegong*
*pc optimizer pro*
*PCoptimizer*
*drivercure*
*performersoft*
*registry mechanic*
*coupon caddy*
```
And post the log


----------



## sweetrose (Sep 7, 2012)

this just come up////.............


emLook 30.07.11 by jpshortstuff
Log created at 21:00 on 18/06/2013 by ann
Administrator - Elevation successful

No Context: folderfind

No Context: *InstallBrain*

No Context: *mywebsearch*

No Context: *MySearchDial*

No Context: *delta-search*

No Context: *babylon*

No Context: *datamngr*

No Context: *smartbar*

No Context: *crossrider*


----------



## eddie5659 (Mar 19, 2001)

It looks like you missed the first part by mistake. Make sure you copy/paste this part at the beginning, including the :

*:folderfind*

So, it should look like this:

*:folderfind
*InstallBrain*
*mywebsearch*
*MySearchDial*
*delta-search*
*babylon*
*datamngr*
*smartbar*
*crossrider*
*pricegong*
*pc optimizer pro*
*PCoptimizer*
*drivercure*
*performersoft*
*registry mechanic*
*coupon caddy**


----------



## sweetrose (Sep 7, 2012)

doing it again


----------



## sweetrose (Sep 7, 2012)

herSystemLook 30.07.11 by jpshortstuff
Log created at 21:13 on 18/06/2013 by ann
Administrator - Elevation successful

No Context: Code:

========== folderfind ==========

Searching for "*InstallBrain*"
No folders found.

Searching for "*mywebsearch*"
No folders found.

Searching for "*MySearchDial*"
C:\_OTL\MovedFiles\06132013_205817\C_Users\ann\AppData\Roaming\mysearchdial	d------	[18:03 07/06/2013]

Searching for "*delta-search*"
No folders found.

Searching for "*babylon*"
No folders found.

Searching for "*datamngr*"
No folders found.

Searching for "*smartbar*"
No folders found.

Searching for "*crossrider*"
No folders found.

Searching for "*pricegong*"
No folders found.

Searching for "*pc optimizer pro*"
No folders found.

Searching for "*PCoptimizer*"
No folders found.

Searching for "*drivercure*"
No folders found.

Searching for "*performersoft*"
No folders found.

Searching for "*registry mechanic*"
C:\Program Files (x86)\PC Tools Registry Mechanic	d------	[16:18 02/09/2012]

Searching for "*coupon caddy"
No folders found.


----------



## eddie5659 (Mar 19, 2001)

Looks like that worked 

Onto the next:


```
:regfind
InstallBrain
mywebsearch
MySearchDial
delta-search
babylon
datamngr
smartbar
crossrider
pricegong
pc optimizer pro
PCoptimizer
drivercure
performersoft
registry mechanic
coupon caddy
```


----------



## sweetrose (Sep 7, 2012)

SystemLook 30.07.11 by jpshortstuff
Log created at 21:23 on 18/06/2013 by ann
Administrator - Elevation successful

No Context: Code:

========== regfind ==========

Searching for "InstallBrain"
No data found.

Searching for "mywebsearch"
No data found.

Searching for "MySearchDial"
[HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
"path"="C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}\1.0\0\win32]
@="C:\Program Files (x86)\Mysearchdial\mysearchdialsrv.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}\1.0\HELPDIR]
@="C:\Program Files (x86)\Mysearchdial"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}\LocalServer32]
@=""C:\Program Files (x86)\Mysearchdial\mysearchdialsrv.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}\ProgID]
@="esrv.mysearchdialESrvc.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}\VersionIndependentProgID]
@="esrv.mysearchdialESrvc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}\1.0\0\win32]
@="C:\Program Files (x86)\Mysearchdial\mysearchdialsrv.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}\1.0\HELPDIR]
@="C:\Program Files (x86)\Mysearchdial"
[HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
"path"="C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
"path"="C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}\LocalServer32]
@=""C:\Program Files (x86)\Mysearchdial\mysearchdialsrv.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}\ProgID]
@="esrv.mysearchdialESrvc.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}\VersionIndependentProgID]
@="esrv.mysearchdialESrvc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}\1.0\0\win32]
@="C:\Program Files (x86)\Mysearchdial\mysearchdialsrv.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}\1.0\HELPDIR]
@="C:\Program Files (x86)\Mysearchdial"
[HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
"path"="C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx"

Searching for "delta-search"
No data found.

Searching for "babylon"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"

Searching for "datamngr"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3E650A8F-E360-44CC-AAC9-0EEE75B1321D}]
"AppPath"="C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar"

Searching for "smartbar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Users\ann\AppData\Local\Smartbar\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Users\ann\AppData\Local\Smartbar\Application\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467]
"00000000000000000000000000000000"="01:\Software\Smartbar\version"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\SmartbarExeInstaller_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\SmartbarExeInstaller_RASMANCS]

Searching for "crossrider"
No data found.

Searching for "pricegong"
[HKEY_CURRENT_USER\Software\PowerPack\225\13]
"c"="http://www.powerpackdl.com/downloads/pricegong.exe"
[HKEY_CURRENT_USER\Software\PowerPack\225\13]
"i"="http://www.pricegong.com/TermsofUse.aspx"
[HKEY_CURRENT_USER\Software\PowerPack\225\13]
"j"="PriceGong"
[HKEY_CURRENT_USER\Software\PowerPack\225\13]
"n"="rv:HKCR,AppID\\PriceGongIE.DLL,AppID,{835315FC-1BF6-4CA9-80CD-F6C158D40692}"
[HKEY_CURRENT_USER\Software\PowerPack\225\13]
"x"="http://www.pricegong.com/favicon.ico"
[HKEY_CURRENT_USER\Software\PowerPack\225\13]
"y"="http://www.pricegong.com/"
[HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\PowerPack\225\13]
"c"="http://www.powerpackdl.com/downloads/pricegong.exe"
[HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\PowerPack\225\13]
"i"="http://www.pricegong.com/TermsofUse.aspx"
[HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\PowerPack\225\13]
"j"="PriceGong"
[HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\PowerPack\225\13]
"n"="rv:HKCR,AppID\\PriceGongIE.DLL,AppID,{835315FC-1BF6-4CA9-80CD-F6C158D40692}"
[HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\PowerPack\225\13]
"x"="http://www.pricegong.com/favicon.ico"
[HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\PowerPack\225\13]
"y"="http://www.pricegong.com/"

Searching for "pc optimizer pro"
[HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\PCOptimizerPro\PC Optimizer Pro]
[HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\Local AppWizard-Generated Applications\PCOptimizerPro\PC Optimizer Pro]

Searching for "PCoptimizer"
[HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\PCOptimizerPro]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PCOptimizerPro_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PCOptimizerPro_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\PCOptimizerProSetup64_1_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\PCOptimizerProSetup64_1_RASMANCS]
[HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\Local AppWizard-Generated Applications\PCOptimizerPro]

Searching for "drivercure"
No data found.

Searching for "performersoft"
No data found.

Searching for "registry mechanic"
No data found.

Searching for "coupon caddy"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111271149}]
"AppName"="Coupon Caddy.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111271149}]
"AppPath"="C:\Program Files (x86)\Coupon Caddy"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110111271149}]
"AppName"="Coupon Caddy-bg.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110111271149}]
"AppPath"="C:\Program Files (x86)\Coupon Caddy"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy-InternalInstaller_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy-InternalInstaller_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy_RASMANCS]

-= EOF =-


----------



## eddie5659 (Mar 19, 2001)

Uninstall this program because its not needed.
If it can't be installed, let me know, but carry on with the rest of the uninstall and the programs below. We can look at any that couldn't be uninstalled later 
Optimizers, boosters, cleaners, etc. are basically useless and a waste of money and can do more harm than good

Reading these links might also put you off such progs:

http://miekiemoes.blogspot.com/2008/02/registry-cleaners-and-system-tweaking_13.html

http://www.edbott.com/weblog/?p=643

*PC Tools Registry Mechanic*

Also, you may want to uninstall this toolbar:

*IncrediMail Media Bar*

----
I've got to go now, but will be on tomorrow with a fix to remove the things you just posted. May take me a few mins to create, but will post early tomorrow evening 

eddie


----------



## sweetrose (Sep 7, 2012)

ok abd thanks eddie,,,,,have agood night....;.)


----------



## eddie5659 (Mar 19, 2001)

No problem, and you have a nice evening as well


----------



## eddie5659 (Mar 19, 2001)

size=3]*Backing Up Your Registry*[/size]
Download *ERUNT* 
_(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)_
Install *ERUNT* by following the prompts
_(use the default install settings but say no to the portion that asks you to add *ERUNT* to the start-up folder, if you like you can enable this option later)_
Start *ERUNT*
_(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)_
Choose a location for the backup
_(the default location is C:\WINDOWS\ERDNT which is acceptable)._
Make sure that at least the first two check boxes are ticked
Press *OK*
Press *YES* to create the folder.










Let me know when you've done that and then we'll do the next part


----------



## sweetrose (Sep 7, 2012)

all done.


----------



## eddie5659 (Mar 19, 2001)

Have you uninstalled PC Tools Registry Mechanic?

I'll not put it in my fix, just in case you still have it installed 

Okay, lets now do the following

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open *notepad* and copy/paste the text in the quotebox below into it:


```
File::
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_dailybibleguide.dl.mywebsearch.com_0.localstorage
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_dailybibleguide.dl.mywebsearch.com_0.localstorage-journal
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filmfanatic2.dl.mywebsearch.com_0.localstorage
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filmfanatic2.dl.mywebsearch.com_0.localstorage-journal
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\IncrediMail_Media Bar_2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\IncrediMail_Media Bar_2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGong_16.png
C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx

Folder::
C:\Program Files (x86)\Mysearchdial
C:\Users\ann\AppData\Local\Smartbar
C:\Program Files (x86)\Coupon Caddy

Registry::
[-HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
[-HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Users\ann\AppData\Local\Smartbar\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Users\ann\AppData\Local\Smartbar\Application\"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\SmartbarExeInstaller_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\SmartbarExeInstaller_RASMANCS]
[-HKEY_CURRENT_USER\Software\PowerPack\225\13]
[-HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\PowerPack\225\13]
[-HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\PCOptimizerPro]
[-HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\Local AppWizard-Generated Applications\PCOptimizerPro]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PCOptimizerPro_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PCOptimizerPro_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\PCOptimizerProSetup64_1_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\PCOptimizerProSetup64_1_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111271149}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy-InternalInstaller_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy-InternalInstaller_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy_RASMANCS]
```
Save this as *CFScript.txt*, in the same location as ComboFix.exe










Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at *C:\ComboFix.txt* which I will require in your next reply.


----------



## sweetrose (Sep 7, 2012)

erunt did not work....and cant find that commad promt you ask me to uninsall


----------



## sweetrose (Sep 7, 2012)

eddie.i cant find that box that you are showing me


----------



## eddie5659 (Mar 19, 2001)

I was a bit confused as just after the Erunt post you said it was all done, so I thought you'd done it.

Did you follow what I posted, as in creating the backup in Erunt? If you got to the same kind of screen as I posted, and pressed OK, then the backup has been done.

Leave ComboFix for now, just need to work on the erunt part


----------



## sweetrose (Sep 7, 2012)

so its done then,.........ok leave combo fix to yoou


----------



## eddie5659 (Mar 19, 2001)

Hi

So, you've managed to do the Erunt backup?

If so, then we can do the next stage which will be the ComboFix fix 

Reposting here, so you can see it fully 

-------------

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open *notepad* and copy/paste the text in the quotebox below into it:


```
File::
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_dailybibleguide.dl.mywebsearch.com_0.localstorage
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_dailybibleguide.dl.mywebsearch.com_0.localstorage-journal
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filmfanatic2.dl.mywebsearch.com_0.localstorage
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filmfanatic2.dl.mywebsearch.com_0.localstorage-journal
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\IncrediMail_Media Bar_2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\IncrediMail_Media Bar_2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGong_16.png
C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx

Folder::
C:\Program Files (x86)\Mysearchdial
C:\Users\ann\AppData\Local\Smartbar
C:\Program Files (x86)\Coupon Caddy

Registry::
[-HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
[-HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Users\ann\AppData\Local\Smartbar\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Users\ann\AppData\Local\Smartbar\Application\"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\SmartbarExeInstaller_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\SmartbarExeInstaller_RASMANCS]
[-HKEY_CURRENT_USER\Software\PowerPack\225\13]
[-HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\PowerPack\225\13]
[-HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\PCOptimizerPro]
[-HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\Local AppWizard-Generated Applications\PCOptimizerPro]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PCOptimizerPro_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PCOptimizerPro_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\PCOptimizerProSetup64_1_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\PCOptimizerProSetup64_1_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111271149}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy-InternalInstaller_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy-InternalInstaller_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy_RASMANCS]
```
Save this as *CFScript.txt*, in the same location as ComboFix.exe










Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at *C:\ComboFix.txt* which I will require in your next reply.

eddie


----------



## sweetrose (Sep 7, 2012)

dont seem to be working right


----------



## eddie5659 (Mar 19, 2001)

Okay, we'll use OTL instead 

Run OTL 

Under the *Custom Scans/Fixes* box at the bottom, paste in the following


```
:Files
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_dailybibleguide.dl.mywebsearch.com_0.localstorage
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_dailybibleguide.dl.mywebsearch.com_0.localstorage-journal
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filmfanatic2.dl.mywebsearch.com_0.localstorage
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filmfanatic2.dl.mywebsearch.com_0.localstorage-journal
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\IncrediMail_Media Bar_2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\IncrediMail_Media Bar_2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGong_16.png
C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx
C:\Program Files (x86)\Mysearchdial
C:\Users\ann\AppData\Local\Smartbar
C:\Program Files (x86)\Coupon Caddy
:Reg
[-HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
[-HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Users\ann\AppData\Local\Smartbar\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Users\ann\AppData\Local\Smartbar\Application\"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\SmartbarExeInstaller_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\SmartbarExeInstaller_RASMANCS]
[-HKEY_CURRENT_USER\Software\PowerPack\225\13]
[-HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\PowerPack\225\13]
[-HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\PCOptimizerPro]
[-HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\Local AppWizard-Generated Applications\PCOptimizerPro]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PCOptimizerPro_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PCOptimizerPro_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\PCOptimizerProSetup64_1_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\PCOptimizerProSetup64_1_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111271149}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy-InternalInstaller_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy-InternalInstaller_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy_RASMANCS]
:Commands
[emptytemp]
[purity] 
[CREATERESTOREPOINT]
```

Then click the *Run Fix* button at the top 
Click OK.
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply. The log is saved in the same location as OTL.


----------



## sweetrose (Sep 7, 2012)

All processes killed
Error: Unable to interpret <ode:> in the current context!
========== FILES ==========
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_dailybibleguide.dl.mywebsearch.com_0.localstorage moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_dailybibleguide.dl.mywebsearch.com_0.localstorage-journal moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filmfanatic2.dl.mywebsearch.com_0.localstorage moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filmfanatic2.dl.mywebsearch.com_0.localstorage-journal moved successfully.
File\Folder C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\IncrediMail_Media Bar_2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll not found.
File\Folder C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\IncrediMail_Media Bar_2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGong_16.png not found.
File\Folder C:\Users\ann\AppData\Local\mysearchdial_speedial_v9.0.2.crx not found.
File\Folder C:\Program Files (x86)\Mysearchdial not found.
File\Folder C:\Users\ann\AppData\Local\Smartbar not found.
File\Folder C:\Program Files (x86)\Coupon Caddy not found.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Users\ann\AppData\Local\Smartbar\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Users\ann\AppData\Local\Smartbar\Application\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\SmartbarExeInstaller_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\SmartbarExeInstaller_RASMANCS\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\PowerPack\225\13\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\PowerPack\225\13\ not found.
Registry key HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\PCOptimizerPro\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\Local AppWizard-Generated Applications\PCOptimizerPro\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PCOptimizerPro_RASAPI32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PCOptimizerPro_RASMANCS\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\PCOptimizerProSetup64_1_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\PCOptimizerProSetup64_1_RASMANCS\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111271149}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111271149}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy-InternalInstaller_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy-InternalInstaller_RASMANCS\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Coupon Caddy_RASMANCS\ deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: ann
->Temp folder emptied: 156139 bytes
->Temporary Internet Files folder emptied: 4691431 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 403236213 bytes
->Flash cache emptied: 813 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 124515 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 389.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 06232013_131913

Files\Folders moved on Reboot...
C:\Users\ann\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\ann\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


----------



## eddie5659 (Mar 19, 2001)

Looks like a lot has gone already, which is good 

Now, do you know what this is:

c:\windows\DeleteOnReboot.bat

If not, lets take a look now 

So, using SystemLook again, can you run the following code and post the log:


```
:contents
c:\windows\DeleteOnReboot.bat
```
------

Also, can you run a fresh OTL scan as follows. Only the one log will may appear this time:


Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath *Output* at the top change it to *Standard Output*.
Select 
*All Users*
*LOP Check*
*Purity Check*
Under the *Standard Registry* box change it to *All*

Click the *Run Scan* button. Do not change any settings unless otherwise told to do so. The scan wont take long.

*IF OTL SAYS 'NOT RESPONDING' DON'T USE THE MOUSE. IT WILL CARRY ON SCANNING AFTER A FEW MINUTES*

When the scan completes, it will open two notepad windows. *OTL.Txt* and *Extras.Txt*. These are saved in the same location as OTL.

Please copy *(Edit->Select All, Edit->Copy)* the contents of these files, one at a time and post them in your topic


eddie


----------



## sweetrose (Sep 7, 2012)

SystemLook 30.07.11 by jpshortstuff
Log created at 19:12 on 24/06/2013 by ann
Administrator - Elevation successful

No Context: Code:

========== contents ==========

c:\windows\DeleteOnReboot.bat - Opened succesfully.

rmdir /s /q "C:\Program Files (x86)\Common Files\AVG Secure Search"
del /f /q "C:\Windows\DeleteOnReboot.bat">nul 2>&1


-= EOF =-


----------



## sweetrose (Sep 7, 2012)

OTL logfile created on: 6/24/2013 7:14:43 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ann\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.87 Gb Total Physical Memory | 0.51 Gb Available Physical Memory | 27.34% Memory free
3.74 Gb Paging File | 1.74 Gb Available in Paging File | 46.48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 79.77 Gb Free Space | 68.50% Space Free | Partition Type: NTFS
Drive D: | 116.05 Gb Total Space | 10.90 Gb Free Space | 9.39% Space Free | Partition Type: NTFS

Computer Name: ANN-TOSH | User Name: ann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/12 19:54:24 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ann\Downloads\OTL.exe
PRC - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
PRC - [2013/04/29 00:58:42 | 004,408,368 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
PRC - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
PRC - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/12/21 12:09:14 | 000,894,920 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe
PRC - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/09/03 07:45:02 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe
PRC - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
PRC - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2010/06/03 17:09:00 | 000,304,560 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- c:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2009/07/28 21:26:42 | 000,062,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
PRC - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

========== Modules (No Company Name) ==========

MOD - [2013/06/15 02:28:42 | 000,393,168 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppgooglenaclpluginchrome.dll
MOD - [2013/06/15 02:28:41 | 013,140,432 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
MOD - [2013/06/15 02:28:40 | 004,051,408 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll
MOD - [2013/06/15 02:27:51 | 000,599,504 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\libglesv2.dll
MOD - [2013/06/15 02:27:50 | 000,124,368 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\libegl.dll
MOD - [2013/06/15 02:27:48 | 001,597,392 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\ffmpegsumo.dll
MOD - [2012/05/25 05:25:00 | 000,921,600 | ---- | M] () -- C:\Program Files (x86)\Yahoo!\Messenger\yui.dll

========== Services (SafeList) ==========

SRV:*64bit:* - [2010/09/28 13:30:28 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:*64bit:* - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:*64bit:* - [2010/02/05 18:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:*64bit:* - [2009/07/28 15:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:*64bit:* - [2009/07/14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/12/21 12:09:14 | 000,894,920 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe -- (vToolbarUpdater13.3.2)
SRV - [2012/12/06 19:40:43 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/09/03 07:45:02 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe -- (McComponentHostService)
SRV - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2010/05/11 09:40:52 | 000,124,368 | ---- | M] (Toshiba Europe GmbH) [Auto | Running] -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe -- (TemproMonitoringService)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- c:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/28 17:44:40 | 000,249,200 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)
SRV - [2009/10/06 10:21:50 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)

========== Driver Services (SafeList) ==========

DRV:*64bit:* - [2013/03/29 02:53:48 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:*64bit:* - [2013/03/21 03:08:24 | 000,240,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:*64bit:* - [2013/02/08 05:37:56 | 000,116,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:*64bit:* - [2013/02/08 05:37:54 | 000,311,096 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
DRV:*64bit:* - [2013/02/08 05:37:50 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:*64bit:* - [2013/02/08 05:37:42 | 000,206,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:*64bit:* - [2013/02/08 05:37:40 | 000,045,880 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:*64bit:* - [2012/12/21 12:09:14 | 000,030,568 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)
DRV:*64bit:* - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:*64bit:* - [2012/03/01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:*64bit:* - [2011/10/01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:*64bit:* - [2011/10/01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:*64bit:* - [2010/11/20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:*64bit:* - [2010/11/20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:*64bit:* - [2010/09/24 16:11:18 | 000,349,800 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,235,520 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbwwan.sys -- (ZTEusbwwan)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zteusbvoice.sys -- (ZTEusbvoice)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,011,776 | ---- | M] (MBB Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter)
DRV:*64bit:* - [2010/05/20 14:40:28 | 000,075,776 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vodafone_K380x-z_dc_enum.sys -- (vodafone_K380x-z_dc_enum)
DRV:*64bit:* - [2010/04/28 12:32:20 | 000,932,384 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)
DRV:*64bit:* - [2010/03/22 11:55:20 | 000,046,192 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)
DRV:*64bit:* - [2010/03/10 19:51:32 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:*64bit:* - [2010/02/21 01:24:36 | 010,300,800 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:*64bit:* - [2010/01/07 10:05:46 | 000,232,992 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:*64bit:* - [2009/07/30 20:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:*64bit:* - [2009/07/14 16:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:*64bit:* - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:*64bit:* - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:*64bit:* - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:*64bit:* - [2009/06/22 18:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:*64bit:* - [2009/06/20 03:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:*64bit:* - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:*64bit:* - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:*64bit:* - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:*64bit:* - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:*64bit:* - [2009/06/04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE:*64bit:* - HKLM\..\SearchScopes,DefaultScope = 
IE:*64bit:* - HKLM\..\SearchScopes\{ABA5AE01-9B23-4AC7-9BA7-E0345C1287FB}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{A25208D0-8D9E-4B0D-B6DE-CCB82D68D3C2}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox

IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{400E7EA1-093B-4D0E-90AC-CAAEF713611E}: "URL" = http://rover.ebay.com/rover/1/710-44557-9400-9/4?satitle={searchTerms}
IE - HKCU\..\SearchScopes\{56369BA8-0140-7F16-6997-7A636D1E1A62}: "URL" = http://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=021113&q={searchTerms}&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=mkg028
IE - HKCU\..\SearchScopes\{E0F1151B-5874-4D8B-8E18-506FA493AB23}: "URL" = http://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

[2012/11/03 15:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: MyWebSearch (Enabled)
CHR - default_search_provider: search_url = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=84A3265C-6544-45B6-8A52-015E74708D17&n=77fce125&ind=2013061413&p=Z1chr999YYgb&si=trailerclips-2-v3&searchfor={searchTerms}
CHR - default_search_provider: suggest_url = http://srchsugg.funwebproducts.com/query?q={searchTerms}&li=ff&sstype=prefix
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll
CHR - plugin: king.com - Game controller for firefox (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\plugins\npmidas.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U21 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Java Deployment Toolkit 7.0.210.11 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: iNTERNET TURBO = C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\
CHR - Extension: Skype Click to Call = C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.8.0.12323_0\

O1 HOSTS File: ([2013/03/07 19:09:17 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:*64bit:* - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Users\ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:*64bit:* - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3D15F113-3692-4089-B3A3-77DC82321FEB}: NameServer = 10.203.129.68 10.203.129.68
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8303406A-D415-481D-984A-0CB67A97EB51}: DhcpNameServer = 194.168.4.100 194.168.8.100
O18:*64bit:* - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:*64bit:* - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:*64bit:* - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/01/24 19:10:57 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:*64bit:* - HKLM\..comfile [open] -- "%1" %*
O35:*64bit:* - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:*64bit:* - HKLM\...com [@ = comfile] -- "%1" %*
O37:*64bit:* - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/06/24 18:15:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2013/06/24 15:27:04 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan
[2013/06/24 15:26:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfee Security Scan
[2013/06/24 15:26:43 | 000,263,592 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013/06/24 15:26:31 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013/06/24 15:26:31 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013/06/24 15:26:31 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/06/24 15:26:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013/06/23 07:53:41 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/06/22 18:57:53 | 000,000,000 | --SD | C] -- C:\ComboFix
[2013/06/19 19:53:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2013/06/19 19:53:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT
[2013/06/18 19:12:51 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/06/18 18:46:15 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/06/18 18:46:15 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/06/18 18:46:15 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/06/15 08:06:10 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013/06/15 08:06:09 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/06/14 18:20:23 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2013/06/14 17:56:17 | 000,000,000 | ---D | C] -- C:\Users\ann\AppData\Roaming\SUPERAntiSpyware.com
[2013/06/14 15:24:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/06/13 08:06:43 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013/06/13 08:06:43 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013/06/13 08:06:42 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013/06/13 08:06:42 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013/06/13 08:06:42 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/06/13 08:06:42 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/06/13 08:06:42 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013/06/13 08:06:42 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013/06/13 08:06:42 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013/06/13 08:06:40 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013/06/13 08:06:40 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013/06/13 08:06:40 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013/06/13 08:06:39 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013/06/13 07:48:30 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013/06/13 07:48:30 | 000,492,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013/06/13 07:48:20 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptdlg.dll
[2013/06/13 07:48:19 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cryptdlg.dll
[2013/06/13 07:48:12 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013/06/13 07:48:01 | 001,192,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certutil.exe
[2013/06/13 07:48:01 | 000,903,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certutil.exe
[2013/06/13 07:48:00 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2013/06/13 07:48:00 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2013/06/13 07:47:59 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certenc.dll
[2013/06/13 07:47:58 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certenc.dll
[2013/06/13 07:47:42 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013/06/13 07:47:41 | 001,505,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013/06/12 22:34:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013/06/12 22:07:58 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/06/10 19:35:36 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2013/06/05 21:54:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Image Converter

========== Files - Modified Within 30 Days ==========

[2013/06/24 19:18:07 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/06/24 18:51:41 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/24 18:45:21 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001UA.job
[2013/06/24 18:15:12 | 000,001,783 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013/06/24 18:13:51 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/24 18:13:51 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/24 18:04:23 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/24 18:03:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/06/24 18:03:45 | 1504,354,304 | -HS- | M] () -- C:\hiberfil.sys
[2013/06/24 15:26:25 | 000,096,168 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/06/24 15:26:24 | 000,867,240 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2013/06/24 15:26:24 | 000,789,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2013/06/24 15:26:24 | 000,263,592 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013/06/24 15:26:24 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013/06/24 15:26:24 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013/06/24 07:45:00 | 000,000,848 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001Core.job
[2013/06/23 13:41:19 | 000,727,334 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/06/23 13:41:19 | 000,629,326 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/06/23 13:41:19 | 000,111,220 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/06/20 20:53:09 | 000,002,366 | ---- | M] () -- C:\Users\ann\Desktop\Google Chrome.lnk
[2013/06/19 19:54:26 | 000,001,075 | ---- | M] () -- C:\Users\ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2013/06/19 19:53:56 | 000,000,876 | ---- | M] () -- C:\Users\ann\Desktop\ERUNT.lnk
[2013/06/18 18:36:02 | 278,514,194 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013/06/17 20:54:11 | 000,000,121 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013/06/08 15:06:58 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/06/08 12:40:02 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013/05/26 09:16:06 | 000,002,968 | ---- | M] () -- C:\Windows\SysWow64\userawacs.cfg
[2013/05/26 09:16:00 | 000,000,110 | ---- | M] () -- C:\Windows\SysWow64\usergui.cfg
[2013/05/26 09:15:30 | 000,000,851 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk

========== Files Created - No Company Name ==========

[2013/06/24 15:26:56 | 000,001,783 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013/06/19 19:54:26 | 000,001,075 | ---- | C] () -- C:\Users\ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2013/06/19 19:53:56 | 000,000,876 | ---- | C] () -- C:\Users\ann\Desktop\ERUNT.lnk
[2013/06/18 18:46:15 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/06/18 18:46:15 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/06/18 18:46:15 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/06/18 18:46:15 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/06/18 18:46:15 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/06/18 18:36:02 | 278,514,194 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013/06/17 20:53:54 | 000,000,121 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013/06/02 08:00:20 | 004,989,512 | ---- | C] () -- C:\Users\ann\Documents\043.JPG
[2013/01/22 21:20:46 | 000,735,726 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/11/03 21:45:18 | 000,000,000 | ---- | C] () -- C:\Windows\ToDisc.INI
[2012/09/02 13:24:38 | 000,027,520 | ---- | C] () -- C:\Users\ann\AppData\Local\dt.dat
[2011/08/31 08:34:31 | 000,001,072 | ---- | C] () -- C:\Users\ann\Pictures - Shortcut.lnk
[2011/07/21 20:34:13 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{931E4FAA-EDCB-4C4C-9A5F-F55CE7BD62A6}
[2011/07/21 20:05:23 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{8532B172-6F57-4CBE-8E80-FAD83C06C6D3}
[2011/07/15 15:48:15 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{796EF731-ABE6-49A6-8D8F-75DAAE534B52}
[2011/07/15


----------



## sweetrose (Sep 7, 2012)

:28:59 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0B3B4E74-A96D-457B-A3AC-15AF58ED515A}
[2011/07/15 15:07:30 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{9A0EA9CA-EE6E-4B14-AEA4-EF4E0BE4F54A}
[2011/07/12 17:08:10 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{AEEDA0C4-B094-40CA-9072-BDC6E4E10BF3}
[2011/07/12 17:04:33 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0D85A837-7B6B-4379-9BE0-29398598E6DE}
[2011/07/11 19:15:42 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{718D1F67-3F23-4AD2-9624-60761184FA16}
[2011/07/11 19:10:51 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{8885552C-C46F-41CE-AF17-7D809AA70F9B}
[2011/07/11 12:00:50 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0272CA41-FCD0-43E5-BDC1-7D36C50B266C}
[2011/07/11 11:58:10 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{F10292BA-458D-48F4-BB5C-6E00413FB3D2}
[2011/07/05 14:29:26 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{1054FAA8-0F34-4A0D-B2D5-E525DD0BA91E}
[2011/07/04 14:18:16 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{812C46D8-1501-4AFA-8AC1-2D540FA281AD}
[2011/07/04 14:09:23 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{B1AB7382-9FDE-4896-B0A9-D0E584BCBEB7}
[2011/07/04 14:03:38 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{FA6271DC-C11C-4274-A832-ECB58B2FC3D7}
[2011/07/03 13:26:22 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{F129A5BC-03A3-4024-A684-6141D5EB5FB4}
[2011/04/16 08:19:44 | 000,004,608 | ---- | C] () -- C:\Users\ann\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/31 21:30:17 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011/01/31 18:17:23 | 000,007,605 | ---- | C] () -- C:\Users\ann\AppData\Local\Resmon.ResmonCfg
[2010/08/11 11:43:50 | 000,159,464 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4

========== ZeroAccess Check ==========


----------



## sweetrose (Sep 7, 2012)

009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 06:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 05:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2011/12/19 14:50:39 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\AVG
[2012/11/14 16:19:42 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\AVG2013
[2011/10/13 15:39:53 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2011/04/05 17:07:27 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Farm Mania 2
[2012/12/07 15:28:42 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\JDownloaderDownloadManagerPackages
[2011/02/06 22:51:40 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Toshiba
[2013/01/22 21:24:07 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\TP
[2012/10/03 10:29:33 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\TuneUp Software
[2011/04/20 16:26:20 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Vodafone
[2012/10/17 09:03:45 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\WildTangent
[2011/04/18 21:52:51 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Windows Live Writer

========== Purity Check ==========

< End of report >


----------



## sweetrose (Sep 7, 2012)

hi eddie,,,,i think iv done it ok......


----------



## eddie5659 (Mar 19, 2001)

Thanks 

Now, it looks like our old friend iNTERNET TURBO is back, so it must have installed off a toolbar or something 

So, can you do the following. Firstly, delete the copy of AdwCleaner that you have and then get a fresh one from here, and run the scan as before:

Please download *AdwCleaner* by Xplode onto your desktop.

Double click on *AdwCleaner.exe* to run the tool.
Click on *Search*.
A logfile will automatically open after the scan has finished.
Please post the contents of that logfile with your next reply.
You can find the logfile at *C:\AdwCleaner[R1].txt* as well.

---------

Next, go to AddRemove Programs via the Control Panel, and uninstall these (if there):

*AVG Secure Search
iNTERNET TURBO*

--------

Then, using OTL, can you run this fix for me:

Run OTL 

Under the *Custom Scans/Fixes* box at the bottom, paste in the following


```
:OTL
CHR - default_search_provider: Mysearchdial (Enabled)
CHR - default_search_provider: search_url = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=solimmsd&cd=2XzuyEtN2Y1L1QzuzzzztByDtB0C0 B0AtD0A0Azzzz0F0E0DtN0D0Tzu0CyDtByEtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1B1F1I1L1H1H1B1Q&cr=1548855096&ir=
CHR - homepage: http://www.delta-search.com/?affID=1...3388252CBA0AA8
CHR - default_search_provider: suggest_url = http://srchsugg.funwebproducts.com/query?q={searchTerms}&li=ff&sstype=prefix
CHR - default_search_provider: search_url = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=84A3265C-6544-45B6-8A52-015E74708D17&n=77fce125&ind=2013061413&p=Z1chr999YYgb&si=trailerclips-2-v3&searchfor={searchTerms}
PRC - [2012/12/21 12:09:14 | 000,894,920 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe
SRV - [2012/12/21 12:09:14 | 000,894,920 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe -- (vToolbarUpdater13.3.2)
CHR - Extension: iNTERNET TURBO = C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\
:Files
C:\Program Files (x86)\Common Files\AVG Secure Search
:Files
ipconfig /flushdns /c
:Commands
[emptytemp]
[purity] 
[CREATERESTOREPOINT]
```

Then click the *Run Fix* button at the top 
Click OK.
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply. The log is saved in the same location as OTL.

---------

eddie


----------



## sweetrose (Sep 7, 2012)

AdwCleaner v2.303 - Logfile created 06/25/2013 at 19:04:53
# Updated 08/06/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : ann - ANN-TOSH
# Boot Mode : Normal
# Running from : C:\Users\ann\Downloads\adwcleaner (1).exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Found : C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp

***** [Registry] *****

Key Found : HKCU\Software\Google\Chrome\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp
Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16611

[OK] Registry is clean.

-\\ Google Chrome v27.0.1453.116

File : C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.29] : keyword = "mywebsearch",
Found [l.33] : search_url = "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=84A3265C-6544-45B6-8A52-015E74708D17&n=77fce125&ind=2013061413&p=Z1chr999YYgb&si=trailerclips-2-v3&searchfor={searchTerms}",

*************************

AdwCleaner[R5].txt - [4521 octets] - [15/06/2013 18:57:18]
AdwCleaner[R6].txt - [4581 octets] - [17/06/2013 20:52:43]
AdwCleaner[R7].txt - [1390 octets] - [25/06/2013 19:04:53]
AdwCleaner[S6].txt - [4617 octets] - [17/06/2013 20:53:47]

########## EOF - C:\AdwCleaner[R7].txt - [1510 octets] ##########


----------



## eddie5659 (Mar 19, 2001)

Excellent, lets remove those first 


Close all open programs and internet browsers.
Double click on *adwcleaner.exe* to run the tool.
Click on *Delete*.
Confirm each time with *Ok*.
You will be prompted to restart your computer. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at *C:\AdwCleaner[S1].txt* as well.

Then, move onto the next part, and see if the programs are still in AddRemove, and if not, do the OTL part 

edddie


----------



## eddie5659 (Mar 19, 2001)

I'll be back at 10ish, have to dash back to work as I'm on call


----------



## sweetrose (Sep 7, 2012)

dont work to hard........


----------



## sweetrose (Sep 7, 2012)

All processes killed
Error: Unable to interpret <Code:> in the current context!
========== OTL ==========
Use Chrome's Settings page to remove the default_search_provider items.
Use Chrome's Settings page to remove the default_search_provider items.
Use Chrome's Settings page to change the HomePage.
Use Chrome's Settings page to remove the default_search_provider items.
Use Chrome's Settings page to remove the default_search_provider items.
Process ToolbarUpdater.exe killed successfully!
Service vToolbarUpdater13.3.2 stopped successfully!
Service vToolbarUpdater13.3.2 deleted successfully!
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2\ToolbarUpdater.exe moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Search\NewTabPages\js folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Search\NewTabPages\img folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Search\NewTabPages\html folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Search\NewTabPages\css folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Search\NewTabPages\API folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Search\NewTabPages folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Search\html folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Search folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\plugins folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Options folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Media\rssItem folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Media\popup folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Media\icons\useful_components folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Media\icons\urlGadget folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Media\icons folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Media\base64\searchBox folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Media\base64\rssItem folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Media\base64\ifarme folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Media\base64\icons folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Media\base64\dyamincMenu folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Media\base64 folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Media folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\utils\interface folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\utils folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\webNavigation folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\usage folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\translation folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\toolbarsManager folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\toolbarInfo folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\settings folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\serviceMap folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\login folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\jsonData folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\feed folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\cookieMonster folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\ContextMenuService folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\aliasReplace folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\alerts folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services\404 folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\services folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\popup\view folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\popup\controller folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\popup folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\model folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\lib folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\xmlMenu\view folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\xmlMenu\model folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\xmlMenu\controller folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\xmlMenu folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\urlGadget\view folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\urlGadget\model folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\urlGadget\controller folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\urlGadget folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\multiRssItem\view folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\multiRssItem\model folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\multiRssItem\controller folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\multiRssItem folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\menuPanel\view folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\menuPanel\model folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\menuPanel\controller folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\menuPanel folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\gadgets\view folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\gadgets\model folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\gadgets folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\factories\view folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\factories\model folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\factories folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\dynamicMenu\view folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\dynamicMenu\model folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\dynamicMenu\controller folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\dynamicMenu\consts folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\dynamicMenu folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\contextMenu\view folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\contextMenu\model folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\contextMenu\controller folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\contextMenu folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\container folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\components\view\InjectScript folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\components\view folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\components\model folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\components\controller folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\components folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items\about folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\items folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\css folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\controller folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\compatibility folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\API\Toolbar folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\API\Component\view folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\API\Component\model folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\API\Component\controller folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\API\Component folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js\API folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\js folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0\Css folder moved successfully.
C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bblnhhgpgomleanhbppdnkpofhjijgdp\2.3.19.11_0 folder moved successfully.
========== FILES ==========
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.3.2 folder moved successfully.
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater folder moved successfully.
C:\Program Files (x86)\Common Files\AVG Secure Search folder moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\ann\Downloads\cmd.bat deleted successfully.
C:\Users\ann\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: ann
->Temp folder emptied: 6005119 bytes
->Temporary Internet Files folder emptied: 4754206 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 357192494 bytes
->Flash cache emptied: 689 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 10592287 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 98176239 bytes

Total Files Cleaned = 455.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 06252013_191357

Files\Folders moved on Reboot...
C:\Users\ann\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\ann\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


----------



## eddie5659 (Mar 19, 2001)

No need to worry about me working too hard 

Okay, looks like the OTL removed quite a lot, so lets see what we have left.

Can you run SystemLook again, with the following code, and post the log:


```
:folderfind
*mywebsearch*
*AVG Secure Search*
*iNTERNET TURBO*
:filefind
*mywebsearch*.*
*AVG Secure Search*.*
*iNTERNET TURBO*.*
:regfind
mywebsearch
AVG Secure Search
iNTERNET TURBO
```
eddie


----------



## sweetrose (Sep 7, 2012)

Doing it now eddie.and i do worry ...all this with me.may stop you doing wot you want tooo


----------



## sweetrose (Sep 7, 2012)

SystemLook 30.07.11 by jpshortstuff
Log created at 21:07 on 26/06/2013 by ann
Administrator - Elevation successful

No Context: Code:

========== folderfind ==========

Searching for "*mywebsearch*"
No folders found.

Searching for "*AVG Secure Search*"
C:\_OTL\MovedFiles\06252013_191357\C_Program Files (x86)\Common Files\AVG Secure Search	d------	[11:09 21/12/2012]

Searching for "*iNTERNET TURBO*"
No folders found.

========== filefind ==========

Searching for "*mywebsearch*.*"
C:\_OTL\MovedFiles\06232013_131913\C_Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_dailybibleguide.dl.mywebsearch.com_0.localstorage	--a---- 3072 bytes	[07:36 16/04/2013]	[07:36 16/04/2013] C7FF2521E38BEC2F1480C5099BAED672
C:\_OTL\MovedFiles\06232013_131913\C_Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_dailybibleguide.dl.mywebsearch.com_0.localstorage-journal	--a---- 3608 bytes	[07:36 16/04/2013]	[07:36 16/04/2013] 97C01FCB9282637E3887DA61B46EE538
C:\_OTL\MovedFiles\06232013_131913\C_Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filmfanatic2.dl.mywebsearch.com_0.localstorage	--a---- 3072 bytes	[17:47 14/06/2013]	[17:47 14/06/2013] 0D8C912C01E24454F2F7FBB16C3AE1C0
C:\_OTL\MovedFiles\06232013_131913\C_Users\ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filmfanatic2.dl.mywebsearch.com_0.localstorage-journal	--a---- 3608 bytes	[17:47 14/06/2013]	[17:47 14/06/2013] 1E58D48AE975BBE93028D96B2970F118

Searching for "*AVG Secure Search*.*"
No files found.

Searching for "*iNTERNET TURBO*.*"
No files found.

========== regfind ==========

Searching for "mywebsearch"
No data found.

Searching for "AVG Secure Search"
No data found.

Searching for "iNTERNET TURBO"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iNTERNET TURBO Toolbar]

-= EOF =-


----------



## eddie5659 (Mar 19, 2001)

Can you have a look in AddRemove Programs and see if you still have this showing, as its appearing in your SystemLook log:

*iNTERNET TURBO*

If so, uninstall it. If not, it may just be the remains and we'll remove it another way 

Next, can you run an online scan here:

Please run a free online scan with the *ESET Online Scanner*

*Vista / Win7 users: *Right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select *Run as Administrator*.

*Note: This scan works with Internet Explorer or Mozilla FireFox.*

If using* Mozilla Firefox* you will need to download *esetsmartinstaller_enu.exe* when prompted then double click on it to install.


Click the green ESET Online Scanner box
Tick the box next to *YES, I accept the Terms of Use*
then click on: *Start*
You may see a panel towards the top of the screen telling you the website wants to install an addon... click and allow it to install. If your firewall asks whether you want to allow installation, say yes.
 Make sure that the option *Scan archives *is checked.
 Now click on *Advanced Settings* and select the following:
*Scan for potentially unwanted applications*
* Scan for potentially unsafe applications*
* Enable Anti-Stealth Technology*

 Click on *Start*
 The virus signature database will begin to download. *Be patient* this make take some time depending on the speed of your Internet Connection.
 When completed the *Online Scan* will begin automatically. The scan may take several hours.
 *Do not touch either the Mouse or keyboard* during the scan otherwise it may stall.
 When completed select *Uninstall application on close*, *make sure you copy the logfile first!*
 Then click on: *Finish*
 Use *notepad* to open the logfile located at *C:\Program Files\ESET\EsetOnlineScanner\log.txt.*
 *Copy *and *paste* that log *as a reply* to this topic.

--------

Then, and I know we checked a few of the tasks already, but just going to take a few more, before we remove them.

So, using OTL:


Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath *Output* at the top change it to *Standard Output*.
Select 
*All Users*
*LOP Check*
*Purity Check*
Under the *Standard Registry* box change it to *All*

Please copy the text in the code box below and paste it in the *Custom Scans/Fixes* box in OTL:


```
type C:\Windows\SysNative\tasks\{E2614C8F-C69A-4A46-8561-DC301110FA1B} /c
type C:\Windows\SysNative\tasks\{BE29141A-32A4-4270-A25B-A0D6346196D7} /c
type C:\Windows\SysNative\tasks\{26A90B35-2654-4FB7-ACB1-B9F26C49D344} /c
type C:\Windows\SysNative\tasks\{012F9B8D-0852-4DAC-ADDB-B4615E2D666E} /c
type C:\Windows\SysNative\tasks\{3DE3B054-11C2-4C87-8600-B4AF7E2124BF} /c
```

Click the *Run Scan* button. Do not change any settings unless otherwise told to do so. The scan wont take long.
A black box will appear, this is part of the custom scan, so don't be alarmed 
*IF OTL SAYS 'NOT RESPONDING' DON'T USE THE MOUSE. IT WILL CARRY ON SCANNING AFTER A FEW MINUTES*

When the scan completes, it will open one notepad window. *OTL.Txt*. This is saved in the same location as OTL.

Please copy *(Edit->Select All, Edit->Copy)* the contents of this file and post them in your topic


----------



## sweetrose (Sep 7, 2012)

doing it nnow eddie


----------



## sweetrose (Sep 7, 2012)

1.87 Gb Total Physical Memory | 0.34 Gb Available Physical Memory | 17.97% Memory free
3.74 Gb Paging File | 1.62 Gb Available in Paging File | 43.36% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 76.82 Gb Free Space | 65.97% Space Free | Partition Type: NTFS
Drive D: | 116.05 Gb Total Space | 10.90 Gb Free Space | 9.39% Space Free | Partition Type: NTFS

Computer Name: ANN-TOSH | User Name: ann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/12 19:54:24 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ann\Downloads\OTL.exe
PRC - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
PRC - [2013/04/29 00:58:42 | 004,408,368 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
PRC - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
PRC - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/09/03 07:45:02 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe
PRC - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
PRC - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2010/06/03 17:09:00 | 000,304,560 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- c:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2009/07/28 21:26:42 | 000,062,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
PRC - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

========== Modules (No Company Name) ==========

MOD - [2013/06/15 02:28:42 | 000,393,168 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppgooglenaclpluginchrome.dll
MOD - [2013/06/15 02:28:41 | 013,140,432 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
MOD - [2013/06/15 02:28:40 | 004,051,408 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll
MOD - [2013/06/15 02:27:51 | 000,599,504 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\libglesv2.dll
MOD - [2013/06/15 02:27:50 | 000,124,368 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\libegl.dll
MOD - [2013/06/15 02:27:48 | 001,597,392 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\ffmpegsumo.dll
MOD - [2012/05/25 05:25:00 | 000,921,600 | ---- | M] () -- C:\Program Files (x86)\Yahoo!\Messenger\yui.dll

========== Services (SafeList) ==========

SRV:*64bit:* - [2010/09/28 13:30:28 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:*64bit:* - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:*64bit:* - [2010/02/05 18:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:*64bit:* - [2009/07/28 15:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:*64bit:* - [2009/07/14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/06/03 16:21:54 | 000,162,408 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012/12/06 19:40:43 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/09/03 07:45:02 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe -- (McComponentHostService)
SRV - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2010/05/11 09:40:52 | 000,124,368 | ---- | M] (Toshiba Europe GmbH) [Auto | Running] -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe -- (TemproMonitoringService)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- c:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/28 17:44:40 | 000,249,200 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)
SRV - [2009/10/06 10:21:50 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)

========== Driver Services (SafeList) ==========

DRV:*64bit:* - [2013/03/29 02:53:48 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:*64bit:* - [2013/03/21 03:08:24 | 000,240,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:*64bit:* - [2013/02/08 05:37:56 | 000,116,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:*64bit:* - [2013/02/08 05:37:54 | 000,311,096 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
DRV:*64bit:* - [2013/02/08 05:37:50 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:*64bit:* - [2013/02/08 05:37:42 | 000,206,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:*64bit:* - [2013/02/08 05:37:40 | 000,045,880 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:*64bit:* - [2012/12/21 12:09:14 | 000,030,568 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)
DRV:*64bit:* - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:*64bit:* - [2012/03/01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:*64bit:* - [2011/10/01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:*64bit:* - [2011/10/01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:*64bit:* - [2010/11/20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:*64bit:* - [2010/11/20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:*64bit:* - [2010/09/24 16:11:18 | 000,349,800 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,235,520 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbwwan.sys -- (ZTEusbwwan)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zteusbvoice.sys -- (ZTEusbvoice)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,011,776 | ---- | M] (MBB Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter)
DRV:*64bit:* - [2010/05/20 14:40:28 | 000,075,776 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vodafone_K380x-z_dc_enum.sys -- (vodafone_K380x-z_dc_enum)
DRV:*64bit:* - [2010/04/28 12:32:20 | 000,932,384 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)
DRV:*64bit:* - [2010/03/22 11:55:20 | 000,046,192 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)
DRV:*64bit:* - [2010/03/10 19:51:32 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:*64bit:* - [2010/02/21 01:24:36 | 010,300,800 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:*64bit:* - [2010/01/07 10:05:46 | 000,232,992 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:*64bit:* - [2009/07/30 20:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:*64bit:* - [2009/07/14 16:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:*64bit:* - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:*64bit:* - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:*64bit:* - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:*64bit:* - [2009/06/22 18:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:*64bit:* - [2009/06/20 03:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:*64bit:* - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:*64bit:* - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:*64bit:* - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:*64bit:* - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:*64bit:* - [2009/06/04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE:*64bit:* - HKLM\..\SearchScopes,DefaultScope = 
IE:*64bit:* - HKLM\..\SearchScopes\{ABA5AE01-9B23-4AC7-9BA7-E0345C1287FB}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{A25208D0-8D9E-4B0D-B6DE-CCB82D68D3C2}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox

IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{400E7EA1-093B-4D0E-90AC-CAAEF713611E}: "URL" = http://rover.ebay.com/rover/1/710-44557-9400-9/4?satitle={searchTerms}
IE - HKCU\..\SearchScopes\{56369BA8-0140-7F16-6997-7A636D1E1A62}: "URL" = http://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=021113&q={searchTerms}&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=mkg028
IE - HKCU\..\SearchScopes\{E0F1151B-5874-4D8B-8E18-506FA493AB23}: "URL" = http://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

[2012/11/03 15:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: MyWebSearch (Enabled)
CHR - default_search_provider: search_url = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=84A3265C-6544-45B6-8A52-015E74708D17&n=77fce125&ind=2013061413&p=Z1chr999YYgb&si=trailerclips-2-v3&searchfor={searchTerms}
CHR - default_search_provider: suggest_url = http://srchsugg.funwebproducts.com/query?q={searchTerms}&li=ff&sstype=prefix
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll
CHR - plugin: king.com - Game controller for firefox (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\plugins\npmidas.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U21 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Java Deployment Toolkit 7.0.210.11 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: Skype Click to Call = C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0\

O1 HOSTS File: ([2013/03/07 19:09:17 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:*64bit:* - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Users\ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:*64bit:* - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3D15F113-3692-4089-B3A3-77DC82321FEB}: NameServer = 10.203.129.68 10.203.129.68
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8303406A-D415-481D-984A-0CB67A97EB51}: DhcpNameServer = 194.168.4.100 194.168.8.100
O18:*64bit:* - Protocol\Handler\skype4com - No CLSID value found
O18:*64bit:* - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:*64bit:* - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:*64bit:* - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/01/24 19:10:57 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:*64bit:* - HKLM\..comfile [open] -- "%1" %*
O35:*64bit:* - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:*64bit:* - HKLM\...com [@ = comfile] -- "%1" %*
O37:*64bit:* - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/06/24 18:15:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2013/06/24 15:27:04 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan
[2013/06/24 15:26:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfee Security Scan
[2013/06/24 15:26:43 | 000,263,592 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013/06/24 15:26:31 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013/06/24 15:26:31 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013/06/24 15:26:31 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/06/24 15:26:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013/06/23 07:53:41 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/06/22 18:57:53 | 000,000,000 | --SD | C] -- C:\ComboFix
[2013/06/19 19:53:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2013/06/19 19:53:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT
[2013/06/18 19:12:51 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/06/18 18:46:15 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/06/18 18:46:15 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/06/18 18:46:15 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/06/15 08:06:10 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013/06/15 08:06:09 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/06/14 18:20:23 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2013/06/14 17:56:17 | 000,000,000 | ---D | C] -- C:\Users\ann\AppData\Roaming\SUPERAntiSpyware.com
[2013/06/14 15:24:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/06/13 08:06:43 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013/06/13 08:06:43 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013/06/13 08:06:42 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013/06/13 08:06:42 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013/06/13 08:06:42 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/06/13 08:06:42 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/06/13 08:06:42 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013/06/13 08:06:42 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013/06/13 08:06:42 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013/06/13 08:06:40 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013/06/13 08:06:40 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013/06/13 08:06:40 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013/06/13 08:06:39 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013/06/13 07:48:30 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013/06/13 07:48:30 | 000,492,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013/06/13 07:48:20 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptdlg.dll
[2013/06/13 07:48:19 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cryptdlg.dll
[2013/06/13 07:48:12 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013/06/13 07:48:01 | 001,192,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certutil.exe
[2013/06/13 07:48:01 | 000,903,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certutil.exe
[2013/06/13 07:48:00 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2013/06/13 07:48:00 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2013/06/13 07:47:59 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certenc.dll
[2013/06/13 07:47:58 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certenc.dll
[2013/06/13 07:47:42 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013/06/13 07:47:41 | 001,505,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013/06/12 22:34:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013/06/12 22:07:58 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/06/10 19:35:36 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2013/06/05 21:54:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Image Converter

========== Files - Modified Within 30 Days ==========

[2013/06/29 16:51:06 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/29 16:45:07 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001UA.job
[2013/06/29 16:38:40 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/06/29 16:38:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/06/29 14:51:44 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/29 14:36:59 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/29 14:36:59 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/29 14:27:49 | 1504,354,304 | -HS- | M] () -- C:\hiberfil.sys
[2013/06/29 07:45:03 | 000,000,848 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001Core.job
[2013/06/24 18:15:12 | 000,001,783 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013/06/24 15:26:25 | 000,096,168 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/06/24 15:26:24 | 000,867,240 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2013/06/24 15:26:24 | 000,789,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2013/06/24 15:26:24 | 000,263,592 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013/06/24 15:26:24 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013/06/24 15:26:24 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013/06/23 13:41:19 | 000,727,334 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/06/23 13:41:19 | 000,629,326 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/06/23 13:41:19 | 000,111,220 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/06/20 20:53:09 | 000,002,366 | ---- | M] () -- C:\Users\ann\Desktop\Google Chrome.lnk
[2013/06/19 19:54:26 | 000,001,075 | ---- | M] () -- C:\Users\ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2013/06/19 19:53:56 | 000,000,876 | ---- | M] () -- C:\Users\ann\Desktop\ERUNT.lnk
[2013/06/18 18:36:02 | 278,514,194 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013/06/17 20:54:11 | 000,000,121 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013/06/08 15:06:58 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/06/08 12:40:02 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

========== Files Created - No Company Name ==========

[2013/06/24 15:26:56 | 000,001,783 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013/06/19 19:54:26 | 000,001,075 | ---- | C] () -- C:\Users\ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2013/06/19 19:53:56 | 000,000,876 | ---- | C] () -- C:\Users\ann\Desktop\ERUNT.lnk
[2013/06/18 18:46:15 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/06/18 18:46:15 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/06/18 18:46:15 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/06/18 18:46:15 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/06/18 18:46:15 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/06/18 18:36:02 | 278,514,194 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013/06/17 20:53:54 | 000,000,121 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013/06/02 08:00:20 | 004,989,512 | ---- | C] () -- C:\Users\ann\Documents\043.JPG
[2013/01/22 21:20:46 | 000,735,726 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/11/03 21:45:18 | 000,000,000 | ---- | C] () -- C:\Windows\ToDisc.INI
[2012/09/02 13:24:38 | 000,027,520 | ---- | C] () -- C:\Users\ann\AppData\Local\dt.dat
[2011/08/31 08:34:31 | 000,001,072 | ---- | C] () -- C:\Users\ann\Pictures - Shortcut.lnk
[2011/07/21 20:34:13 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{931E4FAA-EDCB-4C4C-9A5F-F55CE7BD62A6}
[2011/07/21 20:05:23 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{8532B172-6F57-4CBE-8E80-FAD83C06C6D3}
[2011/07/15 15:48:15 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{796EF731-ABE6-49A6-8D8F-75DAAE534B52}
[2011/07/15 15:28:59 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0B3B4E74-A96D-457B-A3AC-15AF58ED515A}
[2011/07/15 15:07:30 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{9A0EA9CA-EE6E-4B14-AEA4-EF4E0BE4F54A}
[2011/07/12 17:08:10 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{AEEDA0C4-B094-40CA-9072-BDC6E4E10BF3}
[2011/07/12 17:04:33 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0D85A837-7B6B-4379-9BE0-29398598E6DE}
[2011/07/11 19:15:42 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{718D1F67-3F23-4AD2-9624-60761184FA16}
[2011/07/11 19:10:51 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{8885552C-C46F-41CE-AF17-7D809AA70F9B}
[2011/07/11 12:00:50 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0272CA41-FCD0-43E5-BDC1-7D36C50B266C}
[2011/07/11 11:58:10 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{F10292BA-458D-48F4-BB5C-6E00413FB3D2}
[2011/07/05 14:29:26 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{1054FAA8-0F34-4A0D-B2D5-E525DD0BA91E}
[2011/07/04 14:18:16 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{812C46D8-1501-4AFA-8AC1-2D540FA281AD}
[2011/07/04 14:09:23 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{B1AB7382-9FDE-4896-B0A9-D0E584BCBEB7}
[2011/07/04 14:03:38 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{FA6271DC-C11C-4274-A832-ECB58B2FC3D7}
[2011/07/03 13:26:22 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{F129A5BC-03A3-4024-A684-6141D5EB5FB4}
[2011/04/16 08:19:44 | 000,004,608 | ---- | C] () -- C:\Users\ann\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/31 21:30:17 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011/01/31 18:17:23 | 000,007,605 | ---- | C] () -- C:\Users\ann\AppData\Local\Resmon.ResmonCfg
[2010/08/11 11:43:50 | 000,159,464 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4

========== ZeroAccess Check ==========

[2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 06:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 05:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2011/12/19 14:50:39 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\AVG
[2012/11/14 16:19:42 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\AVG2013
[2011/10/13 15:39:53 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2011/04/05 17:07:27 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Farm Mania 2
[2012/12/07 15:28:42 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\JDownloaderDownloadManagerPackages
[2011/02/06 22:51:40 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Toshiba
[2013/01/22 21:24:07 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\TP
[2012/10/03 10:29:33 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\TuneUp Software
[2011/04/20 16:26:20 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Vodafone
[2012/10/17 09:03:45 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\WildTangent
[2011/04/18 21:52:51 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Windows Live Writer

========== Purity Check ==========

========== Custom Scans ==========

< Code: >
[2009/07/14 06:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2009/07/14 06:08:49 | 000,032,620 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/02/11 09:40:52 | 000,000,848 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001Core.job
[2011/02/11 09:40:53 | 000,000,900 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001UA.job
[2011/06/28 10:49:03 | 000,000,888 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2011/06/28 10:49:03 | 000,000,892 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[2012/12/06 19:40:44 | 000,000,830 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

< type C:\Windows\SysNative\tasks\{E2614C8F-C69A-4A46-8561-DC301110FA1B} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Author>SkypeSetup</Author>
</RegistrationInfo>
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"C:\Program Files (x86)\Internet Explorer\iexplore.exe"</Command>
<Arguments>http://ui.skype.com/ui/0/5.10.0.116/en/go/help.faq.installer?LastError=1603</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<GroupId>S-1-5-32-545</GroupId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< type C:\Windows\SysNative\tasks\{BE29141A-32A4-4270-A25B-A0D6346196D7} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Author>SkypeSetup</Author>
</RegistrationInfo>
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"C:\Program Files (x86)\Internet Explorer\iexplore.exe"</Command>
<Arguments>http://ui.skype.com/ui/0/5.10.0.116/en/go/help.faq.installer?LastError=1603</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<GroupId>S-1-5-32-545</GroupId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< type C:\Windows\SysNative\tasks\{26A90B35-2654-4FB7-ACB1-B9F26C49D344} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Author>SkypeSetup</Author>
</RegistrationInfo>
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"C:\Program Files\Internet Explorer\iexplore.exe"</Command>
<Arguments>http://ui.skype.com/ui/0/5.10.0.116/en/go/help.faq.installer?LastError=1603</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<GroupId>S-1-5-32-545</GroupId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< type C:\Windows\SysNative\tasks\{012F9B8D-0852-4DAC-ADDB-B4615E2D666E} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Author>SkypeSetup</Author>
</RegistrationInfo>
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"C:\Program Files\Internet Explorer\iexplore.exe"</Command>
<Arguments>http://ui.skype.com/ui/0/5.10.0.116/en/go/help.faq.installer?LastError=1603</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<GroupId>S-1-5-32-545</GroupId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< type C:\Windows\SysNative\tasks\{3DE3B054-11C2-4C87-8600-B4AF7E2124BF} /c >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Author>SkypeSetupLight</Author>
</RegistrationInfo>
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"c:\users\ann\appdata\local\google\chrome\application\chrome.exe"</Command>
<Arguments>http://ui.skype.com/ui/0/5.1.0.112/en/abandoninstall?source=lightinstaller&page=tsDownload&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;ienotdefaultbrowser2</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<GroupId>S-1-5-32-545</GroupId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>

< End of report >


----------



## eddie5659 (Mar 19, 2001)

Looks like they're all the same. Before I post the fix, any joy with the online scan?

Re-posting it here 

Please run a free online scan with the *ESET Online Scanner*

*Vista / Win7 users: *Right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select *Run as Administrator*.

*Note: This scan works with Internet Explorer or Mozilla FireFox.*

If using* Mozilla Firefox* you will need to download *esetsmartinstaller_enu.exe* when prompted then double click on it to install.


Click the green ESET Online Scanner box
Tick the box next to *YES, I accept the Terms of Use*
then click on: *Start*
You may see a panel towards the top of the screen telling you the website wants to install an addon... click and allow it to install. If your firewall asks whether you want to allow installation, say yes.
 Make sure that the option *Scan archives *is checked.
 Now click on *Advanced Settings* and select the following:
*Scan for potentially unwanted applications*
* Scan for potentially unsafe applications*
* Enable Anti-Stealth Technology*

 Click on *Start*
 The virus signature database will begin to download. *Be patient* this make take some time depending on the speed of your Internet Connection.
 When completed the *Online Scan* will begin automatically. The scan may take several hours.
 *Do not touch either the Mouse or keyboard* during the scan otherwise it may stall.
 When completed select *Uninstall application on close*, *make sure you copy the logfile first!*
 Then click on: *Finish*
 Use *notepad* to open the logfile located at *C:\Program Files\ESET\EsetOnlineScanner\log.txt.*
 *Copy *and *paste* that log *as a reply* to this topic.


----------



## sweetrose (Sep 7, 2012)

sorry Eddie,i no i did it wrong las time..doing it now.hope its right this time.


----------



## eddie5659 (Mar 19, 2001)

oki doki


----------



## sweetrose (Sep 7, 2012)

not sure if this is right
C:\Program Files (x86)\Yuna Software\Messenger Plus! for Skype\Settings\Settings.exe	a variant of Win32/MessengerPlus.A application
C:\Users\ann\Downloads\PopularScreensaversSetup2.3.98.80.ZRchr999.exe	a variant of Win32/Toolbar.MyWebSearch.K application


----------



## eddie5659 (Mar 19, 2001)

If that is all that came up, I'll create my fix 

Can smell dinner cooking, but will be back after


----------



## sweetrose (Sep 7, 2012)

that is all that come up eddie....hop yoy enjoy yr dinner


----------



## eddie5659 (Mar 19, 2001)

Thanks, dinner was good, stirfry 

Run OTL 

Under the *Custom Scans/Fixes* box at the bottom, paste in the following. Make sure to include the first part *:Files* 


```
:Files
C:\Windows\SysNative\tasks\{00BC1703-9104-4547-9046-82BF662A6C0D}
C:\Windows\SysNative\tasks\{012F9B8D-0852-4DAC-ADDB-B4615E2D666E}
C:\Windows\SysNative\tasks\{02714F41-C704-4F29-A44E-3FDEFA9E5EA0}
C:\Windows\SysNative\tasks\{0399096D-B561-461D-815B-C940EC26C754}
C:\Windows\SysNative\tasks\{03DD895F-8646-4633-B817-4ECC9B1D1152}
C:\Windows\SysNative\tasks\{042DB467-970C-40AF-87BF-26EB331A1C24}
C:\Windows\SysNative\tasks\{05ABE415-C563-439D-9ED4-D68FAECB01B2}
C:\Windows\SysNative\tasks\{05BE0178-0E9D-4EB5-8DC2-C92365F8B69F}
C:\Windows\SysNative\tasks\{07113C9E-5C56-4C56-A139-A3EC393CA716}
C:\Windows\SysNative\tasks\{07AE9ACD-2430-4E16-9F0F-51215130F06F}
C:\Windows\SysNative\tasks\{0805CAA0-8E69-4E51-B914-E3492272A1AF}
C:\Windows\SysNative\tasks\{0812F4DB-A953-4F07-BA53-6FC21275436B}
C:\Windows\SysNative\tasks\{084FBF19-2634-4221-A03B-8E3253D9343F}
C:\Windows\SysNative\tasks\{09153206-56AE-45AB-98D8-9172D82C523A}
C:\Windows\SysNative\tasks\{0A7E78C5-278D-44AE-BEC1-D4A7072E6E6F}
C:\Windows\SysNative\tasks\{0B5FBC82-1762-430A-9388-EDE9926FE67D}
C:\Windows\SysNative\tasks\{0E81D74D-28EB-4A17-8C35-2C7E5BB62A38}
C:\Windows\SysNative\tasks\{0FFFB3B1-22D0-40F0-B42A-FB758CBB4BFB}
C:\Windows\SysNative\tasks\{105293E5-6DE0-40D5-98D3-E18F92CEBB23}
C:\Windows\SysNative\tasks\{10947E19-03DE-4D66-A3B2-8756AA1F2216}
C:\Windows\SysNative\tasks\{11F5A7DC-745D-482D-817C-A13D23C56D3C}
C:\Windows\SysNative\tasks\{12874D8B-073C-4DC2-A8F4-A9DFD691A76B}
C:\Windows\SysNative\tasks\{12A88BCC-7290-490F-863C-A45D8A158B58}
C:\Windows\SysNative\tasks\{12DC0B2D-E732-4ACC-8DD4-A645CC173D57}
C:\Windows\SysNative\tasks\{130B31A5-4E1C-4D4F-9CD8-F368204F209B}
C:\Windows\SysNative\tasks\{133C02EA-5F56-4AB1-90E3-42F1EBDF09F4}
C:\Windows\SysNative\tasks\{14059F30-0D1B-49F6-B507-DE7212F7B848}
C:\Windows\SysNative\tasks\{14123AFB-31E2-437C-AFF5-469E6951673B}
C:\Windows\SysNative\tasks\{14475078-D516-41AB-AD4A-8173DBD176FE}
C:\Windows\SysNative\tasks\{160BAFD7-1E6D-4485-9D96-8AC699E90A8D}
C:\Windows\SysNative\tasks\{161BF736-D33C-4936-AA30-EDA6EADD6061}
C:\Windows\SysNative\tasks\{1A4B5791-B0A0-4C50-B0BA-D2100D3DF90F}
C:\Windows\SysNative\tasks\{1AC7D1A8-2B3F-46B7-AEF3-2FAB757FEF94}
C:\Windows\SysNative\tasks\{1B7D42BA-32C0-496B-8597-9C838B317B76}
C:\Windows\SysNative\tasks\{1BA546E1-C9AB-478B-BAD3-2FC99EF05AC8}
C:\Windows\SysNative\tasks\{1D36548F-DE8F-481C-A49B-E95C69A04CDC}
C:\Windows\SysNative\tasks\{1EAAA1BC-86F9-4DB9-A699-4268C5EAAA8E}
C:\Windows\SysNative\tasks\{2054E632-BF3A-4F41-83B4-9438E558583E}
C:\Windows\SysNative\tasks\{2186CA69-80AD-456A-B5B9-B70F47DD5A55}
C:\Windows\SysNative\tasks\{24E37E6C-754F-49F8-BBE4-6F0D435679C5}
C:\Windows\SysNative\tasks\{267A4A57-801E-4FFA-B0CC-6A9698D4BCBF}
C:\Windows\SysNative\tasks\{26A90B35-2654-4FB7-ACB1-B9F26C49D344}
C:\Windows\SysNative\tasks\{271E62AE-546D-4B07-A307-6E9F1A5ADCB1}
C:\Windows\SysNative\tasks\{27D1B98C-D2E5-4DE5-AEB3-E5A635766751}
C:\Windows\SysNative\tasks\{2852D9BA-B2DE-4BF2-A126-B62DE9D85DC6}
C:\Windows\SysNative\tasks\{29CE92B7-D4FF-4C01-A8E4-187F215FF499}
C:\Windows\SysNative\tasks\{29D783E9-F790-4A0E-9B9E-EE35AD8DFC70}
C:\Windows\SysNative\tasks\{2BBF0C34-7A59-4F44-BC43-76BD32FE5B25}
C:\Windows\SysNative\tasks\{2C26CFC9-1FEF-44AD-A51D-57CDF47AB65A}
C:\Windows\SysNative\tasks\{2E34895B-6A54-4253-98F4-57C934AAC630}
C:\Windows\SysNative\tasks\{3351422F-4729-43FF-9941-5B69BDDF34CC}
C:\Windows\SysNative\tasks\{33A37774-1F76-434D-A89B-1644525668F6}
C:\Windows\SysNative\tasks\{34EB1460-E0FB-4560-8727-EF7894FD8D72}
C:\Windows\SysNative\tasks\{34EDDE88-B588-4084-AE65-D2057278E0E1}
C:\Windows\SysNative\tasks\{3531A692-426D-495E-90D7-12E7CA85E903}
C:\Windows\SysNative\tasks\{36C76AA6-3E80-4647-BD61-DFE2209945F0}
C:\Windows\SysNative\tasks\{36FE49AA-4B8E-4AFB-BB7E-CE8D16C71E3E}
C:\Windows\SysNative\tasks\{37F04637-ACEB-43BB-A855-A5012A85DC27}
C:\Windows\SysNative\tasks\{38F4C17A-C863-4F3E-AE1B-2D25CDA114A5}
C:\Windows\SysNative\tasks\{39AF257D-1D8C-4A0B-884F-4A79A48B7302}
C:\Windows\SysNative\tasks\{3A164BD9-46B1-4F02-9124-027C9A39AE5C}
C:\Windows\SysNative\tasks\{3DCFBD3B-2825-46E3-871D-58BAE0310B11}
C:\Windows\SysNative\tasks\{3EBD1BC6-6B10-46EA-9EA9-6574BD59714B}
C:\Windows\SysNative\tasks\{40516EA8-36C2-4A15-8B32-B79920FE8C30}
C:\Windows\SysNative\tasks\{40C39350-6229-45D6-BD26-92CEDB7E2A94}
C:\Windows\SysNative\tasks\{42F09B25-42B5-47CA-A799-9F91B4093AFD}
C:\Windows\SysNative\tasks\{445250AC-AA2D-4B81-8E17-D3829338D1AD}
C:\Windows\SysNative\tasks\{4657C8B3-4A9E-497B-8AB3-420DF55E9867}
C:\Windows\SysNative\tasks\{46B83C9F-F719-4DA5-8003-0BB43DB68D26}
C:\Windows\SysNative\tasks\{47783290-E027-4380-A0C8-CB01B5ABEEB3}
C:\Windows\SysNative\tasks\{482ECA03-70D4-4D85-82DE-9C0BDEE1E3C0}
C:\Windows\SysNative\tasks\{4987590D-C840-4312-A840-BFD99612807D}
C:\Windows\SysNative\tasks\{49FD10F0-B558-4BEB-AB53-13087FCFEE31}
C:\Windows\SysNative\tasks\{4ADFD596-FB78-4D0D-BCC9-F757446B5ECC}
C:\Windows\SysNative\tasks\{4AF78990-B897-4B49-A5D0-C1190E5AA8C7}
C:\Windows\SysNative\tasks\{4B26B4DF-C4A3-460C-897C-E018CD47D976}
C:\Windows\SysNative\tasks\{4B91AC63-0589-480E-BC9A-D9AD17A9EA40}
C:\Windows\SysNative\tasks\{4BD66EAA-D4AB-42F9-8CDB-A541A73B8D0F}
C:\Windows\SysNative\tasks\{4C843453-2C3C-4326-B2C9-987D379CDE11}
C:\Windows\SysNative\tasks\{4DA1C0D6-8AF0-477C-878E-4247E2FDF788}
C:\Windows\SysNative\tasks\{4EBEB8EB-5818-486B-B405-05B262C6F13D}
C:\Windows\SysNative\tasks\{4FFAFD86-7FFF-40D6-B381-C8677361A590}
C:\Windows\SysNative\tasks\{51028A2B-7C4C-437E-9216-58223E758B20}
C:\Windows\SysNative\tasks\{51D369E2-205E-46D8-BF4A-E23DD4B6525F}
C:\Windows\SysNative\tasks\{52040BF0-3098-49D5-A724-B6693506FE91}
C:\Windows\SysNative\tasks\{543CED65-6E55-4E4C-A59C-95204F0506E5}
C:\Windows\SysNative\tasks\{54EAB814-8382-4549-8909-6CD4F5CFED30}
C:\Windows\SysNative\tasks\{556E78A5-83BF-4DCC-9B18-A2C7D6DABB4F}
C:\Windows\SysNative\tasks\{557E3971-5316-459B-B599-2B69A1DC0CE3}
C:\Windows\SysNative\tasks\{55C7E8D8-C5DA-4291-A5C4-431DC903310B}
C:\Windows\SysNative\tasks\{55E36EC6-8BB1-4174-8002-C81B7868C11F}
C:\Windows\SysNative\tasks\{5666C2A9-464C-49D6-ABD0-67FC0FEA921E}
C:\Windows\SysNative\tasks\{56C5C122-C325-47EA-A233-854A704E7E35}
C:\Windows\SysNative\tasks\{57FA0B87-0653-44A5-AD14-71CA8A1E1D47}
C:\Windows\SysNative\tasks\{5820667B-847A-4E78-8B7E-18DCB446FD0C}
C:\Windows\SysNative\tasks\{588BF048-020A-4C6D-BCF1-A86B9ADD3BCE}
C:\Windows\SysNative\tasks\{596BFEB0-1DD2-40EC-BBA7-9B96703DE3EC}
C:\Windows\SysNative\tasks\{5A1469AB-D47E-49F3-B7A7-6F1B028D8205}
C:\Windows\SysNative\tasks\{5A1894AC-1EBE-4D75-9063-F750FE701A98}
C:\Windows\SysNative\tasks\{5A1ACF51-A7C6-44DC-A6FB-D78AEDE68FA9}
C:\Windows\SysNative\tasks\{5A2D0513-03C5-47D6-A15A-6C04F24EF95D}
C:\Windows\SysNative\tasks\{5A96CAC3-057F-4708-A668-6A9DECDF4389}
C:\Windows\SysNative\tasks\{5B47F55D-BA01-4EC2-89F2-584BAFEC8DA9}
C:\Windows\SysNative\tasks\{5B4B49BC-C968-4885-958E-3C0A75114C41}
C:\Windows\SysNative\tasks\{5EF0C674-BCF7-4E37-9AD6-2EE3CA6A7193}
C:\Windows\SysNative\tasks\{60562019-F0FD-4E7B-A682-C88029E364A5}
C:\Windows\SysNative\tasks\{62BBD555-5375-4937-8737-F72E628BC377}
C:\Windows\SysNative\tasks\{638628E8-D0BC-4A37-8B8C-5F62A8E479C1}
C:\Windows\SysNative\tasks\{64E5D35C-F1E8-44EB-9E5D-4C7BD368701D}
C:\Windows\SysNative\tasks\{64E99B8C-F79E-4319-9A7A-A219BFC7A93A}
C:\Windows\SysNative\tasks\{65358CA2-ABE8-407E-9B74-73CF75B3F970}
C:\Windows\SysNative\tasks\{65D6027D-8020-4758-9336-A453887EEE70}
C:\Windows\SysNative\tasks\{65FE42EC-C6CF-46F7-A76B-454AB7E24E65}
C:\Windows\SysNative\tasks\{6B162686-3443-4A94-A858-55972E0BB848}
C:\Windows\SysNative\tasks\{6CB8A641-C8DE-4834-878B-B80A3A41C74D}
C:\Windows\SysNative\tasks\{6D5F8847-4597-4E51-9190-7BE69DA0DBC9}
C:\Windows\SysNative\tasks\{6DED2CB6-AAED-4432-A762-2BB13EE71D55}
C:\Windows\SysNative\tasks\{6E752EC7-A0FB-42E9-807C-5AAECF128885}
C:\Windows\SysNative\tasks\{6E8B0A82-EA3E-4F8A-84A8-308F473D5EED}
C:\Windows\SysNative\tasks\{6EDC9BE6-32A9-475B-A6AE-2CCD8590B870}
C:\Windows\SysNative\tasks\{7014BAA4-1A18-4778-B2C4-9A3BD8A9B57E}
C:\Windows\SysNative\tasks\{71E0A457-68E9-427B-BC73-54D4A5F0FB76}
C:\Windows\SysNative\tasks\{72E0B780-960B-4BEE-A743-DBC16889CD53}
C:\Windows\SysNative\tasks\{75102181-062A-47DC-B2FF-3BEFDF3D4942}
C:\Windows\SysNative\tasks\{7523EE6D-84A3-4131-BF28-D2C941CB07D7}
C:\Windows\SysNative\tasks\{76992151-4E93-44A2-8821-9966CA1D8641}
C:\Windows\SysNative\tasks\{7796504C-D3B6-4115-9F80-430D1B17BCDB}
C:\Windows\SysNative\tasks\{78377B0C-3BF3-42A1-93FB-7881F9C29B9A}
C:\Windows\SysNative\tasks\{79B3F670-DF64-446C-A830-5A4E8A3CC1DF}
C:\Windows\SysNative\tasks\{79D4FDFC-8FAE-4159-B3AB-8963F25FFF80}
C:\Windows\SysNative\tasks\{7A2F8FA9-5F83-4272-AB32-3E20C9BC79E5}
C:\Windows\SysNative\tasks\{7A5D11ED-576B-4FBD-92C7-9EEFB47D5FB3}
C:\Windows\SysNative\tasks\{7ADF8D71-56DA-4CB8-A944-6A8B23C66997}
C:\Windows\SysNative\tasks\{7B7A2ACB-C8D2-42CB-B0B1-AAF5FBA5EFED}
C:\Windows\SysNative\tasks\{7D3D34A2-70D8-4AB0-815D-994F70A703A2}
C:\Windows\SysNative\tasks\{7F46382B-A73C-4454-8A02-DE5CDBDDFD95}
C:\Windows\SysNative\tasks\{80304483-7D12-4F7C-9FB8-5BC1B4BA8BB8}
C:\Windows\SysNative\tasks\{80C8C0DC-13DA-4859-AE0E-D6DEAD02783A}
C:\Windows\SysNative\tasks\{8138E522-B01E-4C3D-A4EA-17D40344359B}
C:\Windows\SysNative\tasks\{84016759-5D36-4B8F-86C1-D3D6CDB8513F}
C:\Windows\SysNative\tasks\{86F22850-ABF7-45CE-A6AB-1F7FB28945AD}
C:\Windows\SysNative\tasks\{87C4718F-B5BF-4BC9-9710-4BA03C933F6D}
C:\Windows\SysNative\tasks\{897C9BFE-AA3C-4F34-8C49-290F4B3ECBF1}
C:\Windows\SysNative\tasks\{899F6AAE-061B-4673-85A6-FEC7AF26C2E5}
C:\Windows\SysNative\tasks\{8A39EBEF-B474-45CB-8326-C5E7933E0F8B}
C:\Windows\SysNative\tasks\{8AAE2191-D1CD-4941-BDCC-6E9672B44E0A}
C:\Windows\SysNative\tasks\{8B44C92A-00D2-45BB-A039-E9751D9BAE69}
C:\Windows\SysNative\tasks\{8B99CA76-0209-4ED4-86DC-B9390D68C780}
C:\Windows\SysNative\tasks\{8BFCFDE2-C8EB-45C8-AD77-3A03070C93E3}
C:\Windows\SysNative\tasks\{8D8F3827-D61D-4586-86A2-C32526205776}
C:\Windows\SysNative\tasks\{8DF1A5CB-B739-490C-B7A3-26BA46E2890A}
C:\Windows\SysNative\tasks\{8FC35B70-A73F-4175-BAB9-43FE6B67134A}
C:\Windows\SysNative\tasks\{908EE60B-3DD9-47A2-8303-3B5E2D66A6D0}
C:\Windows\SysNative\tasks\{90E32E5F-A9D0-488C-9D60-C46340AEB37F}
C:\Windows\SysNative\tasks\{911E4677-605D-42A7-BA2B-3C28D44E4138}
C:\Windows\SysNative\tasks\{912FF90D-AA9E-40AC-BDAA-2CB6984ABF08}
C:\Windows\SysNative\tasks\{914F5F2F-A73D-4BC0-9269-5F080C387FA2}
C:\Windows\SysNative\tasks\{93948657-1A51-4479-8ACE-1645AE850B55}
C:\Windows\SysNative\tasks\{947A6BBE-928A-497C-8C94-C00B9AF023EE}
C:\Windows\SysNative\tasks\{95A31BD1-77C0-42E3-BD88-9564E9F95A15}
C:\Windows\SysNative\tasks\{965229DB-C2B3-473A-9A21-74E369A248B6}
C:\Windows\SysNative\tasks\{967F1871-F8DB-4314-AB10-83E1A0AD4193}
C:\Windows\SysNative\tasks\{96F85CC2-02EC-4161-9273-86E083955918}
C:\Windows\SysNative\tasks\{979641A5-B2D8-48AB-9D4C-723AD4031693}
C:\Windows\SysNative\tasks\{97BB82C1-F452-461C-8678-62A2C96AE80F}
C:\Windows\SysNative\tasks\{97C6A0E4-F336-4BE7-80E1-72FBA1D4D4D4}
C:\Windows\SysNative\tasks\{97DCB832-345F-4307-AF25-2939D236125C}
C:\Windows\SysNative\tasks\{98E2D4A1-3BE7-45C5-8B14-5CA974340777}
C:\Windows\SysNative\tasks\{9900D95B-941F-487A-B475-B1879CA682F3}
C:\Windows\SysNative\tasks\{9A185BB0-311D-4A55-8840-412B86D593B8}
C:\Windows\SysNative\tasks\{9A96E387-EA24-47B5-80E5-D1179E5FBF0C}
C:\Windows\SysNative\tasks\{9B894420-0131-4820-A4B3-374225F4D929}
C:\Windows\SysNative\tasks\{9BB7C8E8-EC19-48A9-95FB-FD979679BE67}
C:\Windows\SysNative\tasks\{9C161872-1C69-4123-BDB6-D1D4047D89E2}
C:\Windows\SysNative\tasks\{9D6D1C63-B7DF-4B8D-B5A1-6D1DDDCAD287}
C:\Windows\SysNative\tasks\{9DED70FA-D259-4388-842C-52A9F9DB3033}
C:\Windows\SysNative\tasks\{9FBECA74-39A0-4FE2-8071-9922E8176C3C}
C:\Windows\SysNative\tasks\{A29A70A8-58DD-4BE5-B94D-211D05ADB801}
C:\Windows\SysNative\tasks\{A3E00ABA-7E79-4320-9A9E-40878EA3A954}
C:\Windows\SysNative\tasks\{A3EC8D01-657B-4E73-80DC-A4764A5B0732}
C:\Windows\SysNative\tasks\{A4808DBF-FCA4-4F17-AD8C-9E610463D268}
C:\Windows\SysNative\tasks\{A64B7B2B-5452-4A63-B285-6D069F2E23A4}
C:\Windows\SysNative\tasks\{A82E06DE-5F0D-4795-8212-354F18511C8B}
C:\Windows\SysNative\tasks\{A9893523-C825-4C3C-883B-9CCC8306D0B4}
C:\Windows\SysNative\tasks\{AB41B841-6D8F-40C8-A9D7-B0E1537B1B32}
C:\Windows\SysNative\tasks\{ABA529A6-BECB-416F-A158-1C65E960FAC4}
C:\Windows\SysNative\tasks\{AC52691B-F433-4656-9A9E-9CB5BC126A40}
C:\Windows\SysNative\tasks\{AD439006-9B77-40D8-9B9F-FA352A7736B7}
C:\Windows\SysNative\tasks\{ADA6D8AD-5ECD-47E0-ADC0-A8E7B995E8A6}
C:\Windows\SysNative\tasks\{AE73A040-DFC1-4A1B-A81E-09BC7855A689}
C:\Windows\SysNative\tasks\{AFF57B91-18F5-49E2-883F-5DEB16639827}
C:\Windows\SysNative\tasks\{B0F3E5B8-9DCA-46C5-A9AD-F2183C12752B}
C:\Windows\SysNative\tasks\{B114FBD2-1DA8-4BC5-AE78-B00633E58C4A}
C:\Windows\SysNative\tasks\{B1AC5A3E-B979-4118-912A-95672B901949}
C:\Windows\SysNative\tasks\{B2A5C632-7B01-43D7-915F-AF76A81BBE28}
C:\Windows\SysNative\tasks\{B39A7CFB-CD7D-404B-AC73-C6F7CB9340C4}
C:\Windows\SysNative\tasks\{B53DE880-F38B-4C57-A2D3-1C50FCB621FA}
C:\Windows\SysNative\tasks\{B6EA583C-E588-4524-A546-D3AC47428555}
C:\Windows\SysNative\tasks\{B7BA53C2-4643-433A-AFC1-B5D02014CD4C}
C:\Windows\SysNative\tasks\{B8EA589A-F7A7-4D8E-9112-0FE73C379952}
C:\Windows\SysNative\tasks\{BAB8B572-04FE-4CB1-BB8B-0BA991406543}
C:\Windows\SysNative\tasks\{BB2BA7A5-BF50-4E2F-AFCA-D9E64E380942}
C:\Windows\SysNative\tasks\{BCDA932D-71EB-413A-8B86-4342FFD212D8}
C:\Windows\SysNative\tasks\{BDA1C6C9-09A3-4826-A3EF-AE964DA3ABE1}
C:\Windows\SysNative\tasks\{BE66DAC4-7578-49B3-8433-411E9B5643AB}
C:\Windows\SysNative\tasks\{BF1564DF-5D9F-49AC-AD49-0A4065267ED6}
C:\Windows\SysNative\tasks\{BF1A83D1-AC1B-4487-9C78-A8716F3B8E4A}
C:\Windows\SysNative\tasks\{C0D589EA-50AF-44DE-B3FF-F17A401F669E}
C:\Windows\SysNative\tasks\{C16D6542-D09C-46EC-BA22-C96516FA62DA}
C:\Windows\SysNative\tasks\{C38A5A6A-7E62-4531-986D-07CE0894A2F5}
C:\Windows\SysNative\tasks\{C4EDC788-ECF5-4D59-AC09-469B261578C9}
C:\Windows\SysNative\tasks\{C5806AC9-C150-4D7A-AD40-F3A1ECB9EBFE}
C:\Windows\SysNative\tasks\{C73EB754-B89C-4F53-9A83-5ABE256CBE01}
C:\Windows\SysNative\tasks\{C867517B-6D88-4324-87C8-1A150F455FA7}
C:\Windows\SysNative\tasks\{C89D08DA-B271-44A0-BAB3-D4C7E157B541}
C:\Windows\SysNative\tasks\{C909516B-6912-4D4D-91C6-CF22669701D1}
C:\Windows\SysNative\tasks\{CA040947-5FBD-4E6D-A2CC-DE2B9C68C485}
C:\Windows\SysNative\tasks\{CB8B2A16-9AF6-4FAC-A183-9E071C88AB9B}
C:\Windows\SysNative\tasks\{CBFA0DC4-2880-4E74-B8BD-ABDCB4B61568}
C:\Windows\SysNative\tasks\{CCB1141E-9981-4E13-8C57-96E5D746DDE3}
C:\Windows\SysNative\tasks\{CD69430A-876E-4BD2-9AF0-B83B0558B508}
C:\Windows\SysNative\tasks\{D0571D80-AF10-4159-B7F0-FBA4119C9637}
C:\Windows\SysNative\tasks\{D1650CAE-D385-475F-B1F8-33C52AB11845}
C:\Windows\SysNative\tasks\{D2D18017-8964-4FC2-B960-A83BADD5752E}
C:\Windows\SysNative\tasks\{D3178701-DB08-4EB4-976E-E269DF72B799}
C:\Windows\SysNative\tasks\{D457D20C-8A7A-44E6-9B66-2695A8635AB4}
C:\Windows\SysNative\tasks\{D767EAC8-B50E-4053-9758-1894739ADA58}
C:\Windows\SysNative\tasks\{D86FC274-ED38-441D-AE6C-C4AFFD7B6884}
C:\Windows\SysNative\tasks\{D9E70FA0-A583-4460-A5EC-205D89D3AA66}
C:\Windows\SysNative\tasks\{DA062007-7997-45C2-BDA8-2A976343D9FA}
C:\Windows\SysNative\tasks\{DC2034E3-23B4-418F-AD0C-9CA023C49719}
C:\Windows\SysNative\tasks\{DC69A2CC-FF32-4239-ADBD-743C0C39E476}
C:\Windows\SysNative\tasks\{DEF9583B-46EA-4546-B8EA-E83828A3C44D}
C:\Windows\SysNative\tasks\{DFA950F6-C038-445B-9E3C-8C621E159167}
C:\Windows\SysNative\tasks\{E0273E95-EF1D-4855-B806-4BE4C154FF06}
C:\Windows\SysNative\tasks\{E156E0FD-C392-4435-9F4B-E6D3F27D5027}
C:\Windows\SysNative\tasks\{E1E65C77-688C-4DDA-AF3F-5185EA4E2958}
C:\Windows\SysNative\tasks\{E200B99F-6199-49A6-8E21-FEC21249989F}
C:\Windows\SysNative\tasks\{E290C2AF-DB71-4B35-BC9B-60F761876A22}
C:\Windows\SysNative\tasks\{E4EB7EBD-6D78-4E22-B68C-2A67A2F63AB8}
C:\Windows\SysNative\tasks\{E583451E-41D9-4DD0-9FE5-BB64252E4957}
C:\Windows\SysNative\tasks\{E6927B70-B02F-400D-809B-43CE08761EDA}
C:\Windows\SysNative\tasks\{E7072ED1-E2E6-46F0-A066-33E7B16D278C}
C:\Windows\SysNative\tasks\{E73E0F40-B1B3-4972-9D7B-6DD900FA9A73}
C:\Windows\SysNative\tasks\{E8D69631-7E89-4C73-BC34-BC0D12A07F11}
C:\Windows\SysNative\tasks\{E9972B4C-A09C-467C-A05D-48BE923B5ADA}
C:\Windows\SysNative\tasks\{EB8C0CD5-9F49-46CB-B6C2-449E0A809202}
C:\Windows\SysNative\tasks\{EBEA5EB9-C006-4084-A500-689508B271F1}
C:\Windows\SysNative\tasks\{ED2EB6BB-193B-42B0-B695-0C96BCAF0DCE}
C:\Windows\SysNative\tasks\{F0B71CEB-C034-4030-BDDB-F5247724F553}
C:\Windows\SysNative\tasks\{F3119022-3A9B-4019-98F7-8E22196FED9F}
C:\Windows\SysNative\tasks\{F41AA588-4C1E-482E-B72B-0009BBF81DD1}
C:\Windows\SysNative\tasks\{F42BBB8E-AEF8-4841-BEFF-9780E4CE09D3}
C:\Windows\SysNative\tasks\{F4FE9A19-1EB9-4542-8C77-2CB45473CCFA}
C:\Windows\SysNative\tasks\{F5E7BA63-48AC-4196-B907-FAC4E85F51A7}
C:\Windows\SysNative\tasks\{F74218E2-3E63-4870-B668-839B6E19AECF}
C:\Windows\SysNative\tasks\{F7C0633A-1B08-4370-962B-19EE9A87E01B}
C:\Windows\SysNative\tasks\{F86FFABA-93B4-4B29-B4B0-3C3A6A2BC174}
C:\Windows\SysNative\tasks\{F900E470-8C42-4DB4-B0CF-12367023E5F0}
C:\Windows\SysNative\tasks\{F9AA89E0-904A-412E-8EF0-62DB32BFF047}
C:\Windows\SysNative\tasks\{FAFD0C33-3167-4A63-8A5D-ACAE566A42E2}
C:\Windows\SysNative\tasks\{FBB77A98-A1F1-40F2-9284-AF9CF50A64FE}
C:\Windows\SysNative\tasks\{FC0BA82E-16B8-4489-AE84-E7470F2F4F41}
C:\Windows\SysNative\tasks\{FD310B47-7F2C-47AB-BF1C-69341301DC7E}
C:\Windows\SysNative\tasks\{FE4B534A-0526-4B59-927E-D6869FF5FFAC}
C:\Windows\SysNative\tasks\{FF3DEE7D-9A02-4CD1-A13F-BE3685B1A097}
C:\Windows\SysNative\tasks\{FF42B429-AF1A-4B5E-BEF1-BA0477DFA612}
C:\Windows\SysNative\tasks\{017D6C9E-60F2-4368-A830-2C4CAFBDFF4A}
C:\Windows\SysNative\tasks\{04BFC6C6-B40C-4EA5-8CAF-8E2338CC6C5A}
C:\Windows\SysNative\tasks\{0533830A-3A30-43E1-A26C-F24F31313F24}
C:\Windows\SysNative\tasks\{0C12FFCA-5219-41A1-98B3-0A293116D452}
C:\Windows\SysNative\tasks\{0DA69CBB-BC0A-4C01-AA6E-B1C75810EC34}
C:\Windows\SysNative\tasks\{0ED0F7DF-D3C8-436E-B7B1-E7D11715A2F1}
C:\Windows\SysNative\tasks\{129EC48D-627D-44EC-9469-5CDB19E76F28}
C:\Windows\SysNative\tasks\{14B0E181-6CFD-4EBD-B893-D1F128CF3F0B}
C:\Windows\SysNative\tasks\{14D2F3A1-30D3-41B7-B72E-ABD0AC4AE082}
C:\Windows\SysNative\tasks\{1672E0C9-DCD2-43B5-80BA-80493F7DDF49}
C:\Windows\SysNative\tasks\{1D36A951-77E4-4A40-8728-337F4C232478}
C:\Windows\SysNative\tasks\{1DC038B8-7381-4665-8FB4-224C3FDD3AB6}
C:\Windows\SysNative\tasks\{1E08134F-A5A0-4D99-8ED4-C238C7751F1C}
C:\Windows\SysNative\tasks\{1FAB4F31-9F23-45B0-9FA9-FEDB7A82E3D9}
C:\Windows\SysNative\tasks\{22DED5C5-F88E-4E1B-BC0B-F40641719530}
C:\Windows\SysNative\tasks\{259797BC-62E3-4D7A-B0F5-5BAEE58CA893}
C:\Windows\SysNative\tasks\{2813EEFC-48D4-4D02-99CF-668256F9E207}
C:\Windows\SysNative\tasks\{2942FF2B-7888-47C5-BB1E-B32FD0A5C0E7}
C:\Windows\SysNative\tasks\{2A4626EC-2963-469B-96F0-5E884FC1CDA2}
C:\Windows\SysNative\tasks\{2E39F65C-63BA-430D-9253-842FA9440873}
C:\Windows\SysNative\tasks\{2E9B3DE8-B029-47EA-AD44-B1FAFE897164}
C:\Windows\SysNative\tasks\{306C4584-CC14-4C37-8923-09F306837177}
C:\Windows\SysNative\tasks\{33E050AF-A547-4105-9346-F3BAAFEB1E0F}
C:\Windows\SysNative\tasks\{3571D328-3D80-4C80-B719-F32941DC1E66}
C:\Windows\SysNative\tasks\{37A031D1-6247-4C29-AD79-CBEB0552DCF2}
C:\Windows\SysNative\tasks\{38103F34-9331-462E-A218-44DDDF92D17C}
C:\Windows\SysNative\tasks\{3893ABC4-9F02-4244-BE66-3C228AF60450}
C:\Windows\SysNative\tasks\{39D1A89B-6ED4-4D5D-B251-5248C8132122}
C:\Windows\SysNative\tasks\{3BCE4C5D-0C05-4896-9FCC-7CC4B1F7E2AC}
C:\Windows\SysNative\tasks\{3BE470C5-A4AE-4CA6-AFF8-56889AD59AFA}
C:\Windows\SysNative\tasks\{3EF1354F-0C94-483D-AC3D-F19818DF41C3}
C:\Windows\SysNative\tasks\{4205F4BA-A49B-4254-AA46-142224D3A4DD}
C:\Windows\SysNative\tasks\{445107DF-18A9-454C-BD6B-6BEC1268FCE9}
C:\Windows\SysNative\tasks\{46CAD249-CCD8-4647-A872-CFEF98870630}
C:\Windows\SysNative\tasks\{48B57778-3C17-4F8F-9F37-1670C988C758}
C:\Windows\SysNative\tasks\{495E6B96-71C0-494D-80E9-5C65755FB78A}
C:\Windows\SysNative\tasks\{4A8A566A-B20E-4FE7-9E68-C7C5BF544CD7}
C:\Windows\SysNative\tasks\{4B656564-2E3B-4576-BE25-B0DC9544116E}
C:\Windows\SysNative\tasks\{4CA73161-73DA-4B1A-965D-AB09C94B4AEA}
C:\Windows\SysNative\tasks\{4CE8C8E1-A97C-4160-BE86-0DEA65FE56F9}
C:\Windows\SysNative\tasks\{4EC488AC-AE47-4D9A-8865-FD961022DCB9}
C:\Windows\SysNative\tasks\{504A7FEB-609B-4BE0-88A0-834DB4D30410}
C:\Windows\SysNative\tasks\{5069546F-EDCB-4E3A-884E-7E734FACBBB6}
C:\Windows\SysNative\tasks\{517A620A-A28E-42DA-97FE-CB8141300E83}
C:\Windows\SysNative\tasks\{522321CC-5F9C-47A3-B7E8-DD55669E3933}
C:\Windows\SysNative\tasks\{54881447-6145-4A8D-868B-A7F71C105A09}
C:\Windows\SysNative\tasks\{556AA807-AAFA-43F0-8E63-FAB31146F3DA}
C:\Windows\SysNative\tasks\{55F154E4-EDEE-46D1-97A9-AB5F14E78F9C}
C:\Windows\SysNative\tasks\{5C39F11D-42E1-4141-B7AC-796321F09D3B}
C:\Windows\SysNative\tasks\{64E1A5E1-710B-4037-B2ED-C57646D542F3}
C:\Windows\SysNative\tasks\{6659EC54-42B5-4BFC-9D8E-40CAD8E0E459}
C:\Windows\SysNative\tasks\{680BA847-F3A3-46AF-A7AB-59D11B038A4B}
C:\Windows\SysNative\tasks\{69DEDC30-2B86-486A-8534-BF6AC0D0DB0C}
C:\Windows\SysNative\tasks\{6B49ABEA-6BAB-47A3-AEFA-E1F89E7762C3}
C:\Windows\SysNative\tasks\{6BF7C3DF-84E5-4783-93C9-C7A2641FA800}
C:\Windows\SysNative\tasks\{6C1AFD85-9C42-4FF4-A498-4DE3D20AD152}
C:\Windows\SysNative\tasks\{6DC48EB0-B07B-4A1A-9BF2-6BC1F75D0FB7}
C:\Windows\SysNative\tasks\{6F4114E9-E80A-4EEE-8534-4B34AEE51F88}
C:\Windows\SysNative\tasks\{72328F97-34EE-4D10-BC50-D32AD0FEDD77}
C:\Windows\SysNative\tasks\{7403633C-0362-4CFF-B5F1-F2A5A788D63D}
C:\Windows\SysNative\tasks\{76667402-C360-4AD2-A244-0D3816BDE340}
C:\Windows\SysNative\tasks\{76945B4F-EEC1-44DB-A740-4C971E5CA06A}
C:\Windows\SysNative\tasks\{779295CC-2470-41D7-8E30-2D53C545F83E}
C:\Windows\SysNative\tasks\{78D246C5-C9FF-44F2-B869-434593E7DD8F}
C:\Windows\SysNative\tasks\{7A49342F-CD74-4B45-B7D2-B5FE59D3DFF2}
C:\Windows\SysNative\tasks\{7B0D1417-3A48-48F7-93FE-2684A1DFE999}
C:\Windows\SysNative\tasks\{7B11BB2F-7EAC-4FEA-A958-8A8CBEA299A1}
C:\Windows\SysNative\tasks\{7CE94A6D-870E-44B8-98CC-987866536ACB}
C:\Windows\SysNative\tasks\{7D095AD1-2234-43D4-AAF5-E05C02246D13}
C:\Windows\SysNative\tasks\{7D719BB7-E965-4FB9-B514-1DD91A62F803}
C:\Windows\SysNative\tasks\{7DFA6198-44C6-44D7-B522-EBAA01E4F8F4}
C:\Windows\SysNative\tasks\{830253D4-408C-45B5-AFCA-5C773112E23C}
C:\Windows\SysNative\tasks\{8460004D-B02F-4C8D-B2C5-59C76314D487}
C:\Windows\SysNative\tasks\{855EC570-55C9-451A-9122-A318EE4BF0A4}
C:\Windows\SysNative\tasks\{877D0096-9888-47C8-9BF0-35F8419A2A77}
C:\Windows\SysNative\tasks\{89A04B6C-41BD-42FC-8AA1-FB87093F6635}
C:\Windows\SysNative\tasks\{89D178BE-A228-4EA6-94DC-50A6CD05A967}
C:\Windows\SysNative\tasks\{8A74AA99-6B36-4C2C-8827-F1639858D848}
C:\Windows\SysNative\tasks\{8C005AFC-22BB-4239-9DC9-08489544BBFD}
C:\Windows\SysNative\tasks\{8C437078-D3B6-48B9-93BD-1BCF19612697}
C:\Windows\SysNative\tasks\{91558693-2495-451F-9018-0C46DAA1176D}
C:\Windows\SysNative\tasks\{921D7CB4-AB36-4672-A933-A9BF6E532375}
C:\Windows\SysNative\tasks\{92EE84B9-72EC-4000-B858-514FF4770CE0}
C:\Windows\SysNative\tasks\{93A81C3E-DF53-4815-8D07-40C32B59DF58}
C:\Windows\SysNative\tasks\{9426BDE9-7E3B-4EED-9118-4A46A67AC0B7}
C:\Windows\SysNative\tasks\{9431609A-136C-4EBA-A72E-8C406057E543}
C:\Windows\SysNative\tasks\{948922B3-153F-4479-A39A-A12A8E3A4E9F}
C:\Windows\SysNative\tasks\{949E8D62-425C-440B-AD3A-1F40B0F678F4}
C:\Windows\SysNative\tasks\{96126849-28B0-48A9-8656-59785189AF89}
C:\Windows\SysNative\tasks\{9857A2ED-6A1F-4378-8DBB-6DD2C4BF046E}
C:\Windows\SysNative\tasks\{98C88D62-41D0-42B1-BE8A-D485E0966125}
C:\Windows\SysNative\tasks\{98E0E235-72C0-4DBB-8424-C42707A6B358}
C:\Windows\SysNative\tasks\{990AC902-0FED-42E9-92F3-BA95813C5D9B}
C:\Windows\SysNative\tasks\{99BDA781-8B18-4F52-B16B-7F7F03A41A24}
C:\Windows\SysNative\tasks\{9B9828E9-1413-4A86-9766-1891EAE88C51}
C:\Windows\SysNative\tasks\{A13F0025-DA88-42D6-B2F0-A9738578D454}
C:\Windows\SysNative\tasks\{A14A3709-8141-429A-82FB-5DE593041DC3}
C:\Windows\SysNative\tasks\{A1C93020-F1B7-4ABA-B061-9A75938C0B10}
C:\Windows\SysNative\tasks\{A1D657F6-767C-4716-909B-F714373994CE}
C:\Windows\SysNative\tasks\{A2042059-1242-48F6-A605-760CED93F289}
C:\Windows\SysNative\tasks\{A4424D35-0A06-4B71-921A-F5C685D69736}
C:\Windows\SysNative\tasks\{A46EC343-21ED-4914-B487-307B694892CB}
C:\Windows\SysNative\tasks\{A474880F-3FDF-4BFE-A604-7F1F8379D4C9}
C:\Windows\SysNative\tasks\{A4C5A257-7C79-4744-B414-4B4F1070A49E}
C:\Windows\SysNative\tasks\{A563E28C-6E44-47E4-9234-BBC273559977}
C:\Windows\SysNative\tasks\{A57EC87D-A6DC-455E-9685-1273B1791678}
C:\Windows\SysNative\tasks\{A7B7CFB2-02AC-4E2F-86A4-7E19B883562D}
C:\Windows\SysNative\tasks\{AC1CCE5C-3137-4CC1-A70E-E7CD58F19FDE}
C:\Windows\SysNative\tasks\{B47D5112-AB09-4181-9CC5-8D9F99E2D61F}
C:\Windows\SysNative\tasks\{B64EE87B-0F44-4707-BE33-76B5635D3214}
C:\Windows\SysNative\tasks\{B68B39F9-F0B5-4F1B-9DA3-59C1F94AA939}
C:\Windows\SysNative\tasks\{BBBA5219-9C32-45C3-A5A3-6921C4A4AB95}
C:\Windows\SysNative\tasks\{BC6175B1-F290-4B52-9406-6C5FC5B67482}
C:\Windows\SysNative\tasks\{BC9A7D74-62FB-4F02-B532-FFF2F4F1B68B}
C:\Windows\SysNative\tasks\{BDBC6AA9-5917-4E39-B456-61BA623E1A03}
C:\Windows\SysNative\tasks\{BE29141A-32A4-4270-A25B-A0D6346196D7}
C:\Windows\SysNative\tasks\{BF34634F-610F-4E32-B0D5-23F3A93FFB5C}
C:\Windows\SysNative\tasks\{C536A61C-1F54-493F-A908-2B8D4FC329BF}
C:\Windows\SysNative\tasks\{C745B2B2-EEE7-4329-8BBD-DEA6F61EF13F}
C:\Windows\SysNative\tasks\{CF6D1AAC-770A-4337-AB0E-8B45307BBE50}
C:\Windows\SysNative\tasks\{D3B4B5BA-E4E7-44F3-A15F-2427D8ACE965}
C:\Windows\SysNative\tasks\{D4077877-A9D3-44AF-9F6C-3E70624D5F7B}
C:\Windows\SysNative\tasks\{DAD18EC0-0E9E-4D6E-9278-8AC46D16DF1C}
C:\Windows\SysNative\tasks\{DC136D4C-5CE8-4CCE-B28D-15988AD2C560}
C:\Windows\SysNative\tasks\{DC8B20D0-9190-4C9A-A78D-F7F1710C0587}
C:\Windows\SysNative\tasks\{DE225B6C-3CA0-476D-A9C4-1C41C55790C9}
C:\Windows\SysNative\tasks\{DF4A47BC-B0CB-42D8-B54A-DF15E36921FE}
C:\Windows\SysNative\tasks\{E2614C8F-C69A-4A46-8561-DC301110FA1B}
C:\Windows\SysNative\tasks\{E449ECDA-ABC9-4153-82F2-867CDBA02232}
C:\Windows\SysNative\tasks\{E55E0C53-D68E-4BD7-AD86-A60A2D36446B}
C:\Windows\SysNative\tasks\{E6D60D1F-C54A-42FC-8242-1F81AF0FEC42}
C:\Windows\SysNative\tasks\{E811FA29-B844-45A5-A100-999F8662BBC5}
C:\Windows\SysNative\tasks\{E8B3670D-4588-40B6-9A16-51CCCF813AEE}
C:\Windows\SysNative\tasks\{EC8965A1-07B2-4528-AFC3-8EA6BDE92837}
C:\Windows\SysNative\tasks\{ED3635A3-9076-4642-9978-6E32D5F5EB15}
C:\Windows\SysNative\tasks\{EE3C9484-0251-4F91-94BD-2FCE8917E185}
C:\Windows\SysNative\tasks\{EEA55960-BD38-4A7F-8019-4C536AC78ACA}
C:\Windows\SysNative\tasks\{EFDF3337-C855-4B63-BE36-4F71C86C1078}
C:\Windows\SysNative\tasks\{F0D2AD24-9B54-454D-A45A-3ABB3EC1C7A9}
C:\Windows\SysNative\tasks\{F37B161E-B58E-4064-A6A2-BBFC78119ECF}
C:\Windows\SysNative\tasks\{F49E1563-1AE0-4536-84F6-ECD1E5FBA4DF}
C:\Windows\SysNative\tasks\{F6F7A0B0-70F1-4A75-8227-A3641A53B74D}
C:\Windows\SysNative\tasks\{F89E1210-88BB-485B-88A6-1757C5F515BD}
C:\Windows\SysNative\tasks\{F9BCF7B2-359D-4A60-994A-FF0EAA20C2FB}
C:\Windows\SysNative\tasks\{FC39DE98-9520-4AAF-AD0D-3F99E47B2282}
C:\Windows\SysNative\tasks\{FD69BBF3-1C70-43CF-A806-7891476AE74E}
C:\Windows\SysNative\tasks\{02F9E465-5EC7-4745-897D-A644C49C723C}
C:\Windows\SysNative\tasks\{12628E57-5773-436C-8A72-2EE57BEC00FE}
C:\Windows\SysNative\tasks\{27C39371-3922-4011-BC48-98A189CFABAD}
C:\Windows\SysNative\tasks\{3905D924-A7C9-456C-A408-BF5607CA8533}
C:\Windows\SysNative\tasks\{3DE3B054-11C2-4C87-8600-B4AF7E2124BF}
C:\Windows\SysNative\tasks\{46C7F9A1-4814-4F04-A0A1-4AF33943DB1E}
C:\Windows\SysNative\tasks\{48BF65CC-01F2-4BD4-8209-65A8AD69FDF9}
C:\Windows\SysNative\tasks\{5FE44986-DC3C-406B-A653-4DFBE4C0F4FF}
C:\Windows\SysNative\tasks\{AF4FC14D-0075-449B-9463-7B6913D344ED}
C:\Windows\SysNative\tasks\{BDEBE6CF-8B1D-460A-A137-CF78433F9C03}
C:\Windows\SysNative\tasks\{DC47D7E7-06B3-4F66-98DF-79FEFA78DA16}
C:\Windows\SysNative\tasks\{E1A11369-3857-48CD-A739-5876D056A9F4}
C:\Windows\SysNative\tasks\{E51B6117-4776-4B59-AEDD-4AE9F56DC6B1}
C:\Windows\SysNative\tasks\{F05DC8AE-14FF-4A7B-BAD0-A548CEA190B5}
C:\Windows\SysNative\tasks\{13F58323-D6D4-4637-B35E-56C58B6E4096}
C:\Windows\SysNative\tasks\{1721BF00-F4AD-4345-B3E1-F74184695C78}
C:\Windows\SysNative\tasks\{18238F68-53A9-476F-AB6C-30D10382853D}
C:\Windows\SysNative\tasks\{396818F6-9DDB-43F7-AA4C-AC9FFEA27D2B}
C:\Windows\SysNative\tasks\{B7B6A4BF-0AAD-4095-AB47-A92AB231B215}
C:\Windows\SysNative\tasks\{CC5001D5-9895-4BDE-ADD4-91469E526892}
C:\Windows\SysNative\tasks\{EE2C010C-D6FA-4EBA-93E3-566CCAFA38E7}
C:\Users\ann\Downloads\PopularScreensaversSetup2.3.98.80.ZRchr999.exe
:Commands
[emptytemp]
[purity] 
[CREATERESTOREPOINT]
```

Then click the *Run Fix* button at the top 
Click OK.
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply. The log is saved in the same location as OTL.

eddie


----------



## sweetrose (Sep 7, 2012)

hope i got it all in Eddie.........and glad you enjoy yr dinner....


----------



## sweetrose (Sep 7, 2012)

ll processes killed
Error: Unable to interpret <Code:> in the current context!
========== FILES ==========
File\Folder C:\Windows\SysNative\tasks\{00BC1703-9104-4547-9046-82BF662A6C0D} not found.
File\Folder C:\Windows\SysNative\tasks\{012F9B8D-0852-4DAC-ADDB-B4615E2D666E} not found.
File\Folder C:\Windows\SysNative\tasks\{02714F41-C704-4F29-A44E-3FDEFA9E5EA0} not found.
File\Folder C:\Windows\SysNative\tasks\{0399096D-B561-461D-815B-C940EC26C754} not found.
File\Folder C:\Windows\SysNative\tasks\{03DD895F-8646-4633-B817-4ECC9B1D1152} not found.
File\Folder C:\Windows\SysNative\tasks\{042DB467-970C-40AF-87BF-26EB331A1C24} not found.
File\Folder C:\Windows\SysNative\tasks\{05ABE415-C563-439D-9ED4-D68FAECB01B2} not found.
File\Folder C:\Windows\SysNative\tasks\{05BE0178-0E9D-4EB5-8DC2-C92365F8B69F} not found.
File\Folder C:\Windows\SysNative\tasks\{07113C9E-5C56-4C56-A139-A3EC393CA716} not found.
File\Folder C:\Windows\SysNative\tasks\{07AE9ACD-2430-4E16-9F0F-51215130F06F} not found.
File\Folder C:\Windows\SysNative\tasks\{0805CAA0-8E69-4E51-B914-E3492272A1AF} not found.
File\Folder C:\Windows\SysNative\tasks\{0812F4DB-A953-4F07-BA53-6FC21275436B} not found.
File\Folder C:\Windows\SysNative\tasks\{084FBF19-2634-4221-A03B-8E3253D9343F} not found.
File\Folder C:\Windows\SysNative\tasks\{09153206-56AE-45AB-98D8-9172D82C523A} not found.
File\Folder C:\Windows\SysNative\tasks\{0A7E78C5-278D-44AE-BEC1-D4A7072E6E6F} not found.
File\Folder C:\Windows\SysNative\tasks\{0B5FBC82-1762-430A-9388-EDE9926FE67D} not found.
File\Folder C:\Windows\SysNative\tasks\{0E81D74D-28EB-4A17-8C35-2C7E5BB62A38} not found.
File\Folder C:\Windows\SysNative\tasks\{0FFFB3B1-22D0-40F0-B42A-FB758CBB4BFB} not found.
File\Folder C:\Windows\SysNative\tasks\{105293E5-6DE0-40D5-98D3-E18F92CEBB23} not found.
File\Folder C:\Windows\SysNative\tasks\{10947E19-03DE-4D66-A3B2-8756AA1F2216} not found.
File\Folder C:\Windows\SysNative\tasks\{11F5A7DC-745D-482D-817C-A13D23C56D3C} not found.
File\Folder C:\Windows\SysNative\tasks\{12874D8B-073C-4DC2-A8F4-A9DFD691A76B} not found.
File\Folder C:\Windows\SysNative\tasks\{12A88BCC-7290-490F-863C-A45D8A158B58} not found.
File\Folder C:\Windows\SysNative\tasks\{12DC0B2D-E732-4ACC-8DD4-A645CC173D57} not found.
File\Folder C:\Windows\SysNative\tasks\{130B31A5-4E1C-4D4F-9CD8-F368204F209B} not found.
File\Folder C:\Windows\SysNative\tasks\{133C02EA-5F56-4AB1-90E3-42F1EBDF09F4} not found.
File\Folder C:\Windows\SysNative\tasks\{14059F30-0D1B-49F6-B507-DE7212F7B848} not found.
File\Folder C:\Windows\SysNative\tasks\{14123AFB-31E2-437C-AFF5-469E6951673B} not found.
File\Folder C:\Windows\SysNative\tasks\{14475078-D516-41AB-AD4A-8173DBD176FE} not found.
File\Folder C:\Windows\SysNative\tasks\{160BAFD7-1E6D-4485-9D96-8AC699E90A8D} not found.
File\Folder C:\Windows\SysNative\tasks\{161BF736-D33C-4936-AA30-EDA6EADD6061} not found.
File\Folder C:\Windows\SysNative\tasks\{1A4B5791-B0A0-4C50-B0BA-D2100D3DF90F} not found.
File\Folder C:\Windows\SysNative\tasks\{1AC7D1A8-2B3F-46B7-AEF3-2FAB757FEF94} not found.
File\Folder C:\Windows\SysNative\tasks\{1B7D42BA-32C0-496B-8597-9C838B317B76} not found.
File\Folder C:\Windows\SysNative\tasks\{1BA546E1-C9AB-478B-BAD3-2FC99EF05AC8} not found.
File\Folder C:\Windows\SysNative\tasks\{1D36548F-DE8F-481C-A49B-E95C69A04CDC} not found.
File\Folder C:\Windows\SysNative\tasks\{1EAAA1BC-86F9-4DB9-A699-4268C5EAAA8E} not found.
File\Folder C:\Windows\SysNative\tasks\{2054E632-BF3A-4F41-83B4-9438E558583E} not found.
File\Folder C:\Windows\SysNative\tasks\{2186CA69-80AD-456A-B5B9-B70F47DD5A55} not found.
File\Folder C:\Windows\SysNative\tasks\{24E37E6C-754F-49F8-BBE4-6F0D435679C5} not found.
File\Folder C:\Windows\SysNative\tasks\{267A4A57-801E-4FFA-B0CC-6A9698D4BCBF} not found.
File\Folder C:\Windows\SysNative\tasks\{26A90B35-2654-4FB7-ACB1-B9F26C49D344} not found.
File\Folder C:\Windows\SysNative\tasks\{271E62AE-546D-4B07-A307-6E9F1A5ADCB1} not found.
File\Folder C:\Windows\SysNative\tasks\{27D1B98C-D2E5-4DE5-AEB3-E5A635766751} not found.
File\Folder C:\Windows\SysNative\tasks\{2852D9BA-B2DE-4BF2-A126-B62DE9D85DC6} not found.
File\Folder C:\Windows\SysNative\tasks\{29CE92B7-D4FF-4C01-A8E4-187F215FF499} not found.
File\Folder C:\Windows\SysNative\tasks\{29D783E9-F790-4A0E-9B9E-EE35AD8DFC70} not found.
File\Folder C:\Windows\SysNative\tasks\{2BBF0C34-7A59-4F44-BC43-76BD32FE5B25} not found.
File\Folder C:\Windows\SysNative\tasks\{2C26CFC9-1FEF-44AD-A51D-57CDF47AB65A} not found.
File\Folder C:\Windows\SysNative\tasks\{2E34895B-6A54-4253-98F4-57C934AAC630} not found.
File\Folder C:\Windows\SysNative\tasks\{3351422F-4729-43FF-9941-5B69BDDF34CC} not found.
File\Folder C:\Windows\SysNative\tasks\{33A37774-1F76-434D-A89B-1644525668F6} not found.
File\Folder C:\Windows\SysNative\tasks\{34EB1460-E0FB-4560-8727-EF7894FD8D72} not found.
File\Folder C:\Windows\SysNative\tasks\{34EDDE88-B588-4084-AE65-D2057278E0E1} not found.
File\Folder C:\Windows\SysNative\tasks\{3531A692-426D-495E-90D7-12E7CA85E903} not found.
File\Folder C:\Windows\SysNative\tasks\{36C76AA6-3E80-4647-BD61-DFE2209945F0} not found.
File\Folder C:\Windows\SysNative\tasks\{36FE49AA-4B8E-4AFB-BB7E-CE8D16C71E3E} not found.
File\Folder C:\Windows\SysNative\tasks\{37F04637-ACEB-43BB-A855-A5012A85DC27} not found.
File\Folder C:\Windows\SysNative\tasks\{38F4C17A-C863-4F3E-AE1B-2D25CDA114A5} not found.
File\Folder C:\Windows\SysNative\tasks\{39AF257D-1D8C-4A0B-884F-4A79A48B7302} not found.
File\Folder C:\Windows\SysNative\tasks\{3A164BD9-46B1-4F02-9124-027C9A39AE5C} not found.
File\Folder C:\Windows\SysNative\tasks\{3DCFBD3B-2825-46E3-871D-58BAE0310B11} not found.
File\Folder C:\Windows\SysNative\tasks\{3EBD1BC6-6B10-46EA-9EA9-6574BD59714B} not found.
File\Folder C:\Windows\SysNative\tasks\{40516EA8-36C2-4A15-8B32-B79920FE8C30} not found.
File\Folder C:\Windows\SysNative\tasks\{40C39350-6229-45D6-BD26-92CEDB7E2A94} not found.
File\Folder C:\Windows\SysNative\tasks\{42F09B25-42B5-47CA-A799-9F91B4093AFD} not found.
File\Folder C:\Windows\SysNative\tasks\{445250AC-AA2D-4B81-8E17-D3829338D1AD} not found.
File\Folder C:\Windows\SysNative\tasks\{4657C8B3-4A9E-497B-8AB3-420DF55E9867} not found.
File\Folder C:\Windows\SysNative\tasks\{46B83C9F-F719-4DA5-8003-0BB43DB68D26} not found.
File\Folder C:\Windows\SysNative\tasks\{47783290-E027-4380-A0C8-CB01B5ABEEB3} not found.
File\Folder C:\Windows\SysNative\tasks\{482ECA03-70D4-4D85-82DE-9C0BDEE1E3C0} not found.
File\Folder C:\Windows\SysNative\tasks\{4987590D-C840-4312-A840-BFD99612807D} not found.
File\Folder C:\Windows\SysNative\tasks\{49FD10F0-B558-4BEB-AB53-13087FCFEE31} not found.
File\Folder C:\Windows\SysNative\tasks\{4ADFD596-FB78-4D0D-BCC9-F757446B5ECC} not found.
File\Folder C:\Windows\SysNative\tasks\{4AF78990-B897-4B49-A5D0-C1190E5AA8C7} not found.
File\Folder C:\Windows\SysNative\tasks\{4B26B4DF-C4A3-460C-897C-E018CD47D976} not found.
File\Folder C:\Windows\SysNative\tasks\{4B91AC63-0589-480E-BC9A-D9AD17A9EA40} not found.
File\Folder C:\Windows\SysNative\tasks\{4BD66EAA-D4AB-42F9-8CDB-A541A73B8D0F} not found.
File\Folder C:\Windows\SysNative\tasks\{4C843453-2C3C-4326-B2C9-987D379CDE11} not found.
File\Folder C:\Windows\SysNative\tasks\{4DA1C0D6-8AF0-477C-878E-4247E2FDF788} not found.
File\Folder C:\Windows\SysNative\tasks\{4EBEB8EB-5818-486B-B405-05B262C6F13D} not found.
File\Folder C:\Windows\SysNative\tasks\{4FFAFD86-7FFF-40D6-B381-C8677361A590} not found.
File\Folder C:\Windows\SysNative\tasks\{51028A2B-7C4C-437E-9216-58223E758B20} not found.
File\Folder C:\Windows\SysNative\tasks\{51D369E2-205E-46D8-BF4A-E23DD4B6525F} not found.
File\Folder C:\Windows\SysNative\tasks\{52040BF0-3098-49D5-A724-B6693506FE91} not found.
File\Folder C:\Windows\SysNative\tasks\{543CED65-6E55-4E4C-A59C-95204F0506E5} not found.
File\Folder C:\Windows\SysNative\tasks\{54EAB814-8382-4549-8909-6CD4F5CFED30} not found.
File\Folder C:\Windows\SysNative\tasks\{556E78A5-83BF-4DCC-9B18-A2C7D6DABB4F} not found.
File\Folder C:\Windows\SysNative\tasks\{557E3971-5316-459B-B599-2B69A1DC0CE3} not found.
File\Folder C:\Windows\SysNative\tasks\{55C7E8D8-C5DA-4291-A5C4-431DC903310B} not found.
File\Folder C:\Windows\SysNative\tasks\{55E36EC6-8BB1-4174-8002-C81B7868C11F} not found.
File\Folder tasks\{55E36EC6-8BB1-4174-8002-C81B7868C11F} not found.
File\Folder C:\Windows\SysNative\tasks\{5666C2A9-464C-49D6-ABD0-67FC0FEA921E} not found.
File\Folder C:\Windows\SysNative\tasks\{56C5C122-C325-47EA-A233-854A704E7E35} not found.
File\Folder C:\Windows\SysNative\tasks\{57FA0B87-0653-44A5-AD14-71CA8A1E1D47} not found.
File\Folder C:\Windows\SysNative\tasks\{5820667B-847A-4E78-8B7E-18DCB446FD0C} not found.
File\Folder C:\Windows\SysNative\tasks\{588BF048-020A-4C6D-BCF1-A86B9ADD3BCE} not found.
File\Folder C:\Windows\SysNative\tasks\{596BFEB0-1DD2-40EC-BBA7-9B96703DE3EC} not found.
File\Folder C:\Windows\SysNative\tasks\{5A1469AB-D47E-49F3-B7A7-6F1B028D8205} not found.
File\Folder C:\Windows\SysNative\tasks\{5A1894AC-1EBE-4D75-9063-F750FE701A98} not found.
File\Folder C:\Windows\SysNative\tasks\{5A1ACF51-A7C6-44DC-A6FB-D78AEDE68FA9} not found.
File\Folder C:\Windows\SysNative\tasks\{5A2D0513-03C5-47D6-A15A-6C04F24EF95D} not found.
File\Folder C:\Windows\SysNative\tasks\{5A96CAC3-057F-4708-A668-6A9DECDF4389} not found.
File\Folder C:\Windows\SysNative\tasks\{5B47F55D-BA01-4EC2-89F2-584BAFEC8DA9} not found.
File\Folder C:\Windows\SysNative\tasks\{5B4B49BC-C968-4885-958E-3C0A75114C41} not found.
File\Folder C:\Windows\SysNative\tasks\{5EF0C674-BCF7-4E37-9AD6-2EE3CA6A7193} not found.
File\Folder C:\Windows\SysNative\tasks\{60562019-F0FD-4E7B-A682-C88029E364A5} not found.
File\Folder C:\Windows\SysNative\tasks\{62BBD555-5375-4937-8737-F72E628BC377} not found.
File\Folder C:\Windows\SysNative\tasks\{638628E8-D0BC-4A37-8B8C-5F62A8E479C1} not found.
File\Folder C:\Windows\SysNative\tasks\{64E5D35C-F1E8-44EB-9E5D-4C7BD368701D} not found.
File\Folder C:\Windows\SysNative\tasks\{64E99B8C-F79E-4319-9A7A-A219BFC7A93A} not found.
File\Folder C:\Windows\SysNative\tasks\{65358CA2-ABE8-407E-9B74-73CF75B3F970} not found.
File\Folder C:\Windows\SysNative\tasks\{65D6027D-8020-4758-9336-A453887EEE70} not found.
File\Folder C:\Windows\SysNative\tasks\{65FE42EC-C6CF-46F7-A76B-454AB7E24E65} not found.
File\Folder C:\Windows\SysNative\tasks\{6B162686-3443-4A94-A858-55972E0BB848} not found.
File\Folder C:\Windows\SysNative\tasks\{6CB8A641-C8DE-4834-878B-B80A3A41C74D} not found.
File\Folder C:\Windows\SysNative\tasks\{6D5F8847-4597-4E51-9190-7BE69DA0DBC9} not found.
File\Folder C:\Windows\SysNative\tasks\{6DED2CB6-AAED-4432-A762-2BB13EE71D55} not found.
File\Folder C:\Windows\SysNative\tasks\{6E752EC7-A0FB-42E9-807C-5AAECF128885} not found.
File\Folder C:\Windows\SysNative\tasks\{6E8B0A82-EA3E-4F8A-84A8-308F473D5EED} not found.
File\Folder C:\Windows\SysNative\tasks\{6EDC9BE6-32A9-475B-A6AE-2CCD8590B870} not found.
File\Folder C:\Windows\SysNative\tasks\{7014BAA4-1A18-4778-B2C4-9A3BD8A9B57E} not found.
File\Folder C:\Windows\SysNative\tasks\{71E0A457-68E9-427B-BC73-54D4A5F0FB76} not found.
File\Folder C:\Windows\SysNative\tasks\{72E0B780-960B-4BEE-A743-DBC16889CD53} not found.
File\Folder C:\Windows\SysNative\tasks\{75102181-062A-47DC-B2FF-3BEFDF3D4942} not found.
File\Folder C:\Windows\SysNative\tasks\{7523EE6D-84A3-4131-BF28-D2C941CB07D7} not found.
File\Folder C:\Windows\SysNative\tasks\{76992151-4E93-44A2-8821-9966CA1D8641} not found.
File\Folder C:\Windows\SysNative\tasks\{7796504C-D3B6-4115-9F80-430D1B17BCDB} not found.
File\Folder C:\Windows\SysNative\tasks\{78377B0C-3BF3-42A1-93FB-7881F9C29B9A} not found.
File\Folder C:\Windows\SysNative\tasks\{79B3F670-DF64-446C-A830-5A4E8A3CC1DF} not found.
File\Folder C:\Windows\SysNative\tasks\{79D4FDFC-8FAE-4159-B3AB-8963F25FFF80} not found.
File\Folder C:\Windows\SysNative\tasks\{7A2F8FA9-5F83-4272-AB32-3E20C9BC79E5} not found.
File\Folder C:\Windows\SysNative\tasks\{7A5D11ED-576B-4FBD-92C7-9EEFB47D5FB3} not found.
File\Folder C:\Windows\SysNative\tasks\{7ADF8D71-56DA-4CB8-A944-6A8B23C66997} not found.
File\Folder C:\Windows\SysNative\tasks\{7B7A2ACB-C8D2-42CB-B0B1-AAF5FBA5EFED} not found.
File\Folder C:\Windows\SysNative\tasks\{7D3D34A2-70D8-4AB0-815D-994F70A703A2} not found.
File\Folder C:\Windows\SysNative\tasks\{7F46382B-A73C-4454-8A02-DE5CDBDDFD95} not found.
File\Folder C:\Windows\SysNative\tasks\{80304483-7D12-4F7C-9FB8-5BC1B4BA8BB8} not found.
File\Folder C:\Windows\SysNative\tasks\{80C8C0DC-13DA-4859-AE0E-D6DEAD02783A} not found.
File\Folder C:\Windows\SysNative\tasks\{8138E522-B01E-4C3D-A4EA-17D40344359B} not found.
File\Folder C:\Windows\SysNative\tasks\{84016759-5D36-4B8F-86C1-D3D6CDB8513F} not found.
File\Folder C:\Windows\SysNative\tasks\{86F22850-ABF7-45CE-A6AB-1F7FB28945AD} not found.
File\Folder C:\Windows\SysNative\tasks\{87C4718F-B5BF-4BC9-9710-4BA03C933F6D} not found.
File\Folder C:\Windows\SysNative\tasks\{897C9BFE-AA3C-4F34-8C49-290F4B3ECBF1} not found.
File\Folder C:\Windows\SysNative\tasks\{899F6AAE-061B-4673-85A6-FEC7AF26C2E5} not found.
File\Folder C:\Windows\SysNative\tasks\{8A39EBEF-B474-45CB-8326-C5E7933E0F8B} not found.
File\Folder C:\Windows\SysNative\tasks\{8AAE2191-D1CD-4941-BDCC-6E9672B44E0A} not found.
File\Folder C:\Windows\SysNative\tasks\{8B44C92A-00D2-45BB-A039-E9751D9BAE69} not found.
File\Folder C:\Windows\SysNative\tasks\{8B99CA76-0209-4ED4-86DC-B9390D68C780} not found.
File\Folder C:\Windows\SysNative\tasks\{8BFCFDE2-C8EB-45C8-AD77-3A03070C93E3} not found.
File\Folder C:\Windows\SysNative\tasks\{8D8F3827-D61D-4586-86A2-C32526205776} not found.
File\Folder C:\Windows\SysNative\tasks\{8DF1A5CB-B739-490C-B7A3-26BA46E2890A} not found.
File\Folder C:\Windows\SysNative\tasks\{8FC35B70-A73F-4175-BAB9-43FE6B67134A} not found.
File\Folder C:\Windows\SysNative\tasks\{908EE60B-3DD9-47A2-8303-3B5E2D66A6D0} not found.
File\Folder C:\Windows\SysNative\tasks\{90E32E5F-A9D0-488C-9D60-C46340AEB37F} not found.
File\Folder C:\Windows\SysNative\tasks\{911E4677-605D-42A7-BA2B-3C28D44E4138} not found.
File\Folder C:\Windows\SysNative\tasks\{912FF90D-AA9E-40AC-BDAA-2CB6984ABF08} not found.
File\Folder C:\Windows\SysNative\tasks\{914F5F2F-A73D-4BC0-9269-5F080C387FA2} not found.
File\Folder C:\Windows\SysNative\tasks\{93948657-1A51-4479-8ACE-1645AE850B55} not found.
File\Folder C:\Windows\SysNative\tasks\{947A6BBE-928A-497C-8C94-C00B9AF023EE} not found.
File\Folder C:\Windows\SysNative\tasks\{95A31BD1-77C0-42E3-BD88-9564E9F95A15} not found.
File\Folder C:\Windows\SysNative\tasks\{965229DB-C2B3-473A-9A21-74E369A248B6} not found.
File\Folder C:\Windows\SysNative\tasks\{967F1871-F8DB-4314-AB10-83E1A0AD4193} not found.
File\Folder C:\Windows\SysNative\tasks\{96F85CC2-02EC-4161-9273-86E083955918} not found.
File\Folder C:\Windows\SysNative\tasks\{979641A5-B2D8-48AB-9D4C-723AD4031693} not found.
File\Folder C


----------



## sweetrose (Sep 7, 2012)

\Windows\SysNative\tasks\{97BB82C1-F452-461C-8678-62A2C96AE80F} not found.
File\Folder C:\Windows\SysNative\tasks\{97C6A0E4-F336-4BE7-80E1-72FBA1D4D4D4} not found.
File\Folder C:\Windows\SysNative\tasks\{97DCB832-345F-4307-AF25-2939D236125C} not found.
File\Folder C:\Windows\SysNative\tasks\{98E2D4A1-3BE7-45C5-8B14-5CA974340777} not found.
File\Folder C:\Windows\SysNative\tasks\{9900D95B-941F-487A-B475-B1879CA682F3} not found.
File\Folder C:\Windows\SysNative\tasks\{9A185BB0-311D-4A55-8840-412B86D593B8} not found.
File\Folder C:\Windows\SysNative\tasks\{9A96E387-EA24-47B5-80E5-D1179E5FBF0C} not found.
File\Folder C:\Windows\SysNative\tasks\{9B894420-0131-4820-A4B3-374225F4D929} not found.
File\Folder C:\Windows\SysNative\tasks\{9BB7C8E8-EC19-48A9-95FB-FD979679BE67} not found.
File\Folder C:\Windows\SysNative\tasks\{9C161872-1C69-4123-BDB6-D1D4047D89E2} not found.
File\Folder C:\Windows\SysNative\tasks\{9D6D1C63-B7DF-4B8D-B5A1-6D1DDDCAD287} not found.
File\Folder C:\Windows\SysNative\tasks\{9DED70FA-D259-4388-842C-52A9F9DB3033} not found.
File\Folder C:\Windows\SysNative\tasks\{9FBECA74-39A0-4FE2-8071-9922E8176C3C} not found.
File\Folder C:\Windows\SysNative\tasks\{A29A70A8-58DD-4BE5-B94D-211D05ADB801} not found.
File\Folder C:\Windows\SysNative\tasks\{A3E00ABA-7E79-4320-9A9E-40878EA3A954} not found.
File\Folder C:\Windows\SysNative\tasks\{A3EC8D01-657B-4E73-80DC-A4764A5B0732} not found.
File\Folder C:\Windows\SysNative\tasks\{A4808DBF-FCA4-4F17-AD8C-9E610463D268} not found.
File\Folder C:\Windows\SysNative\tasks\{A64B7B2B-5452-4A63-B285-6D069F2E23A4} not found.
File\Folder C:\Windows\SysNative\tasks\{A82E06DE-5F0D-4795-8212-354F18511C8B} not found.
File\Folder C:\Windows\SysNative\tasks\{A9893523-C825-4C3C-883B-9CCC8306D0B4} not found.
File\Folder C:\Windows\SysNative\tasks\{AB41B841-6D8F-40C8-A9D7-B0E1537B1B32} not found.
File\Folder C:\Windows\SysNative\tasks\{ABA529A6-BECB-416F-A158-1C65E960FAC4} not found.
File\Folder C:\Windows\SysNative\tasks\{AC52691B-F433-4656-9A9E-9CB5BC126A40} not found.
File\Folder C:\Windows\SysNative\tasks\{AD439006-9B77-40D8-9B9F-FA352A7736B7} not found.
File\Folder C:\Windows\SysNative\tasks\{ADA6D8AD-5ECD-47E0-ADC0-A8E7B995E8A6} not found.
File\Folder C:\Windows\SysNative\tasks\{AE73A040-DFC1-4A1B-A81E-09BC7855A689} not found.
File\Folder C:\Windows\SysNative\tasks\{AFF57B91-18F5-49E2-883F-5DEB16639827} not found.
File\Folder C:\Windows\SysNative\tasks\{B0F3E5B8-9DCA-46C5-A9AD-F2183C12752B} not found.
File\Folder C:\Windows\SysNative\tasks\{B114FBD2-1DA8-4BC5-AE78-B00633E58C4A} not found.
File\Folder C:\Windows\SysNative\tasks\{B1AC5A3E-B979-4118-912A-95672B901949} not found.
File\Folder C:\Windows\SysNative\tasks\{B2A5C632-7B01-43D7-915F-AF76A81BBE28} not found.
File\Folder C:\Windows\SysNative\tasks\{B39A7CFB-CD7D-404B-AC73-C6F7CB9340C4} not found.
File\Folder C:\Windows\SysNative\tasks\{B53DE880-F38B-4C57-A2D3-1C50FCB621FA} not found.
File\Folder C:\Windows\SysNative\tasks\{B6EA583C-E588-4524-A546-D3AC47428555} not found.
File\Folder C:\Windows\SysNative\tasks\{B7BA53C2-4643-433A-AFC1-B5D02014CD4C} not found.
File\Folder C:\Windows\SysNative\tasks\{B8EA589A-F7A7-4D8E-9112-0FE73C379952} not found.
File\Folder C:\Windows\SysNative\tasks\{BAB8B572-04FE-4CB1-BB8B-0BA991406543} not found.
File\Folder C:\Windows\SysNative\tasks\{BB2BA7A5-BF50-4E2F-AFCA-D9E64E380942} not found.
File\Folder C:\Windows\SysNative\tasks\{BCDA932D-71EB-413A-8B86-4342FFD212D8} not found.
File\Folder C:\Windows\SysNative\tasks\{BDA1C6C9-09A3-4826-A3EF-AE964DA3ABE1} not found.
File\Folder C:\Windows\SysNative\tasks\{BE66DAC4-7578-49B3-8433-411E9B5643AB} not found.
File\Folder C:\Windows\SysNative\tasks\{BF1564DF-5D9F-49AC-AD49-0A4065267ED6} not found.
File\Folder C:\Windows\SysNative\tasks\{BF1A83D1-AC1B-4487-9C78-A8716F3B8E4A} not found.
File\Folder C:\Windows\SysNative\tasks\{C0D589EA-50AF-44DE-B3FF-F17A401F669E} not found.
File\Folder C:\Windows\SysNative\tasks\{C16D6542-D09C-46EC-BA22-C96516FA62DA} not found.
File\Folder C:\Windows\SysNative\tasks\{C38A5A6A-7E62-4531-986D-07CE0894A2F5} not found.
File\Folder C:\Windows\SysNative\tasks\{C4EDC788-ECF5-4D59-AC09-469B261578C9} not found.
File\Folder C:\Windows\SysNative\tasks\{C5806AC9-C150-4D7A-AD40-F3A1ECB9EBFE} not found.
File\Folder C:\Windows\SysNative\tasks\{C73EB754-B89C-4F53-9A83-5ABE256CBE01} not found.
File\Folder Windows\SysNative\tasks\{C5806AC9-C150-4D7A-AD40-F3A1ECB9EBFE} not found.
File\Folder C:\Windows\SysNative\tasks\{C73EB754-B89C-4F53-9A83-5ABE256CBE01} not found.
File\Folder C:\Windows\SysNative\tasks\{C867517B-6D88-4324-87C8-1A150F455FA7} not found.
File\Folder C:\Windows\SysNative\tasks\{C89D08DA-B271-44A0-BAB3-D4C7E157B541} not found.
File\Folder C:\Windows\SysNative\tasks\{C909516B-6912-4D4D-91C6-CF22669701D1} not found.
File\Folder C:\Windows\SysNative\tasks\{CA040947-5FBD-4E6D-A2CC-DE2B9C68C485} not found.
File\Folder C:\Windows\SysNative\tasks\{CB8B2A16-9AF6-4FAC-A183-9E071C88AB9B} not found.
File\Folder C:\Windows\SysNative\tasks\{CBFA0DC4-2880-4E74-B8BD-ABDCB4B61568} not found.
File\Folder C:\Windows\SysNative\tasks\{CCB1141E-9981-4E13-8C57-96E5D746DDE3} not found.
File\Folder C:\Windows\SysNative\tasks\{CD69430A-876E-4BD2-9AF0-B83B0558B508} not found.
File\Folder C:\Windows\SysNative\tasks\{D0571D80-AF10-4159-B7F0-FBA4119C9637} not found.
File\Folder C:\Windows\SysNative\tasks\{D1650CAE-D385-475F-B1F8-33C52AB11845} not found.
File\Folder C:\Windows\SysNative\tasks\{D2D18017-8964-4FC2-B960-A83BADD5752E} not found.
File\Folder C:\Windows\SysNative\tasks\{D3178701-DB08-4EB4-976E-E269DF72B799} not found.
File\Folder C:\Windows\SysNative\tasks\{D457D20C-8A7A-44E6-9B66-2695A8635AB4} not found.
File\Folder C:\Windows\SysNative\tasks\{D767EAC8-B50E-4053-9758-1894739ADA58} not found.
File\Folder C:\Windows\SysNative\tasks\{D86FC274-ED38-441D-AE6C-C4AFFD7B6884} not found.
File\Folder C:\Windows\SysNative\tasks\{D9E70FA0-A583-4460-A5EC-205D89D3AA66} not found.
File\Folder C:\Windows\SysNative\tasks\{DA062007-7997-45C2-BDA8-2A976343D9FA} not found.
File\Folder C:\Windows\SysNative\tasks\{DC2034E3-23B4-418F-AD0C-9CA023C49719} not found.
File\Folder C:\Windows\SysNative\tasks\{DC69A2CC-FF32-4239-ADBD-743C0C39E476} not found.
File\Folder C:\Windows\SysNative\tasks\{DEF9583B-46EA-4546-B8EA-E83828A3C44D} not found.
File\Folder C:\Windows\SysNative\tasks\{DFA950F6-C038-445B-9E3C-8C621E159167} not found.
File\Folder C:\Windows\SysNative\tasks\{E0273E95-EF1D-4855-B806-4BE4C154FF06} not found.
File\Folder C:\Windows\SysNative\tasks\{E156E0FD-C392-4435-9F4B-E6D3F27D5027} not found.
File\Folder C:\Windows\SysNative\tasks\{E1E65C77-688C-4DDA-AF3F-5185EA4E2958} not found.
File\Folder C:\Windows\SysNative\tasks\{E200B99F-6199-49A6-8E21-FEC21249989F} not found.
File\Folder C:\Windows\SysNative\tasks\{E290C2AF-DB71-4B35-BC9B-60F761876A22} not found.
File\Folder C:\Windows\SysNative\tasks\{E4EB7EBD-6D78-4E22-B68C-2A67A2F63AB8} not found.
File\Folder C:\Windows\SysNative\tasks\{E583451E-41D9-4DD0-9FE5-BB64252E4957} not found.
File\Folder C:\Windows\SysNative\tasks\{E6927B70-B02F-400D-809B-43CE08761EDA} not found.
File\Folder C:\Windows\SysNative\tasks\{E7072ED1-E2E6-46F0-A066-33E7B16D278C} not found.
File\Folder C:\Windows\SysNative\tasks\{E73E0F40-B1B3-4972-9D7B-6DD900FA9A73} not found.
File\Folder C:\Windows\SysNative\tasks\{E8D69631-7E89-4C73-BC34-BC0D12A07F11} not found.
File\Folder C:\Windows\SysNative\tasks\{E9972B4C-A09C-467C-A05D-48BE923B5ADA} not found.
File\Folder C:\Windows\SysNative\tasks\{EB8C0CD5-9F49-46CB-B6C2-449E0A809202} not found.
File\Folder C:\Windows\SysNative\tasks\{EBEA5EB9-C006-4084-A500-689508B271F1} not found.
File\Folder C:\Windows\SysNative\tasks\{ED2EB6BB-193B-42B0-B695-0C96BCAF0DCE} not found.
File\Folder C:\Windows\SysNative\tasks\{F0B71CEB-C034-4030-BDDB-F5247724F553} not found.
File\Folder C:\Windows\SysNative\tasks\{F3119022-3A9B-4019-98F7-8E22196FED9F} not found.
File\Folder C:\Windows\SysNative\tasks\{F41AA588-4C1E-482E-B72B-0009BBF81DD1} not found.
File\Folder C:\Windows\SysNative\tasks\{F42BBB8E-AEF8-4841-BEFF-9780E4CE09D3} not found.
File\Folder C:\Windows\SysNative\tasks\{F4FE9A19-1EB9-4542-8C77-2CB45473CCFA} not found.
File\Folder C:\Windows\SysNative\tasks\{F5E7BA63-48AC-4196-B907-FAC4E85F51A7} not found.
File\Folder C:\Windows\SysNative\tasks\{F74218E2-3E63-4870-B668-839B6E19AECF} not found.
File\Folder C:\Windows\SysNative\tasks\{F7C0633A-1B08-4370-962B-19EE9A87E01B} not found.
File\Folder C:\Windows\SysNative\tasks\{F86FFABA-93B4-4B29-B4B0-3C3A6A2BC174} not found.
File\Folder C:\Windows\SysNative\tasks\{F900E470-8C42-4DB4-B0CF-12367023E5F0} not found.
File\Folder C:\Windows\SysNative\tasks\{F9AA89E0-904A-412E-8EF0-62DB32BFF047} not found.
File\Folder C:\Windows\SysNative\tasks\{FAFD0C33-3167-4A63-8A5D-ACAE566A42E2} not found.
File\Folder C:\Windows\SysNative\tasks\{FBB77A98-A1F1-40F2-9284-AF9CF50A64FE} not found.
File\Folder C:\Windows\SysNative\tasks\{FC0BA82E-16B8-4489-AE84-E7470F2F4F41} not found.
File\Folder C:\Windows\SysNative\tasks\{FD310B47-7F2C-47AB-BF1C-69341301DC7E} not found.
File\Folder C:\Windows\SysNative\tasks\{FE4B534A-0526-4B59-927E-D6869FF5FFAC} not found.
File\Folder C:\Windows\SysNative\tasks\{FF3DEE7D-9A02-4CD1-A13F-BE3685B1A097} not found.
File\Folder C:\Windows\SysNative\tasks\{FF42B429-AF1A-4B5E-BEF1-BA0477DFA612} not found.
File\Folder C:\Windows\SysNative\tasks\{017D6C9E-60F2-4368-A830-2C4CAFBDFF4A} not found.
File\Folder C:\Windows\SysNative\tasks\{04BFC6C6-B40C-4EA5-8CAF-8E2338CC6C5A} not found.
File\Folder C:\Windows\SysNative\tasks\{0533830A-3A30-43E1-A26C-F24F31313F24} not found.
File\Folder C:\Windows\SysNative\tasks\{0C12FFCA-5219-41A1-98B3-0A293116D452} not found.
File\Folder C:\Windows\SysNative\tasks\{0DA69CBB-BC0A-4C01-AA6E-B1C75810EC34} not found.
File\Folder C:\Windows\SysNative\tasks\{0ED0F7DF-D3C8-436E-B7B1-E7D11715A2F1} not found.
File\Folder C:\Windows\SysNative\tasks\{129EC48D-627D-44EC-9469-5CDB19E76F28} not found.
File\Folder C:\Windows\SysNative\tasks\{14B0E181-6CFD-4EBD-B893-D1F128CF3F0B} not found.
File\Folder C:\Windows\SysNative\tasks\{14D2F3A1-30D3-41B7-B72E-ABD0AC4AE082} not found.
File\Folder C:\Windows\SysNative\tasks\{1672E0C9-DCD2-43B5-80BA-80493F7DDF49} not found.
File\Folder C:\Windows\SysNative\tasks\{1D36A951-77E4-4A40-8728-337F4C232478} not found.
File\Folder C:\Windows\SysNative\tasks\{1DC038B8-7381-4665-8FB4-224C3FDD3AB6} not found.
File\Folder C:\Windows\SysNative\tasks\{1E08134F-A5A0-4D99-8ED4-C238C7751F1C} not found.
File\Folder C:\Windows\SysNative\tasks\{1FAB4F31-9F23-45B0-9FA9-FEDB7A82E3D9} not found.
File\Folder C:\Windows\SysNative\tasks\{22DED5C5-F88E-4E1B-BC0B-F40641719530} not found.
File\Folder C:\Windows\SysNative\tasks\{259797BC-62E3-4D7A-B0F5-5BAEE58CA893} not found.
File\Folder C:\Windows\SysNative\tasks\{2813EEFC-48D4-4D02-99CF-668256F9E207} not found.
File\Folder C:\Windows\SysNative\tasks\{2942FF2B-7888-47C5-BB1E-B32FD0A5C0E7} not found.
File\Folder C:\Windows\SysNative\tasks\{2A4626EC-2963-469B-96F0-5E884FC1CDA2} not found.
File\Folder C:\Windows\SysNative\tasks\{2E39F65C-63BA-430D-9253-842FA9440873} not found.
File\Folder C:\Windows\SysNative\tasks\{2E9B3DE8-B029-47EA-AD44-B1FAFE897164} not found.
File\Folder C:\Windows\SysNative\tasks\{306C4584-CC14-4C37-8923-09F306837177} not found.
File\Folder C:\Windows\SysNative\tasks\{33E050AF-A547-4105-9346-F3BAAFEB1E0F} not found.
File\Folder C:\Windows\SysNative\tasks\{3571D328-3D80-4C80-B719-F32941DC1E66} not found.
File\Folder C:\Windows\SysNative\tasks\{37A031D1-6247-4C29-AD79-CBEB0552DCF2} not found.
File\Folder C:\Windows\SysNative\tasks\{38103F34-9331-462E-A218-44DDDF92D17C} not found.
File\Folder C:\Windows\SysNative\tasks\{3893ABC4-9F02-4244-BE66-3C228AF60450} not found.
File\Folder C:\Windows\SysNative\tasks\{39D1A89B-6ED4-4D5D-B251-5248C8132122} not found.
File\Folder C:\Windows\SysNative\tasks\{3BCE4C5D-0C05-4896-9FCC-7CC4B1F7E2AC} not found.
File\Folder C:\Windows\SysNative\tasks\{3BE470C5-A4AE-4CA6-AFF8-56889AD59AFA} not found.
File\Folder C:\Windows\SysNative\tasks\{3EF1354F-0C94-483D-AC3D-F19818DF41C3} not found.
File\Folder C:\Windows\SysNative\tasks\{4205F4BA-A49B-4254-AA46-142224D3A4DD} not found.
File\Folder C:\Windows\SysNative\tasks\{445107DF-18A9-454C-BD6B-6BEC1268FCE9} not found.
File\Folder C:\Windows\SysNative\tasks\{46CAD249-CCD8-4647-A872-CFEF98870630} not found.
File\Folder C:\Windows\SysNative\tasks\{48B57778-3C17-4F8F-9F37-1670C988C758} not found.
File\Folder C:\Windows\SysNative\tasks\{495E6B96-71C0-494D-80E9-5C65755FB78A} not found.
File\Folder C:\Windows\SysNative\tasks\{4A8A566A-B20E-4FE7-9E68-C7C5BF544CD7} not found.
File\Folder C:\Windows\SysNative\tasks\{4B656564-2E3B-4576-BE25-B0DC9544116E} not found.
File\Folder C:\Windows\SysNative\tasks\{4CA73161-73DA-4B1A-965D-AB09C94B4AEA} not found.
File\Folder C:\Windows\SysNative\tasks\{4CE8C8E1-A97C-4160-BE86-0DEA65FE56F9} not found.
File\Folder C:\Windows\SysNative\tasks\{4EC488AC-AE47-4D9A-8865-FD961022DCB9} not found.
File\Folder C:\Windows\SysNative\tasks\{504A7FEB-609B-4BE0-88A0-834DB4D30410} not found.
File\Folder C:\Windows\SysNative\tasks\{5069546F-EDCB-4E3A-884E-7E734FACBBB6} not found.
File\Folder C:\Windows\SysNative\tasks\{517A620A-A28E-42DA-97FE-CB8141300E83} not found.
File\Folder C:\Windows\SysNative\tasks\{522321CC-5F9C-47A3-B7E8-DD55669E3933} not found.
File\Folder C:\Windows\SysNative\tasks\{54881447-6145-4A8D-868B-A7F71C105A09} not found.
File\Folder C:\Windows\SysNative\tasks\{556AA807-AAFA-43F0-8E63-FAB31146F3DA} not found.
File\Folder C:\Windows\SysNative\tasks\{55F154E4-EDEE-46D1-97A9-AB5F14E78F9C} not found.
File\Folder C:\Windows\SysNative\tasks\{5C39F11D-42E1-4141-B7AC-796321F09D3B} not found.
File\Folder C:\Windows\SysNative\tasks\{64E1A5E1-710B-4037-B2ED-C57646D542F3} not found.
File\Folder C:\Windows\SysNative\tasks\{6659EC54-42B5-4BFC-9D8E-40CAD8E0E459} not found.
File\Folder C:\Windows\SysNative\tasks\{680BA847-F3A3-46AF-A7AB-59D11B038A4B} not found.
File\Folder C:\Windows\SysNative\tasks\{69DEDC30-2B86-486A-8534-BF6AC0D0DB0C} not found.
File\Folder C:\Windows\SysNative\tasks\{6B49ABEA-6BAB-47A3-AEFA-E1F89E7762C3} not found.
File\Folder C:\Windows\SysNative\tasks\{6BF7C3DF-84E5-4783-93C9-C7A2641FA800} not found.
File\Folder C:\Windows\SysNative\tasks\{6C1AFD85-9C42-4FF4-A498-4DE3D20AD152} not found.
File\Folder C:\Windows\SysNative\tasks\{6DC48EB0-B07B-4A1A-9BF2-6BC1F75D0FB7} not found.
File\Folder C:\Windows\SysNative\tasks\{6F4114E9-E80A-4EEE-8534-4B34AEE51F88} not found.
File\Folder C:\Windows\SysNative\tasks\{72328F97-34EE-4D10-BC50-D32AD0FEDD77} not found.
File\Folder C:\Windows\SysNative\tasks\{7403633C-0362-4CFF-B5F1-F2A5A788D63D} not found.
File\Folder C:\Windows\SysNative\tasks\{76667402-C360-4AD2-A244-0D3816BDE340} not found.
File\Folder C:\Windows\SysNative\tasks\{76945B4F-EEC1-44DB-A740-4C971E5CA06A} not found.
File\Folder C:\Windows\SysNative\tasks\{779295CC-2470-41D7-8E30-2D53C545F83E} not found.
File\Folder C:\Windows\SysNative\tasks\{78D246C5-C9FF-44F2-B869-434593E7DD8F} not found.
File\Folder C:\Windows\SysNative\tasks\{7A49342F-CD74-4B45-B7D2-B5FE59D3DFF2} not found.
File\Folder C:\Windows\SysNative\tasks\{7B0D1417-3A48-48F7-93FE-2684A1DFE999} not found.
File\Folder C:\Windows\SysNative\tasks\{7B11BB2F-7EAC-4FEA-A958-8A8CBEA299A1} not found.
File\Folder C:\Windows\SysNative\tasks\{7CE94A6D-870E-44B8-98CC-987866536ACB} not found.
File\Folder C:\Windows\SysNative\tasks\{7D095AD1-2234-43D4-AAF5-E05C02246D13} not found.
File\Folder C:\Windows\SysNative\tasks\{7D719BB7-E965-4FB9-B514-1DD91A62F803} not found.
File\Folder C:\Windows\SysNative\tasks\{7DFA6198-44C6-44D7-B522-EBAA01E4F8F4} not found.
File\Folder C:\Windows\SysNative\tasks\{830253D4-408C-45B5-AFCA-5C773112E23C} not found.
File\Folder C:\Windows\SysNative\tasks\{8460004D-B02F-4C8D-B2C5-59C76314D487} not found.
File\Folder C:\Windows\SysNative\tasks\{855EC570-55C9-451A-9122-A318EE4BF0A4} not found.
File\Folder C:\Windows\SysNative\tasks\{877D0096-9888-47C8-9BF0-35F8419A2A77} not found.
File\Folder C:\Windows\SysNative\tasks\{89A04B6C-41BD-42FC-8AA1-FB87093F6635} not found.
File\Folder C:\Windows\SysNative\tasks\{89D178BE-A228-4EA6-94DC-50A6CD05A967} not found.
File\Folder C:\Windows\SysNative\tasks\{8A74AA99-6B36-4C2C-8827-F1639858D848} not found.
File\Folder C:\Windows\SysNative\tasks\{8C005AFC-22BB-4239-9DC9-08489544BBFD} not found.
File\Folder C:\Windows\SysNative\tasks\{8C437078-D3B6-48B9-93BD-1BCF19612697} not found.
File\Folder C:\Windows\SysNative\tasks\{91558693-2495-451F-9018-0C46DAA1176D} not found.
File\Folder C:\Windows\SysNative\tasks\{921D7CB4-AB36-4672-A933-A9BF6E532375} not found.
File\Folder C:\Windows\SysNative\tasks\{92EE84B9-72EC-4000-B858-514FF4770CE0} not found.
File\Folder C:\Windows\SysNative\tasks\{93A81C3E-DF53-4815-8D07-40C32B59DF58} not found.
File\Folder C:\Windows\SysNative\tasks\{9426BDE9-7E3B-4EED-9118-4A46A67AC0B7} not found.
File\Folder C:\Windows\SysNative\tasks\{9431609A-136C-4EBA-A72E-8C406057E543} not found.
File\Folder C:\Windows\SysNative\tasks\{948922B3-153F-4479-A39A-A12A8E3A4E9F} not found.
File\Folder C:\Windows\SysNative\tasks\{949E8D62-425C-440B-AD3A-1F40B0F678F4} not found.
File\Folder C:\Windows\SysNative\tasks\{96126849-28B0-48A9-8656-59785189AF89} not found.
File\Folder C:\Windows\SysNative\tasks\{9857A2ED-6A1F-4378-8DBB-6DD2C4BF046E} not found.
File\Folder C:\Windows\SysNative\tasks\{98C88D62-41D0-42B1-BE8A-D485E0966125} not found.
File\Folder C:\Windows\SysNative\tasks\{98E0E235-72C0-4DBB-8424-C42707A6B358} not found.
File\Folder C:\Windows\SysNative\tasks\{990AC902-0FED-42E9-92F3-BA95813C5D9B} not found.
File\Folder C:\Windows\SysNative\tasks\{99BDA781-8B18-4F52-B16B-7F7F03A41A24} not found.
File\Folder C:\Windows\SysNative\tasks\{9B9828E9-1413-4A86-9766-1891EAE88C51} not found.
File\Folder C:\Windows\SysNative\tasks\{A13F0025-DA88-42D6-B2F0-A9738578D454} not found.
File\Folder C:\Windows\SysNative\tasks\{A14A3709-8141-429A-82FB-5DE593041DC3} not found.
File\Folder C:\Windows\SysNative\tasks\{A1C93020-F1B7-4ABA-B061-9A75938C0B10} not found.
File\Folder C:\Windows\SysNative\tasks\{A1D657F6-767C-4716-909B-F714373994CE} not found.
File\Folder C:\Windows\SysNative\tasks\{A2042059-1242-48F6-A605-760CED93F289} not found.
File\Folder C:\Windows\SysNative\tasks\{A4424D35-0A06-4B71-921A-F5C685D69736} not found.
File\Folder C:\Windows


----------



## sweetrose (Sep 7, 2012)

\SysNative\tasks\{A46EC343-21ED-4914-B487-307B694892CB} not found.
File\Folder C:\Windows\SysNative\tasks\{A474880F-3FDF-4BFE-A604-7F1F8379D4C9} not found.
File\Folder C:\Windows\SysNative\tasks\{A4C5A257-7C79-4744-B414-4B4F1070A49E} not found.
File\Folder C:\Windows\SysNative\tasks\{A563E28C-6E44-47E4-9234-BBC273559977} not found.
File\Folder C:\Windows\SysNative\tasks\{A57EC87D-A6DC-455E-9685-1273B1791678} not found.
File\Folder C:\Windows\SysNative\tasks\{A7B7CFB2-02AC-4E2F-86A4-7E19B883562D} not found.
File\Folder C:\Windows\SysNative\tasks\{AC1CCE5C-3137-4CC1-A70E-E7CD58F19FDE} not found.
File\Folder C:\Windows\SysNative\tasks\{B47D5112-AB09-4181-9CC5-8D9F99E2D61F} not found.
File\Folder C:\Windows\SysNative\tasks\{B64EE87B-0F44-4707-BE33-76B5635D3214} not found.
File\Folder C:\Windows\SysNative\tasks\{B68B39F9-F0B5-4F1B-9DA3-59C1F94AA939} not found.
File\Folder C:\Windows\SysNative\tasks\{BBBA5219-9C32-45C3-A5A3-6921C4A4AB95} not found.
File\Folder C:\Windows\SysNative\tasks\{BC6175B1-F290-4B52-9406-6C5FC5B67482} not found.
File\Folder C:\Windows\SysNative\tasks\{BC9A7D74-62FB-4F02-B532-FFF2F4F1B68B} not found.
File\Folder C:\Windows\SysNative\tasks\{BDBC6AA9-5917-4E39-B456-61BA623E1A03} not found.
File\Folder C:\Windows\SysNative\tasks\{BE29141A-32A4-4270-A25B-A0D6346196D7} not found.
File\Folder C:\Windows\SysNative\tasks\{BF34634F-610F-4E32-B0D5-23F3A93FFB5C} not found.
File\Folder C:\Windows\SysNative\tasks\{C536A61C-1F54-493F-A908-2B8D4FC329BF} not found.
File\Folder C:\Windows\SysNative\tasks\{C745B2B2-EEE7-4329-8BBD-DEA6F61EF13F} not found.
File\Folder C:\Windows\SysNative\tasks\{CF6D1AAC-770A-4337-AB0E-8B45307BBE50} not found.
File\Folder C:\Windows\SysNative\tasks\{D3B4B5BA-E4E7-44F3-A15F-2427D8ACE965} not found.
File\Folder C:\Windows\SysNative\tasks\{D4077877-A9D3-44AF-9F6C-3E70624D5F7B} not found.
File\Folder C:\Windows\SysNative\tasks\{DAD18EC0-0E9E-4D6E-9278-8AC46D16DF1C} not found.
File\Folder C:\Windows\SysNative\tasks\{DC136D4C-5CE8-4CCE-B28D-15988AD2C560} not found.
File\Folder C:\Windows\SysNative\tasks\{DC8B20D0-9190-4C9A-A78D-F7F1710C0587} not found.
File\Folder C:\Windows\SysNative\tasks\{DE225B6C-3CA0-476D-A9C4-1C41C55790C9} not found.
File\Folder C:\Windows\SysNative\tasks\{DF4A47BC-B0CB-42D8-B54A-DF15E36921FE} not found.
File\Folder C:\Windows\SysNative\tasks\{E2614C8F-C69A-4A46-8561-DC301110FA1B} not found.
File\Folder C:\Windows\SysNative\tasks\{E449ECDA-ABC9-4153-82F2-867CDBA02232} not found.
File\Folder C:\Windows\SysNative\tasks\{E55E0C53-D68E-4BD7-AD86-A60A2D36446B} not found.
File\Folder C:\Windows\SysNative\tasks\{E6D60D1F-C54A-42FC-8242-1F81AF0FEC42} not found.
File\Folder C:\Windows\SysNative\tasks\{E811FA29-B844-45A5-A100-999F8662BBC5} not found.
File\Folder C:\Windows\SysNative\tasks\{E8B3670D-4588-40B6-9A16-51CCCF813AEE} not found.
File\Folder C:\Windows\SysNative\tasks\{EC8965A1-07B2-4528-AFC3-8EA6BDE92837} not found.
File\Folder C:\Windows\SysNative\tasks\{ED3635A3-9076-4642-9978-6E32D5F5EB15} not found.
File\Folder C:\Windows\SysNative\tasks\{EE3C9484-0251-4F91-94BD-2FCE8917E185} not found.
File\Folder C:\Windows\SysNative\tasks\{EEA55960-BD38-4A7F-8019-4C536AC78ACA} not found.
File\Folder C:\Windows\SysNative\tasks\{EFDF3337-C855-4B63-BE36-4F71C86C1078} not found.
File\Folder C:\Windows\SysNative\tasks\{F0D2AD24-9B54-454D-A45A-3ABB3EC1C7A9} not found.
File\Folder C:\Windows\SysNative\tasks\{F37B161E-B58E-4064-A6A2-BBFC78119ECF} not found.
File\Folder C:\Windows\SysNative\tasks\{F49E1563-1AE0-4536-84F6-ECD1E5FBA4DF} not found.
File\Folder C:\Windows\SysNative\tasks\{F6F7A0B0-70F1-4A75-8227-A3641A53B74D} not found.
File\Folder C:\Windows\SysNative\tasks\{F89E1210-88BB-485B-88A6-1757C5F515BD} not found.
File\Folder C:\Windows\SysNative\tasks\{F9BCF7B2-359D-4A60-994A-FF0EAA20C2FB} not found.
File\Folder C:\Windows\SysNative\tasks\{FC39DE98-9520-4AAF-AD0D-3F99E47B2282} not found.
File\Folder C:\Windows\SysNative\tasks\{FD69BBF3-1C70-43CF-A806-7891476AE74E} not found.
File\Folder C:\Windows\SysNative\tasks\{02F9E465-5EC7-4745-897D-A644C49C723C} not found.
File\Folder C:\Windows\SysNative\tasks\{12628E57-5773-436C-8A72-2EE57BEC00FE} not found.
File\Folder C:\Windows\SysNative\tasks\{27C39371-3922-4011-BC48-98A189CFABAD} not found.
File\Folder C:\Windows\SysNative\tasks\{3905D924-A7C9-456C-A408-BF5607CA8533} not found.
File\Folder C:\Windows\SysNative\tasks\{3DE3B054-11C2-4C87-8600-B4AF7E2124BF} not found.
File\Folder C:\Windows\SysNative\tasks\{46C7F9A1-4814-4F04-A0A1-4AF33943DB1E} not found.
File\Folder C:\Windows\SysNative\tasks\{48BF65CC-01F2-4BD4-8209-65A8AD69FDF9} not found.
File\Folder C:\Windows\SysNative\tasks\{5FE44986-DC3C-406B-A653-4DFBE4C0F4FF} not found.
File\Folder C:\Windows\SysNative\tasks\{AF4FC14D-0075-449B-9463-7B6913D344ED} not found.
File\Folder C:\Windows\SysNative\tasks\{BDEBE6CF-8B1D-460A-A137-CF78433F9C03} not found.
File\Folder C:\Windows\SysNative\tasks\{DC47D7E7-06B3-4F66-98DF-79FEFA78DA16} not found.
File\Folder C:\Windows\SysNative\tasks\{E1A11369-3857-48CD-A739-5876D056A9F4} not found.
File\Folder C:\Windows\SysNative\tasks\{E51B6117-4776-4B59-AEDD-4AE9F56DC6B1} not found.
File\Folder C:\Windows\SysNative\tasks\{F05DC8AE-14FF-4A7B-BAD0-A548CEA190B5} not found.
File\Folder C:\Windows\SysNative\tasks\{13F58323-D6D4-4637-B35E-56C58B6E4096} not found.
File\Folder C:\Windows\SysNative\tasks\{1721BF00-F4AD-4345-B3E1-F74184695C78} not found.
File\Folder C:\Windows\SysNative\tasks\{18238F68-53A9-476F-AB6C-30D10382853D} not found.
File\Folder C:\Windows\SysNative\tasks\{396818F6-9DDB-43F7-AA4C-AC9FFEA27D2B} not found.
File\Folder C:\Windows\SysNative\tasks\{B7B6A4BF-0AAD-4095-AB47-A92AB231B215} not found.
File\Folder C:\Windows\SysNative\tasks\{CC5001D5-9895-4BDE-ADD4-91469E526892} not found.
File\Folder C:\Windows\SysNative\tasks\{EE2C010C-D6FA-4EBA-93E3-566CCAFA38E7} not found.
C:\Users\ann\Downloads\PopularScreensaversSetup2.3.98.80.ZRchr999.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: ann
->Temp folder emptied: 33457797 bytes
->Temporary Internet Files folder emptied: 5963040 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 369631728 bytes
->Flash cache emptied: 813 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 75027 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 50669519 bytes

Total Files Cleaned = 438.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 06302013_180736

Files\Folders moved on Reboot...
C:\Users\ann\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\ann\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


----------



## eddie5659 (Mar 19, 2001)

Hmmm, lets see if they're actually still there, as I can't think why so many would just go.

Using OTL again, can you do the following:


Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath *Output* at the top change it to *Standard Output*.
Select 
*All Users*
*LOP Check*
*Purity Check*
Under the *Standard Registry* box change it to *All*

Please copy the text in the code box below and paste it in the *Custom Scans/Fixes* box in OTL:


```
%windir%\system32\tasks\*.*
%windir%\system32\tasks\*.* /64
```

Click the *Run Scan* button. Do not change any settings unless otherwise told to do so. The scan wont take long.
A black box will appear, this is part of the custom scan, so don't be alarmed 
*IF OTL SAYS 'NOT RESPONDING' DON'T USE THE MOUSE. IT WILL CARRY ON SCANNING AFTER A FEW MINUTES*

When the scan completes, it will open on notepad window. *OTL.Txt*. Thise is saved in the same location as OTL.

Please copy *(Edit->Select All, Edit->Copy)* the contents of this file and post them in your topic


----------



## sweetrose (Sep 7, 2012)

Eddie,.i jus dont no how you can understand all this....it is takeing all your rtime up.im so sorry


----------



## eddie5659 (Mar 19, 2001)

Its okay, its the weekend, so here for most of the night. Off to watch a film soon.....


er


Spongebobs SquarePants


----------



## sweetrose (Sep 7, 2012)

Spongebobs SquarePants.LOL.......well i hope you enjoy it Eddie,;.)
iv dne now.


----------



## sweetrose (Sep 7, 2012)

OTL logfile created on: 6/30/2013 6:41:34 PM - Run 5
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ann\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.87 Gb Total Physical Memory | 0.34 Gb Available Physical Memory | 17.98% Memory free
3.74 Gb Paging File | 1.81 Gb Available in Paging File | 48.57% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 79.30 Gb Free Space | 68.10% Space Free | Partition Type: NTFS
Drive D: | 116.05 Gb Total Space | 10.90 Gb Free Space | 9.39% Space Free | Partition Type: NTFS

Computer Name: ANN-TOSH | User Name: ann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/12 19:54:24 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ann\Downloads\OTL.exe
PRC - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
PRC - [2013/04/29 00:58:42 | 004,408,368 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
PRC - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
PRC - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/09/03 07:45:02 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe
PRC - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
PRC - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- c:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

========== Modules (No Company Name) ==========

MOD - [2013/06/15 02:28:42 | 000,393,168 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppgooglenaclpluginchrome.dll
MOD - [2013/06/15 02:28:41 | 013,140,432 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
MOD - [2013/06/15 02:28:40 | 004,051,408 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll
MOD - [2013/06/15 02:27:51 | 000,599,504 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\libglesv2.dll
MOD - [2013/06/15 02:27:50 | 000,124,368 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\libegl.dll
MOD - [2013/06/15 02:27:48 | 001,597,392 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\ffmpegsumo.dll
MOD - [2012/05/25 05:25:00 | 000,921,600 | ---- | M] () -- C:\Program Files (x86)\Yahoo!\Messenger\yui.dll

========== Services (SafeList) ==========

SRV:*64bit:* - [2010/09/28 13:30:28 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:*64bit:* - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:*64bit:* - [2010/02/05 18:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:*64bit:* - [2009/07/28 15:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:*64bit:* - [2009/07/14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/06/03 16:21:54 | 000,162,408 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012/12/06 19:40:43 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/09/03 07:45:02 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe -- (McComponentHostService)
SRV - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2010/05/11 09:40:52 | 000,124,368 | ---- | M] (Toshiba Europe GmbH) [Auto | Running] -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe -- (TemproMonitoringService)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- c:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/28 17:44:40 | 000,249,200 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)
SRV - [2009/10/06 10:21:50 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)

========== Driver Services (SafeList) ==========

DRV:*64bit:* - [2013/03/29 02:53:48 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:*64bit:* - [2013/03/21 03:08:24 | 000,240,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:*64bit:* - [2013/02/08 05:37:56 | 000,116,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:*64bit:* - [2013/02/08 05:37:54 | 000,311,096 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
DRV:*64bit:* - [2013/02/08 05:37:50 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:*64bit:* - [2013/02/08 05:37:42 | 000,206,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:*64bit:* - [2013/02/08 05:37:40 | 000,045,880 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:*64bit:* - [2012/12/21 12:09:14 | 000,030,568 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)
DRV:*64bit:* - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:*64bit:* - [2012/03/01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:*64bit:* - [2011/10/01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:*64bit:* - [2011/10/01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:*64bit:* - [2010/11/20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:*64bit:* - [2010/11/20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:*64bit:* - [2010/09/24 16:11:18 | 000,349,800 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,235,520 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbwwan.sys -- (ZTEusbwwan)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zteusbvoice.sys -- (ZTEusbvoice)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,011,776 | ---- | M] (MBB Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter)
DRV:*64bit:* - [2010/05/20 14:40:28 | 000,075,776 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vodafone_K380x-z_dc_enum.sys -- (vodafone_K380x-z_dc_enum)
DRV:*64bit:* - [2010/04/28 12:32:20 | 000,932,384 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)
DRV:*64bit:* - [2010/03/22 11:55:20 | 000,046,192 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)
DRV:*64bit:* - [2010/03/10 19:51:32 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:*64bit:* - [2010/02/21 01:24:36 | 010,300,800 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:*64bit:* - [2010/01/07 10:05:46 | 000,232,992 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:*64bit:* - [2009/07/30 20:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:*64bit:* - [2009/07/14 16:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:*64bit:* - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:*64bit:* - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:*64bit:* - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:*64bit:* - [2009/06/22 18:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:*64bit:* - [2009/06/20 03:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:*64bit:* - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:*64bit:* - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:*64bit:* - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:*64bit:* - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:*64bit:* - [2009/06/04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE:*64bit:* - HKLM\..\SearchScopes,DefaultScope = 
IE:*64bit:* - HKLM\..\SearchScopes\{ABA5AE01-9B23-4AC7-9BA7-E0345C1287FB}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{A25208D0-8D9E-4B0D-B6DE-CCB82D68D3C2}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\.DEFAULT\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\S-1-5-18\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-19\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-20\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001\..\SearchScopes\{400E7EA1-093B-4D0E-90AC-CAAEF713611E}: "URL" = http://rover.ebay.com/rover/1/710-44557-9400-9/4?satitle={searchTerms}
IE - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001\..\SearchScopes\{56369BA8-0140-7F16-6997-7A636D1E1A62}: "URL" = http://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=021113&q={searchTerms}&src=IE-SearchBox
IE - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=mkg028
IE - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001\..\SearchScopes\{E0F1151B-5874-4D8B-8E18-506FA493AB23}: "URL" = http://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2
IE - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

[2012/11/03 15:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: MyWebSearch (Enabled)
CHR - default_search_provider: search_url = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=84A3265C-6544-45B6-8A52-015E74708D17&n=77fce125&ind=2013061413&p=Z1chr999YYgb&si=trailerclips-2-v3&searchfor={searchTerms}
CHR - default_search_provider: suggest_url = http://srchsugg.funwebproducts.com/query?q={searchTerms}&li=ff&sstype=prefix
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll
CHR - plugin: king.com - Game controller for firefox (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\plugins\npmidas.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U21 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Java Deployment Toolkit 7.0.210.11 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: Skype Click to Call = C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0\

O1 HOSTS File: ([2013/03/07 19:09:17 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:*64bit:* - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:*64bit:* - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Oracle Corporation)
O4 - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001..\Run: [Skype] C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - Startup: C:\Users\ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-2371791720-1978839507-1749061906-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disableregistrytools = 0
O9:*64bit:* - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - C:\Windows\SysNative\nlaapi.dll (Microsoft Corporation)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - C:\Windows\SysNative\NapiNSP.dll (Microsoft Corporation)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000004 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Windows\SysNative\winrnr.dll (Microsoft Corporation)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64b*


----------



## sweetrose (Sep 7, 2012)

] - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysWOW64\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysWOW64\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\SysWOW64\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3D15F113-3692-4089-B3A3-77DC82321FEB}: NameServer = 10.203.129.68 10.203.129.68
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8303406A-D415-481D-984A-0CB67A97EB51}: DhcpNameServer = 194.168.4.100 194.168.8.100
O18:*64bit:* - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysNative\inetcomm.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\skype4com - No CLSID value found
O18:*64bit:* - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:*64bit:* - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysWOW64\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:*64bit:* - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O29:*64bit:* - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (kerberos) - C:\Windows\SysNative\kerberos.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (schannel) - C:\Windows\SysNative\schannel.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (wdigest) - C:\Windows\SysNative\wdigest.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (tspkg) - C:\Windows\SysNative\tspkg.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (livessp) - C:\Windows\SysNative\livessp.dll (Microsoft Corp.)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\SysWow64\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\SysWow64\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\SysWow64\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\SysWow64\tspkg.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\SysWow64\livessp.dll (Microsoft Corp.)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/01/24 19:10:57 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:*64bit:* - HKLM\..comfile [open] -- "%1" %*
O35:*64bit:* - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:*64bit:* - HKLM\...com [@ = comfile] -- "%1" %*
O37:*64bit:* - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/06/30 18:11:35 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Tasks
[2013/06/30 12:47:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2013/06/24 18:15:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2013/06/24 15:27:04 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan
[2013/06/24 15:26:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfee Security Scan
[2013/06/24 15:26:43 | 000,263,592 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013/06/24 15:26:31 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013/06/24 15:26:31 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013/06/24 15:26:31 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/06/24 15:26:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013/06/23 07:53:41 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/06/22 18:57:53 | 000,000,000 | --SD | C] -- C:\ComboFix
[2013/06/19 19:53:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2013/06/19 19:53:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT
[2013/06/18 19:12:51 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/06/18 18:46:15 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/06/18 18:46:15 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/06/18 18:46:15 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/06/15 08:06:10 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013/06/15 08:06:09 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/06/14 18:20:23 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2013/06/14 17:56:17 | 000,000,000 | ---D | C] -- C:\Users\ann\AppData\Roaming\SUPERAntiSpyware.com
[2013/06/14 15:24:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/06/13 08:06:43 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013/06/13 08:06:43 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013/06/13 08:06:42 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013/06/13 08:06:42 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013/06/13 08:06:42 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/06/13 08:06:42 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/06/13 08:06:42 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013/06/13 08:06:42 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013/06/13 08:06:42 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013/06/13 08:06:40 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013/06/13 08:06:40 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013/06/13 08:06:40 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013/06/13 08:06:39 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013/06/13 07:48:30 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013/06/13 07:48:30 | 000,492,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013/06/13 07:48:20 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptdlg.dll
[2013/06/13 07:48:19 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cryptdlg.dll
[2013/06/13 07:48:12 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013/06/13 07:48:01 | 001,192,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certutil.exe
[2013/06/13 07:48:01 | 000,903,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certutil.exe
[2013/06/13 07:48:00 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2013/06/13 07:48:00 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2013/06/13 07:47:59 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certenc.dll
[2013/06/13 07:47:58 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certenc.dll
[2013/06/13 07:47:42 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013/06/13 07:47:41 | 001,505,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013/06/12 22:34:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013/06/12 22:07:58 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/06/10 19:35:36 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2013/06/05 21:54:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Image Converter

========== Files - Modified Within 30 Days ==========

[2013/06/30 18:45:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001UA.job
[2013/06/30 18:20:19 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/30 18:20:19 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/30 18:18:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/06/30 18:11:43 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/30 18:11:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/06/30 18:11:18 | 1504,354,304 | -HS- | M] () -- C:\hiberfil.sys
[2013/06/30 17:51:01 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/30 07:45:02 | 000,000,848 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001Core.job
[2013/06/29 18:47:49 | 000,727,334 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/06/29 18:47:49 | 000,629,326 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/06/29 18:47:49 | 000,111,220 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/06/24 18:15:12 | 000,001,783 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013/06/24 15:26:25 | 000,096,168 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/06/24 15:26:24 | 000,867,240 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2013/06/24 15:26:24 | 000,789,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2013/06/24 15:26:24 | 000,263,592 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013/06/24 15:26:24 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013/06/24 15:26:24 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013/06/20 20:53:09 | 000,002,366 | ---- | M] () -- C:\Users\ann\Desktop\Google Chrome.lnk
[2013/06/19 19:54:26 | 000,001,075 | ---- | M] () -- C:\Users\ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2013/06/19 19:53:56 | 000,000,876 | ---- | M] () -- C:\Users\ann\Desktop\ERUNT.lnk
[2013/06/18 18:36:02 | 278,514,194 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013/06/17 20:54:11 | 000,000,121 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013/06/08 15:06:58 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/06/08 12:40:02 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

========== Files Created - No Company Name ==========

[2013/06/24 15:26:56 | 000,001,783 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013/06/19 19:54:26 | 000,001,075 | ---- | C] () -- C:\Users\ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2013/06/19 19:53:56 | 000,000,876 | ---- | C] () -- C:\Users\ann\Desktop\ERUNT.lnk
[2013/06/18 18:46:15 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/06/18 18:46:15 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/06/18 18:46:15 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/06/18 18:46:15 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/06/18 18:46:15 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/06/18 18:36:02 | 278,514,194 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013/06/17 20:53:54 | 000,000,121 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013/06/02 08:00:20 | 004,989,512 | ---- | C] () -- C:\Users\ann\Documents\043.JPG
[2013/01/22 21:20:46 | 000,735,726 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/11/03 21:45:18 | 000,000,000 | ---- | C] () -- C:\Windows\ToDisc.INI
[2012/09/02 13:24:38 | 000,027,520 | ---- | C] () -- C:\Users\ann\AppData\Local\dt.dat
[2011/08/31 08:34:31 | 000,001,072 | ---- | C] () -- C:\Users\ann\Pictures - Shortcut.lnk
[2011/07/21 20:34:13 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{931E4FAA-EDCB-4C4C-9A5F-F55CE7BD62A6}
[2011/07/21 20:05:23 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{8532B172-6F57-4CBE-8E80-FAD83C06C6D3}
[2011/07/15 15:48:15 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{796EF731-ABE6-49A6-8D8F-75DAAE534B52}
[2011/07/15 15:28:59 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0B3B4E74-A96D-457B-A3AC-15AF58ED515A}
[2011/07/15 15:07:30 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{9A0EA9CA-EE6E-4B14-AEA4-EF4E0BE4F54A}
[2011/07/12 17:08:10 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{AEEDA0C4-B094-40CA-9072-BDC6E4E10BF3}
[2011/07/12 17:04:33 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0D85A837-7B6B-4379-9BE0-29398598E6DE}
[2011/07/11 19:15:42 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{718D1F67-3F23-4AD2-9624-60761184FA16}
[2011/07/11 19:10:51 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{8885552C-C46F-41CE-AF17-7D809AA70F9B}
[2011/07/11 12:00:50 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0272CA41-FCD0-43E5-BDC1-7D36C50B266C}
[2011/07/11 11:58:10 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{F10292BA-458D-48F4-BB5C-6E00413FB3D2}
[2011/07/05 14:29:26 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{1054FAA8-0F34-4A0D-B2D5-E525DD0BA91E}
[2011/07/04 14:18:16 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{812C46D8-1501-4AFA-8AC1-2D540FA281AD}
[2011/07/04 14:09:23 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{B1AB7382-9FDE-4896-B0A9-D0E584BCBEB7}
[2011/07/04 14:03:38 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{FA6271DC-C11C-4274-A832-ECB58B2FC3D7}
[2011/07/03 13:26:22 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{F129A5BC-03A3-4024-A684-6141D5EB5FB4}
[2011/04/16 08:19:44 | 000,004,608 | ---- | C] () -- C:\Users\ann\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/31 21:30:17 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011/01/31 18:17:23 | 000,007,605 | ---- | C] () -- C:\Users\ann\AppData\Local\Resmon.ResmonCfg
[2010/08/11 11:43:50 | 000,159,464 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4

========== ZeroAccess Check ==========

[2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 06:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 05:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2011/12/19 14:50:39 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\AVG
[2012/11/14 16:19:42 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\AVG2013
[2011/10/13 15:39:53 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2011/04/05 17:07:27 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Farm Mania 2
[2012/12/07 15:28:42 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\JDownloaderDownloadManagerPackages
[2011/02/06 22:51:40 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Toshiba
[2013/01/22 21:24:07 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\TP
[2012/10/03 10:29:33 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\TuneUp Software
[2011/04/20 16:26:20 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Vodafone
[2012/10/17 09:03:45 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\WildTangent
[2011/04/18 21:52:51 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Windows Live Writer

========== Purity Check ==========

========== Custom Scans ==========

< Code: >
[2009/07/14 06:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2009/07/14 06:08:49 | 000,032,620 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/02/11 09:40:52 | 000,000,848 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001Core.job
[2011/02/11 09:40:53 | 000,000,900 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001UA.job
[2011/06/28 10:49:03 | 000,000,888 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2011/06/28 10:49:03 | 000,000,892 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[2012/12/06 19:40:44 | 000,000,830 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

< %windir%\system32\tasks\*.* >

< %windir%\system32\tasks\*.* /64 >

< End of report >


----------



## eddie5659 (Mar 19, 2001)

Its part of my film rentals, so will see how it goes 

Just getting some confirmation about your Chrome settings, so will reply with that soon 

Looks like they're gone, so they may have been removed with some of the other tools.

Apart from the Chrome bit (I'll post a fix soon), how's the computer running?

eddie


----------



## sweetrose (Sep 7, 2012)

that is yr job yes,seeing films.)
my computer is ok.but shock wave keeps comeing up when i close down,


----------



## eddie5659 (Mar 19, 2001)

I wish it was my job, I work in a lab instead 

ShockWave? As in a picture, or something else?

Do you mean this:

Adobe Shockwave Player

http://get.adobe.com/shockwave/


----------



## sweetrose (Sep 7, 2012)

never knew you work in a lab...do you enjoy it.......
no not like that Edie.in wrighting at the top when i go off.it comes up shockwave.and restat


----------



## eddie5659 (Mar 19, 2001)

Well, kind of, prefer when I'm in the office a lot more now 

Not sure I fully understand what it is you're seeing 

Can you post a fresh OTL log, but I need a bit more, so just do this:


Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath *Output* at the top change it to *Standard Output*.
Select 
*All Users*
*LOP Check*
*Purity Check*
Under the *Standard Registry* box change it to *All*

Please copy the text in the code box below and paste it in the *Custom Scans/Fixes* box in OTL:


```
msconfig
```

Click the *Run Scan* button. Do not change any settings unless otherwise told to do so. The scan wont take long.
A black box will appear, this is part of the custom scan, so don't be alarmed 
*IF OTL SAYS 'NOT RESPONDING' DON'T USE THE MOUSE. IT WILL CARRY ON SCANNING AFTER A FEW MINUTES*

When the scan completes, it will a notepad window. *OTL.Txt*. This is saved in the same location as OTL.

Please copy *(Edit->Select All, Edit->Copy)* the content of this file and post them in your topic


----------


----------



## sweetrose (Sep 7, 2012)

when i told you every time i close down,googie chrome comes up saying ShockWave


----------



## sweetrose (Sep 7, 2012)

OTL logfile created on: 7/1/2013 6:16:13 PM - Run 6
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ann\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.87 Gb Total Physical Memory | 0.60 Gb Available Physical Memory | 32.22% Memory free
3.74 Gb Paging File | 1.97 Gb Available in Paging File | 52.86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 78.97 Gb Free Space | 67.82% Space Free | Partition Type: NTFS
Drive D: | 116.05 Gb Total Space | 10.90 Gb Free Space | 9.39% Space Free | Partition Type: NTFS

Computer Name: ANN-TOSH | User Name: ann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/12 19:54:24 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ann\Downloads\OTL.exe
PRC - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
PRC - [2013/04/29 00:58:42 | 004,408,368 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
PRC - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
PRC - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/09/03 07:45:02 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe
PRC - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
PRC - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- c:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

========== Modules (No Company Name) ==========

MOD - [2013/06/15 02:28:42 | 000,393,168 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppgooglenaclpluginchrome.dll
MOD - [2013/06/15 02:28:41 | 013,140,432 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
MOD - [2013/06/15 02:28:40 | 004,051,408 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll
MOD - [2013/06/15 02:27:51 | 000,599,504 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\libglesv2.dll
MOD - [2013/06/15 02:27:50 | 000,124,368 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\libegl.dll
MOD - [2013/06/15 02:27:48 | 001,597,392 | ---- | M] () -- C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\ffmpegsumo.dll
MOD - [2012/05/25 05:25:00 | 000,921,600 | ---- | M] () -- C:\Program Files (x86)\Yahoo!\Messenger\yui.dll

========== Services (SafeList) ==========

SRV:*64bit:* - [2010/09/28 13:30:28 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:*64bit:* - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:*64bit:* - [2010/02/05 18:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:*64bit:* - [2009/07/28 15:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:*64bit:* - [2009/07/14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/06/03 16:21:54 | 000,162,408 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2013/04/15 15:27:46 | 003,289,208 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012/12/06 19:40:43 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/09/03 07:45:02 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe -- (McComponentHostService)
SRV - [2010/08/27 18:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2010/08/18 19:33:54 | 000,008,704 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2010/05/11 09:40:52 | 000,124,368 | ---- | M] (Toshiba Europe GmbH) [Auto | Running] -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe -- (TemproMonitoringService)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- c:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/28 17:44:40 | 000,249,200 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)
SRV - [2009/10/06 10:21:50 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/03/10 19:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)

========== Driver Services (SafeList) ==========

DRV:*64bit:* - [2013/03/29 02:53:48 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:*64bit:* - [2013/03/21 03:08:24 | 000,240,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:*64bit:* - [2013/02/08 05:37:56 | 000,116,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:*64bit:* - [2013/02/08 05:37:54 | 000,311,096 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
DRV:*64bit:* - [2013/02/08 05:37:50 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:*64bit:* - [2013/02/08 05:37:42 | 000,206,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:*64bit:* - [2013/02/08 05:37:40 | 000,045,880 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:*64bit:* - [2012/12/21 12:09:14 | 000,030,568 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)
DRV:*64bit:* - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:*64bit:* - [2012/03/01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:*64bit:* - [2011/10/01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:*64bit:* - [2011/10/01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:*64bit:* - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:*64bit:* - [2010/11/20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:*64bit:* - [2010/11/20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:*64bit:* - [2010/09/24 16:11:18 | 000,349,800 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,235,520 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbwwan.sys -- (ZTEusbwwan)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zteusbvoice.sys -- (ZTEusbvoice)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,121,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:*64bit:* - [2010/08/11 11:44:02 | 000,011,776 | ---- | M] (MBB Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter)
DRV:*64bit:* - [2010/05/20 14:40:28 | 000,075,776 | ---- | M] (Vodafone) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vodafone_K380x-z_dc_enum.sys -- (vodafone_K380x-z_dc_enum)
DRV:*64bit:* - [2010/04/28 12:32:20 | 000,932,384 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)
DRV:*64bit:* - [2010/03/22 11:55:20 | 000,046,192 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)
DRV:*64bit:* - [2010/03/10 19:51:32 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:*64bit:* - [2010/02/21 01:24:36 | 010,300,800 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:*64bit:* - [2010/01/07 10:05:46 | 000,232,992 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:*64bit:* - [2009/07/30 20:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:*64bit:* - [2009/07/14 16:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:*64bit:* - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:*64bit:* - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:*64bit:* - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:*64bit:* - [2009/06/22 18:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:*64bit:* - [2009/06/20 03:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:*64bit:* - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:*64bit:* - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:*64bit:* - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:*64bit:* - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:*64bit:* - [2009/06/04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE:*64bit:* - HKLM\..\SearchScopes,DefaultScope = 
IE:*64bit:* - HKLM\..\SearchScopes\{ABA5AE01-9B23-4AC7-9BA7-E0345C1287FB}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{A25208D0-8D9E-4B0D-B6DE-CCB82D68D3C2}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox

IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{400E7EA1-093B-4D0E-90AC-CAAEF713611E}: "URL" = http://rover.ebay.com/rover/1/710-44557-9400-9/4?satitle={searchTerms}
IE - HKCU\..\SearchScopes\{56369BA8-0140-7F16-6997-7A636D1E1A62}: "URL" = http://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=021113&q={searchTerms}&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=mkg028
IE - HKCU\..\SearchScopes\{E0F1151B-5874-4D8B-8E18-506FA493AB23}: "URL" = http://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ann\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

[2012/11/03 15:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: MyWebSearch (Enabled)
CHR - default_search_provider: search_url = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=84A3265C-6544-45B6-8A52-015E74708D17&n=77fce125&ind=2013061413&p=Z1chr999YYgb&si=trailerclips-2-v3&searchfor={searchTerms}
CHR - default_search_provider: suggest_url = http://srchsugg.funwebproducts.com/query?q={searchTerms}&li=ff&sstype=prefix
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll
CHR - plugin: king.com - Game controller for firefox (Enabled) = C:\Users\ann\AppData\Local\Google\Chrome\Application\plugins\npmidas.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U21 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Java Deployment Toolkit 7.0.210.11 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: Skype Click to Call = C:\Users\ann\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0\

O1 HOSTS File: ([2013/03/07 19:09:17 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:*64bit:* - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Users\ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:*64bit:* - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3D15F113-3692-4089-B3A3-77DC82321FEB}: NameServer = 10.203.129.68 10.203.129.68
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8303406A-D415-481D-984A-0CB67A97EB51}: DhcpNameServer = 194.168.4.100 194.168.8.100
O18:*64bit:* - Protocol\Handler\skype4com - No CLSID value found
O18:*64bit:* - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:*64bit:* - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:*64bit:* - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/01/24 19:10:57 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:*64bit:* - HKLM\..comfile [open] -- "%1" %*
O35:*64bit:* - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:*64bit:* - HKLM\...com [@ = comfile] -- "%1" %*
O37:*64bit:* - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

MsConfig:64bit - StartUpFolder: C:^Users^ann^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^BBC iPlayer Desktop.lnk - C:\Program Files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe - ()
MsConfig:64bit - StartUpFolder: C:^Users^ann^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^TRDCReminder.lnk - C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe - (TOSHIBA Europe)
MsConfig:64bit - StartUpReg: *00TCrdMain* - hkey= - key= - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *Adobe ARM* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *Adobe Reader Speed Launcher* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *Google Update* - hkey= - key= - C:\Users\ann\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
MsConfig:64bit - StartUpReg: *HotKeysCmds* - hkey= - key= - C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
MsConfig:64bit - StartUpReg: *HWSetup* - hkey= - key= - C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)
MsConfig:64bit - StartUpReg: *IgfxTray* - hkey= - key= - C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
MsConfig:64bit - StartUpReg: *IncrediMail* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *KeNotify* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *Magentic* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *mcui_exe* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *Microsoft Default Manager* - hkey= - key= - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: *MobileBroadband* - hkey= - key= - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
MsConfig:64bit - StartUpReg: *NBAgent* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *Persistence* - hkey= - key= - C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
MsConfig:64bit - StartUpReg: *RtHDVBg* - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
MsConfig:64bit - StartUpReg: *RtHDVCpl* - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
MsConfig:64bit - StartUpReg: *SmartFaceVWatcher* - hkey= - key= - C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *SmoothView* - hkey= - key= - C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *SVPWUTIL* - hkey= - key= - C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA CORPORATION)
MsConfig:64bit - StartUpReg: *SynTPEnh* - hkey= - key= - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)
MsConfig:64bit - StartUpReg: *TOSHIBA Online Product Information* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *Toshiba Registration* - hkey= - key= - C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe (Toshiba Europe GmbH)
MsConfig:64bit - StartUpReg: *Toshiba TEMPRO* - hkey= - key= - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH)
MsConfig:64bit - StartUpReg: *TosNC* - hkey= - key= - C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *TosReelTimeMonitor* - hkey= - key= - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *TosSENotify* - hkey= - key= - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *TosVolRegulator* - hkey= - key= - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *TPwrMain* - hkey= - key= - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
MsConfig:64bit - StartUpReg: *TWebCamera* - hkey= - key= - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA CORPORATION.)
MsConfig:64bit - StartUpReg: *XoftSpySE* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *YSearchProtection* - hkey= - key= - C:\Program Files (x86)\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
MsConfig:64bit - State: "startup" - Reg Error: Key error.

========== Files/Folders - Created Within 30 Days ==========

[2013/06/30 18:11:35 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Tasks
[2013/06/30 12:47:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2013/06/24 18:15:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2013/06/24 15:27:04 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan
[2013/06/24 15:26:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfee Security Scan
[2013/06/24 15:26:43 | 000,263,592 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013/06/24 15:26:31 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013/06/24 15:26:31 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013/06/24 15:26:31 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/06/24 15:26:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013/06/23 07:53:41 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/06/22 18:57:53 | 000,000,000 | --SD | C] -- C:\ComboFix
[2013/06/19 19:53:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2013/06/19 19:53:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT
[2013/06/18 19:12:51 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/06/18 18:46:15 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/06/18 18:46:15 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/06/18 18:46:15 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/06/15 08:06:10 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013/06/15 08:06:09 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/06/14 18:20:23 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2013/06/14 17:56:17 | 000,000,000 | ---D | C] -- C:\Users\ann\AppData\Roaming\SUPERAntiSpyware.com
[2013/06/14 15:24:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/06/13 08:06:43 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013/06/13 08:06:43 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013/06/13 08:06:42 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013/06/13 08:06:42 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013/06/13 08:06:42 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/06/13 08:06:42 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/06/13 08:06:42 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013/06/13 08:06:42 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013/06/13 08:06:42 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013/06/13 08:06:40 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013/06/13 08:06:40 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013/06/13 08:06:40 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013/06/13 08:06:39 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013/06/13 07:48:30 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013/06/13 07:48:30 | 000,492,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013/06/13 07:48:20 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptdlg.dll
[2013/06/13 07:48:19 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cryptdlg.dll
[2013/06/13 07:48:12 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013/06/13 07:48:01 | 001,192,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certutil.exe
[2013/06/13 07:48:01 | 000,903,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certutil.exe
[2013/06/13 07:48:00 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2013/06/13 07:48:00 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2013/06/13 07:47:59 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certenc.dll
[2013/06/13 07:47:58 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certenc.dll
[2013/06/13 07:47:42 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013/06/13 07:47:41 | 001,505,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013/06/12 22:34:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013/06/12 22:07:58 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/06/10 19:35:36 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2013/06/05 21:54:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Image Converter

========== Files - Modified Within 30 Days ==========

[2013/07/01 18:18:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/07/01 18:11:13 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/07/01 18:11:13 | 000,016,304 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/07/01 18:04:09 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/07/01 18:02:24 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001UA.job
[2013/07/01 18:02:24 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/07/01 18:02:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/07/01 18:02:18 | 1504,354,304 | -HS- | M] () -- C:\hiberfil.sys
[2013/06/30 07:45:02 | 000,000,848 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001Core.job
[2013/06/29 18:47:49 | 000,727,334 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/06/29 18:47:49 | 000,629,326 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/06/29 18:47:49 | 000,111,220 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/06/24 18:15:12 | 000,001,783 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013/06/24 15:26:25 | 000,096,168 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/06/24 15:26:24 | 000,867,240 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2013/06/24 15:26:24 | 000,789,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2013/06/24 15:26:24 | 000,263,592 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013/06/24 15:26:24 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013/06/24 15:26:24 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013/06


----------



## sweetrose (Sep 7, 2012)

[2013/01/22 21:20:46 | 000,735,726 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/11/03 21:45:18 | 000,000,000 | ---- | C] () -- C:\Windows\ToDisc.INI
[2012/09/02 13:24:38 | 000,027,520 | ---- | C] () -- C:\Users\ann\AppData\Local\dt.dat
[2011/08/31 08:34:31 | 000,001,072 | ---- | C] () -- C:\Users\ann\Pictures - Shortcut.lnk
[2011/07/21 20:34:13 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{931E4FAA-EDCB-4C4C-9A5F-F55CE7BD62A6}
[2011/07/21 20:05:23 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{8532B172-6F57-4CBE-8E80-FAD83C06C6D3}
[2011/07/15 15:48:15 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{796EF731-ABE6-49A6-8D8F-75DAAE534B52}
[2011/07/15 15:28:59 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0B3B4E74-A96D-457B-A3AC-15AF58ED515A}
[2011/07/15 15:07:30 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{9A0EA9CA-EE6E-4B14-AEA4-EF4E0BE4F54A}
[2011/07/12 17:08:10 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{AEEDA0C4-B094-40CA-9072-BDC6E4E10BF3}
[2011/07/12 17:04:33 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0D85A837-7B6B-4379-9BE0-29398598E6DE}
[2011/07/11 19:15:42 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{718D1F67-3F23-4AD2-9624-60761184FA16}
[2011/07/11 19:10:51 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{8885552C-C46F-41CE-AF17-7D809AA70F9B}
[2011/07/11 12:00:50 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{0272CA41-FCD0-43E5-BDC1-7D36C50B266C}
[2011/07/11 11:58:10 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{F10292BA-458D-48F4-BB5C-6E00413FB3D2}
[2011/07/05 14:29:26 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{1054FAA8-0F34-4A0D-B2D5-E525DD0BA91E}
[2011/07/04 14:18:16 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{812C46D8-1501-4AFA-8AC1-2D540FA281AD}
[2011/07/04 14:09:23 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{B1AB7382-9FDE-4896-B0A9-D0E584BCBEB7}
[2011/07/04 14:03:38 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{FA6271DC-C11C-4274-A832-ECB58B2FC3D7}
[2011/07/03 13:26:22 | 000,000,000 | ---- | C] () -- C:\Users\ann\AppData\Local\{F129A5BC-03A3-4024-A684-6141D5EB5FB4}
[2011/04/16 08:19:44 | 000,004,608 | ---- | C] () -- C:\Users\ann\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/31 21:30:17 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011/01/31 18:17:23 | 000,007,605 | ---- | C] () -- C:\Users\ann\AppData\Local\Resmon.ResmonCfg
[2010/08/11 11:43:50 | 000,159,464 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4

========== ZeroAccess Check ==========

[2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 06:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 05:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2011/12/19 14:50:39 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\AVG
[2012/11/14 16:19:42 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\AVG2013
[2011/10/13 15:39:53 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2011/04/05 17:07:27 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Farm Mania 2
[2012/12/07 15:28:42 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\JDownloaderDownloadManagerPackages
[2011/02/06 22:51:40 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Toshiba
[2013/01/22 21:24:07 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\TP
[2012/10/03 10:29:33 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\TuneUp Software
[2011/04/20 16:26:20 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Vodafone
[2012/10/17 09:03:45 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\WildTangent
[2011/04/18 21:52:51 | 000,000,000 | ---D | M] -- C:\Users\ann\AppData\Roaming\Windows Live Writer

========== Purity Check ==========

========== Custom Scans ==========

< Code: >
[2009/07/14 06:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2009/07/14 06:08:49 | 000,032,620 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/02/11 09:40:52 | 000,000,848 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001Core.job
[2011/02/11 09:40:53 | 000,000,900 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2371791720-1978839507-1749061906-1001UA.job
[2011/06/28 10:49:03 | 000,000,888 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2011/06/28 10:49:03 | 000,000,892 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[2012/12/06 19:40:44 | 000,000,830 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

< End of report >


----------



## eddie5659 (Mar 19, 2001)

> when i told you every time i close down,googie chrome comes up saying ShockWave


That sounds like an install that needs finishing. However, I've looked at the Chrome entries that you have, and there are two ways. One is to go into the settings and change them. The other, which may be the easiest, is a reinstall of Chrome.

Your log that you just posted looks a lot better, so lets do the reinstall part now 

--------

So, firstly go to AddRemove Programs via the Control Panel. You can't be using Chrome when you do this part, so either print this out, or when you get to the actual Uninstall part, just close Chrome 

My screenshots won't have the actual programs you have, its just a guide 

So, firstly click on the *Start* button in the bottom left of your screen:










Then, click on the *Control Panel*:










Now, depending on the setup you have, you may have different views.

So, if you have it set to *Large Icons*, this is which you need to click on, *Programs and Features*.










If you have it on *Category*, this is what you need to click on, *Uninstall a Program*










Whichever you have, you will then get to this screen:










Now, in here, you need to look for the program, *Google Chrome * or *Chrome*. They're listed in alphabetical order, so it will be at the top 

Click on it to highlight it (again, mine is a different program):










And then click on the *Uninstall/Change button*, and uninstall it.










If asked about user data or settings, remove those also.

Then, to reinstall Chrome, go here:

https://www.google.com/intl/en/chrome/browser/

And download it as normal. *Don't install any of the toolbars that are offered.*

Let me know how it goes 

eddie


----------



## sweetrose (Sep 7, 2012)

it wont uninstall Eddie


----------



## eddie5659 (Mar 19, 2001)

What happens when you click Uninstall, does it just freeze?

I'm looking at a manual way to do it, so will create a speech from it so its easier to follow


----------



## sweetrose (Sep 7, 2012)

no .sayss i have to trunee all google of.but how


----------



## eddie5659 (Mar 19, 2001)

Ah, that is because you're online here in this page 

You have to close all the Internet pages you have open, then press it again, and it will uninstall


----------



## eddie5659 (Mar 19, 2001)

I see you're still here in the forum. Are you here using Google Chrome? If so, you will have to close all the browser windows, and then you can uninstall it fully


----------



## sweetrose (Sep 7, 2012)

ok will try it


----------



## sweetrose (Sep 7, 2012)

i did it eddie,but every think went my son got me back on


----------



## eddie5659 (Mar 19, 2001)

Glad to hear you're back. When you say everything went, did he install Chrome again to get you back online?

Are you still getting the Shocwave at shutdown?


----------



## sweetrose (Sep 7, 2012)

yes it tock 40 mins for him to do it.the only thing i could get on was skype.
he did install the new chrome for me too
and yes when i close done.flash shocwave did not close down comes up


----------



## eddie5659 (Mar 19, 2001)

Seems strange, as uninstalling a browser should still mean you can get online with the Windows browser, Internet Explorer 

Still, always count on family to help 

Testing a new piece of electronic device for my mum to use, a PDA 

Good to hear the shockwave has stopped. Apart from that, your computer looks a lot cleaner.

Is it all okay now?

eddie


----------



## sweetrose (Sep 7, 2012)

yes its going better now Eddie thanks


----------



## eddie5659 (Mar 19, 2001)

Excellent :up:

Before I post my closing speech, I just want to check its all updated 

Can you re-run Security Check and post the log. If you're unsure, this is the details about it:

Download *Security Check* from *here*.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called *checkup.txt*; please post the contents of that document.

eddie


----------



## sweetrose (Sep 7, 2012)

can i do it tomorrow eddie and post it to you


----------



## eddie5659 (Mar 19, 2001)

Yep, no problem 

I'll take a look when I get home, as its Friday night, but in case I have no time, first thing Saturday


----------



## sweetrose (Sep 7, 2012)

thanks.it will give me tome to do it...and yr busy fridays night,


----------



## eddie5659 (Mar 19, 2001)

oki doki


----------



## sweetrose (Sep 7, 2012)

its ok .anytime will d Results of screen317's Security Check version 0.99.68 
Windows 7 Service Pack 1 x64 (UAC is enabled) 
Internet Explorer 10 
*``````````````Antivirus/Firewall Check:``````````````* 
Windows Firewall Enabled! 
AVG AntiVirus Free Edition 2013 
Antivirus up to date! 
*`````````Anti-malware/Other Utilities Check:`````````* 
Java 7 Update 25 
Google Chrome 27.0.1453.116 
*````````Process Check: objlist.exe by Laurent````````* 
AVG avgwdsvc.exe 
*`````````````````System Health check`````````````````* 
Total Fragmentation on Drive C: 8% 
*````````````````````End of Log``````````````````````*


----------



## eddie5659 (Mar 19, 2001)

That looks good, so lets post my closing speech :up:

*You can mark this thread Solved at the top of this page, if its all running okay *

*Any questions about the following, just ask  *

We have a couple of last steps to perform and then you're all set.

Firstly, lets uninstall the tools we've used:

*Follow these steps to uninstall Combofix and tools used in the removal of malware*

The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

*ComboFix /Uninstall *

Then, run this:


Download *OTC* to your desktop and run it 
Click Yes to beginning the Cleanup process and remove these components, including this application. 
You will be asked to reboot the machine to finish the Cleanup process. Choose Yes. 

======================

Uninstall *SUPERAntiSpyware* from AddRemove Programs.

Also, remove the following from the Desktop or from your download folder at *C:\Users\ann\Downloads*, if still there after doing the above:

*
Security Check
JRT
adwCleaner
SystemLook
*

======================

*Clear Cache/Temp Files*
Download *TFC by OldTimer* to your desktop

 Please double-click *TFC.exe* to run it. (*Note:* If you are running on Vista, right-click on the file and choose *Run As Administrator*).
It *will close all programs* when run, so make sure you have *saved all your work* before you begin.
Click the *Start* button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. *Let it run uninterrupted to completion*. 
Once it's finished it should *reboot your machine*. If it does not, please *manually reboot the machine* yourself to ensure a complete clean.

*Create Restore Point (Win7/Vista)*


Select *Start* > *Control Panel* then double-click on the *System* icon in the Control Panel.
In the left-hand pane click on the *System Protection* option.
When the Dialog comes up, click on the System Protection tab.
Check that the drive letter where Windows is located (usually C indicates System protection *ON*.
(This indicates System restore is turned ON for the Windows drive).
Click on the *Create* button to create a new restore point. In the Name dialog, type a descriptive name and then click on the *Create* button.
You will get a message that the Restore Point was created successfully. Click on the *Close* button.
Click on the *OK* button and close the System window in the Control Panel.

*Making Internet Explorer More Secure*

Go to Control Panel and open the *Internet Options*. Click on the *Advanced tab* and do the following:

 Tick Empty Temporary Internet Files When Browser is Closed under Security. Apply

Then, click on the *Security tab* and do the following:

 Make sure the Internet icon is selected.
 Click once on the *Custom Level* button.
 Change the *Download signed ActiveX controls* to *Prompt*.
 Change the *Download unsigned ActiveX controls* to *Disable*.
 Change the *Initialise and script ActiveX controls not marked as safe* to *Disable.*
 Change the *Installation of desktop items* to *Prompt.*
 Change the *Launching programs and files in an IFRAME* to *Prompt.*
 When all these settings have been made, click on the *OK* button.
 If it prompts you as to whether or not you want to save the settings, press the *Yes* button. 
 Next press the *Apply* button and then the *OK* to exit the Internet Properties page.

*Makeing FireFox More Secure*

Please visit this page to explain how to make Firefox more secure - How to Secure Firefox

*Other Software Updates*
It is very important to update the other software on your computer to patch up any security issues you may have. Go HERE to scan your computer for any out of date software. In particular make sure you download the updates for *Java* and *Adobe* as these are subject to many security vulnerabilities.

Also, its a good idea to keep on top of removing any Temp files etc every month or so. To do this, Windows has a pretty good tool.

Go to Start | Programs | Accessories | System Tools | Disk Cleanup
It should start straight away, but if you have to select a drive, click on the C-drive.
Let it run, and at the end it will give you some boxes to tick. 
All are okay to enable, then press *OK* and then *Yes* to the question after.
It will close after its completed.

To keep your operating system up to date:

*All security updates released by Microsoft must be* *Automatically Installed.*

Click *Start* and in the search box type [b[windows update[/b] and press *ENTER. *
Click *Change Settings* and make sure the *Install updates automatically (recommended)* option is selected, if not select it and click *O.K* to save settings.

Now that you are clean, to help protect your computer in the future I recommend that you get the following free program:
*SpywareBlaster* to help prevent spyware from installing in the first place.

And to keep your system clean run this free malware scanner

*Malwarebytes' Anti-Malware*

weekly, and be aware of what emails you open and websites you visit.

To learn more about how to protect yourself while on the internet read this about Security online: *General Security Information, How to tighten Security Settings and Warnings *

Have a safe and happy computing day!

eddie


----------



## sweetrose (Sep 7, 2012)

thanks for all yr help Eddie,will do all that tomorrow
night and enjoy yr films.........;.)


----------



## eddie5659 (Mar 19, 2001)

Thanks, it was Top Gear Challenges, and half of a documentary about the solar system. Watching part 2 tonight, for an hour 

Any problems with the above, just ask. Most you should be familar with, as its the same as I posted on the other thread


----------



## sweetrose (Sep 7, 2012)

all done now Eddie....time to close this thread now,thankyou very ,very,much.............


----------



## eddie5659 (Mar 19, 2001)

That's good to hear, and any time you have any problems with the computer, send me a message


----------



## sweetrose (Sep 7, 2012)

i will do that Eddie..but you may soon get fed up with me,lol


----------



## eddie5659 (Mar 19, 2001)

Its okay, honestly


----------

