# Malware? Redirecting, various ads, unable to uninstall programs



## Trutalley (Mar 10, 2013)

This is a repost. I have updated my info as my thread was old at the instruction of Triple6(Rob). I have not removed anything since my original post. I am not getting the blue screen anymore & the ad redirect is less but as of this am my desktop font and placement has completely changed. Once I log in on my HP desktop using Vista Home Premium (32 bit) the ads come pretty consistently and with very loud sound. The Hijack this log would not save to desktop, a splash window came up saying HJT could not access all my files. I had difficulty pasting this into my post. none of these would save to the desktop & I ran from my download file. When I ran gmer I was able to uncheck IAT/EAT but could not check the C drive. There were redirect splash ads one after another. The scan did run however without stalling. My logs are below. Thanks in advance for your help!

***was unable to save gmer when i ran it with avast free on. it gave me a warning saying it had blocked win 32ropper-gen and had move it to the chest. once gmer had finished it would not allow me to save it or copy it to notepad. could not open my computer files or access internet. i ran gmer with avast disabled and saved the log to my desktop however i could not load onto techsupportguy because it said the file was to large*** HELP!!!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:20:37 PM, on 6/11/2013
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16483)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
C:\Windows\System32\jureg.exe
C:\Windows\System32\rundll32.exe
C:\Windows\OEM05Mon.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Windows\system32\schtasks.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Privoxy\privoxy.exe
C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\Trudy Stewart\Downloads\HijackThis (4).exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?PC=BNHP
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: EmailBHO - {647FD14A-C4F1-46F4-8FC3-0B40F54226F7} - C:\Program Files\jZip\WebmailPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [WrtMon.exe] C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [OEM05Mon.exe] C:\Windows\OEM05Mon.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Linksys Wireless Manager] "C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" /cm /min /lcid 1033
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_169_Plugin.exe -update plugin
O4 - Global Startup: Privoxy.lnk = C:\Program Files\Privoxy\privoxy.exe
O8 - Extra context menu item: Add to Evernote - res://C:\Program Files\Evernote\Evernote3\enbar.dll/2000
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Download Link Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_file.htm
O8 - Extra context menu item: Download List Of Files Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_list.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Subscribe To RSS/Podcast Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_rss.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll
O9 - Extra 'Tools' menuitem: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: UMVPFSrv - Logitech Inc. - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 11177 bytes

DDS (Ver_2012-11-20.01) - NTFS_x86 
Internet Explorer: 9.0.8112.16483 BrowserJavaVersion: 10.21.2
Run by Trudy Stewart at 14:54:36 on 2013-06-11
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3070.1000 [GMT -4:00]
.
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
C:\Windows\system32\SLsvc.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\CISVC.EXE
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\tcpsvcs.exe
C:\Windows\System32\snmp.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
C:\Windows\System32\jureg.exe
C:\Windows\System32\rundll32.exe
C:\Windows\OEM05Mon.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Windows\system32\schtasks.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Privoxy\privoxy.exe
C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k apphost
C:\Windows\System32\svchost.exe -k ipripsvc
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k iissvcs
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k secsvcs
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.bing.com/?PC=BNHP
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=desktop
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - 
BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - <orphaned>
BHO: jZip Webmail plugin: {647FD14A-C4F1-46F4-8FC3-0B40F54226F7} - c:\program files\jzip\WebmailPlugin.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil32_11_7_700_169_Plugin.exe -update plugin
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [OpwareSE4] "c:\program files\scansoft\omnipagese4\OpwareSE4.exe"
mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe
mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [SunJavaUpdateReg] "c:\windows\system32\jureg.exe"
mRun: [NvSvc] RUNDLL32.EXE c:\windows\system32\nvsvc.dll,nvsvcStart
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [OEM05Mon.exe] c:\windows\OEM05Mon.exe
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [Linksys Wireless Manager] "c:\program files\linksys\linksys wireless manager\LinksysWirelessManager.exe" /cm /min /lcid 1033
mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"
mRun: [LWS] c:\program files\logitech\lws\webcam software\LWS.exe -hide
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\privoxy.lnk - c:\program files\privoxy\privoxy.exe
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: Add to Evernote - c:\program files\evernote\evernote3\enbar.dll/2000
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Download Link Using DownloadStudio... - c:\program files\conceiva\downloadstudio\ds_file.htm
IE: Download List Of Files Using DownloadStudio... - c:\program files\conceiva\downloadstudio\ds_list.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: Subscribe To RSS/Podcast Using DownloadStudio... - c:\program files\conceiva\downloadstudio\ds_rss.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {E0B8C461-F8FB-49b4-8373-FE32E9252800} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEE1} - c:\program files\evernote\evernote3\enbar.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
TCP: NameServer = 24.178.162.3 66.189.0.100 24.217.201.67
TCP: Interfaces\{36937FF7-1F22-4576-8665-B5965D4D3BCC} : DHCPNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
TCP: Interfaces\{BBDB5DE6-583B-4601-A391-1DC2D9542FFD} : DHCPNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\27.0.1453.110\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\trudy stewart\appdata\roaming\mozilla\firefox\profiles\yoebz5b8.default-1357333329994\
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.3.21.145\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\windows\system32\adobe\director\np32dsw_1200112.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_169.dll
FF - plugin: c:\windows\system32\npdeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
FF - ExtSQL: !HIDDEN! 2013-02-14 21:38; [email protected]; c:\program files\mozilla firefox\extensions\[email protected]
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [2013-4-14 49376]
R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [2013-4-14 174664]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2013-2-6 765736]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2013-2-6 368944]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2012-7-11 116608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2013-2-6 29816]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-2-6 66336]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2013-2-6 46808]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-18 21504]
R2 iprip;RIP Listener;c:\windows\system32\svchost.exe -k ipripsvc [2008-6-18 21504]
R2 UMVPFSrv;UMVPFSrv;c:\program files\common files\logishrd\lvmvfm\UMVPFSrv.exe [2012-1-18 450848]
R3 OEM05Vfx;Creative Camera OEM005 Video VFX Driver;c:\windows\system32\drivers\OEM05Vfx.sys [2007-3-5 7424]
R3 OEM05Vid;Creative Camera OEM005 Driver;c:\windows\system32\drivers\OEM05Vid.sys [2007-7-20 235616]
R3 xcbdaNtsc;ViXS Tuner Card (NTSC);c:\windows\system32\drivers\xcbda.sys [2007-1-1 156928]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 CompFilter;UVCCompositeFilter;c:\windows\system32\drivers\lvbusflt.sys [2012-1-18 22176]
S3 Linksys_adapter;Linksys Adapter Network Driver;c:\windows\system32\drivers\AE1200vista.sys [2012-11-26 1073216]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064]
S3 OEM05Afx;Provides a software interface to control audio effects of OEM005 camera.;c:\windows\system32\drivers\OEM05Afx.sys [2007-6-8 141376]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S3 WUSB54GCv3;Compact Wireless-G USB Network Adapter;c:\windows\system32\drivers\WUSB54GCv3.sys [2009-8-16 645120]
.
=============== Created Last 30 ================
.
2013-06-11 12:32:30	7016152	----a-w-	c:\programdata\microsoft\windows defender\definition updates\{53d86308-e2a4-4319-9a11-c8265ca10665}\mpengine.dll
2013-05-27 17:18:56	--------	d-----w-	c:\users\trudy stewart\appdata\local\Apple Computer
2013-05-27 17:18:07	26840	----a-w-	c:\windows\system32\drivers\GEARAspiWDM.sys
2013-05-27 17:17:10	--------	d-----w-	c:\program files\iPod
2013-05-27 17:17:06	--------	d-----w-	c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-05-27 17:17:06	--------	d-----w-	c:\program files\iTunes
2013-05-27 17:14:04	--------	d-----w-	c:\program files\Bonjour
2013-05-27 17:00:06	159744	----a-w-	c:\program files\mozilla firefox\plugins\npqtplugin5.dll
2013-05-27 17:00:06	159744	----a-w-	c:\program files\mozilla firefox\plugins\npqtplugin4.dll
2013-05-27 17:00:06	159744	----a-w-	c:\program files\mozilla firefox\plugins\npqtplugin3.dll
2013-05-27 17:00:06	159744	----a-w-	c:\program files\mozilla firefox\plugins\npqtplugin2.dll
2013-05-27 17:00:06	159744	----a-w-	c:\program files\mozilla firefox\plugins\npqtplugin.dll
2013-05-27 17:00:06	159744	----a-w-	c:\program files\internet explorer\plugins\npqtplugin5.dll
2013-05-27 17:00:06	159744	----a-w-	c:\program files\internet explorer\plugins\npqtplugin4.dll
2013-05-27 17:00:06	159744	----a-w-	c:\program files\internet explorer\plugins\npqtplugin3.dll
2013-05-27 17:00:06	159744	----a-w-	c:\program files\internet explorer\plugins\npqtplugin2.dll
2013-05-27 17:00:06	159744	----a-w-	c:\program files\internet explorer\plugins\npqtplugin.dll
2013-05-23 00:12:39	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2013-05-21 15:29:53	638328	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2013-05-21 15:29:53	37376	----a-w-	c:\windows\system32\cdd.dll
2013-05-21 15:29:20	2049024	----a-w-	c:\windows\system32\win32k.sys
.
==================== Find3M ====================
.
2013-05-09 08:59:10	765736	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2013-05-09 08:59:10	49376	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2013-05-09 08:59:10	174664	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2013-05-09 08:59:09	66336	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2013-05-09 08:58:37	41664	----a-w-	c:\windows\avastSS.scr
2013-05-02 06:06:08	238872	------w-	c:\windows\system32\MpSigStub.exe
2013-05-01 07:59:12	94208	----a-w-	c:\windows\system32\QuickTimeVR.qtx
2013-05-01 07:59:12	69632	----a-w-	c:\windows\system32\QuickTime.qts
2013-04-30 00:35:55	94112	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2013-04-30 00:35:25	866720	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-04-30 00:35:23	788896	----a-w-	c:\windows\system32\deployJava1.dll
2013-04-30 00:27:43	0	----a-w-	c:\windows\system32\REN8D81.tmp
2013-04-30 00:27:43	0	----a-w-	c:\windows\system32\REN8D80.tmp
2013-04-30 00:27:43	0	----a-w-	c:\windows\system32\REN8D7F.tmp
2013-04-23 17:32:40	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-23 17:32:40	691592	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-04-04 22:11:34	1800704	----a-w-	c:\windows\system32\jscript9.dll
2013-04-04 22:02:59	1427968	----a-w-	c:\windows\system32\inetcpl.cpl
2013-04-04 22:02:17	1129472	----a-w-	c:\windows\system32\wininet.dll
2013-04-04 21:58:51	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2013-04-04 21:57:45	420864	----a-w-	c:\windows\system32\vbscript.dll
.
============= FINISH: 14:55:22.38 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft® Windows Vista™ Home Premium 
Boot Device: \Device\HarddiskVolume1
Install Date: 12/11/2007 1:26:43 AM
System Uptime: 6/11/2013 8:19:01 AM (6 hours ago)
.
Motherboard: ASUSTek Computer INC. | | NARRA3
Processor: AMD Phenom(tm) 9500 Quad-Core Processor | Socket AM2 | 2200/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 288 GiB total, 194.045 GiB free.
D: is FIXED (NTFS) - 10 GiB total, 1.294 GiB free.
E: is FIXED (NTFS) - 298 GiB total, 294.68 GiB free.
F: is CDROM ()
G: is Removable
H: is Removable
I: is Removable
J: is Removable
K: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1015: 4/18/2013 12:43:27 PM - Scheduled Checkpoint
RP1016: 4/23/2013 7:59:12 AM - Windows Update
RP1017: 4/24/2013 6:17:02 PM - Scheduled Checkpoint
RP1018: 4/27/2013 12:13:44 PM - Windows Update
RP1019: 4/29/2013 8:15:05 PM - Installed Java 7 Update 21
RP1020: 4/29/2013 8:26:58 PM - Removed Java(TM) SE Runtime Environment 6 Update 1
RP1021: 4/29/2013 8:30:21 PM - Removed Java(TM) 6 Update 35
RP1022: 4/29/2013 8:31:53 PM - Removed Java 7 Update 21
RP1023: 4/29/2013 8:34:53 PM - Installed Java 7 Update 21
RP1024: 4/29/2013 9:34:43 PM - Installed QuickTime
RP1025: 4/30/2013 1:02:13 PM - Scheduled Checkpoint
RP1026: 5/1/2013 5:37:14 PM - Scheduled Checkpoint
RP1027: 5/3/2013 7:07:54 PM - Scheduled Checkpoint
RP1028: 5/4/2013 9:15:59 AM - Windows Update
RP1029: 5/10/2013 5:15:30 PM - Windows Update
RP1030: 5/11/2013 11:59:48 AM - Scheduled Checkpoint
RP1031: 5/21/2013 11:28:21 AM - Windows Update
RP1032: 5/22/2013 7:58:48 PM - Windows Update
RP1033: 5/23/2013 7:57:22 PM - Scheduled Checkpoint
RP1034: 5/24/2013 8:06:18 PM - Scheduled Checkpoint
RP1035: 5/27/2013 12:54:48 PM - Scheduled Checkpoint
RP1036: 5/27/2013 1:15:25 PM - Device Driver Package Install: Apple, Inc. Universal Serial Bus controllers
RP1037: 5/27/2013 1:15:42 PM - Device Driver Package Install: Apple Network adapters
RP1038: 5/30/2013 5:08:42 PM - Windows Update
RP1039: 6/2/2013 11:10:13 AM - Scheduled Checkpoint
RP1040: 6/4/2013 7:51:10 AM - Windows Update
RP1041: 6/5/2013 12:13:56 PM - Scheduled Checkpoint
RP1042: 6/11/2013 8:25:03 AM - Windows Update
.
==== Installed Programs ======================

C:\Program Files\Google\Chrome\Application\chrome.exe[5112] ntdll.dll!NtOpenThread + B 77334B1F 1 Byte [E2]
.text


----------



## Trutalley (Mar 10, 2013)

Just asking for help in getting this taken care of. Thanks, Trudy


----------



## kevinf80 (Mar 21, 2006)

Run the following Trudy,

Download http://www.bleepingcomputer.com/download/adwcleaner/ by Xplode onto your Desktop.


 Please close all open programs and internet browsers.
 Double click on *Adwcleaner.exe* to run the tool.
 Click on *Delete*.
 Confirm each time with OK.
 Your computer will be rebooted automatically. A text file will open after the restart.
 Please post the content of that logfile in your reply.
 You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.

Next,

Please download Farbar Recovery Scan Tool and save it to your desktop.

*Note*: You need to run the version compatibale with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click *Yes* to disclaimer.
Press *Scan* button.
It will make a log (*FRST.txt*) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (*Addition.txt*). Please attach it to your reply.

Post those logs in next reply...

Kevin


----------



## Trutalley (Mar 10, 2013)

Thank you kevin for responding to my post! Below are the logs you requested. I did the xplode incorrectly the 1st time & did a search instead of delete. I reran this and selected delete. It never did que me for another delete.

# AdwCleaner v2.303 - Logfile created 06/18/2013 at 19:24:54
# Updated 08/06/2013 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Trudy Stewart - TRUDYSTEWART-PC
# Boot Mode : Normal
# Running from : C:\Users\Trudy Stewart\Downloads\AdwCleaner (1).exe
# Option [Delete]
# Switch Used : /DisableAskDetection

***** [Services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\Program Files\jZip
File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
File Deleted : C:\user.js
File Deleted : C:\Users\Public\Desktop\eBay.lnk
File Deleted : C:\Users\Public\Desktop\jZip.lnk
Folder Deleted : C:\Program Files\Coupon Companion Plugin
Folder Deleted : C:\Program Files\InfoAtoms
Folder Deleted : C:\Program Files\Perion
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jZip
Folder Deleted : C:\Users\Trudy Stewart\AppData\Local\Coupon Companion Plugin
Folder Deleted : C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhbgpoakplhahbklhkcfbpicgjcaoglk
Folder Deleted : C:\Users\Trudy Stewart\AppData\Local\jZip
Folder Deleted : C:\Users\Trudy Stewart\AppData\LocalLow\AVG Security Toolbar
Folder Deleted : C:\Users\Trudy Stewart\AppData\LocalLow\jZip

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\InstalledBrowserExtensions
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\InfoAtoms
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\jZip
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0021804.BHO
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0021804.Sandbox
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0021804.Sandbox.1
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\hhbgpoakplhahbklhkcfbpicgjcaoglk
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg
Key Deleted : HKLM\Software\IB Updater
Key Deleted : HKLM\Software\InfoAtoms
Key Deleted : HKLM\Software\jZip
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3614D305-2DBB-4991-9297-750DD60FFC73}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InfoAtoms
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\jZip
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [[email protected]]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16490

[OK] Registry is clean.

-\\ Mozilla Firefox v20.0.1 (en-US)

File : C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\prefs.js

Deleted : user_pref("extensions.crossriderapp21804.21804.InstallationTime", 1359831806);
Deleted : user_pref("extensions.crossriderapp21804.21804.active", true);
Deleted : user_pref("extensions.crossriderapp21804.21804.addressbar", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.addressbarenhanced", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.backgroundjs", "\n\n//\n");
Deleted : user_pref("extensions.crossriderapp21804.21804.backgroundver", 38);
Deleted : user_pref("extensions.crossriderapp21804.21804.can_run_bg_code", true);
Deleted : user_pref("extensions.crossriderapp21804.21804.certdomaininstaller", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.changeprevious", false);
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie.InstallationTime.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie.InstallationTime.value", "1359831806");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:0[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_aoi.value", "1359831806");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_arbitrary_code.expiration", "Wed Jun 12 2[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_arbitrary_code.value", "%22%28function%28[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_blocklist.expiration", "Wed Jun 12 2013 2[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_blocklist.value", "%22nonexistantdomain.c[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_cf_bu1.expiration", "Fri Feb 01 2030 00:0[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_cf_bu1.value", "1359831851");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_country_code.expiration", "Tue Jun 18 201[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_country_code.value", "%22US%22");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:0[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_crr.value", "1371083581");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_currenttime.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_currenttime.value", "%221370969346%22");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 0[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_hotfix20111102645.value", "%221%22");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_ib_delay.expiration", "Fri Feb 01 2030 00[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_ib_delay.value", "24");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_ib_disclosure.expiration", "Fri Feb 01 20[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_ib_disclosure.value", "1370973669");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_ib_list.expiration", "Thu Jun 13 2013 02:[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_ib_list.value", "%7B%22f7610cf2b37067876b[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_installer_params.expiration", "Fri Feb 01[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_installer_params.value", "%7B%22source_id[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_installtime.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_installtime.value", "%221359648478%22");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 20[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_parent_zoneid.value", "%2214019%22");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_pc_20120828.value", "1359831845322");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 [...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_product_id.value", "%221175%22");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:0[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie._GPL_zoneid.value", "%22138709%22");
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 [...]
Deleted : user_pref("extensions.crossriderapp21804.21804.cookie.dbtest.value", "1359831840765");
Deleted : user_pref("extensions.crossriderapp21804.21804.description", "Coupon Companion");
Deleted : user_pref("extensions.crossriderapp21804.21804.domain", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.enablesearch", false);
Deleted : user_pref("extensions.crossriderapp21804.21804.fbremoteurl", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.group", 0);
Deleted : user_pref("extensions.crossriderapp21804.21804.homepage", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.iframe", false);
Deleted : user_pref("extensions.crossriderapp21804.21804.internaldb.Resources_appVer.expiration", "Fri Feb 01 [...]
Deleted : user_pref("extensions.crossriderapp21804.21804.internaldb.Resources_appVer.value", "54");
Deleted : user_pref("extensions.crossriderapp21804.21804.internaldb.Resources_lastVersion.expiration", "Fri Fe[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.internaldb.Resources_lastVersion.value", "1");
Deleted : user_pref("extensions.crossriderapp21804.21804.internaldb.Resources_meta.expiration", "Fri Feb 01 20[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.internaldb.Resources_meta.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp21804.21804.internaldb.Resources_nextCheck.expiration", "Thu Jun [...]
Deleted : user_pref("extensions.crossriderapp21804.21804.internaldb.Resources_nextCheck.value", "true");
Deleted : user_pref("extensions.crossriderapp21804.21804.internaldb.Resources_queue.expiration", "Fri Feb 01 2[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.internaldb.Resources_queue.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp21804.21804.internaldb.Resources_remote_resources.expiration", "F[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.internaldb.Resources_remote_resources.value", "%7B%22[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.manifesturl", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.name", "Coupon Companion Plugin");
Deleted : user_pref("extensions.crossriderapp21804.21804.newtab", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.opensearch", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_1.code", "appAPI._cr_config={appID:fun[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_1.name", "base");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_1.ver", 6);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_1000014.code", "Array.prototype.indexO[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_1000014.name", "GPL Plugin (Loader)");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_1000014.ver", 15);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_1000015.code", "var a=appAPI.db.getLis[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_1000015.name", "GPL Background (BG)");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_1000015.ver", 39);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_13.code", "(function(a){a.selectedText[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_13.name", "CrossriderAppUtils");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_13.ver", 3);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_14.code", "if(typeof(appAPI)===\"undef[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_14.name", "CrossriderUtils");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_14.ver", 5);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_16.code", "if((typeof isBackground===\[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_16.name", "FFAppAPIWrapper");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_16.ver", 9);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_17.code", "if(typeof window!==\"undefi[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_17.name", "jQuery");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_17.ver", 4);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_21.code", "var CrossriderDebugManager=[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_21.name", "debug");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_21.ver", 4);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_22.code", "(function(a){appAPI.queueMa[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_22.name", "resources");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_22.ver", 4);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_28.code", "var CrossriderInitializerPl[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_28.name", "initializer");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_28.ver", 3);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_4.code", "var jQuery = $jquery_171 = $[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_4.name", "jquery_1_7_1");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_4.ver", 4);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_47.code", "(function(){appAPI.ready=fu[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_47.name", "resources_background");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_47.ver", 3);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_64.code", "(function(){var h=\"__CR_EM[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_64.name", "appApiMessage");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_64.ver", 2);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_72.code", "if(appAPI.__should_activate[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_72.name", "appApiValidation");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_72.ver", 3);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_78.code", "if(typeof jQuery!==\"undefi[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_78.name", "CrossriderInfo");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_78.ver", 3);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_98.code", "(function(){var b=\"cr_\"+a[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_98.name", "omniCommands");
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins.plugin_98.ver", 2);
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins_lists.plugins_0", "4,14,78,16,64,47,72,98,100[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins_lists.plugins_1", "17,14,78,13,16,64,4,1,21,2[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.plugins_lists.plugins_5", "4,14,78,13,16,64,47,72");
Deleted : user_pref("extensions.crossriderapp21804.21804.pluginsurl", "hxxps://w9u6a2p6.ssl.hwcdn.net/plugin/a[...]
Deleted : user_pref("extensions.crossriderapp21804.21804.pluginsversion", 51);
Deleted : user_pref("extensions.crossriderapp21804.21804.publisher", "Innovative Apps");
Deleted : user_pref("extensions.crossriderapp21804.21804.searchstatus", 0);
Deleted : user_pref("extensions.crossriderapp21804.21804.setnewtab", false);
Deleted : user_pref("extensions.crossriderapp21804.21804.settingsurl", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.thankyou", "");
Deleted : user_pref("extensions.crossriderapp21804.21804.updateinterval", 360);
Deleted : user_pref("extensions.crossriderapp21804.21804.ver", 54);
Deleted : user_pref("extensions.crossriderapp21804.adsOldValue", -1);
Deleted : user_pref("extensions.crossriderapp21804.apps", "21804");
Deleted : user_pref("extensions.crossriderapp21804.bic", "13c9c4ab0e82dfc21f2a2a1be103c7e2");
Deleted : user_pref("extensions.crossriderapp21804.cid", 21804);
Deleted : user_pref("extensions.crossriderapp21804.firstrun", false);
Deleted : user_pref("extensions.crossriderapp21804.hadappinstalled", true);
Deleted : user_pref("extensions.crossriderapp21804.installationdate", 1359831806);
Deleted : user_pref("extensions.crossriderapp21804.lastcheck", 22851377);
Deleted : user_pref("extensions.crossriderapp21804.lastcheckitem", 22851394);
Deleted : user_pref("extensions.crossriderapp21804.modetype", "production");
Deleted : user_pref("extensions.crossriderapp21804.reportInstall", true);
Deleted : user_pref("extensions.crossriderapp21804.statsDailyCounter", 3);

-\\ Google Chrome v27.0.1453.110

File : C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

-\\ Opera v12.15.1748.0

File : C:\Users\Trudy Stewart\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [18567 octets] - [18/06/2013 18:12:16]
AdwCleaner[S1].txt - [18886 octets] - [18/06/2013 19:24:54]

########## EOF - C:\AdwCleaner[S1].txt - [18947 octets] ##########

Next are the farbar results.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-06-2013
Ran by Trudy Stewart (administrator) on 18-06-2013 19:09:40
Running from C:\Users\Trudy Stewart\Downloads
Microsoft® Windows Vista Home Premium Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\system32\CISVC.EXE
(Hewlett-Packard Company) c:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Windows\System32\tcpsvcs.exe
(Microsoft Corporation) C:\Windows\System32\snmp.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Cisco Systems, Inc.) C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Nuance Communications, Inc.) C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
() C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
(Sun Microsystems, Inc.) C:\Windows\System32\jureg.exe
(Creative Technology Ltd.) C:\Windows\OEM05Mon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Linksys, LLC) C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
(Cisco Systems, Inc.) C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
(Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(The Privoxy team - www.privoxy.org) C:\Program Files\Privoxy\privoxy.exe
(Microsoft Corporation) C:\Windows\system32\schtasks.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
() C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
() C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
() C:\Users\Trudy Stewart\Downloads\AdwCleaner.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] RtHDVCpl.exe [x]
HKLM\...\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [79400 2007-02-04] (Nuance Communications, Inc.)
HKLM\...\Run: [WrtMon.exe] C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe [20480 2006-09-20] ()
HKLM\...\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE [x]
HKLM\...\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe" [54672 2008-03-25] (Sun Microsystems, Inc.)
HKLM\...\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart [86016 2007-08-27] (NVIDIA Corporation)
HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [8473120 2007-08-27] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit [81920 2007-08-27] (NVIDIA Corporation)
HKLM\...\Run: [OEM05Mon.exe] C:\Windows\OEM05Mon.exe [36864 2007-05-09] (Creative Technology Ltd.)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [x]
HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [Linksys Wireless Manager] "C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" /cm /min /lcid 1033 [1358384 2009-02-16] (Linksys, LLC)
HKLM\...\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [647216 2009-07-07] (Cisco Systems, Inc.)
HKLM\...\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe -hide [205336 2011-11-11] (Logitech Inc.)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4858968 2013-05-09] (AVAST Software)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [152392 2013-05-15] (Apple Inc.)
HKCU\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\Default\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [x]
HKU\Default User\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [x]
Startup: C:\ProgramData\Start Menu\Programs\Startup\Privoxy.lnk
ShortcutTarget: Privoxy.lnk -> C:\Program Files\Privoxy\privoxy.exe (The Privoxy team - www.privoxy.org)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?PC=BNHP
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=desktop
SearchScopes: HKLM - {11D231C8-2FE5-4B8A-B2F9-B1736520C7A2} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
SearchScopes: HKLM - {4C01D2EE-C655-4AE6-9F57-F91462B366F7} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
HKCU SearchScopes: DefaultScope {759B6E70-7A7D-4FE5-82BF-EA161AA627D9} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=800236&p={searchTerms}
SearchScopes: HKCU - {11D231C8-2FE5-4B8A-B2F9-B1736520C7A2} URL = 
SearchScopes: HKCU - {4C01D2EE-C655-4AE6-9F57-F91462B366F7} URL = 
SearchScopes: HKCU - {759B6E70-7A7D-4FE5-82BF-EA161AA627D9} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=800236&p={searchTerms}
BHO: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll No File
BHO: No Name - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
BHO: jZip Webmail plugin - {647FD14A-C4F1-46F4-8FC3-0B40F54226F7} - C:\Program Files\jZip\WebmailPlugin.dll (Discordia Limited)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU -No Name - {CB789373-04D5-4EF4-9C16-871463FD0830} - No File
Toolbar: HKCU -No Name - {724D43A0-0D85-11D4-9908-00400523E39A} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL No File [ ]
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 24.178.162.3 66.189.0.100 24.217.201.67

FireFox:
========
FF ProfilePath: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\Extensions\[email protected]

Chrome: 
=======
CHR Extension: (Envelopes for Google Docs) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaclkeicedlkpjgnnfkedjomkkhmgcod\2_0
CHR Extension: (Floorplanner) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\abopacaefhbognnmeigicfpgnmpideag\13_0
CHR Extension: (I Dream of Greenie) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\abpplimpipkdhcobigmhmmjpmmkjneod\0.2_0
CHR Extension: (Prezi) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\acoonfmhnndodekhecidldfdjgooefpg\1.3_0
CHR Extension: (Task Timer) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\aomfjmibjhhfdenfkpaodhnlhkolngif\3.9.1_1
CHR Extension: (Lucidchart: Diagramming) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\apboafhkiegglekeafbckfjldecefkhn\16_0
CHR Extension: (Google Drive) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (Loupe) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhaonknplhhecdgjpphnooeomecgipkc\2.0.4_0
CHR Extension: ( "name": "Print this page with CleanPrint") - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\biafepndnnahkfldhobcjlclklffkibe\4.7.0_0
CHR Extension: (Tabs Join) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\binjiceocgbfooocmheaenmmcominbpe\2.1_0
CHR Extension: (Aviary for Google Drive) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkinocibdedleighgndmbfpbialnblep\1.3_0
CHR Extension: (YouTube) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (HelloFax: 50 Free Fax Pages) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bocmleclimfnadgmcdgecijlblfcmfnm\1.12_0
CHR Extension: (Facebook) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\boeajhmfdjldchidhphikilcgdacljfm\1.0.3_0
CHR Extension: (Revision3) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\cncldpggpcpckadjcholildoahcgbmfo\1_0
CHR Extension: (TimelineRemove) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnedfaenfnkikficknkklbdedlecmpgc\1.1.0_1
CHR Extension: (Sumo Paint) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpgjihldbpodlmnjolekemlfbcajnmod\3.7_0
CHR Extension: (Easy Clock) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dplbpgapoedppajbikieafefmcceaagn\9.0.6_0
CHR Extension: (Gravity) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\eboilkbecbgepecmaaicggbpnlbcfagj\1_0
CHR Extension: (Facebook Disconnect) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpepffjfmamnambagiibghpglaidiec\1.3.0_0
CHR Extension: (Stupeflix Video Maker) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkdmcfnoimoilncpjchamnenebopocem\1.5_0
CHR Extension: (Springpad) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkmopoamfjnmppabeaphohombnjcjgla\6_0
CHR Extension: (EasyDrop) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\flogpfmjdekjoilcnmmchanikomlidie\1.3.0_0
CHR Extension: (Attachments.me for Gmail, Dropbox, Box, Drive) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdgofjdapkmlgpgjfielacjckplcdjjk\1.7.4_0
CHR Extension: (Click&Clean) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\8.3_0
CHR Extension: (DocuSign) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\goblijolcnempeilmnkmfbhohlpngemd\2.1.0.0_0
CHR Extension: (Drive Notepad) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpgjomejfimnbmobcocilppikhncegaj\1.2_0
CHR Extension: (Gradient Creator!) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcplneddoadgichngfbobgpllfphdfla\0.2.1.3_0
CHR Extension: (InfoAtoms) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhbgpoakplhahbklhkcfbpicgjcaoglk\1.5.0.0_0
CHR Extension: (Vector Paint) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnbpdiengicdefcjecjbnjnoifekhgdo\3.2.0.0_0
CHR Extension: (Pixlr Editor) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmaknaampgiegkcjlimdiidlhopknpk\1.2_0
CHR Extension: (persona/ you are what you love) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iehdddmijbgofffjjmhkodckmnombhmf\2.0.9_1
CHR Extension: (Sync SugarSync, Evernote, and Google Drive) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifanaabofjmgladnlbckonoiohpmchik\1.2.4.2_0
CHR Extension: (Pixorial Video) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ilbibicalpgnmbjnganinjppjephokai\1.0.3_0
CHR Extension: (Sync Dropbox, Evernote, and Google Drive) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iobcbdgacfkninlcbphihhdlkobkehia\1.2.4.2_0
CHR Extension: (Dropbox) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioekoebejdcmnlefjiknokhhafglcjdl\3.0.6_1
CHR Extension: ( "name": "Save this page with CleanSave") - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iplagehfoafmmjppeijnpkohihcllici\4.7.0_0
CHR Extension: (Free Online PDF Tools) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jddfpnmfhodaljeelokfceepbeapgbdn\1.0.1.2_0
CHR Extension: (Facebook Like Button) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jehaijobeonhempacbjelicepjkhoidi\1.0.3_0
CHR Extension: (mydeco 3D planner) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfnniehafojoidolddmhfnpnbiolbppi\2.3_0
CHR Extension: (Autodesk Homestyler) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdmmkfaghgcicheaimnpffeeekheafkb\2.3_0
CHR Extension: (eBay Extension for Google Chrome\u2122 (by eBay)) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khhckppjhonfmcpegdjdibmngahahhck\1.6.12_0
CHR Extension: (HuffingtonPost NewsGlide) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khjialelnkjdomiblmnpcpjongleegef\0.3.2_0
CHR Extension: (WordPress.com) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khjnjifipfkgglficmipimgjpbmlbemd\1.1.1_0
CHR Extension: (Magisto for Google Drive) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\kinnlbfbjboagbejldhemnifjepmkakj\1.0.4_1
CHR Extension: (CanvasDraw) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\knfimpamngmggpbamfoomdpebdoleghe\2_0
CHR Extension: (DriveTunes) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\labgcacinobdnkfndodfkfeabbjckbnj\3.2.4_0
CHR Extension: (Evernote Web) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol\1.0.7_0
CHR Extension: (Sketchpad) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkllajgbhondgjjnhmmgbjndmogapinp\1.0.0.4_0
CHR Extension: (Spanning Backup for Google Apps\u2122) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lniahgcddkbgipmbmlhjpoafdeephgcf\3.0.1.3_0
CHR Extension: (Word\u00B2) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpibnckjjeaabeepofhfmmpjmnomohee\2.5_0
CHR Extension: (Quick Note) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\mijlebbfndhelmdpmllgcfadlkankhok\1.4.8_0
CHR Extension: (Free Online PDF Unlocker) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkdknbehfogkgogcennnagfokmnimpab\1.0.1.1_0
CHR Extension: (deviantART muro) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\namljbfbglehfnlonjmebceimaalofei\1.0_0
CHR Extension: (InspirARTion) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhbmpilemgmpbdaniehhmodkkppkelec\10_0
CHR Extension: (Pinterest Keyboard Shortcut | Ctrl+Alt+P) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\npbcjndbpajikchenclendcojmaeaphh\1.2.2_1
CHR Extension: (Chrome to Phone) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oadboiipflhobonjjffjbfekfjcgkhco\2.3.1_0
CHR Extension: (Todo.ly) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhefmbclkekanpjjpkbciloojcmpkap\2_0
CHR Extension: (Bolt Save and Share) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofmipocdiiichlijcngflajilbpkkfhj\7.2_0
CHR Extension: (Photo Collage) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiabhgfgfhoilflkoicbmnejgjjfmhcg\1_0
CHR Extension: (WeVideo - Video Editor) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\okgjbfikepgflmlelgfgecmgjnmnmnnb\3.1.0_0
CHR Extension: (Pin Search | Image Search on Pinterest) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\okiaciimfpgbpdhnfdllhdkicpmdoakm\1.0.11_0
CHR Extension: (SlideRocket) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\omeengfjefdmhnkojnfmncpfdbhnecea\2.0.2_0
CHR Extension: (Picasa) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb\6.2.2_0
CHR Extension: (Diigo Web Collector - Capture and Annotate) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oojbgadfejifecebmdnhhkbhdjaphole\2.1.10_0
CHR Extension: (Click&Clean App) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdabfienifkbhoihedcgeogidfmibmhp\8.0_0
CHR Extension: (Outlook.com) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfpeapihoiogbcmdmnibeplnikfnhoge\1.0.2_0
CHR Extension: () - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc\5.9.15_0
CHR Extension: (Gmail) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR Extension: (Balsamiq Mockups) - C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pplbmgaodhjmbklkgkgmlghaekcfhhkk\1.9_0

========================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536 2007-09-19] (Hewlett-Packard)
R2 iprip; C:\Windows\System32\iprip.dll [29696 2006-11-02] (Microsoft Corporation)
R2 nmservice; C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe [647216 2009-07-07] (Cisco Systems, Inc.)
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
S2 RoxLiveShare9; "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe" [x]
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-05-09] (AVAST Software)
R1 AswRdr; C:\Windows\System32\Drivers\AswRdr.sys [49760 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [765736 2013-05-09] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [368944 2013-05-09] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [174664 2013-05-09] ()
S3 CompFilter; C:\Windows\System32\DRIVERS\lvbusflt.sys [22176 2012-01-18] (Logitech Inc.)
S3 Linksys_adapter; C:\Windows\System32\DRIVERS\AE1200vista.sys [1073216 2011-03-30] (Broadcom Corporation)
R3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [36112 2007-04-11] (Logitech, Inc.)
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25824 2010-05-07] ()
S3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41752 2007-10-12] (Logitech Inc.)
S3 NPF; C:\Windows\System32\drivers\npf.sys [34064 2007-11-06] (CACE Technologies)
S3 OEM05Afx; C:\Windows\system32\Drivers\OEM05Afx.sys [141376 2007-06-08] (Creative Technology Ltd.)
R3 OEM05Vfx; C:\Windows\System32\DRIVERS\OEM05Vfx.sys [7424 2007-03-05] (EyePower Games Pte. Ltd.)
R3 OEM05Vid; C:\Windows\System32\DRIVERS\OEM05Vid.sys [235616 2007-07-20] (Creative Technology Ltd.)
R2 pnarp; C:\Windows\System32\DRIVERS\pnarp.sys [26672 2009-07-07] (Cisco Systems, Inc.)
R2 purendis; C:\Windows\System32\DRIVERS\purendis.sys [27696 2009-07-07] (Cisco Systems, Inc.)
S3 WUSB54GCv3; C:\Windows\System32\DRIVERS\WUSB54GCv3.sys [645120 2008-12-04] (Ralink Technology Corp.)
R3 xcbdaNtsc; C:\Windows\System32\DRIVERS\xcbda.sys [156928 2007-09-07] (ViXS Systems Inc.)
S4 blbdrive; No ImagePath
S3 catchme; \??\C:\Users\TRUDYS~1\AppData\Local\Temp\catchme.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 IpInIp; No ImagePath
S3 lvpopflt; system32\DRIVERS\lvpopflt.sys [x]
S3 NwlnkFlt; No ImagePath
S3 NwlnkFwd; No ImagePath
S3 PCTINDIS5; \??\C:\Windows\system32\PCTINDIS5.SYS [x]
S3 pctplsg; \??\C:\Windows\System32\drivers\pctplsg.sys [x]
S3 RimUsb; No ImagePath
S3 SymIMMP; system32\DRIVERS\SymIM.sys [x]
S0 TfFsMon; system32\drivers\TfFsMon.sys [x]
S3 TfNetMon; \??\C:\Windows\system32\drivers\TfNetMon.sys [x]
S0 TfSysMon; system32\drivers\TfSysMon.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-06-18 19:09 - 2013-06-18 19:09 - 00000000 ____D C:\FRST
2013-06-18 18:28 - 2013-06-18 18:28 - 01367073 ____A (Farbar) C:\Users\Trudy Stewart\Downloads\FRST.exe
2013-06-18 18:14 - 2013-06-18 18:14 - 00018567 ____A C:\Users\Trudy Stewart\Desktop\AdwCleaner[R1].txt
2013-06-18 18:12 - 2013-06-18 18:12 - 00018567 ____A C:\AdwCleaner[R1].txt
2013-06-18 18:08 - 2013-06-18 18:08 - 00648201 ____A C:\Users\Trudy Stewart\Downloads\AdwCleaner.exe
2013-06-16 12:51 - 2013-06-16 12:51 - 00499808 ____A C:\Users\Trudy Stewart\Downloads\GoPlayer.exe
2013-06-16 12:49 - 2013-06-16 12:49 - 00000506 ____A C:\Users\Trudy Stewart\Desktop\parvin.txt
2013-06-15 21:27 - 2013-06-15 22:29 - 00000000 ____D C:\ProgramData\SecTaskMan
2013-06-15 21:27 - 2013-06-15 21:27 - 00000000 ____D C:\Program Files\Security Task Manager
2013-06-15 21:26 - 2013-06-15 21:26 - 02365840 ____A C:\Users\Trudy Stewart\Downloads\SecurityTaskManager_Setup.exe
2013-06-13 09:26 - 2013-06-13 09:26 - 20034184 ____A (Microsoft Corporation) C:\Users\Trudy Stewart\Downloads\Windows-KB890830-V5.1.exe
2013-06-13 08:35 - 2013-05-16 18:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-13 08:35 - 2013-05-16 18:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-13 08:34 - 2013-05-16 19:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-13 08:34 - 2013-05-16 18:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-13 08:34 - 2013-05-16 18:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 08:34 - 2013-05-16 18:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 08:34 - 2013-05-16 18:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-13 08:34 - 2013-05-16 18:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-13 08:34 - 2013-05-16 18:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-13 08:34 - 2013-05-16 18:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 08:34 - 2013-05-16 18:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 08:34 - 2013-05-16 18:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-13 08:34 - 2013-05-16 18:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-13 08:34 - 2013-05-16 18:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 08:34 - 2013-05-16 18:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-13 08:34 - 2013-05-16 18:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 11:15 - 2013-05-08 00:37 - 00905576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 11:15 - 2013-05-02 00:04 - 00443904 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 11:15 - 2013-05-02 00:03 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\printcom.dll
2013-06-12 11:14 - 2013-05-02 18:03 - 03603832 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 11:14 - 2013-05-02 18:03 - 03551096 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 11:14 - 2013-04-24 00:00 - 00985600 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 11:14 - 2013-04-24 00:00 - 00133120 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 11:14 - 2013-04-24 00:00 - 00098304 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 11:14 - 2013-04-24 00:00 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 11:14 - 2013-04-23 21:46 - 00812544 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 11:14 - 2013-04-17 08:30 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-11 20:50 - 2013-06-11 20:50 - 00377856 ____A C:\Users\Trudy Stewart\Downloads\05ip2x7x.exe
2013-06-11 17:00 - 2013-06-11 17:00 - 00377856 ____A C:\Users\Trudy Stewart\Desktop\l7643qrl.exe
2013-06-11 16:12 - 2013-06-11 16:12 - 00509440 ____A (Tech Support Guy System) C:\Users\Trudy Stewart\Downloads\SysInfo.exe
2013-06-11 15:41 - 2013-06-11 15:41 - 00299364 ____A C:\Users\Trudy Stewart\Desktop\gmer.txt
2013-06-11 15:02 - 2013-06-11 15:02 - 00377856 ____A C:\Users\Trudy Stewart\Downloads\rkpu8dik.exe
2013-06-11 14:52 - 2013-06-11 14:52 - 00688992 ____R (Swearware) C:\Users\Trudy Stewart\Downloads\dds.com
2013-06-11 14:22 - 2013-06-11 14:22 - 00011179 ____A C:\Users\Trudy Stewart\Desktop\hijackthis.log
2013-06-11 14:21 - 2013-06-11 15:40 - 00000000 ____D C:\Users\Trudy Stewart\Downloads\New Folder
2013-06-11 14:21 - 2013-06-11 14:21 - 00000000 ____D C:\Users\Trudy Stewart\Desktop\New Folder
2013-06-11 14:19 - 2013-06-11 14:19 - 00000895 ____A C:\Users\Trudy Stewart\Downloads\HijackThis (4).exe - Shortcut.lnk
2013-06-11 14:17 - 2013-06-11 14:17 - 00388608 ____A (Trend Micro Inc.) C:\Users\Trudy Stewart\Downloads\HijackThis (4).exe
2013-06-11 14:17 - 2013-06-11 14:17 - 00388608 ____A (Trend Micro Inc.) C:\Users\Trudy Stewart\Downloads\HijackThis (3).exe
2013-06-11 14:16 - 2013-06-11 14:16 - 00388608 ____A (Trend Micro Inc.) C:\Users\Trudy Stewart\Downloads\HijackThis (2).exe
2013-06-11 13:47 - 2013-06-11 13:47 - 00388608 ____A (Trend Micro Inc.) C:\Users\Trudy Stewart\Downloads\HijackThis.exe
2013-05-27 13:18 - 2013-05-27 13:18 - 00001626 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-05-27 13:18 - 2013-05-27 13:18 - 00000000 ____D C:\Users\Trudy Stewart\AppData\Local\Apple Computer
2013-05-27 13:18 - 2012-08-21 13:01 - 00026840 ____A (GEAR Software Inc.) C:\Windows\System32\Drivers\GEARAspiWDM.sys
2013-05-27 13:17 - 2013-05-27 13:18 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-05-27 13:17 - 2013-05-27 13:18 - 00000000 ____D C:\Program Files\iTunes
2013-05-27 13:17 - 2013-05-27 13:17 - 00000000 ____D C:\Program Files\iPod
2013-05-27 13:14 - 2013-05-27 13:14 - 00000000 ____D C:\Program Files\Bonjour
2013-05-27 12:59 - 2013-05-27 13:17 - 00000000 ____D C:\ProgramData\Apple Computer
2013-05-27 12:59 - 2013-05-27 12:59 - 00001688 ____A C:\Users\Public\Desktop\QuickTime Player.lnk
2013-05-27 12:59 - 2013-05-27 12:59 - 00000000 ____D C:\Program Files\QuickTime
2013-05-21 11:29 - 2013-04-15 10:20 - 00638328 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-21 11:29 - 2013-04-13 06:56 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-21 11:29 - 2013-04-08 21:36 - 02049024 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

==================== One Month Modified Files and Folders ========

2013-06-18 19:09 - 2013-06-18 19:09 - 00000000 ____D C:\FRST
2013-06-18 18:43 - 2006-11-02 08:47 - 00003568 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-18 18:43 - 2006-11-02 08:47 - 00003568 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-18 18:36 - 2012-09-19 17:15 - 00000900 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-18 18:28 - 2013-06-18 18:28 - 01367073 ____A (Farbar) C:\Users\Trudy Stewart\Downloads\FRST.exe
2013-06-18 18:14 - 2013-06-18 18:14 - 00018567 ____A C:\Users\Trudy Stewart\Desktop\AdwCleaner[R1].txt
2013-06-18 18:12 - 2013-06-18 18:12 - 00018567 ____A C:\AdwCleaner[R1].txt
2013-06-18 18:08 - 2013-06-18 18:08 - 00648201 ____A C:\Users\Trudy Stewart\Downloads\AdwCleaner.exe
2013-06-18 18:01 - 2007-12-11 02:26 - 01767103 ____A C:\Windows\WindowsUpdate.log
2013-06-18 17:00 - 2008-06-01 13:58 - 00000454 ____A C:\Windows\Tasks\RegCure Program Check.job
2013-06-18 16:43 - 2012-09-28 20:17 - 00065536 _____ C:\Windows\System32\Ikeext.etl
2013-06-18 16:43 - 2012-09-19 17:15 - 00000896 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-18 16:43 - 2006-11-02 09:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-18 11:13 - 2006-11-02 09:01 - 00032572 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-16 14:20 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\tracing
2013-06-16 12:51 - 2013-06-16 12:51 - 00499808 ____A C:\Users\Trudy Stewart\Downloads\GoPlayer.exe
2013-06-16 12:49 - 2013-06-16 12:49 - 00000506 ____A C:\Users\Trudy Stewart\Desktop\parvin.txt
2013-06-15 22:29 - 2013-06-15 21:27 - 00000000 ____D C:\ProgramData\SecTaskMan
2013-06-15 21:27 - 2013-06-15 21:27 - 00000000 ____D C:\Program Files\Security Task Manager
2013-06-15 21:26 - 2013-06-15 21:26 - 02365840 ____A C:\Users\Trudy Stewart\Downloads\SecurityTaskManager_Setup.exe
2013-06-13 09:26 - 2013-06-13 09:26 - 20034184 ____A (Microsoft Corporation) C:\Users\Trudy Stewart\Downloads\Windows-KB890830-V5.1.exe
2013-06-13 09:00 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\rescache
2013-06-13 08:36 - 2009-02-18 17:05 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-12 20:46 - 2013-02-02 15:06 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-06-11 22:28 - 2008-05-19 19:38 - 00000000 ____D C:\users\Trudy Stewart
2013-06-11 20:50 - 2013-06-11 20:50 - 00377856 ____A C:\Users\Trudy Stewart\Downloads\05ip2x7x.exe
2013-06-11 18:39 - 2012-05-13 12:54 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-11 18:39 - 2012-05-13 12:54 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-11 17:00 - 2013-06-11 17:00 - 00377856 ____A C:\Users\Trudy Stewart\Desktop\l7643qrl.exe
2013-06-11 16:12 - 2013-06-11 16:12 - 00509440 ____A (Tech Support Guy System) C:\Users\Trudy Stewart\Downloads\SysInfo.exe
2013-06-11 15:41 - 2013-06-11 15:41 - 00299364 ____A C:\Users\Trudy Stewart\Desktop\gmer.txt
2013-06-11 15:40 - 2013-06-11 14:21 - 00000000 ____D C:\Users\Trudy Stewart\Downloads\New Folder
2013-06-11 15:02 - 2013-06-11 15:02 - 00377856 ____A C:\Users\Trudy Stewart\Downloads\rkpu8dik.exe
2013-06-11 14:55 - 2013-03-10 20:56 - 00017890 ____A C:\Users\Trudy Stewart\Desktop\dds.txt
2013-06-11 14:55 - 2013-03-10 20:56 - 00011487 ____A C:\Users\Trudy Stewart\Desktop\attach.txt
2013-06-11 14:52 - 2013-06-11 14:52 - 00688992 ____R (Swearware) C:\Users\Trudy Stewart\Downloads\dds.com
2013-06-11 14:22 - 2013-06-11 14:22 - 00011179 ____A C:\Users\Trudy Stewart\Desktop\hijackthis.log
2013-06-11 14:21 - 2013-06-11 14:21 - 00000000 ____D C:\Users\Trudy Stewart\Desktop\New Folder
2013-06-11 14:20 - 2013-03-10 20:41 - 00011179 ____A C:\Users\Trudy Stewart\Downloads\hijackthis.log
2013-06-11 14:19 - 2013-06-11 14:19 - 00000895 ____A C:\Users\Trudy Stewart\Downloads\HijackThis (4).exe - Shortcut.lnk
2013-06-11 14:17 - 2013-06-11 14:17 - 00388608 ____A (Trend Micro Inc.) C:\Users\Trudy Stewart\Downloads\HijackThis (4).exe
2013-06-11 14:17 - 2013-06-11 14:17 - 00388608 ____A (Trend Micro Inc.) C:\Users\Trudy Stewart\Downloads\HijackThis (3).exe
2013-06-11 14:16 - 2013-06-11 14:16 - 00388608 ____A (Trend Micro Inc.) C:\Users\Trudy Stewart\Downloads\HijackThis (2).exe
2013-06-11 13:59 - 2008-06-16 13:39 - 00000000 ____D C:\Users\Trudy Stewart\AppData\Roaming\OpenOffice.org2
2013-06-11 13:47 - 2013-06-11 13:47 - 00388608 ____A (Trend Micro Inc.) C:\Users\Trudy Stewart\Downloads\HijackThis.exe
2013-06-11 08:41 - 2012-09-19 17:15 - 00001933 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-06-03 17:43 - 2006-11-02 06:24 - 73393752 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-05-27 20:02 - 2006-11-02 06:33 - 00743956 ____A C:\Windows\System32\PerfStringBackup.INI
2013-05-27 18:14 - 2006-11-02 06:23 - 00002577 ____A C:\Windows\System32\config.nt
2013-05-27 13:18 - 2013-05-27 13:18 - 00001626 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-05-27 13:18 - 2013-05-27 13:18 - 00000000 ____D C:\Users\Trudy Stewart\AppData\Local\Apple Computer
2013-05-27 13:18 - 2013-05-27 13:17 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-05-27 13:18 - 2013-05-27 13:17 - 00000000 ____D C:\Program Files\iTunes
2013-05-27 13:18 - 2013-04-30 11:14 - 00000000 ____D C:\Users\Trudy Stewart\AppData\Roaming\Apple Computer
2013-05-27 13:17 - 2013-05-27 13:17 - 00000000 ____D C:\Program Files\iPod
2013-05-27 13:17 - 2013-05-27 12:59 - 00000000 ____D C:\ProgramData\Apple Computer
2013-05-27 13:17 - 2009-12-07 10:18 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-05-27 13:16 - 2009-03-25 22:15 - 00000000 ____D C:\ProgramData\Apple
2013-05-27 13:14 - 2013-05-27 13:14 - 00000000 ____D C:\Program Files\Bonjour
2013-05-27 12:59 - 2013-05-27 12:59 - 00001688 ____A C:\Users\Public\Desktop\QuickTime Player.lnk
2013-05-27 12:59 - 2013-05-27 12:59 - 00000000 ____D C:\Program Files\QuickTime
2013-05-22 20:46 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-05-22 20:32 - 2006-11-02 08:47 - 00408168 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-21 15:45 - 2012-09-05 17:15 - 00001849 ____A C:\Users\Public\Desktop\Adobe Reader 9.lnk
2013-05-21 13:30 - 2009-03-26 23:24 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR

Files to move or delete:
====================
C:\Users\Trudy Stewart\gosetup.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-06-18 16:51

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 19-06-2013
Ran by Trudy Stewart at 2013-06-18 19:10:15 Run:
Running from C:\Users\Trudy Stewart\Downloads
Boot Mode: Normal
==========================================================

==================== Installed Programs =======================

Update for Microsoft Office 2007 (KB2508958)
Acrobat.com (Version: 1.7.186)
Adobe AIR (Version: 3.7.0.1860)
Adobe Flash Player 11 ActiveX (Version: 11.7.700.169)
Adobe Flash Player 11 Plugin (Version: 11.7.700.224)
Adobe Reader 9.5.5 (Version: 9.5.5)
Adobe Shockwave Player 12.0 (Version: 12.0.0.112)
Apple Application Support (Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
ArtRage 2 Starter Edition (Version: 2.5.20)
avast! Free Antivirus (Version: 8.0.1489.0)
Bonjour (Version: 3.0.0.10)
CameraHelperMsi (Version: 13.31.1038.0)
Canon IJ Network Scan Utility
Canon IJ Network Tool
Canon MP Navigator EX 1.0
Canon MP560 series MP Drivers
Canon MX700 series
Canon My Printer
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Solution Menu
Cards_Calendar_OrderGift_DoMorePlugout (Version: 1.00.0000)
Chasys Draw IES 3.72.01 (Version: 3.72.01)
CoffeeCup HTML Editor 2008
Color Style Studio 2.4 (Version: 2.4)
ColorPic (Version: 4.1)
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
Coupon Companion Plugin (Version: 1.26.152.152)
CyberLink DVD Suite Deluxe (Version: 5.5.1019)
DHTML Editing Component (Version: 6.02.0001)
doPDF 7.3 printer
Enhanced Multimedia Keyboard Solution
erLT (Version: 1.20.138.34)
Evernote (Version: 3.1.0.1107)
FastStone Image Viewer 3.5 (Version: 3.5)
Google Chrome (Version: 27.0.1453.110)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Update Helper (Version: 1.3.21.145)
Hewlett-Packard Active Check (Version: 1.1.11.0)
Hewlett-Packard Asset Agent for Health Check (Version: 2.0.62.5)
HP Active Support Library (Version: 2.3.0.2)
HP Customer Experience Enhancements (Version: 5.4.0.2360)
HP Customer Feedback (Version: 1.0.0)
HP Easy Setup - Frontend (Version: 5.4.0.2430)
HP On-Screen Cap/Num/Scroll Lock Indicator
HP Photosmart Essential 2.5 (Version: 1.02.0000)
HP Photosmart Essential 2.5 (Version: 2.5)
HP Picasso Media Center Add-In (Version: 1.0.0)
HP Update (Version: 4.000.007.003)
HPPhotoSmartPhotobookWebPack1 (Version: 1.00.0000)
iCloud (Version: 2.1.2.8)
Image Mender 1.22 (Version: 1.22)
InfoAtoms [Uninstall] (Version: 1.5.0.0)
Inkscape 0.46 (Version: 0.46)
Interior Designer 8 (Version: 8.5.5.21)
iTunes (Version: 11.0.3.42)
Java 7 Update 21 (Version: 7.0.210)
Java Auto Updater (Version: 2.1.9.5)
jZip
LabelPrint (Version: 2.2.2209)
LightBox Free Image Editor
LightScribe System Software 1.10.16.1 (Version: 1.10.16.1)
LightScribe Template Labeler (Version: 1.10.13.1)
Linksys Wireless Manager (Version: 4.9.9047.0)
Logitech Webcam Software (Version: 2.0)
LWS Facebook (Version: 13.31.1038.0)
LWS Gallery (Version: 13.31.1038.0)
LWS Help_main (Version: 13.31.1044.0)
LWS Launcher (Version: 13.31.1038.0)
LWS Motion Detection (Version: 13.30.1395.0)
LWS Pictures And Video (Version: 13.31.1038.0)
LWS Twitter (Version: 13.30.1346.0)
LWS Video Mask Maker (Version: 13.30.1379.0)
LWS VideoEffects (Version: 13.30.1379.0)
LWS Webcam Software (Version: 13.31.1038.0)
LWS WLM Plugin (Version: 1.30.1201.0)
LWS YouTube Plugin (Version: 13.31.1038.0)
Malwarebytes Anti-Malware version 1.70.0.1100 (Version: 1.70.0.1100)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Ultimate 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft Visual C Runtime (Version: 8.0.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Works (Version: 9.7.0621)
Monitor Webcam (SP2208WFP) Driver (1.00.08.0720) 
Mozilla Firefox 20.0.1 (x86 en-US) (Version: 20.0.1)
Mozilla Maintenance Service (Version: 20.0.1)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
muvee autoProducer 6.1 (Version: 6.10.050)
NoteTab Light 7 (Remove only) (Version: 7.1)
NVIDIA Drivers
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
OpenOffice.org 2.4 (Version: 2.4.9286)
Opera 12.15 (Version: 12.15.1748)
Photo Effect Studio 5.56
Photo Story 3 for Windows (Version: 3.0.1115.11)
PhotoS (Version: 4.0.0)
Picasa 3 (Version: 3.8)
Picture Painter Home and Landscape (Version: 2.0.0.33)
Power2Go (Version: 5.6.3417)
PowerDirector (Version: 6.5.2209)
Presto! PageManager 7.15.16 (Version: 7.15.16)
Privoxy (remove only)
Professor Answers (Version: )
Professor Teaches Windows Vista Premium (Version: 1.0)
PSSWCORE (Version: 2.02.0000)
Pure Networks Platform (Version: 11.2.09195.1)
Python 2.5 (Version: 2.5.150)
QuickTime (Version: 7.74.80.86)
Realtek High Definition Audio Driver (Version: 6.0.1.5789)
RegCure 1.5.0.1 (Version: 1.5.0.1)
ScanSoft OmniPage SE 4 (Version: 15.2.0020)
Security Task Manager 1.8g (Version: 1.8g)
Soft Data Fax Modem with SmartCP (Version: 7.74.00)
swMSM (Version: 12.0.0.1)
Transmute v1.10 (Version: 1.10.7.0)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817327) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VideoToolkit01 (Version: 100.0.128.000)
Visual C++ 2008 x86 Runtime - (v9.0.30729) (Version: 9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01 (Version: 9.0.30729.01)
VLC media player 2.0.6 (Version: 2.0.6)
WeatherBug Gadget (Version: 1.0.0.6)
Windows 7 Upgrade Advisor (Version: 2.0.5000.0)
WinPcap 4.0.2 (Version: 4.0.0.1040)

==================== Restore Points =========================

30-04-2013 01:34:43 Installed QuickTime
30-04-2013 17:02:13 Scheduled Checkpoint
01-05-2013 21:37:14 Scheduled Checkpoint
03-05-2013 23:07:54 Scheduled Checkpoint
04-05-2013 13:15:59 Windows Update
10-05-2013 21:15:30 Windows Update
11-05-2013 15:59:48 Scheduled Checkpoint
21-05-2013 15:28:21 Windows Update
22-05-2013 23:58:48 Windows Update
23-05-2013 23:57:22 Scheduled Checkpoint
25-05-2013 00:06:18 Scheduled Checkpoint
27-05-2013 16:54:48 Scheduled Checkpoint
27-05-2013 17:15:25 Device Driver Package Install: Apple, Inc. Universal Serial Bus controllers
27-05-2013 17:15:42 Device Driver Package Install: Apple Network adapters
30-05-2013 21:08:42 Windows Update
02-06-2013 15:10:13 Scheduled Checkpoint
04-06-2013 11:51:10 Windows Update
05-06-2013 16:13:56 Scheduled Checkpoint
11-06-2013 12:25:03 Windows Update
12-06-2013 15:43:50 Scheduled Checkpoint
13-06-2013 12:28:14 Windows Update
15-06-2013 18:33:25 Scheduled Checkpoint
16-06-2013 01:31:58 Uninstall "ShellExecuteHook"
16-06-2013 14:15:02 Scheduled Checkpoint
18-06-2013 14:51:27 Windows Update

==================== Scheduled Tasks (whitelisted) =============

Task: {004D7633-5DE0-467D-BE3A-81DFB90DD1A5} - System32\Tasks\HPCeeScheduleForTrudy Stewart => C:\Program Files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2007-07-20] (Hewlett-Packard)
Task: {18833E92-DC81-4982-ACDB-3A3133010851} - System32\Tasks\RegCure Program Check => C:\Program Files\RegCure\RegCure.exe [2008-04-21] ()
Task: {197C238E-F862-45D9-8B03-04ED71B1C689} - System32\Tasks\Updater21804.exe => C:\Users\Trudy No File
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {2FDBDC47-7148-49DB-9D32-32E6A003C996} - System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 => C:\Windows\System32\rundll32 No File
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {55264CD0-5482-468C-9D0B-F0415F08167C} - System32\Tasks\RegCure => C:\Program Files\RegCure\RegCure.exe [2008-04-21] ()
Task: {561375CB-FF5A-417B-B297-BA73DE149581} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs [2008-01-05] ()
Task: {565442F0-71A9-44D5-9D72-17D0260541C3} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-19] (Microsoft Corporation)
Task: {69053441-0B5E-42EE-8B16-B5C06167FB57} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {6B651170-7FCA-4D01-8EDB-F6C11457365F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-09-19] (Google Inc.)
Task: {7199355F-5E91-49C3-94FA-9299164A4022} - System32\Tasks\JavaUpdateTrudy Stewart => C:\Windows\system32\jusched.exe No File
Task: {800AD5A0-FF94-4C15-8557-383193AAF7A0} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)
Task: {84B4FC78-F0A3-4675-98A9-FF6CE131E432} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-19] (Microsoft Corporation)
Task: {880EE216-4D95-4246-922A-0F48120C7265} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2008-01-19] (Microsoft Corporation)
Task: {A4270F9C-16DF-43AB-827E-3748BE5FFDC5} - System32\Tasks\Go to RoboForm Install page => C:\Windows\system32\rundll32.exe [2006-11-02] (Microsoft Corporation)
Task: {A61555D3-7840-45C1-A5A9-0D49851DE37A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-19] (Microsoft Corporation)
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => C:\Windows\system32\rundll32.exe [2006-11-02] (Microsoft Corporation)
Task: {B42E7FCF-0DD5-469B-A06E-6C11FA1A23D8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-09-19] (Google Inc.)
Task: {B5273A8B-DEDF-4874-A87D-A8B35E1A7443} - System32\Tasks\WPD\SqmUpload_S-1-5-21-3524870626-1478210970-89139702-1000 => C:\Windows\system32\rundll32.exe [2006-11-02] (Microsoft Corporation)
Task: {BD85C4B3-6245-49AA-A253-1F1A1262CD83} - System32\Tasks\PC-Doctor\Scheduled Maintanence => C:\Program Files\PC-Doctor 5 for Windows\RunProfiler.exe No File
Task: {BE4508DD-9EAA-4195-B9D4-A7518886BCDC} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {D59ED09F-83D2-4402-9870-1B2A93201CA1} - System32\Tasks\JavaUpdateSYSTEM => C:\Windows\System32\jusched.exe No File
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: {E685E160-8DA8-4853-809C-D61148CB13FA} - System32\Tasks\JavaUpdateAdministrator => C:\Windows\system32\jusched.exe No File
Task: {F8D6E476-24FE-4649-A4D7-985706B29128} - System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 => C:\Windows\System32\rundll32 No File
Task: {FDFE9A87-5A6C-448C-BC7B-F4C2B073B6B2} - System32\Tasks\Run RoboForm TaskBar Icon => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe No File

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (06/15/2013 09:31:55 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {ae79c5d7-a220-4d31-85b6-3f23ddeb8092}

Error: (06/11/2013 09:52:57 PM) (Source: EvntAgnt) (User: )
Description: Error positioning to end of log file -- can't get oldest log record. Handle specified is 28311628. Return code from GetOldestEventLogRecord is 8.

Error: (06/11/2013 09:52:57 PM) (Source: EvntAgnt) (User: )
Description: Error positioning to end of log file -- can't get oldest log record. Handle specified is 28311620. Return code from GetOldestEventLogRecord is 8.

Error: (06/11/2013 09:52:57 PM) (Source: EvntAgnt) (User: )
Description: Error positioning to end of log file -- can't get oldest log record. Handle specified is 28311612. Return code from GetOldestEventLogRecord is 8.

Error: (06/11/2013 09:52:57 PM) (Source: EvntAgnt) (User: )
Description: Error positioning to end of log file -- can't get oldest log record. Handle specified is 28311604. Return code from GetOldestEventLogRecord is 8.

Error: (06/11/2013 09:52:57 PM) (Source: EvntAgnt) (User: )
Description: Error positioning to end of log file -- can't get oldest log record. Handle specified is 28311564. Return code from GetOldestEventLogRecord is 8.

Error: (06/11/2013 09:52:57 PM) (Source: EvntAgnt) (User: )
Description: Error positioning to end of log file -- can't get oldest log record. Handle specified is 28311644. Return code from GetOldestEventLogRecord is 8.

Error: (06/11/2013 09:52:57 PM) (Source: EvntAgnt) (User: )
Description: Error positioning to end of log file -- can't get oldest log record. Handle specified is 28311636. Return code from GetOldestEventLogRecord is 8.

Error: (06/11/2013 09:52:57 PM) (Source: EvntAgnt) (User: )
Description: Error positioning to end of log file -- can't get oldest log record. Handle specified is 28311596. Return code from GetOldestEventLogRecord is 8.

Error: (06/11/2013 09:52:57 PM) (Source: EvntAgnt) (User: )
Description: Error positioning to end of log file -- can't get oldest log record. Handle specified is 28311572. Return code from GetOldestEventLogRecord is 8.

System errors:
=============
Error: (06/18/2013 04:44:39 PM) (Source: Service Control Manager) (User: )
Description: TfFsMon
TfSysMon

Error: (06/18/2013 04:44:39 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (06/18/2013 10:47:15 AM) (Source: Service Control Manager) (User: )
Description: TfFsMon
TfSysMon

Error: (06/18/2013 10:47:15 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (06/16/2013 09:14:40 PM) (Source: Service Control Manager) (User: )
Description: TfFsMon
TfSysMon

Error: (06/16/2013 09:14:40 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (06/16/2013 09:38:00 AM) (Source: Service Control Manager) (User: )
Description: TfFsMon
TfSysMon

Error: (06/16/2013 09:38:00 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (06/15/2013 07:31:15 PM) (Source: Service Control Manager) (User: )
Description: TfFsMon
TfSysMon

Error: (06/15/2013 07:31:15 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
Date: 2013-03-29 00:00:01.502
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-03-29 00:00:00.582
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-02-18 18:05:17.826
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-02-18 18:05:16.734
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-02-18 18:05:15.626
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-02-18 18:05:14.550
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-02-18 18:05:13.474
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-02-18 18:05:12.397
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-02-18 18:05:11.305
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-02-18 18:05:10.213
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Percentage of memory in use: 51%
Total physical RAM: 3069.83 MB
Available physical RAM: 1488.13 MB
Total Pagefile: 6348.1 MB
Available Pagefile: 4684.39 MB
Total Virtual: 2047.88 MB
Available Virtual: 1906.05 MB

==================== Drives ================================

Drive c: (HP) (Fixed) (Total:288.49 GB) (Free:194.64 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (FACTORY_IMAGE) (Fixed) (Total:9.6 GB) (Free:1.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_PAVILION) (Fixed) (Total:298.09 GB) (Free:294.68 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=288 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=10 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 298 GB) (Disk ID: 77E6B1D3)
Partition 1: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Again, thank you for your help!


----------



## kevinf80 (Mar 21, 2006)

Continue as follows:

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from the following link :-

http://download.bleepingcomputer.com/sUBs/ComboFix.exe


 Ensure that Combofix is saved directly to the Desktop * <--- Very important*

 Disable all security programs as they will have a negative effect on Combofix, instructions available here http://www.bleepingcomputer.com/forums/topic114351.html if required. Be aware the list may not have all programs listed, if you need more help please ask.

 Close any open browsers and any other programs you might have running

 Double click the







icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)

 Instructions for running Combofix available here http://www.bleepingcomputer.com/combofix/how-to-use-combofix if required.

 If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.

 When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

*******Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze* ******

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read here http://thespykiller.co.uk/index.php?page=20 why disabling autoruns is recommended.

*EXTRA NOTES*

 If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
 *If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal*
 If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Post the log in next reply please...

Kevin


----------



## Trutalley (Mar 10, 2013)

ComboFix 13-06-18.02 - Trudy Stewart 06/19/2013 12:21:00.4.4 - x86
Microsoft® Windows Vista Home Premium 6.0.6002.2.1252.1.1033.18.3070.2034 [GMT -4:00]
Running from: c:\users\Trudy Stewart\Desktop\herewego.exe
AV: avast! Antivirus *Disabled/Outdated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Outdated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-05-19 to 2013-06-19 )))))))))))))))))))))))))))))))
.
.
2013-06-19 16:31 . 2013-06-19 16:31	--------	d-----w-	c:\users\Trudy Stewart\AppData\Local\temp
2013-06-19 16:31 . 2013-06-19 16:31	--------	d-----w-	c:\users\Public\AppData\Local\temp
2013-06-19 16:31 . 2013-06-19 16:31	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-06-18 23:26 . 2013-06-18 23:27	89	----a-w-	c:\windows\DeleteOnReboot.bat
2013-06-18 23:09 . 2013-06-18 23:09	--------	d-----w-	C:\FRST
2013-06-18 14:58 . 2013-06-12 04:18	7068072	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{81EB2B8F-2523-44F1-99F7-59675EBB80DF}\mpengine.dll	ERROR(0x00000005)
2013-06-16 01:27 . 2013-06-16 01:27	--------	d-----w-	c:\program files\Security Task Manager
2013-06-13 12:35 . 2013-05-16 22:16	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2013-06-13 00:46 . 2013-06-13 00:46	262552	----a-w-	c:\program files\Mozilla Firefox\updated\browser\components\browsercomps.dll
2013-06-12 15:15 . 2013-05-08 04:37	905576	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-06-12 15:15 . 2013-05-02 04:04	443904	----a-w-	c:\windows\system32\win32spl.dll
2013-06-12 15:15 . 2013-05-02 04:03	37376	----a-w-	c:\windows\system32\printcom.dll
2013-06-12 15:14 . 2013-04-24 04:00	985600	----a-w-	c:\windows\system32\crypt32.dll
2013-06-12 15:14 . 2013-04-24 01:46	812544	----a-w-	c:\windows\system32\certutil.exe
2013-06-12 15:14 . 2013-04-24 04:00	98304	----a-w-	c:\windows\system32\cryptnet.dll
2013-06-12 15:14 . 2013-04-24 04:00	133120	----a-w-	c:\windows\system32\cryptsvc.dll
2013-06-12 15:14 . 2013-04-24 04:00	41984	----a-w-	c:\windows\system32\certenc.dll
2013-06-12 15:14 . 2013-05-02 22:03	3603832	----a-w-	c:\windows\system32\ntkrnlpa.exe
2013-06-12 15:14 . 2013-05-02 22:03	3551096	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-06-12 15:14 . 2013-04-17 12:30	24576	----a-w-	c:\windows\system32\cryptdlg.dll
2013-05-27 17:18 . 2013-05-27 17:18	--------	d-----w-	c:\users\Trudy Stewart\AppData\Local\Apple Computer
2013-05-27 17:18 . 2012-08-21 17:01	26840	----a-w-	c:\windows\system32\drivers\GEARAspiWDM.sys
2013-05-27 17:17 . 2013-05-27 17:17	--------	d-----w-	c:\program files\iPod
2013-05-27 17:17 . 2013-05-27 17:18	--------	d-----w-	c:\program files\iTunes
2013-05-27 17:14 . 2013-05-27 17:14	--------	d-----w-	c:\program files\Bonjour
2013-05-27 17:00 . 2013-05-27 17:00	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin5.dll
2013-05-27 17:00 . 2013-05-27 17:00	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-05-27 17:00 . 2013-05-27 17:00	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin4.dll
2013-05-27 17:00 . 2013-05-27 17:00	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin3.dll
2013-05-27 17:00 . 2013-05-27 17:00	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-05-27 17:00 . 2013-05-27 17:00	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-05-27 17:00 . 2013-05-27 17:00	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin2.dll
2013-05-27 17:00 . 2013-05-27 17:00	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-05-27 17:00 . 2013-05-27 17:00	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin.dll
2013-05-27 17:00 . 2013-05-27 17:00	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-05-27 16:59 . 2013-05-27 16:59	--------	d-----w-	c:\program files\QuickTime
2013-05-21 15:29 . 2013-04-15 14:20	638328	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2013-05-21 15:29 . 2013-04-13 10:56	37376	----a-w-	c:\windows\system32\cdd.dll
2013-05-21 15:29 . 2013-04-09 01:36	2049024	----a-w-	c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-12 04:18 . 2013-02-02 14:13	7068072	------w-	c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Updates\mpengine.dll	ERROR(0x00000005)
2013-06-11 22:39 . 2012-05-13 16:54	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-06-11 22:39 . 2012-05-13 16:54	692104	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-05-13 06:19 . 2008-05-19 23:50	7016152	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll	ERROR(0x00000005)
2013-05-09 08:59 . 2013-04-15 00:49	49376	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2013-05-09 08:59 . 2013-04-15 00:49	174664	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2013-05-09 08:59 . 2013-02-06 23:47	368944	----a-w-	c:\windows\system32\drivers\aswSP.sys
2013-05-09 08:59 . 2013-02-06 23:47	56080	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2013-05-09 08:59 . 2013-02-06 23:47	765736	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2013-05-09 08:59 . 2013-02-06 23:47	49760	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2013-05-09 08:59 . 2013-02-06 23:47	66336	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2013-05-09 08:59 . 2013-02-06 23:47	29816	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2013-05-09 08:58 . 2013-02-06 23:47	41664	----a-w-	c:\windows\avastSS.scr
2013-05-09 08:58 . 2013-02-06 23:47	229648	----a-w-	c:\windows\system32\aswBoot.exe
2013-05-02 06:06 . 2013-02-02 14:13	238872	------w-	c:\windows\system32\MpSigStub.exe
2013-05-01 07:59 . 2013-05-01 07:59	94208	----a-w-	c:\windows\system32\QuickTimeVR.qtx
2013-05-01 07:59 . 2013-05-01 07:59	69632	----a-w-	c:\windows\system32\QuickTime.qts
2013-04-30 00:35 . 2013-04-30 00:37	94112	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2013-04-30 00:35 . 2012-05-13 17:02	866720	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-04-30 00:35 . 2010-05-09 14:05	788896	----a-w-	c:\windows\system32\deployJava1.dll
2013-04-30 00:27 . 2013-04-30 00:27	0	----a-w-	c:\windows\system32\REN8D81.tmp
2013-04-30 00:27 . 2013-04-30 00:27	0	----a-w-	c:\windows\system32\REN8D80.tmp
2013-04-30 00:27 . 2013-04-30 00:27	0	----a-w-	c:\windows\system32\REN8D7F.tmp
2013-04-10 06:58 . 2013-02-02 19:06	263064	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58	121968	----a-w-	c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-25 4702208]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]
"SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2008-03-25 54672]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-08-27 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-27 8473120]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-27 81920]
"OEM05Mon.exe"="c:\windows\OEM05Mon.exe" [2007-05-09 36864]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"Linksys Wireless Manager"="c:\program files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-02-16 1358384]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-11-11 205336]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2013-05-08 41056]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-05-15 152392]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Privoxy.lnk - c:\program files\Privoxy\privoxy.exe [2013-1-30 370176]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk
backup=c:\windows\pss\Snapfish Media Detector.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Trudy Stewart^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Trudy Stewart^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Oneeko.lnk]
path=c:\users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Oneeko.lnk
backup=c:\windows\pss\Oneeko.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Trudy Stewart^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
path=c:\users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Trudy Stewart^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Stickies.lnk]
path=c:\users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stickies.lnk
backup=c:\windows\pss\Stickies.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2007-04-04 01:50	1603152	----a-w-	c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2007-05-15 01:01	644696	----a-w-	c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-09 00:24	54840	----a-w-	c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2007-04-18 15:01	65536	----a-w-	c:\hp\support\hpsysdrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 16:16	65536	----a-w-	c:\hp\KBD\KbdStub.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OsdMaestro]
2007-02-15 11:59	118784	----a-w-	c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateReg]
2008-03-25 08:28	54672	----a-w-	c:\windows\System32\jureg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38	1008184	----a-w-	c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiSpywareOverride"=dword:00000001
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - kfkyakoc
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
rsmsvcs	REG_MULTI_SZ ntmssvc
ipripsvc	REG_MULTI_SZ iprip
LocalServiceAndNoImpersonation	REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-06-11 12:36	1165776	----a-w-	c:\program files\Google\Chrome\Application\27.0.1453.110\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-19 21:14]
.
2013-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-19 21:14]
.
2013-04-18 c:\windows\Tasks\HPCeeScheduleForTrudy Stewart.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2007-01-01 00:34]
.
2013-06-19 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
.
2013-01-03 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bing.com/?PC=BNHP
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
IE: Add to Evernote - c:\program files\Evernote\Evernote3\enbar.dll/2000
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Download Link Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_file.htm
IE: Download List Of Files Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_list.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Subscribe To RSS/Podcast Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_rss.htm
TCP: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
FF - ProfilePath - c:\users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\
FF - ExtSQL: !HIDDEN! 2013-02-14 21:38; [email protected]; c:\program files\Mozilla Firefox\extensions\[email protected]
.
- - - - ORPHANS REMOVED - - - -
.
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\SUPERAntiSpyware\SASSEH.DLL
AddRemove-Coupon Companion Plugin - c:\program files\Coupon Companion Plugin\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-19 12:31
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2013-06-19 12:34:18
ComboFix-quarantined-files.txt 2013-06-19 16:34
ComboFix2.txt 2013-03-29 04:39
ComboFix3.txt 2013-02-15 02:55
ComboFix4.txt 2013-02-02 04:37
.
Pre-Run: 208,646,062,080 bytes free
Post-Run: 208,997,650,432 bytes free
.
- - End Of File - - 9ED979322CF07E442DDE489E742D7051
81CD5EC01DB0CE57EDD853F82462EF27

Took forever to do this. Could not access gmail or combofix from interenet explorer. this was done from chrome with some manipulation. Thanks again!


----------



## kevinf80 (Mar 21, 2006)

What is happening with your system now, what issues/concerns do you have...


----------



## Trutalley (Mar 10, 2013)

still getting pop ups, full screen ads behind the screen(usually chrome), ebay, email account. Also my desktop icons rearrange themselves at will. But the strangest thing is that internet explorer is not listed in my add/remove programs on my computer.
the icon is on my desktop and it works but all my add ons are gone. the only way to access my gmail account is not by doing a search for gmail but by typing the url in the address box. I really don't have any other complaints. Things seem to be working but the ads are still there and there are some quirky things going on.  ?


----------



## kevinf80 (Mar 21, 2006)

OK, run the following:

Please download Junkware Removal tool from this link:
http://www.bleepingcomputer.com/download/junkware-removal-tool/
Save to your desktop.


*Shut down your Security Protection software now to avoid potential conflicts*.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator. Follow prompts as they come.
The tool will open and start scanning your system. (Press any key when prompted to continue)
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post JRT.txt to your next message.

Next,

Download Farbar Service Scanner from here: http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/ and run it on the computer with the issue.
*Make sure the following options are checked:*


*Internet Services*
*Windows Firewall*
*System Restore*
*Security Center/Action Center*
*Windows Update*
*Windows Defender*


Press "*Scan*".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

Next,

Download *OTL* from any of the following links and save to your desktop.

http://itxassociates.com/OT-Tools/OTL.com
http://oldtimer.geekstogo.com/OTL.exe
http://www.itxassociates.com/OT-Tools/OTL.scr

Double click the OTL icon to start the tool. (Note: If you are running on Vista or Windows 7 accept UAC alert)


 When the window appears, underneath *Output* at the top, make sure *Standard output* is selected.
 Select *Scan all users*
 Under the *Extra Registry* section, check *Use SafeList*
 In the lower right corner, checkmark *"LOP Check"* and checkmark *"Purity Check".*
 Click *Run Scan* and let the program run uninterrupted.
 When the scan is complete, two text files will be created on your Desktop.
 *OTL.Txt* <- this one will be opened
 *Extras.txt* <- this one will be minimized

Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of *OTL.Txt* and the *Extras.txt* in your next reply.

Post those logs....

Kevin..


----------



## Trutalley (Mar 10, 2013)

I am sending this in 2 posts. I am being told the files are too large.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Trudy Stewart on Wed 06/19/2013 at 21:40:37.42
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{22222222-2222-2222-2222-220222182204}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{4C01D2EE-C655-4AE6-9F57-F91462B366F7}

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Users\Trudy Stewart\appdata\local\updater21804"

~~~ FireFox

Successfully deleted: [Folder] "C:\Program Files\Mozilla Firefox\extensions\[email protected]"
Successfully deleted: [Folder] C:\Users\Trudy Stewart\AppData\Roaming\mozilla\firefox\profiles\yoebz5b8.default-1357333329994\extensions\[email protected]
Successfully deleted the following from C:\Users\Trudy Stewart\AppData\Roaming\mozilla\firefox\profiles\yoebz5b8.default-1357333329994\prefs.js

user_pref("extensions.crossrider.bic", "13c9c4ab0e82dfc21f2a2a1be103c7e2");
Emptied folder: C:\Users\Trudy Stewart\AppData\Roaming\mozilla\firefox\profiles\yoebz5b8.default-1357333329994\minidumps [3 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 06/19/2013 at 21:43:40.41
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Farbar Service Scanner Version: 16-06-2013
Ran by Trudy Stewart (administrator) on 19-06-2013 at 21:47:19
Running from "C:\Users\Trudy Stewart\Downloads"
Windows Vista (TM) Home Premium Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy: 
==================

System Restore:
============

System Restore Disabled Policy: 
========================

Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Other Services:
==============

File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2013-06-12 11:15] - [2013-05-08 00:37] - 0905576 ____A (Microsoft Corporation) 548E198BAE21EFC21F8B5F0C1728AD27

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll
[2013-06-12 11:14] - [2013-04-24 00:00] - 0133120 ____A (Microsoft Corporation) 3EDE4C1F9672C972479201544969ADCB

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****
OTL logfile created on: 6/20/2013 10:38:13 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Trudy Stewart\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.81 Gb Available Physical Memory | 60.37% Memory free
6.20 Gb Paging File | 4.73 Gb Available in Paging File | 76.40% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.49 Gb Total Space | 194.48 Gb Free Space | 67.41% Space Free | Partition Type: NTFS
Drive D: | 9.60 Gb Total Space | 1.29 Gb Free Space | 13.48% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 294.68 Gb Free Space | 98.86% Space Free | Partition Type: NTFS

Computer Name: TRUDYSTEWART-PC | User Name: Trudy Stewart | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/20 10:37:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Trudy Stewart\Downloads\OTL.com
PRC - [2013/05/29 01:27:40 | 000,825,808 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2013/05/09 04:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2013/01/30 21:50:30 | 000,370,176 | ---- | M] (The Privoxy team - www.privoxy.org) -- C:\Program Files\Privoxy\privoxy.exe
PRC - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe
PRC - [2011/11/11 14:08:06 | 000,205,336 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
PRC - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
PRC - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/16 05:44:55 | 001,358,384 | R--- | M] (Linksys, LLC) -- C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
PRC - [2008/03/25 04:28:03 | 000,054,672 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\jureg.exe
PRC - [2008/01/19 03:33:27 | 000,151,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\schtasks.exe
PRC - [2007/10/25 09:52:08 | 004,702,208 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/05/09 01:00:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM05Mon.exe
PRC - [2007/02/04 12:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
PRC - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Modules (No Company Name) ==========

MOD - [2013/06/13 18:47:34 | 013,140,872 | ---- | M] () -- C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\PepperFlash\11.7.700.225\pepflashplayer.dll
MOD - [2013/05/29 01:27:38 | 000,393,168 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.110\ppgooglenaclpluginchrome.dll
MOD - [2013/05/29 01:27:35 | 004,051,408 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.110\pdf.dll
MOD - [2013/05/29 01:26:36 | 001,597,392 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.110\ffmpegsumo.dll
MOD - [2013/01/30 21:50:30 | 000,086,528 | ---- | M] () -- C:\Program Files\Privoxy\mgwz.dll
MOD - [2012/10/11 21:56:46 | 000,087,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/10/11 21:56:22 | 001,242,512 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/11/11 14:09:20 | 000,336,408 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
MOD - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
MOD - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
MOD - [2010/05/07 18:37:40 | 000,126,808 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll
MOD - [2010/05/07 18:37:40 | 000,027,480 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll
MOD - [2010/05/07 18:36:54 | 000,340,824 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll
MOD - [2010/05/07 18:35:56 | 007,954,776 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll
MOD - [2010/05/07 18:35:44 | 002,143,576 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll
MOD - [2009/07/13 18:37:04 | 000,152,112 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll
MOD - [2009/07/13 18:37:04 | 000,098,304 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll
MOD - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
MOD - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe -- (RoxLiveShare9)
SRV - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2013/04/10 02:58:17 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2009/04/11 02:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/11/06 16:22:26 | 000,092,792 | ---- | M] (CACE Technologies) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2006/11/02 08:36:18 | 000,029,696 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\iprip.dll -- (iprip)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfSysMon.sys -- (TfSysMon)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\TfNetMon.sys -- (TfNetMon)
DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfFsMon.sys -- (TfFsMon)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (RimUsb)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pctplsg.sys -- (pctplsg)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\PCTINDIS5.SYS -- (PCTINDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lvpopflt.sys -- (lvpopflt)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jubusenum.sys -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\TRUDYS~1\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2013/05/09 04:59:10 | 000,765,736 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2013/05/09 04:59:10 | 000,368,944 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2013/05/09 04:59:10 | 000,174,664 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswVmm.sys -- (aswVmm)
DRV - [2013/05/09 04:59:10 | 000,056,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2013/05/09 04:59:10 | 000,049,376 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswRvrt.sys -- (aswRvrt)
DRV - [2013/05/09 04:59:09 | 000,066,336 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2013/05/09 04:59:09 | 000,049,760 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2013/05/09 04:59:08 | 000,029,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/01/18 02:44:52 | 004,332,960 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUVC.sys -- (LVUVC)
DRV - [2012/01/18 02:44:28 | 000,312,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2012/01/18 02:44:14 | 000,022,176 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvbusflt.sys -- (CompFilter)
DRV - [2011/03/30 23:54:32 | 001,073,216 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AE1200vista.sys -- (Linksys_adapter)
DRV - [2010/05/07 18:43:30 | 000,025,824 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009/07/07 15:48:44 | 000,027,696 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\purendis.sys -- (purendis)
DRV - [2009/07/07 15:48:44 | 000,026,672 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pnarp.sys -- (pnarp)
DRV - [2008/12/04 09:17:15 | 000,645,120 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WUSB54GCv3.sys -- (WUSB54GCv3)
DRV - [2008/08/01 19:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008/05/08 05:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2008/05/08 05:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)
DRV - [2007/11/06 16:22:06 | 000,034,064 | ---- | M] (CACE Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2007/10/26 07:51:22 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007/10/18 07:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/10/12 02:00:44 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/09/07 10:36:08 | 000,156,928 | ---- | M] (ViXS Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\xcbda.sys -- (xcbdaNtsc)
DRV - [2007/08/27 14:59:00 | 007,574,976 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/07/20 01:00:00 | 000,235,616 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vid.sys -- (OEM05Vid)
DRV - [2007/06/08 01:00:02 | 000,141,376 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\OEM05Afx.sys -- (OEM05Afx)
DRV - [2007/04/11 15:33:06 | 000,079,376 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2007/04/11 15:32:58 | 000,036,112 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007/04/11 15:32:52 | 000,034,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2007/04/11 15:32:38 | 000,063,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2007/04/11 15:32:30 | 000,020,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007/03/05 18:45:04 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vfx.sys -- (OEM05Vfx)
DRV - [2005/12/12 13:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{11D231C8-2FE5-4B8A-B2F9-B1736520C7A2}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?PC=BNHP
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes,DefaultScope = {759B6E70-7A7D-4FE5-82BF-EA161AA627D9}
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{637897BC-FCE2-4DEA-8938-5BA57BAEB440}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE8SRC&src=IE-SearchBox
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{759B6E70-7A7D-4FE5-82BF-EA161AA627D9}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=800236&p={searchTerms}
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: extension21804%40extension21804.com:0.91.48
FF - prefs.js..extensions.enabledAddons: infoatoms%40infoatoms.com:1.5.0.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/05/27 18:14:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/27 13:00:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/27 13:00:06 | 000,000,000 | ---D | M]

[2008/09/08 20:54:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Extensions
[2013/06/19 21:43:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\extensions
[2013/06/19 21:43:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/02/02 15:07:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/02/02 15:07:01 | 000,000,000 | ---D | M] (The Browser Highlighter) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\extensions
[2013/06/12 20:46:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\updated\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/06/12 20:46:17 | 000,000,000 | ---D | M] (The Browser Highlighter) -- C:\Program Files\Mozilla Firefox\updated\extensions\[email protected]
[2013/06/12 20:46:17 | 000,000,000 | ---D | M] (InfoAtoms) -- C:\Program Files\Mozilla Firefox\updated\extensions\[email protected]
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\[email protected]
File not found (No name found) -- C:\USERS\TRUDY STEWART\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YOEBZ5B8.DEFAULT-1357333329994\EXTENSIONS\[email protected]
[2013/04/10 02:58:33 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2008/09/03 20:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\mozilla firefox\plugins\npbittorrent.dll
[2013/04/10 02:57:54 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013/04/10 02:57:54 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Bing (Enabled)
CHR - default_search_provider: search_url = http://www.bing.com/search?setmkt=en-US&q={searchTerms}
CHR - default_search_provider: suggest_url = http://api.bing.com/osjson.aspx?query={searchTerms}&language={language},
CHR - homepage: 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.110\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_278.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.110\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U35 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.350.10 (Enabled) = C:\Windows\system32\npdeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Envelopes for Google Docs = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaclkeicedlkpjgnnfkedjomkkhmgcod\2_0\
CHR - Extension: Floorplanner = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\abopacaefhbognnmeigicfpgnmpideag\13_0\
CHR - Extension: I Dream of Greenie = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\abpplimpipkdhcobigmhmmjpmmkjneod\0.2_0\
CHR - Extension: Prezi = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\acoonfmhnndodekhecidldfdjgooefpg\1.3_0\
CHR - Extension: Task Timer = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\aomfjmibjhhfdenfkpaodhnlhkolngif\3.9.1_1\
CHR - Extension: Lucidchart: Diagramming = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\apboafhkiegglekeafbckfjldecefkhn\16_0\
CHR - Extension: Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: Loupe = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhaonknplhhecdgjpphnooeomecgipkc\2.0.4_0\
CHR - Extension: Print this page with CleanPrint = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\biafepndnnahkfldhobcjlclklffkibe\4.7.0_0\
CHR - Extension: Tabs Join = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\binjiceocgbfooocmheaenmmcominbpe\2.1_0\
CHR - Extension: Aviary for Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkinocibdedleighgndmbfpbialnblep\1.3_0\
CHR - Extension: YouTube = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: HelloFax: 50 Free Fax Pages = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bocmleclimfnadgmcdgecijlblfcmfnm\1.12_0\
CHR - Extension: Facebook = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\boeajhmfdjldchidhphikilcgdacljfm\1.0.3_0\
CHR - Extension: Revision3 = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\cncldpggpcpckadjcholildoahcgbmfo\1_0\
CHR - Extension: TimelineRemove = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnedfaenfnkikficknkklbdedlecmpgc\1.1.0_1\
CHR - Extension: Sumo Paint = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpgjihldbpodlmnjolekemlfbcajnmod\3.7_0\
CHR - Extension: Easy Clock = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dplbpgapoedppajbikieafefmcceaagn\9.0.6_0\
CHR - Extension: Gravity = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\eboilkbecbgepecmaaicggbpnlbcfagj\1_0\
CHR - Extension: Facebook Disconnect = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpepffjfmamnambagiibghpglaidiec\1.3.0_0\
CHR - Extension: Stupeflix Video Maker = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkdmcfnoimoilncpjchamnenebopocem\1.5_0\
CHR - Extension: Springpad = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkmopoamfjnmppabeaphohombnjcjgla\6_0\
CHR - Extension: EasyDrop = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\flogpfmjdekjoilcnmmchanikomlidie\1.3.0_0\
CHR - Extension: Attachments.me for Gmail, Dropbox, Box, Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdgofjdapkmlgpgjfielacjckplcdjjk\1.7.4_0\
CHR - Extension: Attachments.me for Gmail, Dropbox, Box, Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdgofjdapkmlgpgjfielacjckplcdjjk\1.7.4_0\.mustache
CHR - Extension: Click&Clean = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\8.3_0\
CHR - Extension: DocuSign = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\goblijolcnempeilmnkmfbhohlpngemd\2.1.0.0_0\
CHR - Extension: Drive Notepad = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpgjomejfimnbmobcocilppikhncegaj\1.2_0\
CHR - Extension: Gradient Creator! = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcplneddoadgichngfbobgpllfphdfla\0.2.1.3_0\
CHR - Extension: Vector Paint = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnbpdiengicdefcjecjbnjnoifekhgdo\3.2.0.0_0\
CHR - Extension: Pixlr Editor = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmaknaampgiegkcjlimdiidlhopknpk\1.2_0\
CHR - Extension: persona/ you are what you love = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iehdddmijbgofffjjmhkodckmnombhmf\2.0.9_1\
CHR - Extension: Sync SugarSync, Evernote, and Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifanaabofjmgladnlbckonoiohpmchik\1.2.4.2_0\
CHR - Extension: Pixorial Video = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ilbibicalpgnmbjnganinjppjephokai\1.0.3_0\
CHR - Extension: Sync Dropbox, Evernote, and Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iobcbdgacfkninlcbphihhdlkobkehia\1.2.4.2_0\
CHR - Extension: Dropbox = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioekoebejdcmnlefjiknokhhafglcjdl\3.0.6_1\
CHR - Extension: Save this page with CleanSave = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iplagehfoafmmjppeijnpkohihcllici\4.7.0_0\
CHR - Extension: Free Online PDF Tools = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jddfpnmfhodaljeelokfceepbeapgbdn\1.0.1.2_0\
CHR - Extension: Facebook Like Button = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jehaijobeonhempacbjelicepjkhoidi\1.0.3_0\
CHR - Extension: mydeco 3D planner = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfnniehafojoidolddmhfnpnbiolbppi\2.3_0\
CHR - Extension: Autodesk Homestyler = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdmmkfaghgcicheaimnpffeeekheafkb\2.3_0\
CHR - Extension: eBay Extension for Google Chrome\u2122 (by eBay) = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khhckppjhonfmcpegdjdibmngahahhck\1.6.12_0\
CHR - Extension: HuffingtonPost NewsGlide = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khjialelnkjdomiblmnpcpjongleegef\0.3.2_0\
CHR - Extension: WordPress.com = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khjnjifipfkgglficmipimgjpbmlbemd\1.1.1_0\
CHR - Extension: Magisto for Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\kinnlbfbjboagbejldhemnifjepmkakj\1.0.4_1\
CHR - Extension: CanvasDraw = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\knfimpamngmggpbamfoomdpebdoleghe\2_0\
CHR - Extension: DriveTunes = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\labgcacinobdnkfndodfkfeabbjckbnj\3.2.4_0\
CHR - Extension: Evernote Web = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol\1.0.7_0\
CHR - Extension: Sketchpad = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkllajgbhondgjjnhmmgbjndmogapinp\1.0.0.4_0\
CHR - Extension: Spanning Backup for Google Apps\u2122 = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lniahgcddkbgipmbmlhjpoafdeephgcf\3.0.1.3_0\
CHR - Extension: Word\u00B2 = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpibnckjjeaabeepofhfmmpjmnomohee\2.5_0\
CHR - Extension: Quick Note = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\mijlebbfndhelmdpmllgcfadlkankhok\1.4.8_0\
CHR - Extension: Free Online PDF Unlocker = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkdknbehfogkgogcennnagfokmnimpab\1.0.1.1_0\
CHR - Extension: deviantART muro = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\namljbfbglehfnlonjmebceimaalofei\1.0_0\
CHR - Extension: InspirARTion = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhbmpilemgmpbdaniehhmodkkppkelec\10_0\
CHR - Extension: Pinterest Keyboard Shortcut | Ctrl+Alt+P = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\npbcjndbpajikchenclendcojmaeaphh\1.2.2_1\
CHR - Extension: Google Chrome to Phone Extension = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oadboiipflhobonjjffjbfekfjcgkhco\2.3.1_0\
CHR - Extension: Todo.ly = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhefmbclkekanpjjpkbciloojcmpkap\2_0\
CHR - Extension: Bolt Save and Share = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofmipocdiiichlijcngflajilbpkkfhj\7.2_0\
CHR - Extension: Photo Collage = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiabhgfgfhoilflkoicbmnejgjjfmhcg\1_0\
CHR - Extension: WeVideo - Video Editor = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\okgjbfikepgflmlelgfgecmgjnmnmnnb\3.1.0_0\
CHR - Extension: Pin Search | Image Search on Pinterest = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\okiaciimfpgbpdhnfdllhdkicpmdoakm\1.0.11_0\
CHR - Extension: SlideRocket = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\omeengfjefdmhnkojnfmncpfdbhnecea\2.0.2_0\
CHR - Extension: Picasa = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb\6.2.2_0\
CHR - Extension: Diigo Web Collector - Capture and Annotate = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oojbgadfejifecebmdnhhkbhdjaphole\2.1.10_0\
CHR - Extension: Click&Clean App = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdabfienifkbhoihedcgeogidfmibmhp\8.0_0\
CHR - Extension: Outlook.com = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfpeapihoiogbcmdmnibeplnikfnhoge\1.0.2_0\
CHR - Extension: Evernote Web Clipper = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc\5.9.16_0\
CHR - Extension: Gmail = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Balsamiq Mockups = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pplbmgaodhjmbklkgkgmlghaekcfhhkk\1.9_0\

O1 HOSTS File: ([2013/02/02 00:35:03 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (jZip Webmail plugin) - {647FD14A-C4F1-46F4-8FC3-0B40F54226F7} - C:\Program Files\jZip\WebmailPlugin.dll (Discordia Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found.
O3 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\Toolbar\WebBrowser: (no name) - {CB789373-04D5-4EF4-9C16-871463FD0830} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Linksys Wireless Manager] C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe (Linksys, LLC)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OEM05Mon.exe] C:\Windows\OEM05Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateReg] C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000..\Run: [B7456CF5EF0D0980D92DD0562D346087910D60E2._service_run] C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Evernote - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Download Link Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_file.htm File not found
O8 - Extra context menu item: Download List Of Files Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_list.htm File not found
O8 - Extra context menu item: Subscribe To RSS/Podcast Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_rss.htm File not found
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 1.7.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 10.21.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{36937FF7-1F22-4576-8665-B5965D4D3BCC}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BBDB5DE6-583B-4601-A391-1DC2D9542FFD}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/01/01 10:56:33 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/06/19 21:40:33 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/06/19 21:40:09 | 000,000,000 | ---D | C] -- C:\JRT
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Local\temp
[2013/06/19 12:33:38 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/06/19 12:10:01 | 005,081,021 | R--- | C] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/18 19:09:10 | 000,000,000 | ---D | C] -- C:\FRST
[2013/06/15 21:27:20 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan
[2013/06/15 21:27:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
[2013/06/15 21:27:12 | 000,000,000 | ---D | C] -- C:\Program Files\Security Task Manager
[2013/06/13 08:35:00 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/06/13 08:34:58 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013/06/13 08:34:58 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013/06/13 08:34:57 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013/06/13 08:34:57 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013/06/13 08:34:55 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013/06/13 08:34:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013/06/13 08:34:53 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013/06/12 11:15:02 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printcom.dll
[2013/06/12 11:14:58 | 000,812,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certutil.exe
[2013/06/12 11:14:57 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certenc.dll
[2013/06/12 11:14:50 | 003,603,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013/06/12 11:14:49 | 003,551,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013/06/12 11:14:40 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cryptdlg.dll
[2013/06/11 14:21:48 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\Desktop\New Folder
[2013/05/27 13:18:56 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Local\Apple Computer
[2013/05/27 13:18:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013/05/27 13:17:10 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013/05/27 13:17:06 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013/05/27 13:17:06 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013/05/27 13:14:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
[2013/05/27 13:14:04 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2013/05/27 12:59:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013/05/27 12:59:26 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2013/05/27 12:59:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2013/05/21 11:29:53 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2013/05/21 11:29:20 | 002,049,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012/10/28 22:15:21 | 011,881,936 | ---- | C] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Users\Trudy Stewart\gosetup.exe
[3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/06/20 10:36:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/20 10:13:19 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/20 10:13:19 | 000,000,454 | ---- | M] () -- C:\Windows\tasks\RegCure Program Check.job
[2013/06/20 10:13:17 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2013/06/20 10:13:07 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/20 10:13:07 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/20 10:13:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/06/20 10:13:00 | 3219,591,168 | -HS- | M] () -- C:\hiberfil.sys
[2013/06/19 21:45:59 | 000,000,935 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Continue Zip Opener Installation.lnk
[2013/06/19 14:29:01 | 000,000,911 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/19 12:10:07 | 005,081,021 | R--- | M] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/18 19:27:16 | 000,000,089 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013/06/11 18:39:35 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013/06/11 18:39:35 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013/06/11 08:41:38 | 000,001,933 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/05/27 20:02:39 | 000,634,834 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/05/27 20:02:39 | 000,112,596 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/05/27 18:14:47 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2013/05/27 13:18:50 | 000,001,626 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013/05/27 12:59:51 | 000,001,688 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2013/05/22 20:32:59 | 000,408,168 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/05/21 15:45:55 | 000,001,849 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/06/19 21:45:59 | 000,000,935 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Continue Zip Opener Installation.lnk
[2013/06/19 14:29:01 | 000,000,911 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/18 19:26:02 | 000,000,089 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013/05/27 13:18:50 | 000,001,626 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013/05/27 12:59:51 | 000,001,688 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2013/04/14 20:49:34 | 000,174,664 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/04/14 20:49:34 | 000,049,376 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013/02/02 00:21:01 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/02/02 00:21:01 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/02/02 00:21:01 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/02/02 00:21:01 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/02/02 00:21:01 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/05/29 13:08:18 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2012/03/31 21:41:09 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012/01/18 02:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2012/01/18 02:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2012/01/18 02:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2011/11/16 21:40:38 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2011/08/12 12:20:14 | 000,015,896 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
[2010/05/07 07:07:08 | 000,000,760 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\setup_ldm.iss
[2010/04/07 12:31:26 | 000,000,000 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\prvlcl.dat
[2009/12/09 22:32:11 | 008,892,928 | ---- | C] () -- C:\ProgramData\atscie.msi
[2009/03/24 22:26:10 | 000,000,050 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-recent-projects.properties
[2009/03/24 22:21:47 | 000,000,745 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-defaults.jap
[2008/12/28 17:31:28 | 000,031,232 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/11/16 00:46:07 | 000,000,138 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\wklnhst.dat
[2008/07/21 16:40:25 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat
[2008/05/20 03:12:40 | 000,001,356 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\d3d9caps.dat

========== ZeroAccess Check ==========

[2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 02:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 02:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2009/04/09 02:14:12 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Ambient Design
[2009/03/28 10:48:26 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Artisteer
[2010/02/26 11:39:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Canon
[2008/09/13 12:52:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/07/21 14:45:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Conceiva
[2009/03/28 22:50:52 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Darq Software
[2013/02/18 15:36:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\DeskSoft
[2012/03/22 16:15:59 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Dropbox
[2008/07/07 15:29:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Individual Software
[2010/06/27 15:16:09 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Inkscape
[2009/03/28 13:18:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Interior Designer 8.0
[2013/01/02 21:57:32 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\IObit
[2012/05/29 17:50:58 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\IrfanView
[2012/05/13 12:44:02 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Leadertech
[2012/05/29 13:24:23 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MAGIX
[2010/06/27 15:30:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MSNInstaller
[2009/03/27 18:55:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NewSoft
[2013/02/01 22:47:11 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NoteTab Light
[2012/03/31 21:23:28 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Opera
[2010/05/29 18:59:53 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoFiltre
[2010/05/29 19:02:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoScape
[2013/04/02 15:29:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\QuickScan
[2008/05/25 20:11:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\ScanSoft
[2008/09/15 22:05:44 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Snapfish
[2013/05/01 20:37:05 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Softland
[2009/04/07 03:05:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\stickies
[2008/11/16 00:46:07 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Template
[2009/03/29 03:17:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\uTorrent

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 284 bytes -> C:\Windows\System32\´ý:@kpctlsp.log
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMPFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:1CA73D29

< End of report >


----------



## Trutalley (Mar 10, 2013)

OTL Extras logfile created on: 6/20/2013 10:38:13 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Trudy Stewart\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.81 Gb Available Physical Memory | 60.37% Memory free
6.20 Gb Paging File | 4.73 Gb Available in Paging File | 76.40% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.49 Gb Total Space | 194.48 Gb Free Space | 67.41% Space Free | Partition Type: NTFS
Drive D: | 9.60 Gb Total Space | 1.29 Gb Free Space | 13.48% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 294.68 Gb Free Space | 98.86% Space Free | Partition Type: NTFS

Computer Name: TRUDYSTEWART-PC | User Name: Trudy Stewart | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

[HKEY_USERS\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [Browse with FastStone] -- "C:\Program Files\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 1
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2B5C102A-2F85-41AA-A0DF-4B29849F1245}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=file and printer sharing (spooler service - rpc-epmap) | 
"{2F8DB637-6B0D-47A0-9779-9D3A28000669}" = lport=138 | protocol=17 | dir=in | app=system | 
"{37D77BC9-B345-400F-963A-3AE039A87527}" = lport=137 | protocol=17 | dir=in | app=system | 
"{5857283E-65FE-433A-AA8A-84EC1C967C72}" = lport=445 | protocol=6 | dir=in | app=system | 
"{7E9AA345-DD13-4172-B2AE-AFB5A3A79C31}" = rport=138 | protocol=17 | dir=out | app=system | 
"{A6EDA168-7252-4309-93B7-C22BC789A93C}" = rport=139 | protocol=6 | dir=out | app=system | 
"{C048FD24-BF27-47A3-BF19-30FE2D3A540E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=c:\windows\system32\spoolsv.exe | 
"{DD3EDD64-4C09-4020-999F-31C2ED524F61}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E49EDD1E-78E2-4BBD-BE4D-917B73C1B873}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{E5410391-24C8-44F6-B630-1D36463A3F68}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service | 
"{EF3C7162-07F8-439B-965B-7974F7FD5F30}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{F5A7E1B9-A236-416C-BA82-DD6F662FED52}" = rport=445 | protocol=6 | dir=out | app=system | 
"{FC7DDDB3-A87C-4671-9614-6700B8024D70}" = rport=137 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{171E2811-FE90-4898-A588-A4A344BB0EF7}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{1AF0C643-52C5-4AFD-9A0E-C372A869C9D3}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{230C5A4B-8073-440C-BFC2-C1231154FFFC}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"{2C002230-3129-49C4-8EDB-16F4059AB82A}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{32309D6F-37A6-4894-9184-2A2BB65A1AC7}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{3AD88B88-0F09-4AE0-8A39-DEDAF4EDF7FA}" = protocol=58 | dir=out | name=file and printer sharing (echo request - icmpv6-out) | 
"{48E260AC-7936-4505-A4F4-16706633FA19}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{52D9830E-4EA8-4923-A9DA-4FBFB957E73D}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{53FA3C26-2526-48D6-B015-DCA1735BC32A}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"{6E3F040F-4892-431B-ADF5-5E92216256AE}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{6E8CE4C0-7EF4-4BE8-9263-D00418994111}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{98005BA6-FB48-4ED9-9092-853A1A82C900}" = protocol=6 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | 
"{A6435162-E89E-4887-982C-97CBB197A9B4}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{A849F0F0-629E-4BF4-8269-C3BE016C6B27}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{AB5E8326-A88B-4508-8390-8A43F93BE7A3}" = protocol=6 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe | 
"{AD5DC11A-066E-48FB-8C72-166ED69E1643}" = protocol=6 | dir=in | app=c:\program files\citrix\gotomypc\g2svc.exe | 
"{B96003ED-7A2F-4EA8-ACD8-F86672A91C8E}" = protocol=1 | dir=out | name=file and printer sharing (echo request - icmpv4-out) | 
"{BB588A75-248E-4231-884E-ED327DB03632}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{C2AB2EE1-1F83-4DC2-AAE3-C703152D49ED}" = protocol=17 | dir=in | app=c:\program files\citrix\gotomypc\g2svc.exe | 
"{C921D61F-94B3-4C9B-8DF5-15F814B5B74C}" = protocol=17 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | 
"{CA4760A8-5A45-4CE0-B434-42D8BE9E391F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{E073820C-F42B-454F-880A-45EB992DE92B}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{E13D43B0-EF0E-4B2E-9E8A-531CFE1A7EFB}" = protocol=58 | dir=in | name=file and printer sharing (echo request - icmpv6-in) | 
"{E4D8E406-9641-4595-AB6B-ECF0F569965A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{E6A1E825-52EF-44A3-B50F-4637047C65EA}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{EC1E3A28-96F7-449C-B7A6-5D75B539BB40}" = protocol=17 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe | 
"{F15D811C-BBF5-4F1A-8406-BFFB34757AE2}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{F814EDF0-6FDA-4AD7-B646-4E345C8978D9}" = protocol=1 | dir=in | name=file and printer sharing (echo request - icmpv4-in) | 
"{FD3D8681-159C-4D93-9432-8566477A54DD}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"TCP Query User{12C7280E-FAD3-4684-9FFF-4A9E2643749C}C:\program files\oneeko\oneeko.exe" = protocol=6 | dir=in | app=c:\program files\oneeko\oneeko.exe | 
"TCP Query User{53D78474-D07F-4CEF-B4FF-845EB4543393}C:\program files\oneeko\oneeko.exe" = protocol=6 | dir=in | app=c:\program files\oneeko\oneeko.exe | 
"TCP Query User{CAB5F08C-B19D-471E-B475-2E69B9E8107E}C:\users\trudy stewart\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\trudy stewart\program files\dna\btdna.exe | 
"TCP Query User{E1B16E35-B279-41D4-9C13-CBE4ECFB2092}C:\users\trudy stewart\downloads\utorrent(2).exe" = protocol=6 | dir=in | app=c:\users\trudy stewart\downloads\utorrent(2).exe | 
"TCP Query User{EC751BFB-C7F3-4593-97A9-69563F5AB2E8}C:\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe | 
"UDP Query User{13817C37-6C0B-4474-8095-4D16A7B732C2}C:\program files\oneeko\oneeko.exe" = protocol=17 | dir=in | app=c:\program files\oneeko\oneeko.exe | 
"UDP Query User{3D19ED8B-5CA5-452D-B163-5057F98F636E}C:\program files\oneeko\oneeko.exe" = protocol=17 | dir=in | app=c:\program files\oneeko\oneeko.exe | 
"UDP Query User{623451B8-D177-45AD-A1D8-97536D4C3B9C}C:\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe | 
"UDP Query User{A8424EB2-1B9F-4747-BA13-24072DC732B2}C:\users\trudy stewart\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\trudy stewart\program files\dna\btdna.exe | 
"UDP Query User{BC18183C-C5E0-4C98-9424-392DF3B91D2E}C:\users\trudy stewart\downloads\utorrent(2).exe" = protocol=17 | dir=in | app=c:\users\trudy stewart\downloads\utorrent(2).exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5
"{0D025345-1033-4F35-A5CE-68CDCDE6CC03}" = Evernote
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP560_series" = Canon MP560 series MP Drivers
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX700_series" = Canon MX700 series
"{11B83AD3-7A46-4C2E-A568-9505981D4C6F}" = HP Update
"{11BB336F-0E58-4977-B866-F24FA334616B}" = HP Active Support Library
"{11E568E0-3244-4BCB-875E-F334269DFDCB}" = iTunes
"{12A76360-388E-4B27-ABEB-D5FC5378DD2A}" = HPPhotoSmartPhotobookWebPack1
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EBA6E7C-3DF6-48AE-B87B-4CAFB2C1C3F7}" = LightScribe Template Labeler
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CACFCD9-F71B-413A-8DF5-1A6419D5CDC6}" = Cards_Calendar_OrderGift_DoMorePlugout
"{4CE8DF60-5468-4E0B-98EA-9F7169DC79D0}" = Transmute v1.10
"{4F41AD68-89F2-4262-A32C-2F70B01FCE9E}" = Photo Story 3 for Windows
"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
"{5B2029A4-1854-42BC-96B6-4ACE5F5414BD}" = ArtRage 2 Starter Edition
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{64FFDCF5-740E-ECA2-DAA2-2C9E190A7D88}" = Interior Designer 8
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A5F34E2-37CF-4AD4-808C-2D413786E31A}" = Microsoft Visual C Runtime
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ULTIMATER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ULTIMATER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ULTIMATER_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002E-0000-0000-0000000FF1CE}" = Microsoft Office Ultimate 2007
"{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{925F1DB6-E86E-4378-9091-D1F68B0583C9}" = iCloud
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9885A11E-60E4-417C-B58B-8B31B21C0B8A}" = HP Easy Setup - Frontend
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{A0087DDE-69D0-11E2-AD57-43CA6188709B}" = Adobe AIR
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.5
"{AFAD41A9-9687-48A3-848F-693C11451433}" = HP Customer Experience Enhancements
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B2F3DBD9-A9D2-4838-B45D-C917DAB32BC3}" = ScanSoft OmniPage SE 4
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C86B0A93-6134-462A-A510-A6ED6F043982}" = Picture Painter Home and Landscape
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}" = Presto! PageManager 7.15.16
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E6CFBFB5-9232-410C-B353-AF6E614B2681}" = LightScribe System Software 1.10.16.1
"{E8C2622C-9FF1-4F60-8008-A0208154F9F3}" = muvee autoProducer 6.1
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F87A8E11-02A4-4875-A3A5-5961081B0E4E}" = OpenOffice.org 2.4
"{FC467B61-F890-4E29-8585-365DAB66F13E}" = Pure Networks Platform
"{FEF07CF4-5834-4AF1-9DEA-9EE94B53C6EB}" = PhotoS
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.0
"avast" = avast! Free Antivirus
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Chasys Draw IES" = Chasys Draw IES 3.72.01
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Soft Data Fax Modem with SmartCP
"CoffeeCup HTML Editor 2008" = CoffeeCup HTML Editor 2008
"Color Style Studio_is1" = Color Style Studio 2.4
"ColorPic" = ColorPic
"Creative OEM005" = Monitor Webcam (SP2208WFP) Driver (1.00.08.0720) 
"doPDF 7 printer_is1" = doPDF 7.3 printer
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"FastStone Image Viewer" = FastStone Image Viewer 3.5
"Google Chrome" = Google Chrome
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"Image Mender" = Image Mender 1.22
"Inkscape" = Inkscape 0.46
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"LightBox Free Image Editor" = LightBox Free Image Editor
"Linksys Wireless Manager" = Linksys Wireless Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.70.0.1100
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 20.0.1 (x86 en-US)" = Mozilla Firefox 20.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"NoteTab Light 7_is1" = NoteTab Light 7 (Remove only)
"NVIDIA Drivers" = NVIDIA Drivers
"Opera 12.15.1748" = Opera 12.15
"OsdMaestro" = HP On-Screen Cap/Num/Scroll Lock Indicator
"Photo Effect Studio_is1" = Photo Effect Studio 5.56
"Picasa 3" = Picasa 3
"Privoxy" = Privoxy (remove only)
"Professor Answers" = Professor Answers
"Professor Teaches Windows Vista Premium" = Professor Teaches Windows Vista Premium
"RegCure" = RegCure 1.5.0.1
"Security Task Manager" = Security Task Manager 1.8g
"ULTIMATER" = Microsoft Office Ultimate 2007
"VLC media player" = VLC media player 2.0.6
"WinPcapInst" = WinPcap 4.0.2

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 6/19/2013 9:46:15 PM | Computer Name = TrudyStewart-PC | Source = Application Error | ID = 1000
Description = Faulting application ZipOpenerSetup.exe, version 0.0.0.0, time stamp
0x2a425e19, faulting module ntdll.dll, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc0000005, fault offset 0x000665c9, process id 0x1370, application
start time 0x01ce6d57e914bedd.

[ System Events ]
Error - 6/20/2013 8:52:59 AM | Computer Name = TrudyStewart-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/20/2013 8:52:59 AM | Computer Name = TrudyStewart-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 6/20/2013 10:13:37 AM | Computer Name = TrudyStewart-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/20/2013 10:13:37 AM | Computer Name = TrudyStewart-PC | Source = Service Control Manager | ID = 7026
Description =

< End of report >

THANKS!!


----------



## kevinf80 (Mar 21, 2006)

Re-Run







by double left click, Vista and Widows 7 users accept UAC alert.


Under the







box at the bottom, paste in the following, start with and include the colon plus OTL . *:OTL*


```
:OTL
DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfSysMon.sys -- (TfSysMon)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\TfNetMon.sys -- (TfNetMon)
DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfFsMon.sys -- (TfFsMon)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (RimUsb)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pctplsg.sys -- (pctplsg)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\PCTINDIS5.SYS -- (PCTINDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lvpopflt.sys -- (lvpopflt)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jubusenum.sys -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\TRUDYS~1\AppData\Local\Temp\catchme.sys -- (catchme)
FF - prefs.js..extensions.enabledAddons: infoatoms%40infoatoms.com:1.5.0.0
[2013/06/12 20:46:17 | 000,000,000 | ---D | M] (InfoAtoms) -- C:\Program Files\Mozilla Firefox\updated\extensions\[email protected]
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\[email protected]
File not found (No name found) -- C:\USERS\TRUDY STEWART\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YOEBZ5B8.DEFAULT-1357333329994\EXTENSIONS\[email protected]
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found.
O3 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\Toolbar\WebBrowser: (no name) - {CB789373-04D5-4EF4-9C16-871463FD0830} - No CLSID value found.
[3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[2013/01/02 21:57:32 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\IObit
@Alternate Data Stream - 284 bytes -> C:\Windows\System32\´ý:@kpctlsp.log
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMPFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:1CA73D29

:Files
C:\WINDOWS\tasks\At*.job /d
ipconfig /flushdns /c
:Commands
[emptytemp]
[CREATERESTOREPOINT]
```

Then click







button at the top
Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
Please post that log in your next reply.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.
If you are asked to reboot the machine choose *Yes*. In this case, after the reboot, open Notepad (Start > All Programs > Accessories > Notepad), click File > Open, in the File Name box enter **.log* and press the Enter key, navigate to the *C:\_OTL\MovedFiles folder*, and open the newest *.log* file present, and copy/paste the contents of that document back here in your next post.

Give update on current issues/concerns...

Kevin


----------



## Trutalley (Mar 10, 2013)

Kevin, You want me to rerun http://billy-oneal.com/forums/Canned Speeches/speechimages/OTL/otlDesktopIcon.png by a double left click in vista? Where do i run this? Does it go in address bar or in the OTL under custom scan? When I double click on the link it gives me the OTL shortcut on a full page that is totally blank and doesn't open when I double click or rt click.

Clueless, Trutalley


----------



## kevinf80 (Mar 21, 2006)

You should still have OTL on your Desktop from last time when you did the initial scan. All you do is run it again, copy the the script into the Custom scan/fix box then hit the "Run Fix" button...

Edit....

Just checked, you`ve actually ran it from your downloads folder, not the desktop


----------



## Trutalley (Mar 10, 2013)

All processes killed
========== OTL ==========
Service TfSysMon stopped successfully!
Service TfSysMon deleted successfully!
File system32\drivers\TfSysMon.sys not found.
Service TfNetMon stopped successfully!
Service TfNetMon deleted successfully!
File C:\Windows\system32\drivers\TfNetMon.sys not found.
Service TfFsMon stopped successfully!
Service TfFsMon deleted successfully!
File system32\drivers\TfFsMon.sys not found.
Service SymIMMP stopped successfully!
Service SymIMMP deleted successfully!
File system32\DRIVERS\SymIM.sys not found.
Service RimUsb stopped successfully!
Service RimUsb deleted successfully!
Service pctplsg stopped successfully!
Service pctplsg deleted successfully!
File C:\Windows\System32\drivers\pctplsg.sys not found.
Service PCTINDIS5 stopped successfully!
Service PCTINDIS5 deleted successfully!
File C:\Windows\system32\PCTINDIS5.SYS not found.
Service NwlnkFwd stopped successfully!
Service NwlnkFwd deleted successfully!
Service NwlnkFlt stopped successfully!
Service NwlnkFlt deleted successfully!
Service lvpopflt stopped successfully!
Service lvpopflt deleted successfully!
File system32\DRIVERS\lvpopflt.sys not found.
Service IpInIp stopped successfully!
Service IpInIp deleted successfully!
Service huawei_enumerator stopped successfully!
Service huawei_enumerator deleted successfully!
File system32\DRIVERS\ew_jubusenum.sys not found.
Service catchme stopped successfully!
Service catchme deleted successfully!
File C:\Users\TRUDYS~1\AppData\Local\Temp\catchme.sys not found.
Prefs.js: infoatoms%40infoatoms.com:1.5.0.0 removed from extensions.enabledAddons
C:\Program Files\Mozilla Firefox\updated\extensions\[email protected]\chrome\content folder moved successfully.
C:\Program Files\Mozilla Firefox\updated\extensions\[email protected]\chrome folder moved successfully.
C:\Program Files\Mozilla Firefox\updated\extensions\[email protected] folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
Registry value HKEY_USERS\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{724D43A0-0D85-11D4-9908-00400523E39A} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{724D43A0-0D85-11D4-9908-00400523E39A}\ not found.
Registry value HKEY_USERS\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CB789373-04D5-4EF4-9C16-871463FD0830} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CB789373-04D5-4EF4-9C16-871463FD0830}\ not found.
C:\Windows\System32\REN8D7F.tmp deleted successfully.
C:\Windows\System32\REN8D80.tmp deleted successfully.
C:\Windows\System32\REN8D81.tmp deleted successfully.
C:\Users\Trudy Stewart\AppData\Roaming\IObit\IObit Malware Fighter folder moved successfully.
C:\Users\Trudy Stewart\AppData\Roaming\IObit folder moved successfully.
Unable to delete ADS C:\Windows\System32\待: @k pctlsp.log .
Unable to delete ADS C:\ProgramData\TEMPFC5A2B2 .
ADS C:\ProgramData\TEMP:1CA73D29 deleted successfully.
========== FILES ==========
File\Folder C:\WINDOWS\tasks\At*.job not found.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Trudy Stewart\Desktop\cmd.bat deleted successfully.
C:\Users\Trudy Stewart\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 57472 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Trudy Stewart
->Temp folder emptied: 243639033 bytes
->Temporary Internet Files folder emptied: 17495309 bytes
->Java cache emptied: 47626540 bytes
->FireFox cache emptied: 7101701 bytes
->Google Chrome cache emptied: 396564290 bytes
->Opera cache emptied: 1559221 bytes
->Flash cache emptied: 57983 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 124121144 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 799.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 06202013_135836

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


----------



## Trutalley (Mar 10, 2013)

still the same?


----------



## kevinf80 (Mar 21, 2006)

Do the re-directs happen in a specific browser or all browsers.. FireFox, Chrome, Internet Explorer.


----------



## Trutalley (Mar 10, 2013)

Kevin, This thing occurs in all browsers and I have ie, firefox, chrome, opera. I think I said this before, maybe not; the hit man pro scan showed several items but I didn't write it down i did however save the log if needed. That was back in March or April.
I ran the windows security scan and it found: C:\Users...tmp30d8.tmp
Win 32: Dropper-gen 
Hmmm maybe that was avast. I don't remember. Oh that was during the combofix running and avast popped up because of suspicious activity and ran a scan. I really should have kept a trail of this stuff. It keeps hanging around. That really is all I can think of. I did a lot of safety stuff after it started because there were so many ads within the websites, ebay, etc. that I couldn't use my computer at all...blocking ads, empty the cache and delete history on closing of browser. Yet still it persists. Hope this helps. Trudy


----------



## Trutalley (Mar 10, 2013)

Kevin, one other thing, every once in a while for no reason to the left and down low I see the blue download arrow fade in and fade out. It seems to be when there is a youtube ad that has been put up. Come to think of it I think this thing came from a youtube download to my phone that I emailed to myself. I ran a malware scan on it but evidently did not work. I really don't know where it came from! Trudy


----------



## kevinf80 (Mar 21, 2006)

Do you have access to another PC to create the Widows Defender Offline Tool, I give the instructions to load to a USB flash drive. If you do not have access to another PC create the tool from your own....

Download the tool from here :- http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline and save to the Desktop.

You will have to select the correct version for your system, either 32 or 64 bit










Double click







to run the tool, Windows 7 or Vista user right click and select "Run as Administrator"

Read the instructions in the new window and select "Next"










In the new window accept the agreement:










In the new window select your USB Flash Drive, then select "Next"










In the new window ensure you Flash drive is selected, if not click on "Refresh" then select "Next"










In the new window accept the formatting alert by selecting "Next"










Files will be Downloaded:










Files will be processed and created










Flash drive will be formatted and prepared










Files will be added to the Flash Drive and the tool will be created.










The procedure is finished and the Tool created, click on "Finish" to complete.










Plug the USB into the sick PC and boot up, if it does not boot from the flash drive change the boot options as required, Use F12 as it boots, change options...
As it boots you`ll see files being loaded and the windows splash screen, eventually the tool will run a "Quick Scan" follow the prompts and deal with what it finds. 
When complete do a full scan, deal with what it finds.
When finished, remove the USB stick then press the *Esc key* to boot into regular windows.
Navigate to the following file:
*"C:\windows\windows defender offline\support\mssWrapper.log"* Open with notepad and copy and paste it into a reply.

C:\Windows\Windows Defender Offline\Support\MPLog-MM/DD/YYYY-HH/MM/SS .txt

If this is a problem for you tell me, also you mentioned the log from Hitman Pro, can you post that also


----------



## Trutalley (Mar 10, 2013)

Kevin I have another computer are the directions the same? Thanks, Trudy


----------



## Trutalley (Mar 10, 2013)

Kevin, I will have to buy a usb drive that will work on an old laptop. Usb ports are different than my desktop. Back in touch tomorrow. Meanwhile I'm posting hitman log file. Will send other stuff friday! Trudy

```
HitmanPro 3.7.0.185
www.hitmanpro.com

   Computer name . . . . : TRUDYSTEWART-PC
   Windows . . . . . . . : 6.0.2.6002.X86/4
   User name . . . . . . : TrudyStewart-PC\Trudy Stewart
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Trial (31 days left)

   Scan date . . . . . . : 2013-01-04 20:26:34
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 4m 41s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 2
   Traces  . . . . . . . : 131

   Objects scanned . . . : 1,731,322
   Files scanned . . . . : 31,193
   Remnants scanned  . . : 412,491 files / 1,287,638 keys

Malware remnants ____________________________________________________________

   HKLM\SOFTWARE\Classes\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}\ (Adware.MyWebSearch) -> Deleted
   HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\InstalledBrowserExtensions\215 Apps\ (Adware.IWantThis) -> Deleted

Potential Unwanted Programs _________________________________________________

   HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Softonic\ (Softonic)

Cookies _____________________________________________________________________

   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:247realmedia.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:2o7.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:a1.interclick.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.360yield.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.yieldmanager.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:adbrite.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.al.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.cleveland.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.intergi.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.masslive.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.mlive.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.nj.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.nola.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.oregonlive.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.p161.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.pennlive.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.pointroll.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.pubmatic.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.syracuse.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.undertone.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.us.e-planning.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:adserver.adtechus.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtech.de
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtechus.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:advertising.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:apmebf.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ar.atwola.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:at.atwola.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:atdmt.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:atwola.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:bs.serving-sys.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:burstnet.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:c.atdmt.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:casalemedia.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:cisco.112.2o7.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:collective-media.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:csc.112.2o7.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:dmtracker.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:fastclick.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:h.atdmt.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:in.getclicky.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:interclick.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:invitemedia.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:kontera.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:linksynergy.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:marthastewart.122.2o7.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:media6degrees.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:mediaplex.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:network.realmedia.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:overture.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:paypal.112.2o7.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:pointroll.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:questionmarket.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:realmedia.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:revsci.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:rosettamarketing.112.2o7.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ru4.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:serving-sys.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:smartadserver.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:specificclick.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:statcounter.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:statse.webtrendslive.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:tacoda.at.atwola.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:track.adform.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:tribalfusion.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:weborama.fr
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:ww251.smartadserver.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.burstnet.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.googleadservices.com
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:yieldmanager.net
   C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Cookies:zedo.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:247realmedia.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:a1.interclick.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:ad.360yield.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:ad.doubleclick.net
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:ad.mlnadvertising.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:ad.yieldmanager.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:adbrite.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:ads.p161.net
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:ads.pointroll.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:ads.pubmatic.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:advertising.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:apmebf.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:ar.atwola.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:at.atwola.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:atdmt.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:atwola.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:burstnet.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:c.atdmt.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:c1.atdmt.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:casalemedia.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:collective-media.net
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:dmtracker.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:doubleclick.net
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:dressesexpert.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:fastclick.net
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:googleads.g.doubleclick.net
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:h.atdmt.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:interclick.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:invitemedia.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:kontera.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:marthastewart.122.2o7.net
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:media6degrees.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:mediaplex.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:microsoftsto.112.2o7.net
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:microsoftwlsearchcrm.112.2o7.net
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:network.realmedia.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:overture.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:paypal.112.2o7.net
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:pointroll.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:questionmarket.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:realmedia.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:revsci.net
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:ru4.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:serving-sys.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:specificclick.net
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:stat.onestat.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:statcounter.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:stats.ilivid.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:stats.paypal.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:statse.webtrendslive.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:tacoda.at.atwola.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:track.prd1.netshelter.net
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:tribalfusion.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:www.burstnet.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:www.googleadservices.com
   C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\cookies.sqlite:zedo.com
```


----------



## kevinf80 (Mar 21, 2006)

The Windows Defender Offline Tool will work on any system, just make sure to get correct version, it can also be burnt to a CD as well as a USB stick. The instructions are more or less the same, just select CD instead of USB.


----------



## Trutalley (Mar 10, 2013)

kevin, sorry i took so long gettingg back to you. i have been working on it. i purchased a usb drive without preloaded software. when i tried to use it with wdo it formatted the usb but did not load the program on it. it seems wdo is not compatible with windows 7. i tried the recommended fix but did not work for me. so i did it on the sick computer. it formatted and loaded fine. when i booted to the usb it did not give a usb option when i selected f12. nor could i change from an f10 screen. 3 options were given but not usb. vista doesn't always offer this. so i burned wdo to a cd. i booted up and in the boot menu i had previously selected the boot order with a cd being 1st. it offered only one screen with the popup saying "would you like to start this computer from this cd, yes or no" it did not do a quick scan, nor was a full scan offered. i selected yes and it took me to the desktop so i know the program is on there. and according to the gb used it is the full wdo program. what do i do now? thanks, trudy


----------



## kevinf80 (Mar 21, 2006)

If you booted to the Desktop you`ve done something wrong, if you boot from the CD you should end up with the GUI for Windows Offline Tool, not the Desktop.

Have a read here :- http://www.online-tech-tips.com/com...-defender-offline-tool-to-fix-an-infected-pc/


----------



## Trutalley (Mar 10, 2013)

kevin, these are the steps.
* disconnected computer from internet connection
*placed cd with preloaded windows defender offline in the computer
*turn on computer
*turn on moitor
*automatically the screen shows the boot screen & it automatically 
scans the various drives
*popup window ask if i want to start this computer from the cd, yes or no. i selected yes & it went to desktop. do you think if i selected no it would offer the option for a scan or start one automatically?


----------



## kevinf80 (Mar 21, 2006)

When you say "it went to the desktop" do you mean as in a Normal boot type desktop?


----------



## Trutalley (Mar 10, 2013)

kevin, the desktop screen that shows is the usual desktop screen i normally work from. when i look at the dvd drive it shows the capacity is 4.37gb and the amount used is 291mb. this was a new never used disc. the black screen looks like a post test? not sure about what it looks like(been a long time since i've visted, like windows 95). it shows phoenix as the at the top. then it shows the cache, ram, memory. if i boot up using the cd it scans the drives and goes to the regular desktop. hope that helps.
trudy


----------



## kevinf80 (Mar 21, 2006)

It would seem the CD may be corrupt as you are booting directly to Windows, OK we try a different tack:

Please download RKill from here: http://www.bleepingcomputer.com/download/rkill/

There are three buttons to choose from with different names on, select the first one and save it to your desktop.


 Double-click on the Rkill desktop icon to run the tool.
 If using Vista or Windows 7, right-click on it and Run As Administrator.
 A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
 A log pops up at the end of the run. This log file is located at C:\rkill.log. Please post this in your next reply.
 If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time.
 If the tool does not run from any of the links provided, please let me know.

Next,

Please download RogueKiller from here http://tigzy.geekstogo.com/roguekiller.php and save direct to your Desktop, ensure to get the correct version for your system. 32 Bit or 64 Bit..

 Quit all running programs
 Please disconnect any USB or external drives from the computer before you run this scan!
 For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
 Wait until Prescan has finished...
 The following EULA will appear, please select accept










 Ensure MBR scan, Check faked and AntiRootkit are checked
 Select Scan










 When the scan completes select Report, copy and paste that to your reply.










 The log should be found in RKreport[?].txt on your Desktop
 Exit/Close RogueKiller

Post those two logs...

Kevin


----------



## Trutalley (Mar 10, 2013)

Kevin, I was able to make a copy of windows defender offline with a plug and play dvd player used on a windows 7 laptop(won't do a usb drive download but cd is ok). I changed the boot order(AGAIN) on the sick computer making the 1st and 2nd selection the cd and the 3rd the hard drive. I changed my log in password. I am showing I am an administrator but when I tried the disk before I could not get past the pop us asking for my administrator password? I went to control panel and selected change account type saved my changes again. Then went to start and in search box typed in "cmd" and selected "Run as Administrator. This takes me to the command prompt window (all black) At the command prompt I typed "net user administrator/active.yes" Press ENTER. At the next command prompt I typed in "net user administrator 'password' (using the new password I had just set) Press ENTER (removed quotation marks on all of these.) At the next command prompt typed "exit" and Press ENTER. I shut the computer down and restarted and logged in with the new password. I am now a FULL administrator. On user accounts everything looks exactly as it did before I made all the changes I am now the "official full administrator.(who knew you had to do this in VISTA, but now I'm going to give this a test run. I shut the computer down and rebooted with the new cd. It asked if i wanted to boot from cd. I selected yes, it went immediately to Windows Defender Offline. YEAH!!! A quick scan was done, then I selected full scan. Once it had completed the scan I was given a selection box. I selected "remove the virus". I exited the program. It went immediately to the desktop. No files, anywhere. Do you know where these might be. I'm set to show hidden files and searched the C drive and the temp folders. I did however write down what it found: 
Adware:Win 32 Info Atoms. OTL moved files\06202013_135836\C
Program Files\Mozilla Firefoox\Updated\extensions
Infoatoms\chrome\content\vitruvian.plugin-api.s

I'm going to run the other programs and get them to you. There has been only one ad & it was right after I logged in, there have been no other ads in the last hour. Hope this helps. Thanks again, Trudy


----------



## kevinf80 (Mar 21, 2006)

Windows Defender Offline Tool has only indicated an entry that had already been removed by OTL and being held in its moved files folder...

Can you run RKill and RogueKiller and post those two logs..


----------



## Trutalley (Mar 10, 2013)

Kevin, Here are the items you requested.
Ref A: d2edade6b28f4d52bc7b9b42c1a8f16c Ref B: 783DBA7783E3D79C0E721DCFE991AAC3 Ref C: Sun Jun 30 08:15:34 2013 PST

ok, that did not go well.

Ref A: d2edade6b28f4d52bc7b9b42c1a8f16c Ref B: 783DBA7783E3D79C0E721DCFE991AAC3 Ref C: Sun Jun 30 08:15:34 2013 PST

hmmm.Ref A: d2edade6b28f4d52bc7b9b42c1a8f16c Ref B: 783DBA7783E3D79C0E721DCFE991AAC3 Ref C: Sun Jun 30 08:15:34 Ref A: d2edade6b28f4d52bc7b9b42c1a8f16c Ref B: 783DBA7783E3D79C0E721DCFE991AAC3 Ref C: Sun Jun 30 08:15:34 2013 PST2013 PST

okay this started this morning when I couldn't access your site this was the error message

Ref A: d2edade6b28f4d52bc7b9b42c1a8f16c Ref B: 783DBA7783E3D79C0E721DCFE991AAC3 Ref C: Sun Jun 30 08:15:34 2013 PST

have serveral temp files from todays date at about this time frame but cannot open. nor can i zip send any of ithe stuff on the desk. i'm don't know if i should download a new zip file program?. i would have asked first just seeing what the options are. oh well, the ads are back! Trudy


----------



## kevinf80 (Mar 21, 2006)

OK, as this issue affects all browsers see if you can run the following;

download the latest version of TDSSKiller from here: 
http://support.kaspersky.com/downloads/utils/tdsskiller.exe and save it to your Desktop.


 Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.










 Put a checkmark beside loaded modules.










 A *reboot* will be needed to apply the changes. *Do it.*
 TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
 Then click on Change parameters in TDSSKiller.
 Check all boxes then click OK.










 Click the Start Scan button.










 The scan will be quick.
 If a *suspicious* object is detected, the default action will be *Skip,* click on *Continue.*










 If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
 Ensure *Cure (default)* is selected, then click *Continue* > *Reboot* now to finish the cleaning process.










 Note: If *Cure* is not available, please choose *Skip* instead, do not choose *Delete* unless instructed.
 A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Kevin..


----------



## Trutalley (Mar 10, 2013)

+++++ PhysicalDrive0: Hitachi HDT725032VLA SCSI Disk Device +++++
--- User ---
[MBR] d0367b4d456509db51763b0a591f26b0
[BSP] cbe1a3892920c024e3e7b9efc684338e : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 295415 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 605011680 | Size: 9826 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

+++++ PhysicalDrive1: Hitachi HDT725032VLA SCSI Disk Device +++++
--- User ---
[MBR] 052154d1102588cad50353a17ce923b7
[BSP] 032805d5c0d315e20e0795cf5088e95b : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Finished : << RKreport[0]_S_06302013_111102.txt >>

+++++ PhysicalDrive0: Hitachi HDT725032VLA SCSI Disk Device +++++
--- User ---
[MBR] d0367b4d456509db51763b0a591f26b0
[BSP] cbe1a3892920c024e3e7b9efc684338e : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 295415 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 605011680 | Size: 9826 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

+++++ PhysicalDrive1: Hitachi HDT725032VLA SCSI Disk Device +++++
--- User ---
[MBR] 052154d1102588cad50353a17ce923b7
[BSP] 032805d5c0d315e20e0795cf5088e95b : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Finished : << RKreport[0]_S_06302013_111102.txt >>

When I couldn't search in chrome with bing I went to mozilla of course in a flash it downloaded updates. very odd. would not let me access techsupport guy at all. I went to opera with dual search engines, Google I could access, Bing no.

Anyway hope these reports help. Trudy


----------



## kevinf80 (Mar 21, 2006)

That is not the full log from RogueKiller, only partial. Also there is no log from RKill...


----------



## Trutalley (Mar 10, 2013)

18:15:25.0530 5784 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
18:15:26.0079 5784 ============================================================
18:15:26.0080 5784 Current date / time: 2013/06/30 18:15:26.0079
18:15:26.0080 5784 SystemInfo:
18:15:26.0080 5784 
18:15:26.0080 5784 OS Version: 6.0.6002 ServicePack: 2.0
18:15:26.0080 5784 Product type: Workstation
18:15:26.0080 5784 ComputerName: TRUDYSTEWART-PC
18:15:26.0081 5784 UserName: Trudy Stewart
18:15:26.0081 5784 Windows directory: C:\Windows
18:15:26.0081 5784 System windows directory: C:\Windows
18:15:26.0081 5784 Processor architecture: Intel x86
18:15:26.0081 5784 Number of processors: 4
18:15:26.0081 5784 Page size: 0x1000
18:15:26.0081 5784 Boot type: Normal boot
18:15:26.0081 5784 ============================================================
18:15:26.0754 5784 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0xA181, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000050
18:15:26.0766 5784 Drive \Device\Harddisk1\DR1 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
18:15:26.0854 5784 ============================================================
18:15:26.0854 5784 \Device\Harddisk0\DR0:
18:15:26.0854 5784 MBR partitions:
18:15:26.0854 5784 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x240FBEA1
18:15:26.0854 5784 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x240FBEE0, BlocksNum 0x1331430
18:15:26.0854 5784 \Device\Harddisk1\DR1:
18:15:26.0854 5784 MBR partitions:
18:15:26.0854 5784 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2542D682
18:15:26.0854 5784 ============================================================
18:15:26.0889 5784 C: <-> \Device\Harddisk0\DR0\Partition1
18:15:26.0924 5784 E: <-> \Device\Harddisk1\DR1\Partition1
18:15:26.0973 5784 D: <-> \Device\Harddisk0\DR0\Partition2
18:15:26.0973 5784 ============================================================
18:15:26.0973 5784 Initialize success
18:15:26.0973 5784 ============================================================
18:45:13.0169 3948 Deinitialize success

another downoaded file
18:45:50.0591 4840 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
18:45:51.0012 4840 ============================================================
18:45:51.0012 4840 Current date / time: 2013/06/30 18:45:51.0012
18:45:51.0012 4840 SystemInfo:
18:45:51.0012 4840 
18:45:51.0012 4840 OS Version: 6.0.6002 ServicePack: 2.0
18:45:51.0012 4840 Product type: Workstation
18:45:51.0012 4840 ComputerName: TRUDYSTEWART-PC
18:45:51.0012 4840 UserName: Trudy Stewart
18:45:51.0012 4840 Windows directory: C:\Windows
18:45:51.0012 4840 System windows directory: C:\Windows
18:45:51.0012 4840 Processor architecture: Intel x86
18:45:51.0012 4840 Number of processors: 4
18:45:51.0012 4840 Page size: 0x1000
18:45:51.0012 4840 Boot type: Normal boot
18:45:51.0012 4840 ============================================================
18:45:51.0402 4840 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0xA181, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000050
18:45:51.0433 4840 Drive \Device\Harddisk1\DR1 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
18:45:51.0465 4840 ============================================================
18:45:51.0465 4840 \Device\Harddisk0\DR0:
18:45:51.0465 4840 MBR partitions:
18:45:51.0465 4840 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x240FBEA1
18:45:51.0465 4840 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x240FBEE0, BlocksNum 0x1331430
18:45:51.0465 4840 \Device\Harddisk1\DR1:
18:45:51.0465 4840 MBR partitions:
18:45:51.0465 4840 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2542D682
18:45:51.0465 4840 ============================================================
18:45:51.0496 4840 C: <-> \Device\Harddisk0\DR0\Partition1
18:45:51.0543 4840 E: <-> \Device\Harddisk1\DR1\Partition1
18:45:51.0745 4840 D: <-> \Device\Harddisk0\DR0\Partition2
18:45:51.0745 4840 ============================================================
18:45:51.0745 4840 Initialize success
18:45:51.0745 4840 ============================================================
18:48:24.0688 6072 Deinitialize success

last one
18:52:15.0347 3816 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
18:52:15.0784 3816 ============================================================
18:52:15.0784 3816 Current date / time: 2013/06/30 18:52:15.0784
18:52:15.0784 3816 SystemInfo:
18:52:15.0784 3816 
18:52:15.0784 3816 OS Version: 6.0.6002 ServicePack: 2.0
18:52:15.0784 3816 Product type: Workstation
18:52:15.0784 3816 ComputerName: TRUDYSTEWART-PC
18:52:15.0784 3816 UserName: Trudy Stewart
18:52:15.0784 3816 Windows directory: C:\Windows
18:52:15.0784 3816 System windows directory: C:\Windows
18:52:15.0784 3816 Processor architecture: Intel x86
18:52:15.0784 3816 Number of processors: 4
18:52:15.0784 3816 Page size: 0x1000
18:52:15.0784 3816 Boot type: Normal boot
18:52:15.0784 3816 ============================================================
18:52:16.0938 3816 BG loaded
18:52:17.0437 3816 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0xA181, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000050
18:52:17.0437 3816 Drive \Device\Harddisk1\DR1 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
18:52:17.0468 3816 ============================================================
18:52:17.0468 3816 \Device\Harddisk0\DR0:
18:52:17.0484 3816 MBR partitions:
18:52:17.0484 3816 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x240FBEA1
18:52:17.0484 3816 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x240FBEE0, BlocksNum 0x1331430
18:52:17.0484 3816 \Device\Harddisk1\DR1:
18:52:17.0484 3816 MBR partitions:
18:52:17.0484 3816 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2542D682
18:52:17.0484 3816 ============================================================
18:52:17.0515 3816 C: <-> \Device\Harddisk0\DR0\Partition1
18:52:17.0531 3816 E: <-> \Device\Harddisk1\DR1\Partition1
18:52:17.0656 3816 D: <-> \Device\Harddisk0\DR0\Partition2
18:52:17.0656 3816 ============================================================
18:52:17.0656 3816 Initialize success
18:52:17.0656 3816 ============================================================
18:53:41.0590 5492 ============================================================
18:53:41.0590 5492 Scan started
18:53:41.0590 5492 Mode: Manual; SigCheck; TDLFS; 
18:53:41.0590 5492 ============================================================
18:53:41.0933 5492 ================ Scan system memory ========================
18:53:41.0933 5492 System memory - ok
18:53:41.0933 5492 ================ Scan services =============================
18:53:42.0729 5492 [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI C:\Windows\system32\drivers\acpi.sys
18:53:42.0931 5492 ACPI - ok
18:53:43.0072 5492 [ 2EDC5BBAC6C651ECE337BDE8ED97C9FB ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
18:53:43.0150 5492 adp94xx - ok
18:53:43.0197 5492 [ B84088CA3CDCA97DA44A984C6CE1CCAD ] adpahci C:\Windows\system32\drivers\adpahci.sys
18:53:43.0228 5492 adpahci - ok
18:53:43.0243 5492 [ 7880C67BCCC27C86FD05AA2AFB5EA469 ] adpu160m C:\Windows\system32\drivers\adpu160m.sys
18:53:43.0259 5492 adpu160m - ok
18:53:43.0290 5492 [ 9AE713F8E30EFC2ABCCD84904333DF4D ] adpu320 C:\Windows\system32\drivers\adpu320.sys
18:53:43.0306 5492 adpu320 - ok
18:53:43.0337 5492 [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
18:53:43.0524 5492 AeLookupSvc - ok
18:53:43.0571 5492 [ 3911B972B55FEA0478476B2E777B29FA ] AFD C:\Windows\system32\drivers\afd.sys
18:53:43.0649 5492 AFD - ok
18:53:43.0665 5492 [ EF23439CDD587F64C2C1B8825CEAD7D8 ] agp440 C:\Windows\system32\drivers\agp440.sys
18:53:43.0711 5492 agp440 - ok
18:53:43.0774 5492 [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx C:\Windows\system32\drivers\djsvs.sys
18:53:43.0805 5492 aic78xx - ok
18:53:43.0852 5492 [ A1545B731579895D8CC44FC0481C1192 ] ALG C:\Windows\System32\alg.exe
18:53:44.0008 5492 ALG - ok
18:53:44.0023 5492 [ 90395B64600EBB4552E26E178C94B2E4 ] aliide C:\Windows\system32\drivers\aliide.sys
18:53:44.0055 5492 aliide - ok
18:53:44.0070 5492 [ 2B13E304C9DFDFA5EB582F6A149FA2C7 ] amdagp C:\Windows\system32\drivers\amdagp.sys
18:53:44.0101 5492 amdagp - ok
18:53:44.0117 5492 [ 0577DF1D323FE75A739C787893D300EA ] amdide C:\Windows\system32\drivers\amdide.sys
18:53:44.0133 5492 amdide - ok
18:53:44.0164 5492 [ DC487885BCEF9F28EECE6FAC0E5DDFC5 ] AmdK7 C:\Windows\system32\drivers\amdk7.sys
18:53:44.0335 5492 AmdK7 - ok
18:53:44.0367 5492 [ 0CA0071DA4315B00FC1328CA86B425DA ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
18:53:44.0445 5492 AmdK8 - ok
18:53:44.0569 5492 [ DFAE18C675D71FD06D57DC69D2913975 ] AppHostSvc C:\Windows\system32\inetsrv\apphostsvc.dll
18:53:44.0647 5492 AppHostSvc - ok
18:53:44.0694 5492 [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo C:\Windows\System32\appinfo.dll
18:53:44.0788 5492 Appinfo - ok
18:53:44.0944 5492 [ 4FE5C6D40664AE07BE5105874357D2ED ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
18:53:44.0975 5492 Apple Mobile Device - ok
18:53:45.0006 5492 [ 5F673180268BB1FDB69C99B6619FE379 ] arc C:\Windows\system32\drivers\arc.sys
18:53:45.0053 5492 arc - ok
18:53:45.0100 5492 [ 957F7540B5E7F602E44648C7DE5A1C05 ] arcsas C:\Windows\system32\drivers\arcsas.sys
18:53:45.0131 5492 arcsas - ok
18:53:45.0178 5492 [ 4AF5F360BA1E8794D32B366E45A64A0A ] aswFsBlk C:\Windows\system32\drivers\aswFsBlk.sys
18:53:45.0193 5492 aswFsBlk - ok
18:53:45.0225 5492 [ 1F7094D4268D46F718C51286DC189791 ] aswMonFlt C:\Windows\system32\drivers\aswMonFlt.sys
18:53:45.0240 5492 aswMonFlt - ok
18:53:45.0271 5492 [ 7B43265F92257A21CBFD88E7A651044C ] AswRdr C:\Windows\system32\drivers\AswRdr.sys
18:53:45.0287 5492 AswRdr - ok
18:53:45.0349 5492 [ B680134BA1813B78B47FDD1DFF223CA5 ] aswRvrt C:\Windows\system32\drivers\aswRvrt.sys
18:53:45.0365 5492 aswRvrt - ok
18:53:45.0412 5492 [ CCD565A8A72AF7D45F9A242013870926 ] aswSnx C:\Windows\system32\drivers\aswSnx.sys
18:53:45.0474 5492 aswSnx - ok
18:53:45.0630 5492 [ 937300BC7C4CDF7576BCCE44E19BBB9D ] aswSP C:\Windows\system32\drivers\aswSP.sys
18:53:45.0677 5492 aswSP - ok
18:53:45.0708 5492 [ 1F71F170D90E42EFDE9633D81D5E12DC ] aswTdi C:\Windows\system32\drivers\aswTdi.sys
18:53:45.0724 5492 aswTdi - ok
18:53:45.0802 5492 [ 8CFAA2B965773A653F48F1207A9CB9C4 ] aswVmm C:\Windows\system32\drivers\aswVmm.sys
18:53:45.0833 5492 aswVmm - ok
18:53:45.0880 5492 [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
18:53:45.0958 5492 AsyncMac - ok
18:53:46.0020 5492 [ 1F05B78AB91C9075565A9D8A4B880BC4 ] atapi C:\Windows\system32\drivers\atapi.sys
18:53:46.0051 5492 atapi - ok
18:53:46.0098 5492 [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
18:53:46.0176 5492 AudioEndpointBuilder - ok
18:53:46.0192 5492 [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv C:\Windows\System32\Audiosrv.dll
18:53:46.0223 5492 Audiosrv - ok
18:53:46.0395 5492 [ 28D6701C710AD7BA3CB95E75F8F1A9AA ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe
18:53:46.0410 5492 avast! Antivirus - ok
18:53:46.0488 5492 [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep C:\Windows\system32\drivers\Beep.sys
18:53:46.0551 5492 Beep - ok
18:53:46.0597 5492 [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE C:\Windows\System32\bfe.dll
18:53:46.0660 5492 BFE - ok
18:53:46.0722 5492 [ 93952506C6D67330367F7E7934B6A02F ] BITS C:\Windows\system32\qmgr.dll
18:53:46.0831 5492 BITS - ok
18:53:46.0847 5492 blbdrive - ok
18:53:47.0003 5492 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
18:53:47.0050 5492 Bonjour Service - ok
18:53:47.0065 5492 [ 35F376253F687BDE63976CCB3F2108CA ] bowser C:\Windows\system32\DRIVERS\bowser.sys
18:53:47.0143 5492 bowser - ok
18:53:47.0159 5492 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\drivers\brfiltlo.sys
18:53:47.0221 5492 BrFiltLo - ok
18:53:47.0253 5492 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\drivers\brfiltup.sys
18:53:47.0331 5492 BrFiltUp - ok
18:53:47.0377 5492 [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser C:\Windows\System32\browser.dll
18:53:47.0440 5492 Browser - ok
18:53:47.0471 5492 [ B304E75CFF293029EDDF094246747113 ] Brserid C:\Windows\system32\drivers\brserid.sys
18:53:47.0611 5492 Brserid - ok
18:53:47.0643 5492 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\system32\drivers\brserwdm.sys
18:53:47.0799 5492 BrSerWdm - ok
18:53:47.0845 5492 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\system32\drivers\brusbmdm.sys
18:53:47.0970 5492 BrUsbMdm - ok
18:53:48.0001 5492 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\system32\drivers\brusbser.sys
18:53:48.0111 5492 BrUsbSer - ok
18:53:48.0157 5492 [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
18:53:48.0220 5492 BTHMODEM - ok
18:53:48.0282 5492 [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
18:53:48.0345 5492 cdfs - ok
18:53:48.0391 5492 [ 6B4BFFB9BECD728097024276430DB314 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
18:53:48.0454 5492 cdrom - ok
18:53:48.0501 5492 [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc C:\Windows\System32\certprop.dll
18:53:48.0579 5492 CertPropSvc - ok
18:53:48.0625 5492 [ DA8E0AFC7BAA226C538EF53AC2F90897 ] circlass C:\Windows\system32\drivers\circlass.sys
18:53:48.0750 5492 circlass - ok
18:53:48.0813 5492 [ 745D20B75B3BDDA545022625ED5DBB1B ] CISVC C:\Windows\system32\CISVC.EXE
18:53:48.0891 5492 CISVC - ok
18:53:48.0937 5492 [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS C:\Windows\system32\CLFS.sys
18:53:48.0969 5492 CLFS - ok
18:53:49.0109 5492 [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:53:49.0140 5492 clr_optimization_v2.0.50727_32 - ok
18:53:49.0218 5492 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:53:49.0265 5492 clr_optimization_v4.0.30319_32 - ok
18:53:49.0312 5492 [ 45201046C776FFDAF3FC8A0029C581C8 ] cmdide C:\Windows\system32\drivers\cmdide.sys
18:53:49.0343 5492 cmdide - ok
18:53:49.0343 5492 [ 82B8C91D327CFECF76CB58716F7D4997 ] Compbatt C:\Windows\system32\drivers\compbatt.sys
18:53:49.0374 5492 Compbatt - ok
18:53:49.0405 5492 [ 9704B9C442E3EF2989746D08F80A3743 ] CompFilter C:\Windows\system32\DRIVERS\lvbusflt.sys
18:53:49.0437 5492 CompFilter - ok
18:53:49.0452 5492 COMSysApp - ok
18:53:49.0483 5492 [ 2A213AE086BBEC5E937553C7D9A2B22C ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
18:53:49.0499 5492 crcdisk - ok
18:53:49.0530 5492 [ 22A7F883508176489F559EE745B5BF5D ] Crusoe C:\Windows\system32\drivers\crusoe.sys
18:53:49.0608 5492 Crusoe - ok
18:53:49.0702 5492 [ 3EDE4C1F9672C972479201544969ADCB ] CryptSvc C:\Windows\system32\cryptsvc.dll
18:53:49.0764 5492 CryptSvc - ok
18:53:49.0827 5492 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch C:\Windows\system32\rpcss.dll
18:53:49.0873 5492 DcomLaunch - ok
18:53:49.0920 5492 [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC C:\Windows\system32\Drivers\dfsc.sys
18:53:49.0998 5492 DfsC - ok
18:53:50.0107 5492 [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR C:\Windows\system32\DFSR.exe
18:53:50.0248 5492 DFSR - ok
18:53:50.0295 5492 [ 9028559C132146FB75EB7ACF384B086A ] Dhcp C:\Windows\System32\dhcpcsvc.dll
18:53:50.0341 5492 Dhcp - ok
18:53:50.0388 5492 [ 5D4AEFC3386920236A548271F8F1AF6A ] disk C:\Windows\system32\drivers\disk.sys
18:53:50.0404 5492 disk - ok
18:53:50.0435 5492 [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache C:\Windows\System32\dnsrslvr.dll
18:53:50.0497 5492 Dnscache - ok
18:53:50.0529 5492 [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc C:\Windows\System32\dot3svc.dll
18:53:50.0575 5492 dot3svc - ok
18:53:50.0700 5492 [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS C:\Windows\system32\dps.dll
18:53:50.0778 5492 DPS - ok
18:53:50.0841 5492 [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
18:53:50.0919 5492 drmkaud - ok
18:53:51.0075 5492 [ 5DE0FAEC9E5D1AAE74F8568897891A01 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
18:53:51.0121 5492 DXGKrnl - ok
18:53:51.0168 5492 [ F88FB26547FD2CE6D0A5AF2985892C48 ] E1G60 C:\Windows\system32\DRIVERS\E1G60I32.sys
18:53:51.0309 5492 E1G60 - ok
18:53:51.0340 5492 [ C0B95E40D85CD807D614E264248A45B9 ] EapHost C:\Windows\System32\eapsvc.dll
18:53:51.0418 5492 EapHost - ok
18:53:51.0527 5492 [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache C:\Windows\system32\drivers\ecache.sys
18:53:51.0574 5492 Ecache - ok
18:53:51.0761 5492 [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
18:53:51.0870 5492 ehRecvr - ok
18:53:51.0901 5492 [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched C:\Windows\ehome\ehsched.exe
18:53:51.0979 5492 ehSched - ok
18:53:51.0995 5492 [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart C:\Windows\ehome\ehstart.dll
18:53:52.0042 5492 ehstart - ok
18:53:52.0089 5492 [ E8F3F21A71720C84BCF423B80028359F ] elxstor C:\Windows\system32\drivers\elxstor.sys
18:53:52.0135 5492 elxstor - ok
18:53:52.0291 5492 [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt C:\Windows\system32\emdmgmt.dll
18:53:52.0369 5492 EMDMgmt - ok
18:53:52.0432 5492 [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem C:\Windows\system32\es.dll
18:53:52.0479 5492 EventSystem - ok
18:53:52.0525 5492 [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat C:\Windows\system32\drivers\exfat.sys
18:53:52.0588 5492 exfat - ok
18:53:52.0650 5492 [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat C:\Windows\system32\drivers\fastfat.sys
18:53:52.0697 5492 fastfat - ok
18:53:52.0744 5492 [ 63BDADA84951B9C03E641800E176898A ] fdc C:\Windows\system32\DRIVERS\fdc.sys
18:53:52.0806 5492 fdc - ok
18:53:52.0853 5492 [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost C:\Windows\system32\fdPHost.dll
18:53:52.0900 5492 fdPHost - ok
18:53:52.0915 5492 [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub C:\Windows\system32\fdrespub.dll
18:53:52.0993 5492 FDResPub - ok
18:53:53.0056 5492 [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
18:53:53.0087 5492 FileInfo - ok
18:53:53.0118 5492 [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace C:\Windows\system32\drivers\filetrace.sys
18:53:53.0149 5492 Filetrace - ok
18:53:53.0181 5492 [ 6603957EFF5EC62D25075EA8AC27DE68 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
18:53:53.0243 5492 flpydisk - ok
18:53:53.0321 5492 [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
18:53:53.0337 5492 FltMgr - ok
18:53:53.0430 5492 [ 8CE364388C8ECA59B14B539179276D44 ] FontCache C:\Windows\system32\FntCache.dll
18:53:53.0524 5492 FontCache - ok
18:53:53.0571 5492 [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
18:53:53.0602 5492 FontCache3.0.0.0 - ok
18:53:53.0617 5492 [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
18:53:53.0695 5492 Fs_Rec - ok
18:53:53.0711 5492 [ 4E1CD0A45C50A8882616CAE5BF82F3C5 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
18:53:53.0742 5492 gagp30kx - ok
18:53:53.0789 5492 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
18:53:53.0805 5492 GEARAspiWDM - ok
18:53:53.0898 5492 [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc C:\Windows\System32\gpsvc.dll
18:53:54.0023 5492 gpsvc - ok
18:53:54.0117 5492 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
18:53:54.0132 5492 gupdate - ok
18:53:54.0148 5492 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
18:53:54.0163 5492 gupdatem - ok
18:53:54.0257 5492 [ CC839E8D766CC31A7710C9F38CF3E375 ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
18:53:54.0288 5492 gusvc - ok
18:53:54.0319 5492 [ CB04C744BE0A61B1D648FAED182C3B59 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
18:53:54.0444 5492 HdAudAddService - ok
18:53:54.0475 5492 [ C87B1EE051C0464491C1A7B03FA0BC99 ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
18:53:54.0538 5492 HDAudBus - ok
18:53:54.0585 5492 [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth C:\Windows\system32\drivers\hidbth.sys
18:53:54.0678 5492 HidBth - ok
18:53:54.0709 5492 [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr C:\Windows\system32\drivers\hidir.sys
18:53:54.0787 5492 HidIr - ok
18:53:54.0819 5492 [ 84067081F3318162797385E11A8F0582 ] hidserv C:\Windows\System32\hidserv.dll
18:53:54.0881 5492 hidserv - ok
18:53:54.0912 5492 [ CCA4B519B17E23A00B826C55716809CC ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
18:53:54.0990 5492 HidUsb - ok
18:53:55.0021 5492 [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc C:\Windows\system32\kmsvc.dll
18:53:55.0099 5492 hkmsvc - ok
18:53:55.0209 5492 [ 0D26C438E2938A3E6BDD91173BC96FF0 ] HP Health Check Service c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
18:53:55.0255 5492 HP Health Check Service ( UnsignedFile.Multi.Generic ) - warning
18:53:55.0255 5492 HP Health Check Service - detected UnsignedFile.Multi.Generic (1)
18:53:55.0302 5492 [ DF353B401001246853763C4B7AAA6F50 ] HpCISSs C:\Windows\system32\drivers\hpcisss.sys
18:53:55.0333 5492 HpCISSs - ok
18:53:55.0536 5492 [ 88749FBF8BEB18C90E7D6626C8C1910B ] HSF_DP C:\Windows\system32\DRIVERS\HSX_DP.sys
18:53:55.0723 5492 HSF_DP - ok
18:53:55.0770 5492 [ FE440536BD98AF772130DC3A6FE1915F ] HSXHWBS2 C:\Windows\system32\DRIVERS\HSXHWBS2.sys
18:53:55.0801 5492 HSXHWBS2 - ok
18:53:55.0942 5492 [ F870AA3E254628EBEAFE754108D664DE ] HTTP C:\Windows\system32\drivers\HTTP.sys
18:53:56.0020 5492 HTTP - ok
18:53:56.0067 5492 [ 324C2152FF2C61ABAE92D09F3CCA4D63 ] i2omp C:\Windows\system32\drivers\i2omp.sys
18:53:56.0098 5492 i2omp - ok
18:53:56.0129 5492 [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
18:53:56.0191 5492 i8042prt - ok
18:53:56.0269 5492 [ C957BF4B5D80B46C5017BF0101E6C906 ] iaStorV C:\Windows\system32\drivers\iastorv.sys
18:53:56.0316 5492 iaStorV - ok
18:53:56.0441 5492 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
18:53:56.0503 5492 IDriverT ( UnsignedFile.Multi.Generic ) - warning
18:53:56.0503 5492 IDriverT - detected UnsignedFile.Multi.Generic (1)
18:53:56.0628 5492 [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc  C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
18:53:56.0691 5492 idsvc - ok
18:53:56.0722 5492 [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp C:\Windows\system32\drivers\iirsp.sys
18:53:56.0753 5492 iirsp - ok
18:53:56.0800 5492 [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT C:\Windows\System32\ikeext.dll
18:53:56.0909 5492 IKEEXT - ok
18:53:57.0283 5492 [ 84ED2154239F9D013BBD3220755ADA8B ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
18:53:57.0393 5492 IntcAzAudAddService - ok
18:53:57.0424 5492 [ 97469037714070E45194ED318D636401 ] intelide C:\Windows\system32\drivers\intelide.sys
18:53:57.0439 5492 intelide - ok
18:53:57.0471 5492 [ CE44CC04262F28216DD4341E9E36A16F ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
18:53:57.0564 5492 intelppm - ok
18:53:57.0595 5492 [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
18:53:57.0658 5492 IPBusEnum - ok
18:53:57.0736 5492 [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
18:53:57.0798 5492 IpFilterDriver - ok
18:53:57.0829 5492 [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
18:53:57.0861 5492 iphlpsvc - ok
18:53:57.0892 5492 [ 40F34F8ABA2A015D780E4B09138B6C17 ] IPMIDRV C:\Windows\system32\drivers\ipmidrv.sys
18:53:57.0970 5492 IPMIDRV - ok
18:53:58.0017 5492 [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT C:\Windows\system32\DRIVERS\ipnat.sys
18:53:58.0079 5492 IPNAT - ok
18:53:58.0141 5492 [ E3E71649A926CB34FA4D7AB75DCE126C ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
18:53:58.0157 5492 iPod Service - ok
18:53:58.0204 5492 [ 03D54E7BCF9B77CEAF34DC0057420352 ] iprip C:\Windows\System32\iprip.dll
18:53:58.0282 5492 iprip - ok
18:53:58.0313 5492 [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
18:53:58.0375 5492 IRENUM - ok
18:53:58.0422 5492 [ 350FCA7E73CF65BCEF43FAE1E4E91293 ] isapnp C:\Windows\system32\drivers\isapnp.sys
18:53:58.0422 5492 isapnp - ok
18:53:58.0485 5492 [ F247EEC28317F6C739C16DE420097301 ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys
18:53:58.0500 5492 iScsiPrt - ok
18:53:58.0531 5492 [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi C:\Windows\system32\drivers\iteatapi.sys
18:53:58.0563 5492 iteatapi - ok
18:53:58.0578 5492 [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid C:\Windows\system32\drivers\iteraid.sys
18:53:58.0594 5492 iteraid - ok
18:53:58.0656 5492 [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
18:53:58.0672 5492 kbdclass - ok
18:53:58.0703 5492 [ D2600CB17B7408B4A83F231DC9A11AC3 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
18:53:58.0828 5492 kbdhid - ok
18:53:58.0859 5492 [ A3E186B4B935905B829219502557314E ] KeyIso C:\Windows\system32\lsass.exe
18:53:58.0937 5492 KeyIso - ok
18:53:59.0015 5492 [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
18:53:59.0077 5492 KSecDD - ok
18:53:59.0124 5492 [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm C:\Windows\system32\msdtckrm.dll
18:53:59.0218 5492 KtmRm - ok
18:53:59.0249 5492 [ D88846F9F4F27AE9BE584A6E5B6B8753 ] L8042Kbd C:\Windows\system32\DRIVERS\L8042Kbd.sys
18:53:59.0280 5492 L8042Kbd - ok
18:53:59.0311 5492 [ BEA61FDA2103F6F51B14EB0872E8A050 ] L8042mou C:\Windows\system32\DRIVERS\L8042mou.Sys
18:53:59.0343 5492 L8042mou - ok
18:53:59.0389 5492 [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer C:\Windows\System32\srvsvc.dll
18:53:59.0436 5492 LanmanServer - ok
18:53:59.0530 5492 [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
18:53:59.0592 5492 LanmanWorkstation - ok
18:53:59.0623 5492 [ 3FA98339E8D9E007726BE62F231E2015 ] LHidFilt C:\Windows\system32\DRIVERS\LHidFilt.Sys
18:53:59.0639 5492 LHidFilt - ok
18:53:59.0795 5492 [ 75AC54B996F7C8E17594EBC32B6614BD ] LightScribeService c:\Program Files\Common Files\LightScribe\LSSrvc.exe
18:53:59.0811 5492 LightScribeService - ok
18:54:00.0107 5492 [ BA8494FE6EE119AAD2505A57058B282E ] Linksys_adapter C:\Windows\system32\DRIVERS\AE1200vista.sys
18:54:00.0201 5492 Linksys_adapter - ok
18:54:00.0279 5492 [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
18:54:00.0357 5492 lltdio - ok
18:54:00.0450 5492 [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc C:\Windows\System32\lltdsvc.dll
18:54:00.0528 5492 lltdsvc - ok
18:54:00.0559 5492 [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts C:\Windows\System32\lmhsvc.dll
18:54:00.0669 5492 lmhosts - ok
18:54:00.0700 5492 [ F259F758E04D8FB8D48C6CDBE45223E8 ] LMouFilt C:\Windows\system32\DRIVERS\LMouFilt.Sys
18:54:00.0700 5492 LMouFilt - ok
18:54:00.0731 5492 [ CAB504E38FCED9A56D87D838E9BA13E9 ] LMouKE C:\Windows\system32\DRIVERS\LMouKE.Sys
18:54:00.0778 5492 LMouKE - ok
18:54:00.0809 5492 [ A2262FB9F28935E862B4DB46438C80D2 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
18:54:00.0825 5492 LSI_FC - ok
18:54:00.0840 5492 [ 30D73327D390F72A62F32C103DAF1D6D ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
18:54:00.0856 5492 LSI_SAS - ok
18:54:00.0871 5492 [ E1E36FEFD45849A95F1AB81DE0159FE3 ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
18:54:00.0887 5492 LSI_SCSI - ok
18:54:00.0918 5492 [ 8F5C7426567798E62A3B3614965D62CC ] luafv C:\Windows\system32\drivers\luafv.sys
18:54:00.0981 5492 luafv - ok
18:54:00.0996 5492 [ 8BE71D7EDB8C7494913722059F760DD0 ] LVPr2Mon C:\Windows\system32\DRIVERS\LVPr2Mon.sys
18:54:01.0012 5492 LVPr2Mon - ok
18:54:01.0059 5492 [ ED643E777BA3F7151EF3F0FB6BE4F7F0 ] LVRS C:\Windows\system32\DRIVERS\lvrs.sys
18:54:01.0090 5492 LVRS - ok
18:54:01.0137 5492 [ BE5E104BE263921D6842C555DB6A5C23 ] LVUSBSta C:\Windows\system32\drivers\LVUSBSta.sys
18:54:01.0168 5492 LVUSBSta - ok
18:54:02.0619 5492 [ 5BC80451109A8DD7F2DDD35BCE2929A3 ] LVUVC C:\Windows\system32\DRIVERS\lvuvc.sys
18:54:02.0931 5492 LVUVC - ok
18:54:02.0962 5492 [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
18:54:03.0024 5492 Mcx2Svc - ok
18:54:03.0055 5492 [ 0CEA2D0D3FA284B85ED5B68365114F76 ] mdmxsdk C:\Windows\system32\DRIVERS\mdmxsdk.sys
18:54:03.0118 5492 mdmxsdk - ok
18:54:03.0149 5492 [ D153B14FC6598EAE8422A2037553ADCE ] megasas C:\Windows\system32\drivers\megasas.sys
18:54:03.0180 5492 megasas - ok
18:54:03.0445 5492 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
18:54:03.0508 5492 Microsoft Office Groove Audit Service - ok
18:54:03.0555 5492 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS C:\Windows\system32\mmcss.dll
18:54:03.0617 5492 MMCSS - ok
18:54:03.0648 5492 [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem C:\Windows\system32\drivers\modem.sys
18:54:03.0695 5492 Modem - ok
18:54:03.0742 5492 [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
18:54:03.0789 5492 monitor - ok
18:54:03.0820 5492 [ 5BF6A1326A335C5298477754A506D263 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
18:54:03.0851 5492 mouclass - ok
18:54:03.0882 5492 [ 93B8D4869E12CFBE663915502900876F ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
18:54:03.0960 5492 mouhid - ok
18:54:04.0007 5492 [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr C:\Windows\system32\drivers\mountmgr.sys
18:54:04.0069 5492 MountMgr - ok
18:54:04.0163 5492 [ 825BF0E46B4470A463AEB641480C5FCA ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
18:54:04.0225 5492 MozillaMaintenance - ok
18:54:04.0335 5492 [ 583A41F26278D9E0EA548163D6139397 ] mpio C:\Windows\system32\drivers\mpio.sys
18:54:04.0366 5492 mpio - ok
18:54:04.0413 5492 [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
18:54:04.0475 5492 mpsdrv - ok
18:54:04.0693 5492 [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc C:\Windows\system32\mpssvc.dll
18:54:04.0756 5492 MpsSvc - ok
18:54:04.0771 5492 [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x C:\Windows\system32\drivers\mraid35x.sys
18:54:04.0803 5492 Mraid35x - ok
18:54:04.0881 5492 [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
18:54:04.0912 5492 MRxDAV - ok
18:54:04.0974 5492 [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
18:54:05.0052 5492 mrxsmb - ok
18:54:05.0083 5492 [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
18:54:05.0115 5492 mrxsmb10 - ok
18:54:05.0146 5492 [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
18:54:05.0177 5492 mrxsmb20 - ok
18:54:05.0208 5492 [ 742AED7939E734C36B7E8D6228CE26B7 ] msahci C:\Windows\system32\drivers\msahci.sys
18:54:05.0239 5492 msahci - ok
18:54:05.0271 5492 [ 3FC82A2AE4CC149165A94699183D3028 ] msdsm C:\Windows\system32\drivers\msdsm.sys
18:54:05.0302 5492 msdsm - ok
18:54:05.0411 5492 [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC C:\Windows\System32\msdtc.exe
18:54:05.0489 5492 MSDTC - ok
18:54:05.0536 5492 [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs C:\Windows\system32\drivers\Msfs.sys
18:54:05.0614 5492 Msfs - ok
18:54:05.0661 5492 [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
18:54:05.0676 5492 msisadrv - ok
18:54:05.0723 5492 [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
18:54:05.0801 5492 MSiSCSI - ok
18:54:05.0817 5492 msiserver - ok
18:54:05.0863 5492 [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
18:54:05.0941 5492 MSKSSRV - ok
18:54:05.0957 5492 [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
18:54:06.0004 5492 MSPCLOCK - ok
18:54:06.0019 5492 [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
18:54:06.0082 5492 MSPQM - ok
18:54:06.0581 5492 [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
18:54:06.0628 5492 MsRPC - ok
18:54:06.0690 5492 [ E384487CB84BE41D09711C30CA79646C ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
18:54:06.0706 5492 mssmbios - ok
18:54:06.0768 5492 [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
18:54:06.0877 5492 MSTEE - ok
18:54:06.0924 5492 [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup C:\Windows\system32\Drivers\mup.sys
18:54:06.0955 5492 Mup - ok
18:54:07.0096 5492 [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent C:\Windows\system32\qagentRT.dll
18:54:07.0174 5492 napagent - ok
18:54:07.0252 5492 [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
18:54:07.0283 5492 NativeWifiP - ok
18:54:07.0439 5492 [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS C:\Windows\system32\drivers\ndis.sys
18:54:07.0657 5492 NDIS - ok
18:54:07.0735 5492 [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
18:54:07.0845 5492 NdisTapi - ok
18:54:08.0047 5492 [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
18:54:08.0125 5492 Ndisuio - ok
18:54:08.0188 5492 [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
18:54:08.0219 5492 NdisWan - ok
18:54:08.0281 5492 [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
18:54:08.0375 5492 NDProxy - ok
18:54:08.0484 5492 [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
18:54:08.0593 5492 NetBIOS - ok
18:54:08.0718 5492 [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt C:\Windows\system32\DRIVERS\netbt.sys
18:54:08.0827 5492 netbt - ok
18:54:08.0859 5492 [ A3E186B4B935905B829219502557314E ] Netlogon C:\Windows\system32\lsass.exe
18:54:08.0874 5492 Netlogon - ok
18:54:08.0983 5492 [ C8052711DAECC48B982434C5116CA401 ] Netman C:\Windows\System32\netman.dll
18:54:09.0093 5492 Netman - ok
18:54:09.0233 5492 [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm C:\Windows\System32\netprofm.dll
18:54:09.0389 5492 netprofm - ok
18:54:09.0436 5492 [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
18:54:09.0498 5492 NetTcpPortSharing - ok
18:54:09.0545 5492 [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
18:54:09.0576 5492 nfrd960 - ok
18:54:09.0685 5492 [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc C:\Windows\System32\nlasvc.dll
18:54:09.0779 5492 NlaSvc - ok
18:54:10.0091 5492 [ CD569FA91EC6F59D045C19D0D3850F44 ] nmservice C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
18:54:10.0185 5492 nmservice - ok
18:54:10.0247 5492 [ 6623E51595C0076755C29C00846C4EB2 ] NPF C:\Windows\system32\drivers\npf.sys
18:54:10.0278 5492 NPF - ok
18:54:10.0325 5492 [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs C:\Windows\system32\drivers\Npfs.sys
18:54:10.0434 5492 Npfs - ok
18:54:10.0512 5492 [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi C:\Windows\system32\nsisvc.dll
18:54:10.0606 5492 nsi - ok
18:54:10.0777 5492 [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
18:54:10.0871 5492 nsiproxy - ok
18:54:11.0277 5492 [ 2C1121F2B87E9A6B12485DF53CD848C7 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
18:54:11.0651 5492 Ntfs - ok
18:54:11.0901 5492 [ A7DFF9642D510BE1EEC6664CD0369953 ] NtmsSvc C:\Windows\system32\ntmssvc.dll
18:54:11.0979 5492 NtmsSvc - ok
18:54:12.0010 5492 [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi C:\Windows\system32\drivers\ntrigdigi.sys
18:54:12.0135 5492 ntrigdigi - ok
18:54:12.0166 5492 [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null C:\Windows\system32\drivers\Null.sys
18:54:12.0228 5492 Null - ok
18:54:12.0618 5492 [ D958A2B5F6AD5C3B8CCDC4D7DA62466C ] NVENETFD C:\Windows\system32\DRIVERS\nvmfdx32.sys
18:54:12.0696 5492 NVENETFD - ok
18:54:13.0679 5492 [ 11F99482DAFFEDF622A4A3F4B0C81487 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
18:54:14.0053 5492 nvlddmkm - ok
18:54:14.0085 5492 [ E69E946F80C1C31C53003BFBF50CBB7C ] nvraid C:\Windows\system32\drivers\nvraid.sys
18:54:14.0100 5492 nvraid - ok
18:54:14.0131 5492 [ 9E0BA19A28C498A6D323D065DB76DFFC ] nvstor C:\Windows\system32\drivers\nvstor.sys
18:54:14.0163 5492 nvstor - ok
18:54:14.0194 5492 [ 63B7838E9C272BAAA7B33A0CA4EBB748 ] nvstor32 C:\Windows\system32\DRIVERS\nvstor32.sys
18:54:14.0225 5492 nvstor32 - ok
18:54:14.0256 5492 [ 07C186427EB8FCC3D8D7927187F260F7 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
18:54:14.0334 5492 nv_agp - ok
18:54:14.0568 5492 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
18:54:14.0631 5492 odserv - ok
18:54:14.0693 5492 [ 58F478FD0115012CEEC75FB73628901C ] OEM05Afx C:\Windows\system32\Drivers\OEM05Afx.sys
18:54:14.0740 5492 OEM05Afx - ok
18:54:14.0755 5492 [ 86326062A90494BDD79CE383511D7D69 ] OEM05Vfx C:\Windows\system32\DRIVERS\OEM05Vfx.sys
18:54:14.0802 5492 OEM05Vfx - ok
18:54:14.0833 5492 [ 3C60C2022CB93073DA2574DA90C962C2 ] OEM05Vid C:\Windows\system32\DRIVERS\OEM05Vid.sys
18:54:14.0865 5492 OEM05Vid - ok
18:54:14.0943 5492 [ 6F310E890D46E246E0E261A63D9B36B4 ] ohci1394 C:\Windows\system32\DRIVERS\ohci1394.sys
18:54:15.0021 5492 ohci1394 - ok
18:54:15.0083 5492 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
18:54:15.0114 5492 ose - ok
18:54:15.0177 5492 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc C:\Windows\system32\p2psvc.dll
18:54:15.0270 5492 p2pimsvc - ok
18:54:15.0286 5492 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc C:\Windows\system32\p2psvc.dll
18:54:15.0348 5492 p2psvc - ok
18:54:15.0379 5492 [ 0FA9B5055484649D63C303FE404E5F4D ] Parport C:\Windows\system32\drivers\parport.sys
18:54:15.0504 5492 Parport - ok
18:54:15.0598 5492 [ B9C2B89F08670E159F7181891E449CD9 ] partmgr C:\Windows\system32\drivers\partmgr.sys
18:54:15.0645 5492 partmgr - ok
18:54:15.0660 5492 [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm C:\Windows\system32\drivers\parvdm.sys
18:54:15.0769 5492 Parvdm - ok
18:54:15.0816 5492 [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc C:\Windows\System32\pcasvc.dll
18:54:15.0879 5492 PcaSvc - ok
18:54:15.0972 5492 [ 941DC1D19E7E8620F40BBC206981EFDB ] pci C:\Windows\system32\drivers\pci.sys
18:54:16.0003 5492 pci - ok
18:54:16.0066 5492 [ 1636D43F10416AEB483BC6001097B26C ] pciide C:\Windows\system32\drivers\pciide.sys
18:54:16.0097 5492 pciide - ok
18:54:16.0128 5492 [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
18:54:16.0159 5492 pcmcia - ok
18:54:16.0206 5492 [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
18:54:16.0300 5492 PEAUTH - ok
18:54:16.0768 5492 [ B1689DF169143F57053F795390C99DB3 ] pla C:\Windows\system32\pla.dll
18:54:16.0908 5492 pla - ok
18:54:16.0986 5492 [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay C:\Windows\system32\umpnpmgr.dll
18:54:17.0049 5492 PlugPlay - ok
18:54:17.0095 5492 [ 3DE33BCE4A930EDF57BD1F742823BCD8 ] pnarp C:\Windows\system32\DRIVERS\pnarp.sys
18:54:17.0111 5492 pnarp - ok
18:54:17.0314 5492 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg C:\Windows\system32\p2psvc.dll
18:54:17.0376 5492 PNRPAutoReg - ok
18:54:17.0392 5492 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc C:\Windows\system32\p2psvc.dll
18:54:17.0439 5492 PNRPsvc - ok
18:54:17.0485 5492 [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
18:54:17.0563 5492 PolicyAgent - ok
18:54:17.0626 5492 [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
18:54:17.0704 5492 PptpMiniport - ok
18:54:17.0766 5492 [ 2027293619DD0F047C584CF2E7DF4FFD ] Processor C:\Windows\system32\DRIVERS\processr.sys
18:54:17.0813 5492 Processor - ok
18:54:17.0891 5492 [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc  C:\Windows\system32\profsvc.dll
18:54:17.0953 5492 ProfSvc - ok
18:54:18.0000 5492 [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
18:54:18.0016 5492 ProtectedStorage - ok
18:54:18.0063 5492 [ 390C204CED3785609AB24E9C52054A84 ] Ps2 C:\Windows\system32\DRIVERS\PS2.sys
18:54:18.0109 5492 Ps2 - ok
18:54:18.0141 5492 [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched C:\Windows\system32\DRIVERS\pacer.sys
18:54:18.0203 5492 PSched - ok
18:54:18.0250 5492 [ 53EFA6066E7FFAA1AD91C7FB40FFD2EC ] purendis C:\Windows\system32\DRIVERS\purendis.sys
18:54:18.0281 5492 purendis - ok
18:54:18.0593 5492 [ CCDAC889326317792480C0A67156A1EC ] ql2300 C:\Windows\system32\drivers\ql2300.sys
18:54:18.0671 5492 ql2300 - ok
18:54:18.0687 5492 [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
18:54:18.0718 5492 ql40xx - ok
18:54:18.0780 5492 [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE C:\Windows\system32\qwave.dll
18:54:18.0843 5492 QWAVE - ok
18:54:18.0905 5492 [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
18:54:18.0952 5492 QWAVEdrv - ok
18:54:18.0999 5492 [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
18:54:19.0061 5492 RasAcd - ok
18:54:19.0123 5492 [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto C:\Windows\System32\rasauto.dll
18:54:19.0201 5492 RasAuto - ok
18:54:19.0264 5492 [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
18:54:19.0326 5492 Rasl2tp - ok
18:54:19.0389 5492 [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan C:\Windows\System32\rasmans.dll
18:54:19.0435 5492 RasMan - ok
18:54:19.0482 5492 [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
18:54:19.0529 5492 RasPppoe - ok
18:54:19.0638 5492 [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
18:54:19.0669 5492 RasSstp - ok
18:54:19.0747 5492 [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
18:54:19.0810 5492 rdbss - ok
18:54:19.0888 5492 [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
18:54:19.0966 5492 RDPCDD - ok
18:54:20.0059 5492 [ E8BD98D46F2ED77132BA927FCCB47D8B ] rdpdr C:\Windows\system32\drivers\rdpdr.sys
18:54:20.0200 5492 rdpdr - ok
18:54:20.0215 5492 [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
18:54:20.0262 5492 RDPENCDD - ok
18:54:20.0340 5492 [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
18:54:20.0418 5492 RDPWD - ok
18:54:20.0481 5492 [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess C:\Windows\System32\mprdim.dll
18:54:20.0543 5492 RemoteAccess - ok
18:54:20.0605 5492 [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry C:\Windows\system32\regsvc.dll
18:54:20.0652 5492 RemoteRegistry - ok
18:54:20.0699 5492 [ D9B34325EE5DF78B8F28A3DE9F577C7D ] RimVSerPort C:\Windows\system32\DRIVERS\RimSerial.sys
18:54:20.0761 5492 RimVSerPort - ok
18:54:20.0808 5492 [ 75E8A6BFA7374ABA833AE92BF41AE4E6 ] ROOTMODEM C:\Windows\system32\Drivers\RootMdm.sys
18:54:20.0886 5492 ROOTMODEM - ok
18:54:20.0964 5492 RoxLiveShare9 - ok
18:54:21.0011 5492 [ E51A8D02B4BD33EBA1F7A5B76C3766ED ] rpcapd C:\Program Files\WinPcap\rpcapd.exe
18:54:21.0027 5492 rpcapd - ok
18:54:21.0058 5492 [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator C:\Windows\system32\locator.exe
18:54:21.0136 5492 RpcLocator - ok
18:54:21.0198 5492 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs C:\Windows\system32\rpcss.dll
18:54:21.0261 5492 RpcSs - ok
18:54:21.0307 5492 [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
18:54:21.0417 5492 rspndr - ok
18:54:21.0432 5492 [ A3E186B4B935905B829219502557314E ] SamSs C:\Windows\system32\lsass.exe
18:54:21.0463 5492 SamSs - ok
18:54:21.0495 5492 [ 3CE8F073A557E172B330109436984E30 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
18:54:21.0526 5492 sbp2port - ok
18:54:21.0573 5492 [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr C:\Windows\System32\SCardSvr.dll
18:54:21.0604 5492 SCardSvr - ok
18:54:21.0682 5492 [ 51EC343E322DD43C6BE884F1CDA4CA38 ] SCDEmu C:\Windows\system32\drivers\SCDEmu.sys
18:54:21.0697 5492 SCDEmu - ok
18:54:21.0822 5492 [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule C:\Windows\system32\schedsvc.dll
18:54:21.0869 5492 Schedule - ok
18:54:21.0900 5492 [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc C:\Windows\System32\certprop.dll
18:54:21.0931 5492 SCPolicySvc - ok
18:54:21.0994 5492 [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC C:\Windows\System32\SDRSVC.dll
18:54:22.0056 5492 SDRSVC - ok
18:54:22.0072 5492 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
18:54:22.0181 5492 secdrv - ok
18:54:22.0259 5492 [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon C:\Windows\system32\seclogon.dll
18:54:22.0321 5492 seclogon - ok
18:54:22.0368 5492 [ A9BBAB5759771E523F55563D6CBE140F ] SENS C:\Windows\system32\sens.dll
18:54:22.0446 5492 SENS - ok
18:54:22.0493 5492 [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum C:\Windows\system32\drivers\serenum.sys
18:54:22.0587 5492 Serenum - ok
18:54:22.0602 5492 [ C70D69A918B178D3C3B06339B40C2E1B ] Serial C:\Windows\system32\drivers\serial.sys
18:54:22.0680 5492 Serial - ok
18:54:22.0743 5492 [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse C:\Windows\system32\drivers\sermouse.sys
18:54:22.0836 5492 sermouse - ok
18:54:22.0914 5492 [ D2193326F729B163125610DBF3E17D57 ] SessionEnv C:\Windows\system32\sessenv.dll
18:54:22.0961 5492 SessionEnv - ok
18:54:23.0008 5492 [ 51CF56AA8BCC241F134B420B8F850406 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
18:54:23.0070 5492 sffdisk - ok
18:54:23.0086 5492 [ 96DED8B20C734AC41641CE275250E55D ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
18:54:23.0133 5492 sffp_mmc - ok
18:54:23.0164 5492 [ 8B08CAB1267B2C377883FC9E56981F90 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
18:54:23.0195 5492 sffp_sd - ok
18:54:23.0211 5492 [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
18:54:23.0320 5492 sfloppy - ok
18:54:23.0382 5492 [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess C:\Windows\System32\ipnathlp.dll
18:54:23.0429 5492 SharedAccess - ok
18:54:23.0460 5492 [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
18:54:23.0538 5492 ShellHWDetection - ok
18:54:23.0554 5492 [ A275FBB7C99458C12E088DFF3E58EB4D ] simptcp C:\Windows\System32\tcpsvcs.exe
18:54:23.0632 5492 simptcp - ok
18:54:23.0647 5492 [ D2A595D6EEBEEAF4334F8E50EFBC9931 ] sisagp C:\Windows\system32\drivers\sisagp.sys
18:54:23.0679 5492 sisagp - ok
18:54:23.0694 5492 [ CEDD6F4E7D84E9F98B34B3FE988373AA ] SiSRaid2 C:\Windows\system32\drivers\sisraid2.sys
18:54:23.0741 5492 SiSRaid2 - ok
18:54:23.0772 5492 [ DF843C528C4F69D12CE41CE462E973A7 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
18:54:23.0788 5492 SiSRaid4 - ok
18:54:24.0381 5492 [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc C:\Windows\system32\SLsvc.exe
18:54:24.0583 5492 slsvc - ok
18:54:24.0630 5492 [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify C:\Windows\system32\SLUINotify.dll
18:54:24.0693 5492 SLUINotify - ok
18:54:24.0755 5492 [ 7B75299A4D201D6A6533603D6914AB04 ] Smb C:\Windows\system32\DRIVERS\smb.sys
18:54:24.0817 5492 Smb - ok
18:54:24.0864 5492 [ 26BA81BA48C3D9FB292B4B60FDE849F2 ] SNMP C:\Windows\System32\snmp.exe
18:54:24.0927 5492 SNMP - ok
18:54:24.0958 5492 [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
18:54:25.0051 5492 SNMPTRAP - ok
18:54:25.0083 5492 [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr C:\Windows\system32\drivers\spldr.sys
18:54:25.0114 5492 spldr - ok
18:54:25.0192 5492 [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler C:\Windows\System32\spoolsv.exe
18:54:25.0270 5492 Spooler - ok
18:54:25.0301 5492 [ 41987F9FC0E61ADF54F581E15029AD91 ] srv C:\Windows\system32\DRIVERS\srv.sys
18:54:25.0363 5492 srv - ok
18:54:25.0441 5492 [ FF33AFF99564B1AA534F58868CBE41EF ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
18:54:25.0519 5492 srv2 - ok
18:54:25.0551 5492 [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
18:54:25.0566 5492 srvnet - ok
18:54:25.0629 5492 [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
18:54:25.0691 5492 SSDPSRV - ok
18:54:25.0785 5492 [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc C:\Windows\system32\sstpsvc.dll
18:54:25.0847 5492 SstpSvc - ok
18:54:25.0863 5492 [ EF70B3D22B4BFFDA6EA851ECB063EFAA ] StillCam C:\Windows\system32\DRIVERS\serscan.sys
18:54:25.0941 5492 StillCam - ok
18:54:26.0081 5492 [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc C:\Windows\System32\wiaservc.dll
18:54:26.0175 5492 stisvc - ok
18:54:26.0206 5492 [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
18:54:26.0237 5492 swenum - ok
18:54:26.0284 5492 [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv C:\Windows\System32\swprv.dll
18:54:26.0362 5492 swprv - ok
18:54:26.0424 5492 [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx C:\Windows\system32\drivers\symc8xx.sys
18:54:26.0455 5492 Symc8xx - ok
18:54:26.0502 5492 [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi C:\Windows\system32\drivers\sym_hi.sys
18:54:26.0533 5492 Sym_hi - ok
18:54:26.0580 5492 [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3 C:\Windows\system32\drivers\sym_u3.sys
18:54:26.0611 5492 Sym_u3 - ok
18:54:26.0799 5492 [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain C:\Windows\system32\sysmain.dll
18:54:26.0861 5492 SysMain - ok
18:54:26.0955 5492 [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
18:54:27.0001 5492 TabletInputService - ok
18:54:27.0064 5492 [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv C:\Windows\System32\tapisrv.dll
18:54:27.0142 5492 TapiSrv - ok
18:54:27.0189 5492 [ CB05822CD9CC6C688168E113C603DBE7 ] TBS C:\Windows\System32\tbssvc.dll
18:54:27.0267 5492 TBS - ok
18:54:27.0438 5492 [ 548E198BAE21EFC21F8B5F0C1728AD27 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
18:54:27.0516 5492 Tcpip - ok
18:54:27.0532 5492 [ 548E198BAE21EFC21F8B5F0C1728AD27 ] Tcpip6 C:\Windows\system32\DRIVERS\tcpip.sys
18:54:27.0579 5492 Tcpip6 - ok
18:54:27.0625 5492 [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
18:54:27.0688 5492 tcpipreg - ok
18:54:27.0735 5492 [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
18:54:27.0813 5492 TDPIPE - ok
18:54:27.0844 5492 [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
18:54:27.0922 5492 TDTCP - ok
18:54:27.0969 5492 [ 76B06EB8A01FC8624D699E7045303E54 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
18:54:28.0015 5492 tdx - ok
18:54:28.0047 5492 [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
18:54:28.0062 5492 TermDD - ok
18:54:28.0171 5492 [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService C:\Windows\System32\termsrv.dll
18:54:28.0234 5492 TermService - ok
18:54:28.0265 5492 [ C7230FBEE14437716701C15BE02C27B8 ] Themes C:\Windows\system32\shsvcs.dll
18:54:28.0296 5492 Themes - ok
18:54:28.0312 5492 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER C:\Windows\system32\mmcss.dll
18:54:28.0343 5492 THREADORDER - ok
18:54:28.0374 5492 [ 5E1BC006CB4A26507D4512795CF08373 ] TlntSvr C:\Windows\System32\tlntsvr.exe
18:54:28.0437 5492 TlntSvr - ok
18:54:28.0468 5492 [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks C:\Windows\System32\trkwks.dll
18:54:28.0515 5492 TrkWks - ok
18:54:28.0577 5492 [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
18:54:28.0608 5492 TrustedInstaller - ok
18:54:28.0655 5492 [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
18:54:28.0702 5492 tssecsrv - ok
18:54:28.0749 5492 [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp C:\Windows\system32\DRIVERS\tunmp.sys
18:54:28.0780 5492 tunmp - ok
18:54:28.0827 5492 [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
18:54:28.0873 5492 tunnel - ok
18:54:28.0920 5492 [ C3ADE15414120033A36C0F293D4A4121 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
18:54:28.0951 5492 uagp35 - ok
18:54:28.0998 5492 [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
18:54:29.0061 5492 udfs - ok
18:54:29.0139 5492 [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect C:\Windows\system32\UI0Detect.exe
18:54:29.0232 5492 UI0Detect - ok
18:54:29.0263 5492 [ 75E6890EBFCE0841D3291B02E7A8BDB0 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
18:54:29.0310 5492 uliagpkx - ok
18:54:29.0326 5492 [ 3CD4EA35A6221B85DCC25DAA46313F8D ] uliahci C:\Windows\system32\drivers\uliahci.sys
18:54:29.0357 5492 uliahci - ok
18:54:29.0373 5492 [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata C:\Windows\system32\drivers\ulsata.sys
18:54:29.0404 5492 UlSata - ok
18:54:29.0419 5492 [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2 C:\Windows\system32\drivers\ulsata2.sys
18:54:29.0451 5492 ulsata2 - ok
18:54:29.0497 5492 [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
18:54:29.0544 5492 umbus - ok
18:54:29.0685 5492 [ 67A95B9D129ED5399E7965CD09CF30E7 ] UMVPFSrv C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
18:54:29.0731 5492 UMVPFSrv - ok
18:54:29.0809 5492 [ 4F887D2C0362E1B4183139A5EB926A50 ] Updater By SweetPacks C:\Program Files\Updater By SweetPacks\ExtensionUpdaterService.exe
18:54:29.0841 5492 Updater By SweetPacks - ok
18:54:29.0950 5492 [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost C:\Windows\System32\upnphost.dll
18:54:30.0028 5492 upnphost - ok
18:54:30.0090 5492 [ 32DB9517628FF0D070682AAB61E688F0 ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
18:54:30.0121 5492 usbaudio - ok
18:54:30.0168 5492 [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
18:54:30.0215 5492 usbccgp - ok
18:54:30.0293 5492 [ E9476E6C486E76BC4898074768FB7131 ] usbcir C:\Windows\system32\drivers\usbcir.sys
18:54:30.0418 5492 usbcir - ok
18:54:30.0496 5492 [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
18:54:30.0558 5492 usbehci - ok
18:54:30.0605 5492 [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
18:54:30.0667 5492 usbhub - ok
18:54:30.0699 5492 [ CE697FEE0D479290D89BEC80DFE793B7 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
18:54:30.0745 5492 usbohci - ok
18:54:30.0792 5492 [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
18:54:30.0870 5492 usbprint - ok
18:54:30.0901 5492 [ A508C9BD8724980512136B039BBA65E9 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
18:54:30.0964 5492 usbscan - ok
18:54:30.0995 5492 [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
18:54:31.0089 5492 USBSTOR - ok
18:54:31.0151 5492 [ 325DBBACB8A36AF9988CCF40EAC228CC ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
18:54:31.0307 5492 usbuhci - ok
18:54:31.0401 5492 [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo C:\Windows\system32\Drivers\usbvideo.sys
18:54:31.0479 5492 usbvideo - ok
18:54:31.0525 5492 [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms C:\Windows\System32\uxsms.dll
18:54:31.0603 5492 UxSms - ok
18:54:31.0666 5492 [ CD88D1B7776DC17A119049742EC07EB4 ] vds C:\Windows\System32\vds.exe
18:54:31.0759 5492 vds - ok
18:54:31.0806 5492 [ 7D92BE0028ECDEDEC74617009084B5EF ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
18:54:31.0900 5492 vga - ok
18:54:31.0978 5492 [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave C:\Windows\System32\drivers\vga.sys
18:54:32.0040 5492 VgaSave - ok
18:54:32.0103 5492 [ 045D9961E591CF0674A920B6BA3BA5CB ] viaagp C:\Windows\system32\drivers\viaagp.sys
18:54:32.0118 5492 viaagp - ok
18:54:32.0149 5492 [ 56A4DE5F02F2E88182B0981119B4DD98 ] ViaC7 C:\Windows\system32\drivers\viac7.sys
18:54:32.0259 5492 ViaC7 - ok
18:54:32.0290 5492 [ FD2E3175FCADA350C7AB4521DCA187EC ] viaide C:\Windows\system32\drivers\viaide.sys
18:54:32.0321 5492 viaide - ok
18:54:32.0337 5492 [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr C:\Windows\system32\drivers\volmgr.sys
18:54:32.0368 5492 volmgr - ok
18:54:32.0399 5492 [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
18:54:32.0446 5492 volmgrx - ok
18:54:32.0493 5492 [ 786DB5771F05EF300390399F626BF30A ] volsnap C:\Windows\system32\drivers\volsnap.sys
18:54:32.0539 5492 volsnap - ok
18:54:32.0586 5492 [ D984439746D42B30FC65A4C3546C6829 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
18:54:32.0617 5492 vsmraid - ok
18:54:32.0742 5492 [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS C:\Windows\system32\vssvc.exe
18:54:32.0820 5492 VSS - ok
18:54:32.0883 5492 [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time C:\Windows\system32\w32time.dll
18:54:32.0961 5492 W32Time - ok
18:54:33.0085 5492 [ 9CA92191C8F18E8B491A5B28E63C07B7 ] W3SVC C:\Windows\system32\inetsrv\iisw3adm.dll
18:54:33.0163 5492 W3SVC - ok
18:54:33.0195 5492 [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
18:54:33.0288 5492 WacomPen - ok
18:54:33.0304 5492 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp C:\Windows\system32\DRIVERS\wanarp.sys
18:54:33.0382 5492 Wanarp - ok
18:54:33.0382 5492 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
18:54:33.0429 5492 Wanarpv6 - ok
18:54:33.0460 5492 [ 9CA92191C8F18E8B491A5B28E63C07B7 ] WAS C:\Windows\system32\inetsrv\iisw3adm.dll
18:54:33.0507 5492 WAS - ok
18:54:33.0600 5492 [ A3CD60FD826381B49F03832590E069AF ] wcncsvc C:\Windows\System32\wcncsvc.dll
18:54:33.0678 5492 wcncsvc - ok
18:54:33.0709 5492 [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
18:54:33.0772 5492 WcsPlugInService - ok
18:54:33.0819 5492 [ AFC5AD65B991C1E205CF25CFDBF7A6F4 ] Wd C:\Windows\system32\drivers\wd.sys
18:54:33.0850 5492 Wd - ok
18:54:33.0928 5492 [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
18:54:33.0990 5492 Wdf01000 - ok
18:54:34.0021 5492 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost C:\Windows\system32\wdi.dll
18:54:34.0115 5492 WdiServiceHost - ok
18:54:34.0131 5492 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost C:\Windows\system32\wdi.dll
18:54:34.0193 5492 WdiSystemHost - ok
18:54:34.0302 5492 [ 04C37D8107320312FBAE09926103D5E2 ] WebClient C:\Windows\System32\webclnt.dll
18:54:34.0333 5492 WebClient - ok
18:54:34.0458 5492 [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc C:\Windows\system32\wecsvc.dll
18:54:34.0536 5492 Wecsvc - ok
18:54:34.0599 5492 [ 670FF720071ED741206D69BD995EA453 ] wercplsupport C:\Windows\System32\wercplsupport.dll
18:54:34.0645 5492 wercplsupport - ok
18:54:34.0755 5492 [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc C:\Windows\System32\WerSvc.dll
18:54:34.0817 5492 WerSvc - ok
18:54:35.0113 5492 [ 72CC6A8CA7891031D6380DB5025C773C ] winachsf C:\Windows\system32\DRIVERS\HSX_CNXT.sys
18:54:35.0145 5492 winachsf - ok
18:54:35.0223 5492 [ 4575AA12561C5648483403541D0D7F2B ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
18:54:35.0254 5492 WinDefend - ok
18:54:35.0269 5492 WinHttpAutoProxySvc - ok
18:54:35.0316 5492 [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
18:54:35.0332 5492 Winmgmt - ok
18:54:35.0815 5492 [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM C:\Windows\system32\WsmSvc.dll
18:54:35.0925 5492 WinRM - ok
18:54:35.0987 5492 [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc C:\Windows\System32\wlansvc.dll
18:54:36.0049 5492 Wlansvc - ok
18:54:36.0081 5492 [ 701A9F884A294327E9141D73746EE279 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
18:54:36.0190 5492 WmiAcpi - ok
18:54:36.0299 5492 [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
18:54:36.0346 5492 wmiApSrv - ok
18:54:36.0736 5492 [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
18:54:36.0798 5492 WMPNetworkSvc - ok
18:54:36.0845 5492 [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc C:\Windows\System32\wpcsvc.dll
18:54:36.0907 5492 WPCSvc - ok
18:54:36.0939 5492 [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
18:54:37.0017 5492 WPDBusEnum - ok
18:54:37.0219 5492 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
18:54:37.0251 5492 WPFFontCache_v0400 - ok
18:54:37.0329 5492 [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
18:54:37.0391 5492 ws2ifsl - ok
18:54:37.0438 5492 [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc C:\Windows\system32\wscsvc.dll
18:54:37.0485 5492 wscsvc - ok
18:54:37.0485 5492 WSearch - ok
18:54:37.0578 5492 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll
18:54:37.0687 5492 wuauserv - ok
18:54:37.0703 5492 [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
18:54:37.0734 5492 WudfPf - ok
18:54:37.0750 5492 [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
18:54:37.0797 5492 WUDFRd - ok
18:54:37.0828 5492 [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
18:54:37.0859 5492 wudfsvc - ok
18:54:38.0046 5492 [ 2E812881EC96E80EAE304877ED90206B ] WUSB54GCv3 C:\Windows\system32\DRIVERS\WUSB54GCv3.sys
18:54:38.0124 5492 WUSB54GCv3 - ok
18:54:38.0140 5492 [ DAB33CFA9DD24251AAA389FF36B64D4B ] XAudio C:\Windows\system32\DRIVERS\xaudio.sys
18:54:38.0218 5492 XAudio - ok
18:54:38.0249 5492 [ CD5F291A1161F15896D1A4D63DAFF5DF ] XAudioService C:\Windows\system32\DRIVERS\xaudio.exe
18:54:38.0280 5492 XAudioService - ok
18:54:38.0311 5492 [ DA57C74AAEABD6F97F404151069BE42E ] xcbdaNtsc C:\Windows\system32\DRIVERS\xcbda.sys
18:54:38.0374 5492 xcbdaNtsc - ok
18:54:38.0405 5492 ================ Scan global ===============================
18:54:38.0467 5492 [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
18:54:38.0655 5492 [ A508314231C49AEE86987CEA3EAECAD1 ] C:\Windows\system32\winsrv.dll
18:54:38.0779 5492 [ A508314231C49AEE86987CEA3EAECAD1 ] C:\Windows\system32\winsrv.dll
18:54:38.0967 5492 [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
18:54:38.0982 5492 [Global] - ok
18:54:38.0982 5492 ================ Scan MBR ==================================
18:54:39.0013 5492 [ 81CD5EC01DB0CE57EDD853F82462EF27 ] \Device\Harddisk0\DR0
18:54:41.0119 5492 \Device\Harddisk0\DR0 - ok
18:54:41.0119 5492 [ 671B81004FDD1588FA9ED1331C9CECA9 ] \Device\Harddisk1\DR1
18:54:41.0182 5492 \Device\Harddisk1\DR1 - ok
18:54:41.0182 5492 ================ Scan VBR ==================================
18:54:41.0213 5492 [ E45CE8304640417EC1AAD2251D489160 ] \Device\Harddisk0\DR0\Partition1
18:54:41.0213 5492 \Device\Harddisk0\DR0\Partition1 - ok
18:54:41.0244 5492 [ 5D0C9B59ECAC2763A4FE12F5CAE06A86 ] \Device\Harddisk0\DR0\Partition2
18:54:41.0244 5492 \Device\Harddisk0\DR0\Partition2 - ok
18:54:41.0260 5492 [ C27D86533D223AECE6BC046049E2A7B9 ] \Device\Harddisk1\DR1\Partition1
18:54:41.0260 5492 \Device\Harddisk1\DR1\Partition1 - ok
18:54:41.0260 5492 ================ Scan active images ========================
18:54:41.0260 5492 [ 36975327EF03949CC378AB01E316B574 ] C:\Windows\System32\drivers\crashdmp.sys
18:54:41.0260 5492 C:\Windows\System32\drivers\crashdmp.sys - ok
18:54:41.0275 5492 [ 494075282E23D838F43A4C9FB7143959 ] C:\Windows\System32\drivers\Diskdump.sys
18:54:41.0275 5492 C:\Windows\System32\drivers\Diskdump.sys - ok
18:54:41.0291 5492 [ 63B7838E9C272BAAA7B33A0CA4EBB748 ] C:\Windows\System32\drivers\nvstor32.sys
18:54:41.0291 5492 C:\Windows\System32\drivers\nvstor32.sys - ok
18:54:41.0291 5492 [ 300DB877AC094FEAB0BE7688C3454A9C ] C:\Windows\System32\drivers\tunnel.sys
18:54:41.0291 5492 C:\Windows\System32\drivers\tunnel.sys - ok
18:54:41.0307 5492 [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] C:\Windows\System32\drivers\i8042prt.sys
18:54:41.0307 5492 C:\Windows\System32\drivers\i8042prt.sys - ok
18:54:41.0322 5492 [ 2027293619DD0F047C584CF2E7DF4FFD ] C:\Windows\System32\drivers\processr.sys
18:54:41.0322 5492 C:\Windows\System32\drivers\processr.sys - ok
18:54:41.0322 5492 [ CAECC0120AC49E3D2F758B9169872D38 ] C:\Windows\System32\drivers\TUNMP.SYS
18:54:41.0322 5492 C:\Windows\System32\drivers\TUNMP.SYS - ok
18:54:41.0338 5492 [ 37605E0A8CF00CBBA538E753E4344C6E ] C:\Windows\System32\drivers\kbdclass.sys
18:54:41.0338 5492 C:\Windows\System32\drivers\kbdclass.sys - ok
18:54:41.0353 5492 [ D88846F9F4F27AE9BE584A6E5B6B8753 ] C:\Windows\System32\drivers\L8042Kbd.sys
18:54:41.0353 5492 C:\Windows\System32\drivers\L8042Kbd.sys - ok
18:54:41.0353 5492 [ A1C100A87D981AD0774FBC0B4B82E913 ] C:\Windows\System32\drivers\usbport.sys
18:54:41.0353 5492 C:\Windows\System32\drivers\usbport.sys - ok
18:54:41.0369 5492 [ 0349BE02F329F4F48F1D48097FD65974 ] C:\Windows\System32\drivers\1394bus.sys
18:54:41.0369 5492 C:\Windows\System32\drivers\1394bus.sys - ok
18:54:41.0385 5492 [ 6F310E890D46E246E0E261A63D9B36B4 ] C:\Windows\System32\drivers\ohci1394.sys
18:54:41.0385 5492 C:\Windows\System32\drivers\ohci1394.sys - ok
18:54:41.0385 5492 [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] C:\Windows\System32\drivers\usbehci.sys
18:54:41.0385 5492 C:\Windows\System32\drivers\usbehci.sys - ok
18:54:41.0400 5492 [ CE697FEE0D479290D89BEC80DFE793B7 ] C:\Windows\System32\drivers\usbohci.sys
18:54:41.0400 5492 C:\Windows\System32\drivers\usbohci.sys - ok
18:54:41.0400 5492 [ FE440536BD98AF772130DC3A6FE1915F ] C:\Windows\System32\drivers\HSXHWBS2.sys
18:54:41.0400 5492 C:\Windows\System32\drivers\HSXHWBS2.sys - ok
18:54:41.0416 5492 [ EF73C1E29FBE7B0FD0274BF4394E346A ] C:\Windows\System32\drivers\ks.sys
18:54:41.0416 5492 C:\Windows\System32\drivers\ks.sys - ok
18:54:41.0416 5492 [ 88749FBF8BEB18C90E7D6626C8C1910B ] C:\Windows\System32\drivers\HSX_DP.sys
18:54:41.0416 5492 C:\Windows\System32\drivers\HSX_DP.sys - ok
18:54:41.0431 5492 [ 72CC6A8CA7891031D6380DB5025C773C ] C:\Windows\System32\drivers\HSX_CNXT.sys
18:54:41.0431 5492 C:\Windows\System32\drivers\HSX_CNXT.sys - ok
18:54:41.0431 5492 [ E13B5EA0F51BA5B1512EC671393D09BA ] C:\Windows\System32\drivers\modem.sys
18:54:41.0431 5492 C:\Windows\System32\drivers\modem.sys - ok
18:54:41.0431 5492 [ C87B1EE051C0464491C1A7B03FA0BC99 ] C:\Windows\System32\drivers\hdaudbus.sys
18:54:41.0431 5492 C:\Windows\System32\drivers\hdaudbus.sys - ok
18:54:41.0447 5492 [ D958A2B5F6AD5C3B8CCDC4D7DA62466C ] C:\Windows\System32\drivers\nvmfdx32.sys
18:54:41.0447 5492 C:\Windows\System32\drivers\nvmfdx32.sys - ok
18:54:41.0447 5492 [ 6B4BFFB9BECD728097024276430DB314 ] C:\Windows\System32\drivers\cdrom.sys
18:54:41.0447 5492 C:\Windows\System32\drivers\cdrom.sys - ok
18:54:41.0463 5492 [ 185ADA973B5020655CEE342059A86CBB ] C:\Windows\System32\drivers\GEARAspiWDM.sys
18:54:41.0463 5492 C:\Windows\System32\drivers\GEARAspiWDM.sys - ok
18:54:41.0463 5492 [ 11F99482DAFFEDF622A4A3F4B0C81487 ] C:\Windows\System32\drivers\nvlddmkm.sys
18:54:41.0463 5492 C:\Windows\System32\drivers\nvlddmkm.sys - ok
18:54:41.0478 5492 [ 5DE0FAEC9E5D1AAE74F8568897891A01 ] C:\Windows\System32\drivers\dxgkrnl.sys
18:54:41.0478 5492 C:\Windows\System32\drivers\dxgkrnl.sys - ok
18:54:41.0478 5492 [ 4A5C31E2C1646034E6A60EBA4C747FF6 ] C:\Windows\System32\drivers\watchdog.sys
18:54:41.0478 5492 C:\Windows\System32\drivers\watchdog.sys - ok
18:54:41.0478 5492 [ 9F5F8F2318DFA3974A6F6A5602733929 ] C:\Windows\System32\drivers\bdasup.sys
18:54:41.0478 5492 C:\Windows\System32\drivers\bdasup.sys - ok
18:54:41.0494 5492 [ B0F44B503ECD4655601283F61FD58F54 ] C:\Windows\System32\drivers\xcmem.sys
18:54:41.0494 5492 C:\Windows\System32\drivers\xcmem.sys - ok
18:54:41.0494 5492 [ FEAD9E2ED54F273D701BEAB2A5CBB12B ] C:\Windows\System32\drivers\xchal.sys
18:54:41.0494 5492 C:\Windows\System32\drivers\xchal.sys - ok
18:54:41.0509 5492 [ 9418521B3FB8BE415518EF36C3DB81BB ] C:\Windows\System32\drivers\xcfe.sys
18:54:41.0509 5492 C:\Windows\System32\drivers\xcfe.sys - ok
18:54:41.0509 5492 [ EF70B3D22B4BFFDA6EA851ECB063EFAA ] C:\Windows\System32\drivers\serscan.sys
18:54:41.0509 5492 C:\Windows\System32\drivers\serscan.sys - ok
18:54:41.0509 5492 [ DA57C74AAEABD6F97F404151069BE42E ] C:\Windows\System32\drivers\xcbda.sys
18:54:41.0509 5492 C:\Windows\System32\drivers\xcbda.sys - ok
18:54:41.0525 5492 [ F247EEC28317F6C739C16DE420097301 ] C:\Windows\System32\drivers\msiscsi.sys
18:54:41.0525 5492 C:\Windows\System32\drivers\msiscsi.sys - ok
18:54:41.0525 5492 [ A214ADBAF4CB47DD2728859EF31F26B0 ] C:\Windows\System32\drivers\rasl2tp.sys
18:54:41.0525 5492 C:\Windows\System32\drivers\rasl2tp.sys - ok
18:54:41.0541 5492 [ 77937EFF009AC696B90E09F671F9D0A4 ] C:\Windows\System32\drivers\tdi.sys
18:54:41.0541 5492 C:\Windows\System32\drivers\tdi.sys - ok
18:54:41.0556 5492 [ 0E186E90404980569FB449BA7519AE61 ] C:\Windows\System32\drivers\ndistapi.sys
18:54:41.0556 5492 C:\Windows\System32\drivers\ndistapi.sys - ok
18:54:41.0556 5492 [ 818F648618AE34F729FDB47EC68345C3 ] C:\Windows\System32\drivers\ndiswan.sys
18:54:41.0556 5492 C:\Windows\System32\drivers\ndiswan.sys - ok
18:54:41.0572 5492 [ 509A98DD18AF4375E1FC40BC175F1DEF ] C:\Windows\System32\drivers\raspppoe.sys
18:54:41.0572 5492 C:\Windows\System32\drivers\raspppoe.sys - ok
18:54:41.0572 5492 [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] C:\Windows\System32\drivers\raspptp.sys
18:54:41.0572 5492 C:\Windows\System32\drivers\raspptp.sys - ok
18:54:41.0587 5492 [ 2005F4A1E05FA09389AC85840F0A9E4D ] C:\Windows\System32\drivers\rassstp.sys
18:54:41.0587 5492 C:\Windows\System32\drivers\rassstp.sys - ok
18:54:41.0603 5492 [ 5BF6A1326A335C5298477754A506D263 ] C:\Windows\System32\drivers\mouclass.sys
18:54:41.0603 5492 C:\Windows\System32\drivers\mouclass.sys - ok
18:54:41.0603 5492 [ 3CAD38910468EAB9A6479E2F01DB43C7 ] C:\Windows\System32\drivers\termdd.sys
18:54:41.0603 5492 C:\Windows\System32\drivers\termdd.sys - ok
18:54:41.0603 5492 [ E384487CB84BE41D09711C30CA79646C ] C:\Windows\System32\drivers\mssmbios.sys
18:54:41.0603 5492 C:\Windows\System32\drivers\mssmbios.sys - ok
18:54:41.0619 5492 [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] C:\Windows\System32\drivers\swenum.sys
18:54:41.0619 5492 C:\Windows\System32\drivers\swenum.sys - ok
18:54:41.0619 5492 [ 32CFF9F809AE9AED85464492BF3E32D2 ] C:\Windows\System32\drivers\umbus.sys
18:54:41.0619 5492 C:\Windows\System32\drivers\umbus.sys - ok
18:54:41.0634 5492 [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] C:\Windows\System32\drivers\usbhub.sys
18:54:41.0634 5492 C:\Windows\System32\drivers\usbhub.sys - ok
18:54:41.0634 5492 [ 71DAB552B41936358F3B541AE5997FB3 ] C:\Windows\System32\drivers\ndproxy.sys
18:54:41.0634 5492 C:\Windows\System32\drivers\ndproxy.sys - ok
18:54:41.0634 5492 [ 7BE5A3C671A2CB56E94403BFC2020A0D ] C:\Windows\System32\drivers\drmk.sys
18:54:41.0634 5492 C:\Windows\System32\drivers\drmk.sys - ok
18:54:41.0650 5492 [ 218286724EC530FF252648369E05B090 ] C:\Windows\System32\drivers\portcls.sys
18:54:41.0650 5492 C:\Windows\System32\drivers\portcls.sys - ok
18:54:41.0650 5492 [ 84ED2154239F9D013BBD3220755ADA8B ] C:\Windows\System32\drivers\RTKVHDA.sys
18:54:41.0650 5492 C:\Windows\System32\drivers\RTKVHDA.sys - ok
18:54:41.0665 5492 [ CCD565A8A72AF7D45F9A242013870926 ] C:\Windows\System32\drivers\aswSnx.sys
18:54:41.0665 5492 C:\Windows\System32\drivers\aswSnx.sys - ok
18:54:41.0665 5492 [ B972A66758577E0BFD1DE0F91AAA27B5 ] C:\Windows\System32\drivers\fs_rec.sys
18:54:41.0665 5492 C:\Windows\System32\drivers\fs_rec.sys - ok
18:54:41.0665 5492 [ 67E506B75BD5326A3EC7B70BD014DFB6 ] C:\Windows\System32\drivers\beep.sys
18:54:41.0665 5492 C:\Windows\System32\drivers\beep.sys - ok
18:54:41.0681 5492 [ C5DBBCDA07D780BDA9B685DF333BB41E ] C:\Windows\System32\drivers\null.sys
18:54:41.0681 5492 C:\Windows\System32\drivers\null.sys - ok
18:54:41.0681 5492 [ 2E93AC0A1D8C79D019DB6C51F036636C ] C:\Windows\System32\drivers\vga.sys
18:54:41.0681 5492 C:\Windows\System32\drivers\vga.sys - ok
18:54:41.0697 5492 [ C048D2C33D27441A0CDCAAE2651EB03D ] C:\Windows\System32\drivers\videoprt.sys
18:54:41.0697 5492 C:\Windows\System32\drivers\videoprt.sys - ok
18:54:41.0697 5492 [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] C:\Windows\System32\drivers\RDPCDD.sys
18:54:41.0697 5492 C:\Windows\System32\drivers\RDPCDD.sys - ok
18:54:41.0712 5492 [ 9D91FE5286F748862ECFFA05F8A0710C ] C:\Windows\System32\drivers\RDPENCDD.sys
18:54:41.0712 5492 C:\Windows\System32\drivers\RDPENCDD.sys - ok
18:54:41.0712 5492 [ A9927F4A46B816C92F461ACB90CF8515 ] C:\Windows\System32\drivers\msfs.sys
18:54:41.0712 5492 C:\Windows\System32\drivers\msfs.sys - ok
18:54:41.0712 5492 [ D36F239D7CCE1931598E8FB90A0DBC26 ] C:\Windows\System32\drivers\npfs.sys
18:54:41.0712 5492 C:\Windows\System32\drivers\npfs.sys - ok
18:54:41.0728 5492 [ 147D7F9C556D259924351FEB0DE606C3 ] C:\Windows\System32\drivers\rasacd.sys
18:54:41.0728 5492 C:\Windows\System32\drivers\rasacd.sys - ok
18:54:41.0728 5492 [ 76B06EB8A01FC8624D699E7045303E54 ] C:\Windows\System32\drivers\tdx.sys
18:54:41.0728 5492 C:\Windows\System32\drivers\tdx.sys - ok
18:54:41.0743 5492 [ 1F71F170D90E42EFDE9633D81D5E12DC ] C:\Windows\System32\drivers\aswTdi.sys
18:54:41.0743 5492 C:\Windows\System32\drivers\aswTdi.sys - ok
18:54:41.0743 5492 [ 7B75299A4D201D6A6533603D6914AB04 ] C:\Windows\System32\drivers\smb.sys
18:54:41.0743 5492 C:\Windows\System32\drivers\smb.sys - ok
18:54:41.0743 5492 [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] C:\Windows\System32\drivers\netbt.sys
18:54:41.0743 5492 C:\Windows\System32\drivers\netbt.sys - ok
18:54:41.0759 5492 [ 3911B972B55FEA0478476B2E777B29FA ] C:\Windows\System32\drivers\afd.sys
18:54:41.0759 5492 C:\Windows\System32\drivers\afd.sys - ok
18:54:41.0759 5492 [ 7B43265F92257A21CBFD88E7A651044C ] C:\Windows\System32\drivers\aswRdr.sys
18:54:41.0759 5492 C:\Windows\System32\drivers\aswRdr.sys - ok
18:54:41.0775 5492 [ E3A3CB253C0EC2494D4A61F5E43A389C ] C:\Windows\System32\drivers\ws2ifsl.sys
18:54:41.0775 5492 C:\Windows\System32\drivers\ws2ifsl.sys - ok
18:54:41.0775 5492 [ 99514FAA8DF93D34B5589187DB3AA0BA ] C:\Windows\System32\drivers\pacer.sys
18:54:41.0775 5492 C:\Windows\System32\drivers\pacer.sys - ok
18:54:41.0775 5492 [ BCD093A5A6777CF626434568DC7DBA78 ] C:\Windows\System32\drivers\netbios.sys
18:54:41.0775 5492 C:\Windows\System32\drivers\netbios.sys - ok
18:54:41.0790 5492 [ 55201897378CCA7AF8B5EFD874374A26 ] C:\Windows\System32\drivers\wanarp.sys
18:54:41.0790 5492 C:\Windows\System32\drivers\wanarp.sys - ok
18:54:41.0790 5492 [ 51EC343E322DD43C6BE884F1CDA4CA38 ] C:\Windows\System32\drivers\scdemu.sys
18:54:41.0790 5492 C:\Windows\System32\drivers\scdemu.sys - ok
18:54:41.0790 5492 [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] C:\Windows\System32\drivers\rdbss.sys
18:54:41.0790 5492 C:\Windows\System32\drivers\rdbss.sys - ok
18:54:41.0806 5492 [ 609773E344A97410CE4EBF74A8914FCF ] C:\Windows\System32\drivers\nsiproxy.sys
18:54:41.0806 5492 C:\Windows\System32\drivers\nsiproxy.sys - ok
18:54:41.0806 5492 [ 622C41A07CA7E6DD91770F50D532CB6C ] C:\Windows\System32\drivers\dfsc.sys
18:54:41.0806 5492 C:\Windows\System32\drivers\dfsc.sys - ok
18:54:41.0806 5492 [ 937300BC7C4CDF7576BCCE44E19BBB9D ] C:\Windows\System32\drivers\aswSP.sys
18:54:41.0806 5492 C:\Windows\System32\drivers\aswSP.sys - ok
18:54:41.0821 5492 [ DDA770BBD7C2ED024D6F50E279D90E5B ] C:\Windows\System32\ntdll.dll
18:54:41.0821 5492 C:\Windows\System32\ntdll.dll - ok
18:54:41.0821 5492 [ BE7480C91E89EB82FC080F772C220AE4 ] C:\Windows\System32\smss.exe
18:54:41.0821 5492 C:\Windows\System32\smss.exe - ok
18:54:41.0837 5492 [ 10761177A6EBE45843F443E99509F5E7 ] C:\Windows\System32\autochk.exe
18:54:41.0837 5492 C:\Windows\System32\autochk.exe - ok
18:54:41.0837 5492 [ 551F51B66E5EA87A38D8197EB3BDB57A ] C:\Windows\System32\setupapi.dll
18:54:41.0837 5492 C:\Windows\System32\setupapi.dll - ok
18:54:41.0837 5492 [ CAF811AE4C147FFCD5B51750C7F09142 ] C:\Windows\System32\drivers\usbccgp.sys
18:54:41.0837 5492 C:\Windows\System32\drivers\usbccgp.sys - ok
18:54:41.0853 5492 [ 790FDAC6D0C762DF9047C3C625A6FF6C ] C:\Windows\System32\drivers\usbd.sys
18:54:41.0853 5492 C:\Windows\System32\drivers\usbd.sys - ok
18:54:41.0853 5492 [ BE3DA31C191BC222D9AD503C5224F2AD ] C:\Windows\System32\drivers\USBSTOR.SYS
18:54:41.0853 5492 C:\Windows\System32\drivers\USBSTOR.SYS - ok
18:54:41.0853 5492 [ 86326062A90494BDD79CE383511D7D69 ] C:\Windows\System32\drivers\OEM05Vfx.sys
18:54:41.0853 5492 C:\Windows\System32\drivers\OEM05Vfx.sys - ok
18:54:41.0868 5492 [ 3C60C2022CB93073DA2574DA90C962C2 ] C:\Windows\System32\drivers\OEM05Vid.sys
18:54:41.0868 5492 C:\Windows\System32\drivers\OEM05Vid.sys - ok
18:54:41.0868 5492 [ 32DB9517628FF0D070682AAB61E688F0 ] C:\Windows\System32\drivers\USBAUDIO.sys
18:54:41.0868 5492 C:\Windows\System32\drivers\USBAUDIO.sys - ok
18:54:41.0884 5492 [ E2281CFF793D7A09CE2B35F9F8732EE3 ] C:\Windows\System32\rpcrt4.dll
18:54:41.0884 5492 C:\Windows\System32\rpcrt4.dll - ok
18:54:41.0884 5492 [ 9586E7CB2255A8B097A7E4538202585E ] C:\Windows\System32\ole32.dll
18:54:41.0884 5492 C:\Windows\System32\ole32.dll - ok
18:54:41.0884 5492 [ 75510147B94598407666F4802797C75A ] C:\Windows\System32\user32.dll
18:54:41.0884 5492 C:\Windows\System32\user32.dll - ok
18:54:41.0899 5492 [ C8BDCECEE082B54F0BAC838BF0A34597 ] C:\Windows\System32\imm32.dll
18:54:41.0899 5492 C:\Windows\System32\imm32.dll - ok
18:54:41.0899 5492 [ B218342214D9BBA0F54EA12BA2E9278C ] C:\Windows\System32\oleaut32.dll
18:54:41.0899 5492 C:\Windows\System32\oleaut32.dll - ok
18:54:41.0899 5492 [ B304D47D5744BA20FCB99FB8B2C07B0B ] C:\Windows\System32\ws2_32.dll
18:54:41.0899 5492 C:\Windows\System32\ws2_32.dll - ok
18:54:41.0915 5492 [ EB49FAA5EBBC06356FB12476438781B9 ] C:\Windows\System32\imagehlp.dll
18:54:41.0915 5492 C:\Windows\System32\imagehlp.dll - ok
18:54:41.0915 5492 [ A64AEBC6C78B4CFD7F41A7277879DF8F ] C:\Windows\System32\nsi.dll
18:54:41.0915 5492 C:\Windows\System32\nsi.dll - ok
18:54:41.0931 5492 [ 71D8D1FD4989932674CD1F5743191286 ] C:\Windows\System32\urlmon.dll
18:54:41.0931 5492 C:\Windows\System32\urlmon.dll - ok
18:54:41.0931 5492 [ A508C9BD8724980512136B039BBA65E9 ] C:\Windows\System32\drivers\usbscan.sys
18:54:41.0931 5492 C:\Windows\System32\drivers\usbscan.sys - ok
18:54:41.0931 5492 [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] C:\Windows\System32\drivers\usbprint.sys
18:54:41.0931 5492 C:\Windows\System32\drivers\usbprint.sys - ok
18:54:41.0946 5492 [ 5961CADB7CAD938368D2028725EF771D ] C:\Windows\System32\drivers\hidclass.sys
18:54:41.0946 5492 C:\Windows\System32\drivers\hidclass.sys - ok
18:54:41.0946 5492 [ 175444D3A01CA45D0E1C5DC5F48DF7CD ] C:\Windows\System32\drivers\hidparse.sys
18:54:41.0946 5492 C:\Windows\System32\drivers\hidparse.sys - ok
18:54:41.0962 5492 [ CCA4B519B17E23A00B826C55716809CC ] C:\Windows\System32\drivers\hidusb.sys
18:54:41.0962 5492 C:\Windows\System32\drivers\hidusb.sys - ok
18:54:41.0962 5492 [ 3FA98339E8D9E007726BE62F231E2015 ] C:\Windows\System32\drivers\LHidFilt.Sys
18:54:41.0962 5492 C:\Windows\System32\drivers\LHidFilt.Sys - ok
18:54:41.0962 5492 [ F259F758E04D8FB8D48C6CDBE45223E8 ] C:\Windows\System32\drivers\LMouFilt.Sys
18:54:41.0962 5492 C:\Windows\System32\drivers\LMouFilt.Sys - ok
18:54:41.0977 5492 [ 93B8D4869E12CFBE663915502900876F ] C:\Windows\System32\drivers\mouhid.sys
18:54:41.0977 5492 C:\Windows\System32\drivers\mouhid.sys - ok
18:54:41.0977 5492 [ AAF101900A23D75AE1AE00840FA6F3B8 ] C:\Windows\System32\shell32.dll
18:54:41.0977 5492 C:\Windows\System32\shell32.dll - ok
18:54:41.0993 5492 [ 17AF64D727545F2804F6E6D998327E3F ] C:\Windows\System32\msvcrt.dll
18:54:41.0993 5492 C:\Windows\System32\msvcrt.dll - ok
18:54:41.0993 5492 [ C394079EB162E812D682C73FA96AF6E4 ] C:\Windows\System32\clbcatq.dll
18:54:41.0993 5492 C:\Windows\System32\clbcatq.dll - ok
18:54:41.0993 5492 [ 7856E3B4594714EF89BB97375E8644EE ] C:\Windows\System32\gdi32.dll
18:54:41.0993 5492 C:\Windows\System32\gdi32.dll - ok
18:54:42.0009 5492 [ EB0E02749CE5C488741C9A0ABEAB5DEC ] C:\Windows\System32\lpk.dll
18:54:42.0009 5492 C:\Windows\System32\lpk.dll - ok
18:54:42.0009 5492 [ B8A609FB5EFB4E44FC1355B1C01C64BC ] C:\Windows\System32\Wldap32.dll
18:54:42.0009 5492 C:\Windows\System32\Wldap32.dll - ok
18:54:42.0024 5492 [ DC3105CC925A0D47F61B54E66AB730FC ] C:\Windows\System32\kernel32.dll
18:54:42.0024 5492 C:\Windows\System32\kernel32.dll - ok
18:54:42.0024 5492 [ 6057AA7FDF03309A18FAE4E9FCFE7D8F ] C:\Windows\System32\iertutil.dll
18:54:42.0024 5492 C:\Windows\System32\iertutil.dll - ok
18:54:42.0024 5492 [ 80FFF14F1757B9AF8BE9D314FC1AE88B ] C:\Windows\System32\usp10.dll
18:54:42.0024 5492 C:\Windows\System32\usp10.dll - ok
18:54:42.0040 5492 [ 6A25377A76479A0C0BF3DB6FC42FE09A ] C:\Windows\System32\wininet.dll
18:54:42.0040 5492 C:\Windows\System32\wininet.dll - ok
18:54:42.0040 5492 [ E3C3BD69701CE6B7B17101E4F7740534 ] C:\Windows\System32\msctf.dll
18:54:42.0040 5492 C:\Windows\System32\msctf.dll - ok
18:54:42.0040 5492 [ 4AA2A0E26CEF1A803741253DCF9A1503 ] C:\Windows\System32\comdlg32.dll
18:54:42.0040 5492 C:\Windows\System32\comdlg32.dll - ok
18:54:42.0055 5492 [ 420B075CD71AB9E58D15DD258958FBA3 ] C:\Windows\System32\shlwapi.dll
18:54:42.0055 5492 C:\Windows\System32\shlwapi.dll - ok
18:54:42.0055 5492 [ 50CAA7072C171B9887215C83D52069E4 ] C:\Windows\System32\advapi32.dll
18:54:42.0055 5492 C:\Windows\System32\advapi32.dll - ok
18:54:42.0071 5492 [ 6F29236AB5926100972924BD29D9D225 ] C:\Windows\System32\normaliz.dll
18:54:42.0071 5492 C:\Windows\System32\normaliz.dll - ok
18:54:42.0071 5492 [ DC8891A9203810FC994E7FCCF76E94C8 ] C:\Windows\System32\comctl32.dll
18:54:42.0071 5492 C:\Windows\System32\comctl32.dll - ok
18:54:42.0071 5492 [ 93A1732F7F997E36A5C3893539E2FF02 ] C:\Windows\System32\psapi.dll
18:54:42.0071 5492 C:\Windows\System32\psapi.dll - ok
18:54:42.0087 5492 [ EAAAFEF04FBB45665C9576E525D45A12 ] C:\Windows\System32\drivers\dxapi.sys
18:54:42.0087 5492 C:\Windows\System32\drivers\dxapi.sys - ok
18:54:42.0087 5492 [ C2DD5271193B4CCF11D63319DA0CA7AE ] C:\Windows\System32\win32k.sys
18:54:42.0087 5492 C:\Windows\System32\win32k.sys - ok
18:54:42.0102 5492 [ 33F84B64D4765BCDFA0AB8464122DA14 ] C:\Windows\System32\csrsrv.dll
18:54:42.0102 5492 C:\Windows\System32\csrsrv.dll - ok
18:54:42.0102 5492 [ ABCA209EBA02CB59233614DB83B4F50D ] C:\Windows\System32\csrss.exe
18:54:42.0102 5492 C:\Windows\System32\csrss.exe - ok
18:54:42.0102 5492 [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\System32\basesrv.dll
18:54:42.0102 5492 C:\Windows\System32\basesrv.dll - ok
18:54:42.0118 5492 [ A508314231C49AEE86987CEA3EAECAD1 ] C:\Windows\System32\winsrv.dll
18:54:42.0118 5492 C:\Windows\System32\winsrv.dll - ok
18:54:42.0118 5492 [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] C:\Windows\System32\drivers\monitor.sys
18:54:42.0118 5492 C:\Windows\System32\drivers\monitor.sys - ok
18:54:42.0133 5492 [ CC21507D246861671A0BF97E75CE1B00 ] C:\Windows\System32\tsddd.dll
18:54:42.0133 5492 C:\Windows\System32\tsddd.dll - ok
18:54:42.0133 5492 [ D602FEDBD9155FC2DED6863FB60C950F ] C:\Windows\System32\secur32.dll
18:54:42.0133 5492 C:\Windows\System32\secur32.dll - ok
18:54:42.0133 5492 [ 665417528489096BBCB8AEA46D3DA924 ] C:\Windows\System32\userenv.dll
18:54:42.0133 5492 C:\Windows\System32\userenv.dll - ok
18:54:42.0149 5492 [ 101BA3EA053480BB5D957EF37C06B5ED ] C:\Windows\System32\wininit.exe
18:54:42.0149 5492 C:\Windows\System32\wininit.exe - ok
18:54:42.0149 5492 [ 12C8D6C564702B0776512932290A3F6B ] C:\Windows\System32\KBDUS.DLL
18:54:42.0149 5492 C:\Windows\System32\KBDUS.DLL - ok
18:54:42.0165 5492 [ 92283D9E33EC5F41ECC0B430B7459241 ] C:\Windows\System32\WlS0WndH.dll
18:54:42.0165 5492 C:\Windows\System32\WlS0WndH.dll - ok
18:54:42.0165 5492 [ 1107BD574A84367735FEC38B9BD64E6B ] C:\Windows\System32\apphelp.dll
18:54:42.0165 5492 C:\Windows\System32\apphelp.dll - ok
18:54:42.0180 5492 [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\System32\services.exe
18:54:42.0180 5492 C:\Windows\System32\services.exe - ok
18:54:42.0180 5492 [ BE6FAC6F0745C67DAE7522C96406D083 ] C:\Windows\System32\sxs.dll
18:54:42.0180 5492 C:\Windows\System32\sxs.dll - ok
18:54:42.0180 5492 [ 6F0D2FBABC62E39413C836B8DAE888E1 ] C:\Windows\System32\cdd.dll
18:54:42.0180 5492 C:\Windows\System32\cdd.dll - ok
18:54:42.0196 5492 [ A3E186B4B935905B829219502557314E ] C:\Windows\System32\lsass.exe
18:54:42.0196 5492 C:\Windows\System32\lsass.exe - ok
18:54:42.0196 5492 [ D90911B3FA05D7B930C1286084B404DE ] C:\Windows\System32\scesrv.dll
18:54:42.0196 5492 C:\Windows\System32\scesrv.dll - ok
18:54:42.0211 5492 [ 1AE011BB950A5E0B05023D2AFEC3666D ] C:\Windows\System32\authz.dll
18:54:42.0211 5492 C:\Windows\System32\authz.dll - ok
18:54:42.0211 5492 [ 4774AD6C447E02E954BD9A793614EBEC ] C:\Windows\System32\lsm.exe
18:54:42.0211 5492 C:\Windows\System32\lsm.exe - ok
18:54:42.0227 5492 [ 98B656EAF128CD06F625B09C84D959E1 ] C:\Windows\System32\netapi32.dll
18:54:42.0227 5492 C:\Windows\System32\netapi32.dll - ok
18:54:42.0243 5492 [ 178FAC2B7C66E9A4400CE7AC37623E3F ] C:\Windows\System32\lsasrv.dll
18:54:42.0243 5492 C:\Windows\System32\lsasrv.dll - ok
18:54:42.0243 5492 [ 2FA16465F64DB54B1F7F511395EB4FD7 ] C:\Windows\System32\ncobjapi.dll
18:54:42.0243 5492 C:\Windows\System32\ncobjapi.dll - ok
18:54:42.0258 5492 [ 7808BF0E367ED7348808879CEF482AB3 ] C:\Windows\System32\samsrv.dll
18:54:42.0258 5492 C:\Windows\System32\samsrv.dll - ok
18:54:42.0258 5492 [ 71F5A7104FDF16C0AC5283A6CE666553 ] C:\Windows\System32\sysntfy.dll
18:54:42.0258 5492 C:\Windows\System32\sysntfy.dll - ok
18:54:42.0274 5492 [ F0321DA5203F1E71917F3B7A13DC4912 ] C:\Windows\System32\wmsgapi.dll
18:54:42.0274 5492 C:\Windows\System32\wmsgapi.dll - ok
18:54:42.0289 5492 [ 459B48188494490707DCA8BAA91AA185 ] C:\Windows\System32\cryptdll.dll
18:54:42.0289 5492 C:\Windows\System32\cryptdll.dll - ok
18:54:42.0289 5492 [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] C:\Windows\System32\aelupsvc.dll
18:54:42.0289 5492 C:\Windows\System32\aelupsvc.dll - ok
18:54:42.0289 5492 [ A1545B731579895D8CC44FC0481C1192 ] C:\Windows\System32\alg.exe
18:54:42.0289 5492 C:\Windows\System32\alg.exe - ok
18:54:42.0305 5492 [ 85E861D0B88DB2B54ACB0839654C09F7 ] C:\Windows\System32\dnsapi.dll
18:54:42.0305 5492 C:\Windows\System32\dnsapi.dll - ok
18:54:42.0305 5492 [ 965AC9FBF2C67231C157E99C03C58D24 ] C:\Windows\System32\feclient.dll
18:54:42.0305 5492 C:\Windows\System32\feclient.dll - ok
18:54:42.0305 5492 [ 1F94EA31C9543B855F53BDAC7792DA4E ] C:\Windows\System32\mpr.dll
18:54:42.0305 5492 C:\Windows\System32\mpr.dll - ok
18:54:42.0321 5492 [ EE2FF9A3FC4404234BE3B7C6AA383AF8 ] C:\Windows\System32\msasn1.dll
18:54:42.0321 5492 C:\Windows\System32\msasn1.dll - ok
18:54:42.0321 5492 [ 7F0F1D4B0D847696F8E309423D227DCE ] C:\Windows\System32\ntdsapi.dll
18:54:42.0321 5492 C:\Windows\System32\ntdsapi.dll - ok
18:54:42.0321 5492 [ 453DE2958C885527E20C79A3FEFE6AF7 ] C:\Windows\System32\samlib.dll
18:54:42.0321 5492 C:\Windows\System32\samlib.dll - ok
18:54:42.0336 5492 [ 54289361E9150C2D03E68AA6DEEF171F ] C:\Windows\System32\crypt32.dll
18:54:42.0336 5492 C:\Windows\System32\crypt32.dll - ok
18:54:42.0336 5492 [ CFEBBA297B36CBB7C52C5FF592F6F0FE ] C:\Windows\System32\inetsrv\iisres.dll
18:54:42.0336 5492 C:\Windows\System32\inetsrv\iisres.dll - ok
18:54:42.0352 5492 [ C6D704C7F0434DC791AAC37CAC4B6E14 ] C:\Windows\System32\appinfo.dll
18:54:42.0352 5492 C:\Windows\System32\appinfo.dll - ok
18:54:42.0352 5492 [ 68E2A1A0407A66CF50DA0300852424AB ] C:\Windows\System32\audiosrv.dll
18:54:42.0352 5492 C:\Windows\System32\audiosrv.dll - ok
18:54:42.0352 5492 [ C6DF7A87063D006ECF1FD8156CB6DE3F ] C:\Windows\System32\SLC.dll
18:54:42.0352 5492 C:\Windows\System32\SLC.dll - ok
18:54:42.0367 5492 [ C789AF0F724FDA5852FB9A7D3A432381 ] C:\Windows\System32\BFE.DLL
18:54:42.0367 5492 C:\Windows\System32\BFE.DLL - ok
18:54:42.0367 5492 [ 4DE3C4D07BAFDE616EFA0ADE076CBAC2 ] C:\Windows\System32\wevtapi.dll
18:54:42.0367 5492 C:\Windows\System32\wevtapi.dll - ok
18:54:42.0367 5492 [ 4FE8425F21B3F0F8C4B4726351D43EAA ] C:\Windows\System32\IPHLPAPI.DLL
18:54:42.0367 5492 C:\Windows\System32\IPHLPAPI.DLL - ok
18:54:42.0383 5492 [ 93952506C6D67330367F7E7934B6A02F ] C:\Windows\System32\qmgr.dll
18:54:42.0383 5492 C:\Windows\System32\qmgr.dll - ok
18:54:42.0383 5492 [ 9028559C132146FB75EB7ACF384B086A ] C:\Windows\System32\dhcpcsvc.dll
18:54:42.0383 5492 C:\Windows\System32\dhcpcsvc.dll - ok
18:54:42.0399 5492 [ DFB6B71CDABA9DFB49C9D2B318B97A1A ] C:\Windows\System32\dhcpcsvc6.dll
18:54:42.0399 5492 C:\Windows\System32\dhcpcsvc6.dll - ok
18:54:42.0399 5492 [ 6B09105742C75DF80CEF21700F20F55A ] C:\Windows\System32\winnsi.dll
18:54:42.0399 5492 C:\Windows\System32\winnsi.dll - ok
18:54:42.0399 5492 [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] C:\Windows\System32\browser.dll
18:54:42.0399 5492 C:\Windows\System32\browser.dll - ok
18:54:42.0414 5492 [ 312EC3E37A0A1F2006534913E37B4423 ] C:\Windows\System32\certprop.dll
18:54:42.0414 5492 C:\Windows\System32\certprop.dll - ok
18:54:42.0414 5492 [ 7F15B4953378C8B5161D65C26D5FED4D ] C:\Windows\System32\cngaudit.dll
18:54:42.0414 5492 C:\Windows\System32\cngaudit.dll - ok
18:54:42.0430 5492 [ 898E7C06A350D4A1A64A9EA264D55452 ] C:\Windows\System32\winlogon.exe
18:54:42.0430 5492 C:\Windows\System32\winlogon.exe - ok
18:54:42.0445 5492 [ DE0DD9AE3430F84A96B5501112A696BE ] C:\Windows\System32\bcrypt.dll
18:54:42.0445 5492 C:\Windows\System32\bcrypt.dll - ok
18:54:42.0445 5492 [ 745D20B75B3BDDA545022625ED5DBB1B ] C:\Windows\System32\CISVC.EXE
18:54:42.0445 5492 C:\Windows\System32\CISVC.EXE - ok
18:54:42.0461 5492 [ 4211249955AF9133E2E357CC92B54DFD ] C:\Windows\System32\comres.dll
18:54:42.0461 5492 C:\Windows\System32\comres.dll - ok
18:54:42.0461 5492 [ 13CC59C1B04E9F20A87987C68CD4BE3F ] C:\Windows\System32\ncrypt.dll
18:54:42.0461 5492 C:\Windows\System32\ncrypt.dll - ok
18:54:42.0477 5492 [ 4AAFC7461633848AA87A363B2CBEC522 ] C:\Windows\System32\winsta.dll
18:54:42.0477 5492 C:\Windows\System32\winsta.dll - ok
18:54:42.0492 5492 [ 26F139DDEC6407508071930D3D07337E ] C:\Windows\System32\credssp.dll
18:54:42.0492 5492 C:\Windows\System32\credssp.dll - ok
18:54:42.0492 5492 [ 3EDE4C1F9672C972479201544969ADCB ] C:\Windows\System32\cryptsvc.dll
18:54:42.0492 5492 C:\Windows\System32\cryptsvc.dll - ok
18:54:42.0508 5492 [ ABE9EEA1EABEA0711610A637A7B1C25D ] C:\Windows\System32\msprivs.dll
18:54:42.0508 5492 C:\Windows\System32\msprivs.dll - ok
18:54:42.0523 5492 [ 74F380C8EC8813626C670D46E8A714D1 ] C:\Windows\System32\dfsrres.dll
18:54:42.0523 5492 C:\Windows\System32\dfsrres.dll - ok
18:54:42.0523 5492 [ AA01497884F9CBAC89470120AF78D2B1 ] C:\Windows\System32\kerberos.dll
18:54:42.0523 5492 C:\Windows\System32\kerberos.dll - ok
18:54:42.0539 5492 [ 08D6D1692B62C9EE4062E1FA04D8FE2F ] C:\Windows\System32\oleres.dll
18:54:42.0539 5492 C:\Windows\System32\oleres.dll - ok
18:54:42.0539 5492 [ 69827805A221C21450BA22F4326A2EE3 ] C:\Windows\System32\version.dll
18:54:42.0539 5492 C:\Windows\System32\version.dll - ok
18:54:42.0555 5492 [ 324FD74686B1EF5E7C19A8AF49E748F6 ] C:\Windows\System32\dot3svc.dll
18:54:42.0555 5492 C:\Windows\System32\dot3svc.dll - ok
18:54:42.0570 5492 [ A622E888F8AA2F6B49E9BC466F0E5DEF ] C:\Windows\System32\dps.dll
18:54:42.0570 5492 C:\Windows\System32\dps.dll - ok
18:54:42.0570 5492 [ 9BE3744D295A7701EB425332014F0797 ] C:\Windows\ehome\ehrecvr.exe
18:54:42.0570 5492 C:\Windows\ehome\ehrecvr.exe - ok
18:54:42.0586 5492 [ C0B95E40D85CD807D614E264248A45B9 ] C:\Windows\System32\eapsvc.dll
18:54:42.0586 5492 C:\Windows\System32\eapsvc.dll - ok
18:54:42.0586 5492 [ 9E80FF0752E365F97FD2D1D68C2AFDA1 ] C:\Windows\System32\wship6.dll
18:54:42.0586 5492 C:\Windows\System32\wship6.dll - ok
18:54:42.0601 5492 [ 22CFAEB9172F5F198048401485CD0571 ] C:\Windows\System32\WSHTCPIP.DLL
18:54:42.0601 5492 C:\Windows\System32\WSHTCPIP.DLL - ok
18:54:42.0617 5492 [ 05C3B38DB95BA5585817A4F898EE5581 ] C:\Windows\System32\wshqos.dll
18:54:42.0617 5492 C:\Windows\System32\wshqos.dll - ok
18:54:42.0617 5492 [ AD1870C8E5D6DD340C829E6074BF3C3F ] C:\Windows\ehome\ehsched.exe
18:54:42.0617 5492 C:\Windows\ehome\ehsched.exe - ok
18:54:42.0617 5492 [ FC62A635063B762E1C3C60EA77279378 ] C:\Windows\System32\NapiNSP.dll
18:54:42.0617 5492 C:\Windows\System32\NapiNSP.dll - ok
18:54:42.0633 5492 [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] C:\Windows\System32\nlasvc.dll
18:54:42.0633 5492 C:\Windows\System32\nlasvc.dll - ok
18:54:42.0633 5492 [ 8617350C9B590B63E620881092751BCB ] C:\Windows\System32\mswsock.dll
18:54:42.0633 5492 C:\Windows\System32\mswsock.dll - ok
18:54:42.0648 5492 [ 690D41DF1D555F96D4898A0F54EBA065 ] C:\Windows\System32\pnrpnsp.dll
18:54:42.0648 5492 C:\Windows\System32\pnrpnsp.dll - ok
18:54:42.0648 5492 [ C27C4EE8926E74AA72EFCAB24C5242C3 ] C:\Windows\ehome\ehstart.dll
18:54:42.0648 5492 C:\Windows\ehome\ehstart.dll - ok
18:54:42.0648 5492 [ 4ABCE74D012971305249E45E095E9EA6 ] C:\Windows\System32\msv1_0.dll
18:54:42.0648 5492 C:\Windows\System32\msv1_0.dll - ok
18:54:42.0664 5492 [ 4E6B23DFC917EA39306B529B773950F4 ] C:\Windows\System32\emdmgmt.dll
18:54:42.0664 5492 C:\Windows\System32\emdmgmt.dll - ok
18:54:42.0664 5492 [ 95DAECF0FB120A7B5DA679CC54E37DDE ] C:\Windows\System32\netlogon.dll
18:54:42.0664 5492 C:\Windows\System32\netlogon.dll - ok
18:54:42.0679 5492 [ A1B40A28F38D27A7E3229EE4C7064434 ] C:\Windows\System32\wevtsvc.dll
18:54:42.0679 5492 C:\Windows\System32\wevtsvc.dll - ok
18:54:42.0695 5492 [ 72910BC4A218C49EA8E43D1FAEC403A5 ] C:\Windows\System32\winbrand.dll
18:54:42.0695 5492 C:\Windows\System32\winbrand.dll - ok
18:54:42.0695 5492 [ 6629B5F0E98151F4AFDD87567EA32BA3 ] C:\Windows\System32\fdPHost.dll
18:54:42.0695 5492 C:\Windows\System32\fdPHost.dll - ok
18:54:42.0711 5492 [ 50E3E76B0901BB4FC029BB88BFA5CE79 ] C:\Windows\System32\schannel.dll
18:54:42.0711 5492 C:\Windows\System32\schannel.dll - ok
18:54:42.0711 5492 [ 89ED56DCE8E47AF40892778A5BD31FD2 ] C:\Windows\System32\FDResPub.dll
18:54:42.0711 5492 C:\Windows\System32\FDResPub.dll - ok
18:54:42.0726 5492 [ 8CE364388C8ECA59B14B539179276D44 ] C:\Windows\System32\FntCache.dll
18:54:42.0726 5492 C:\Windows\System32\FntCache.dll - ok
18:54:42.0742 5492 [ 93620229F3CC3B67A3528BF39F064C30 ] C:\Windows\System32\wdigest.dll
18:54:42.0742 5492 C:\Windows\System32\wdigest.dll - ok
18:54:42.0742 5492 [ E14170AEA125119B98FA2BDE3FF4F462 ] C:\Windows\System32\rsaenh.dll
18:54:42.0742 5492 C:\Windows\System32\rsaenh.dll - ok
18:54:42.0757 5492 [ 302964DCAC79D618CC7B72C778DA9FD2 ] C:\Windows\System32\PresentationHost.exe
18:54:42.0757 5492 C:\Windows\System32\PresentationHost.exe - ok
18:54:42.0773 5492 [ F8873D15018F411588BEC02C1725BADA ] C:\Windows\System32\TSpkg.dll
18:54:42.0773 5492 C:\Windows\System32\TSpkg.dll - ok
18:54:42.0773 5492 [ 0F420E81062757EA8363CBACD4D40D6D ] C:\Windows\System32\gpapi.dll
18:54:42.0773 5492 C:\Windows\System32\gpapi.dll - ok
18:54:42.0789 5492 [ 84067081F3318162797385E11A8F0582 ] C:\Windows\System32\hidserv.dll
18:54:42.0789 5492 C:\Windows\System32\hidserv.dll - ok
18:54:42.0789 5492 [ D8AD255B37DA92434C26E4876DB7D418 ] C:\Windows\System32\KMSVC.DLL
18:54:42.0789 5492 C:\Windows\System32\KMSVC.DLL - ok
18:54:42.0804 5492 [ 05586F5438AB0DA4F5149159E0E5FD4B ] C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll
18:54:42.0804 5492 C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll - ok
18:54:42.0820 5492 [ 9908D8A397B76CD8D31D0D383C5773C9 ] C:\Windows\System32\IKEEXT.DLL
18:54:42.0820 5492 C:\Windows\System32\IKEEXT.DLL - ok
18:54:42.0820 5492 [ 9AC218C6E6105477484C6FDBE7D409A4 ] C:\Windows\System32\IPBusEnum.dll
18:54:42.0820 5492 C:\Windows\System32\IPBusEnum.dll - ok
18:54:42.0835 5492 [ 3464DAE0E801F5A81A23C571D86F30B2 ] C:\Windows\System32\rascfg.dll
18:54:42.0835 5492 C:\Windows\System32\rascfg.dll - ok
18:54:42.0835 5492 [ 1998BD97F950680BB55F55A7244679C2 ] C:\Windows\System32\iphlpsvc.dll
18:54:42.0835 5492 C:\Windows\System32\iphlpsvc.dll - ok
18:54:42.0835 5492 [ 03D54E7BCF9B77CEAF34DC0057420352 ] C:\Windows\System32\iprip.dll
18:54:42.0835 5492 C:\Windows\System32\iprip.dll - ok
18:54:42.0851 5492 [ 74C2F29CC612B2B34231BEBD824D2FB2 ] C:\Windows\System32\keyiso.dll
18:54:42.0851 5492 C:\Windows\System32\keyiso.dll - ok
18:54:42.0851 5492 [ 1BF5EEBFD518DD7298434D8C862F825D ] C:\Windows\System32\srvsvc.dll
18:54:42.0851 5492 C:\Windows\System32\srvsvc.dll - ok
18:54:42.0867 5492 [ 1DB69705B695B987082C8BAEC0C6B34F ] C:\Windows\System32\wkssvc.dll
18:54:42.0867 5492 C:\Windows\System32\wkssvc.dll - ok
18:54:42.0882 5492 [ 132F6237FA3BF3E9715F63A1CCF72BF1 ] C:\Windows\ehome\ehres.dll
18:54:42.0882 5492 C:\Windows\ehome\ehres.dll - ok
18:54:42.0882 5492 [ FA0593D936C9B95FB6FAA32AD1595D49 ] C:\Windows\System32\lltdres.dll
18:54:42.0882 5492 C:\Windows\System32\lltdres.dll - ok
18:54:42.0882 5492 [ 35D40113E4A5B961B6CE5C5857702518 ] C:\Windows\System32\lmhsvc.dll
18:54:42.0882 5492 C:\Windows\System32\lmhsvc.dll - ok
18:54:42.0898 5492 [ 95F1EB99B81CFD6F581C85F0A0AA9B2B ] C:\Windows\System32\FirewallAPI.dll
18:54:42.0898 5492 C:\Windows\System32\FirewallAPI.dll - ok
18:54:42.0898 5492 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] C:\Windows\System32\mmcss.dll
18:54:42.0898 5492 C:\Windows\System32\mmcss.dll - ok
18:54:42.0898 5492 [ EA822412BBBA9B7D2B1A3748AD50EFB8 ] C:\Windows\System32\iscsidsc.dll
18:54:42.0898 5492 C:\Windows\System32\iscsidsc.dll - ok
18:54:42.0913 5492 [ ED21401F1E2F6BC2F54C462BB66D0D6B ] C:\Windows\System32\msimsg.dll
18:54:42.0913 5492 C:\Windows\System32\msimsg.dll - ok
18:54:42.0913 5492 [ E4EAF0C5C1B41B5C83386CF212CA9584 ] C:\Windows\System32\QAGENTRT.DLL
18:54:42.0913 5492 C:\Windows\System32\QAGENTRT.DLL - ok
18:54:42.0929 5492 [ C8052711DAECC48B982434C5116CA401 ] C:\Windows\System32\netman.dll
18:54:42.0929 5492 C:\Windows\System32\netman.dll - ok
18:54:42.0929 5492 [ ED640F4CE585058119B824CC76591D9C ] C:\Windows\System32\netprof.dll
18:54:42.0929 5492 C:\Windows\System32\netprof.dll - ok
18:54:42.0929 5492 [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] C:\Windows\System32\nsisvc.dll
18:54:42.0929 5492 C:\Windows\System32\nsisvc.dll - ok
18:54:42.0945 5492 [ A7DFF9642D510BE1EEC6664CD0369953 ] C:\Windows\System32\ntmssvc.dll
18:54:42.0945 5492 C:\Windows\System32\ntmssvc.dll - ok
18:54:42.0945 5492 [ 0C8E8E61AD1EB0B250B846712C917506 ] C:\Windows\System32\p2psvc.dll
18:54:42.0945 5492 C:\Windows\System32\p2psvc.dll - ok
18:54:42.0945 5492 [ C6276AD11F4BB49B58AA1ED88537F14A ] C:\Windows\System32\pcasvc.dll
18:54:42.0945 5492 C:\Windows\System32\pcasvc.dll - ok
18:54:42.0960 5492 [ B1689DF169143F57053F795390C99DB3 ] C:\Windows\System32\pla.dll
18:54:42.0960 5492 C:\Windows\System32\pla.dll - ok
18:54:42.0960 5492 [ C5E7F8A996EC0A82D508FD9064A5569E ] C:\Windows\System32\umpnpmgr.dll
18:54:42.0960 5492 C:\Windows\System32\umpnpmgr.dll - ok
18:54:42.0976 5492 [ 64B28D672B5B6A01E87B0C3096B1E047 ] C:\Windows\System32\polstore.dll
18:54:42.0976 5492 C:\Windows\System32\polstore.dll - ok
18:54:42.0991 5492 [ 0508FAA222D28835310B7BFCA7A77346 ] C:\Windows\System32\profsvc.dll
18:54:42.0991 5492 C:\Windows\System32\profsvc.dll - ok
18:54:42.0991 5492 [ 08F9134A2215B7ED985409A4DF60AC60 ] C:\Windows\System32\psbase.dll
18:54:42.0991 5492 C:\Windows\System32\psbase.dll - ok
18:54:43.0007 5492 [ E9ECAE663F47E6CB43962D18AB18890F ] C:\Windows\System32\qwave.dll
18:54:43.0007 5492 C:\Windows\System32\qwave.dll - ok
18:54:43.0023 5492 [ 9F5E0E1926014D17486901C88ECA2DB7 ] C:\Windows\System32\drivers\qwavedrv.sys
18:54:43.0023 5492 C:\Windows\System32\drivers\qwavedrv.sys - ok
18:54:43.0023 5492 [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] C:\Windows\System32\rasauto.dll
18:54:43.0023 5492 C:\Windows\System32\rasauto.dll - ok
18:54:43.0038 5492 [ 75D47445D70CA6F9F894B032FBC64FCF ] C:\Windows\System32\rasmans.dll
18:54:43.0038 5492 C:\Windows\System32\rasmans.dll - ok
18:54:43.0038 5492 [ 6F1A32E7B7B30F004D9A20AFADB14944 ] C:\Windows\System32\sstpsvc.dll
18:54:43.0038 5492 C:\Windows\System32\sstpsvc.dll - ok
18:54:43.0054 5492 [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] C:\Windows\System32\mprdim.dll
18:54:43.0054 5492 C:\Windows\System32\mprdim.dll - ok
18:54:43.0054 5492 [ 9E6894EA18DAFF37B63E1005F83AE4AB ] C:\Windows\System32\regsvc.dll
18:54:43.0054 5492 C:\Windows\System32\regsvc.dll - ok
18:54:43.0069 5492 [ 5123F83CBC4349D065534EEB6BBDC42B ] C:\Windows\System32\Locator.exe
18:54:43.0069 5492 C:\Windows\System32\Locator.exe - ok
18:54:43.0069 5492 [ 77B7A11A0C3D78D3386398FBBEA1B632 ] C:\Windows\System32\SCardSvr.dll
18:54:43.0069 5492 C:\Windows\System32\SCardSvr.dll - ok
18:54:43.0069 5492 [ 1A58069DB21D05EB2AB58EE5753EBE8D ] C:\Windows\System32\schedsvc.dll
18:54:43.0069 5492 C:\Windows\System32\schedsvc.dll - ok
18:54:43.0085 5492 [ 716313D9F6B0529D03F726D5AAF6F191 ] C:\Windows\System32\sdrsvc.dll
18:54:43.0085 5492 C:\Windows\System32\sdrsvc.dll - ok
18:54:43.0085 5492 [ FD5199D4D8A521005E4B5EE7FE00FA9B ] C:\Windows\System32\seclogon.dll
18:54:43.0085 5492 C:\Windows\System32\seclogon.dll - ok
18:54:43.0085 5492 [ A9BBAB5759771E523F55563D6CBE140F ] C:\Windows\System32\Sens.dll
18:54:43.0085 5492 C:\Windows\System32\Sens.dll - ok
18:54:43.0101 5492 [ D2193326F729B163125610DBF3E17D57 ] C:\Windows\System32\SessEnv.dll
18:54:43.0101 5492 C:\Windows\System32\SessEnv.dll - ok
18:54:43.0101 5492 [ E1499BD0FF76B1B2FBBF1AF339D91165 ] C:\Windows\System32\ipnathlp.dll
18:54:43.0101 5492 C:\Windows\System32\ipnathlp.dll - ok
18:54:43.0101 5492 [ C7230FBEE14437716701C15BE02C27B8 ] C:\Windows\System32\shsvcs.dll
18:54:43.0101 5492 C:\Windows\System32\shsvcs.dll - ok
18:54:43.0116 5492 [ 1AC26293326D464A22B8C37A943F23D6 ] C:\Windows\System32\simptcp.dll
18:54:43.0116 5492 C:\Windows\System32\simptcp.dll - ok
18:54:43.0116 5492 [ 862BB4CBC05D80C5B45BE430E5EF872F ] C:\Windows\System32\SLsvc.exe
18:54:43.0116 5492 C:\Windows\System32\SLsvc.exe - ok
18:54:43.0132 5492 [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] C:\Windows\System32\SLUINotify.dll
18:54:43.0132 5492 C:\Windows\System32\SLUINotify.dll - ok
18:54:43.0132 5492 [ E4060CFE50F87C72316CB0FDB20E4913 ] C:\Windows\System32\tcpipcfg.dll
18:54:43.0132 5492 C:\Windows\System32\tcpipcfg.dll - ok
18:54:43.0132 5492 [ 26BA81BA48C3D9FB292B4B60FDE849F2 ] C:\Windows\System32\snmp.exe
18:54:43.0132 5492 C:\Windows\System32\snmp.exe - ok
18:54:43.0147 5492 [ 2A146A055B4401C16EE62D18B8E2A032 ] C:\Windows\System32\snmptrap.exe
18:54:43.0147 5492 C:\Windows\System32\snmptrap.exe - ok
18:54:43.0147 5492 [ 8554097E5136C3BF9F69FE578A1B35F4 ] C:\Windows\System32\spoolsv.exe
18:54:43.0147 5492 C:\Windows\System32\spoolsv.exe - ok
18:54:43.0147 5492 [ 03D50B37234967433A5EA5BA72BC0B62 ] C:\Windows\System32\ssdpsrv.dll
18:54:43.0147 5492 C:\Windows\System32\ssdpsrv.dll - ok
18:54:43.0163 5492 [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] C:\Windows\System32\wiaservc.dll
18:54:43.0163 5492 C:\Windows\System32\wiaservc.dll - ok
18:54:43.0179 5492 [ F21FD248040681CCA1FB6C9A03AAA93D ] C:\Windows\System32\swprv.dll
18:54:43.0179 5492 C:\Windows\System32\swprv.dll - ok
18:54:43.0179 5492 [ 9A51B04E9886AA4EE90093586B0BA88D ] C:\Windows\System32\sysmain.dll
18:54:43.0179 5492 C:\Windows\System32\sysmain.dll - ok
18:54:43.0194 5492 [ 2DCA225EAE15F42C0933E998EE0231C3 ] C:\Windows\System32\TabSvc.dll
18:54:43.0194 5492 C:\Windows\System32\TabSvc.dll - ok
18:54:43.0194 5492 [ D7673E4B38CE21EE54C59EEEB65E2483 ] C:\Windows\System32\tapisrv.dll
18:54:43.0194 5492 C:\Windows\System32\tapisrv.dll - ok
18:54:43.0210 5492 [ CB05822CD9CC6C688168E113C603DBE7 ] C:\Windows\System32\tbssvc.dll
18:54:43.0210 5492 C:\Windows\System32\tbssvc.dll - ok
18:54:43.0225 5492 [ BB95DA09BEF6E7A131BFF3BA5032090D ] C:\Windows\System32\termsrv.dll
18:54:43.0225 5492 C:\Windows\System32\termsrv.dll - ok
18:54:43.0225 5492 [ 5E1BC006CB4A26507D4512795CF08373 ] C:\Windows\System32\tlntsvr.exe
18:54:43.0225 5492 C:\Windows\System32\tlntsvr.exe - ok
18:54:43.0241 5492 [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] C:\Windows\servicing\TrustedInstaller.exe
18:54:43.0241 5492 C:\Windows\servicing\TrustedInstaller.exe - ok
18:54:43.0241 5492 [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] C:\Windows\System32\trkwks.dll
18:54:43.0241 5492 C:\Windows\System32\trkwks.dll - ok
18:54:43.0257 5492 [ ECEF404F62863755951E09C802C94AD5 ] C:\Windows\System32\UI0Detect.exe
18:54:43.0257 5492 C:\Windows\System32\UI0Detect.exe - ok
18:54:43.0272 5492 [ 68308183F4AE0BE7BF8ECD07CB297999 ] C:\Windows\System32\upnphost.dll
18:54:43.0272 5492 C:\Windows\System32\upnphost.dll - ok
18:54:43.0272 5492 [ 01DD1004181FD46ECDC3628228EB269D ] C:\Windows\System32\dwm.exe
18:54:43.0272 5492 C:\Windows\System32\dwm.exe - ok
18:54:43.0272 5492 [ CD88D1B7776DC17A119049742EC07EB4 ] C:\Windows\System32\vds.exe
18:54:43.0272 5492 C:\Windows\System32\vds.exe - ok
18:54:43.0288 5492 [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] C:\Windows\System32\VSSVC.exe
18:54:43.0288 5492 C:\Windows\System32\VSSVC.exe - ok
18:54:43.0288 5492 [ 96EA68B9EB310A69C25EBB0282B2B9DE ] C:\Windows\System32\w32time.dll
18:54:43.0288 5492 C:\Windows\System32\w32time.dll - ok
18:54:43.0303 5492 [ A3CD60FD826381B49F03832590E069AF ] C:\Windows\System32\wcncsvc.dll
18:54:43.0303 5492 C:\Windows\System32\wcncsvc.dll - ok
18:54:43.0303 5492 [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] C:\Windows\System32\WcsPlugInService.dll
18:54:43.0303 5492 C:\Windows\System32\WcsPlugInService.dll - ok
18:54:43.0303 5492 [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] C:\Windows\System32\drivers\Wdf01000.sys
18:54:43.0303 5492 C:\Windows\System32\drivers\Wdf01000.sys - ok
18:54:43.0319 5492 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] C:\Windows\System32\wdi.dll
18:54:43.0319 5492 C:\Windows\System32\wdi.dll - ok
18:54:43.0319 5492 [ 04C37D8107320312FBAE09926103D5E2 ] C:\Windows\System32\WebClnt.dll
18:54:43.0319 5492 C:\Windows\System32\WebClnt.dll - ok
18:54:43.0319 5492 [ AE3736E7E8892241C23E4EBBB7453B60 ] C:\Windows\System32\wecsvc.dll
18:54:43.0319 5492 C:\Windows\System32\wecsvc.dll - ok
18:54:43.0335 5492 [ 670FF720071ED741206D69BD995EA453 ] C:\Windows\System32\wercplsupport.dll
18:54:43.0335 5492 C:\Windows\System32\wercplsupport.dll - ok
18:54:43.0335 5492 [ 32B88481D3B326DA6DEB07B1D03481E7 ] C:\Windows\System32\wersvc.dll
18:54:43.0335 5492 C:\Windows\System32\wersvc.dll - ok
18:54:43.0350 5492 [ DBD02E3E6F061EBBBF9B99A9D7CBA30B ] C:\Windows\System32\winhttp.dll
18:54:43.0350 5492 C:\Windows\System32\winhttp.dll - ok
18:54:43.0350 5492 [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] C:\Windows\System32\wbem\WMIsvc.dll
18:54:43.0350 5492 C:\Windows\System32\wbem\WMIsvc.dll - ok
18:54:43.0366 5492 [ 7CFE68BDC065E55AA5E8421607037511 ] C:\Windows\System32\WsmSvc.dll
18:54:43.0366 5492 C:\Windows\System32\WsmSvc.dll - ok
18:54:43.0366 5492 [ C008405E4FEEB069E30DA1D823910234 ] C:\Windows\System32\wlansvc.dll
18:54:43.0366 5492 C:\Windows\System32\wlansvc.dll - ok
18:54:43.0381 5492 [ 43BE3875207DCB62A85C8C49970B66CC ] C:\Windows\System32\wbem\WmiApSrv.exe
18:54:43.0381 5492 C:\Windows\System32\wbem\WmiApSrv.exe - ok
18:54:43.0381 5492 [ 3978704576A121A9204F8CC49A301A9B ] C:\Program Files\Windows Media Player\wmpnetwk.exe
18:54:43.0381 5492 C:\Program Files\Windows Media Player\wmpnetwk.exe - ok
18:54:43.0381 5492 [ CFC5A04558F5070CEE3E3A7809F3FF52 ] C:\Windows\System32\wpcsvc.dll
18:54:43.0381 5492 C:\Windows\System32\wpcsvc.dll - ok
18:54:43.0397 5492 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
18:54:43.0397 5492 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe - ok
18:54:43.0397 5492 [ 801FBDB89D472B3C467EB112A0FC9246 ] C:\Windows\System32\wpdbusenum.dll
18:54:43.0397 5492 C:\Windows\System32\wpdbusenum.dll - ok
18:54:43.0413 5492 [ 1CA6C40261DDC0425987980D0CD2AAAB ] C:\Windows\System32\wscsvc.dll
18:54:43.0413 5492 C:\Windows\System32\wscsvc.dll - ok
18:54:43.0413 5492 [ AED0DFF80C6B3914769407E78D7AB21A ] C:\Windows\System32\SearchIndexer.exe
18:54:43.0413 5492 C:\Windows\System32\SearchIndexer.exe - ok
18:54:43.0413 5492 [ FC3EC24FCE372C89423E015A2AC1A31E ] C:\Windows\System32\wuaueng.dll
18:54:43.0413 5492 C:\Windows\System32\wuaueng.dll - ok
18:54:43.0428 5492 [ 06E6F32C8D0A3F66D956F57B43A2E070 ] C:\Windows\System32\drivers\WUDFPf.sys
18:54:43.0428 5492 C:\Windows\System32\drivers\WUDFPf.sys - ok
18:54:43.0428 5492 [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] C:\Windows\System32\WUDFSvc.dll
18:54:43.0428 5492 C:\Windows\System32\WUDFSvc.dll - ok
18:54:43.0428 5492 [ 8FC182167381E9915651267044105EE1 ] C:\Windows\System32\scecli.dll
18:54:43.0428 5492 C:\Windows\System32\scecli.dll - ok
18:54:43.0444 5492 [ CD08EEC61C591AF59A39F4363C567D30 ] C:\Windows\System32\ntmarta.dll
18:54:43.0444 5492 C:\Windows\System32\ntmarta.dll - ok
18:54:43.0444 5492 [ 3794B461C45882E06856F282EEF025AF ] C:\Windows\System32\svchost.exe
18:54:43.0444 5492 C:\Windows\System32\svchost.exe - ok
18:54:43.0459 5492 [ 9A7F4B2EDACD11444D048AA19CBB26AF ] C:\Windows\System32\powrprof.dll
18:54:43.0459 5492 C:\Windows\System32\powrprof.dll - ok
18:54:43.0459 5492 [ 8F5C7426567798E62A3B3614965D62CC ] C:\Windows\System32\drivers\luafv.sys
18:54:43.0459 5492 C:\Windows\System32\drivers\luafv.sys - ok
18:54:43.0459 5492 [ 1F7094D4268D46F718C51286DC189791 ] C:\Windows\System32\drivers\aswMonFlt.sys
18:54:43.0459 5492 C:\Windows\System32\drivers\aswMonFlt.sys - ok
18:54:43.0475 5492 [ 4AF5F360BA1E8794D32B366E45A64A0A ] C:\Windows\System32\drivers\aswFsBlk.sys
18:54:43.0475 5492 C:\Windows\System32\drivers\aswFsBlk.sys - ok
18:54:43.0491 5492 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] C:\Windows\System32\rpcss.dll
18:54:43.0491 5492 C:\Windows\System32\rpcss.dll - ok
18:54:43.0491 5492 [ 62D577288B48998FC6667BF22DC5B690 ] C:\Windows\System32\LogonUI.exe
18:54:43.0491 5492 C:\Windows\System32\LogonUI.exe - ok
18:54:43.0506 5492 [ 58C2521D87C494831A625202C80354AD ] C:\Windows\System32\authui.dll
18:54:43.0506 5492 C:\Windows\System32\authui.dll - ok
18:54:43.0506 5492 [ 56B5914070B2C243DFB3D186070DA89D ] C:\Windows\System32\MMDevAPI.dll
18:54:43.0506 5492 C:\Windows\System32\MMDevAPI.dll - ok
18:54:43.0506 5492 [ F42483814FC39170B3982A184EC5AAA2 ] C:\Windows\System32\wtsapi32.dll
18:54:43.0506 5492 C:\Windows\System32\wtsapi32.dll - ok
18:54:43.0522 5492 [ BE3C082837866C4C291ADAF163C10EA6 ] C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
18:54:43.0522 5492 C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll - ok
18:54:43.0522 5492 [ 67A95B9D129ED5399E7965CD09CF30E7 ] C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe
18:54:43.0522 5492 C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe - ok
18:54:43.0537 5492 [ C9244BCAC83B259B920BBEE18A97BFE1 ] C:\Windows\System32\avrt.dll
18:54:43.0537 5492 C:\Windows\System32\avrt.dll - ok
18:54:43.0537 5492 [ 2EC53B5A351C4D443896DBAD117F7E82 ] C:\Windows\System32\msimg32.dll
18:54:43.0537 5492 C:\Windows\System32\msimg32.dll - ok
18:54:43.0537 5492 [ 999D69DEB576C2C424294DF025891CC6 ] C:\Windows\System32\uxtheme.dll
18:54:43.0537 5492 C:\Windows\System32\uxtheme.dll - ok
18:54:43.0553 5492 [ 76EAEF4DDEBBC7C38853F586C0E91DCE ] C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\GdiPlus.dll
18:54:43.0553 5492 C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\GdiPlus.dll - ok
18:54:43.0553 5492 [ B2E569EF26DAC9D6994A2AFF4F601B7A ] C:\Windows\System32\wintrust.dll
18:54:43.0553 5492 C:\Windows\System32\wintrust.dll - ok
18:54:43.0569 5492 [ D5CF1536137026ACDED95BF6CBF849F6 ] C:\Windows\System32\WUDFPlatform.dll
18:54:43.0569 5492 C:\Windows\System32\WUDFPlatform.dll - ok
18:54:43.0569 5492 [ EC43D9CC95C3BB5FEFDBCF22D375E1F5 ] C:\Windows\System32\adtschema.dll
18:54:43.0569 5492 C:\Windows\System32\adtschema.dll - ok
18:54:43.0569 5492 [ A99871BA522CB2539AE275AC18CACC8F ] C:\Windows\System32\cabinet.dll
18:54:43.0569 5492 C:\Windows\System32\cabinet.dll - ok
18:54:43.0584 5492 [ 75EB73E64F5B4655D9797D20F26DE320 ] C:\Windows\System32\duser.dll
18:54:43.0584 5492 C:\Windows\System32\duser.dll - ok
18:54:43.0584 5492 [ 1908CC7673F72601AFFDCA022689CEDF ] C:\Windows\System32\xmllite.dll
18:54:43.0584 5492 C:\Windows\System32\xmllite.dll - ok
18:54:43.0584 5492 [ 97FEF831AB90BEE128C9AF390E243F80 ] C:\Windows\System32\drivers\drmkaud.sys
18:54:43.0584 5492 C:\Windows\System32\drivers\drmkaud.sys - ok
18:54:43.0600 5492 [ B25DBBA6C63A61FF4AFDB5ADAB4E70CB ] C:\Windows\System32\SmartcardCredentialProvider.dll
18:54:43.0600 5492 C:\Windows\System32\SmartcardCredentialProvider.dll - ok
18:54:43.0600 5492 [ 9DC3723519F52B6BC63EACD4BD411313 ] C:\Windows\System32\rasplap.dll
18:54:43.0600 5492 C:\Windows\System32\rasplap.dll - ok
18:54:43.0615 5492 [ 3CB863B78642405371CB3A71C07E2382 ] C:\Windows\System32\rasapi32.dll
18:54:43.0615 5492 C:\Windows\System32\rasapi32.dll - ok
18:54:43.0615 5492 [ 3A1DDA77F331D107BA40DB06E4D666E9 ] C:\Windows\System32\rasman.dll
18:54:43.0615 5492 C:\Windows\System32\rasman.dll - ok
18:54:43.0615 5492 [ 70F08ECE7A30A639D3F0C8C433685C7D ] C:\Windows\System32\tapi32.dll
18:54:43.0615 5492 C:\Windows\System32\tapi32.dll - ok
18:54:43.0631 5492 [ 3437B9E218A2E4586BEF4F7A3BD00777 ] C:\Windows\System32\audiodg.exe
18:54:43.0631 5492 C:\Windows\System32\audiodg.exe - ok
18:54:43.0631 5492 [ 3D418A22A56471295AEB1CEB9027C3DA ] C:\Windows\System32\rtutils.dll
18:54:43.0631 5492 C:\Windows\System32\rtutils.dll - ok
18:54:43.0631 5492 [ 14FF750EFE13B0C21E5A06507C3A97B1 ] C:\Windows\System32\winmm.dll
18:54:43.0631 5492 C:\Windows\System32\winmm.dll - ok
18:54:43.0647 5492 [ DC15AB7168C0309D8F04FD95B6240422 ] C:\Windows\System32\oleacc.dll
18:54:43.0647 5492 C:\Windows\System32\oleacc.dll - ok
18:54:43.0647 5492 [ 627920CFF5DFCF8CF54CF2D592D61307 ] C:\Windows\System32\WinSCard.dll
18:54:43.0647 5492 C:\Windows\System32\WinSCard.dll - ok
18:54:43.0647 5492 [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] C:\Windows\System32\gpsvc.dll
18:54:43.0647 5492 C:\Windows\System32\gpsvc.dll - ok
18:54:43.0662 5492 [ D1A84F7D4CAFCFE2A32149FF418056E5 ] C:\Windows\System32\nlaapi.dll
18:54:43.0662 5492 C:\Windows\System32\nlaapi.dll - ok
18:54:43.0662 5492 [ 409F36C8BD06FCE184631EB4142B009A ] C:\Windows\System32\atl.dll
18:54:43.0662 5492 C:\Windows\System32\atl.dll - ok
18:54:43.0678 5492 [ 12A1DF1B84FB45A00D47B2CDE2CEEBBA ] C:\Windows\System32\shgina.dll
18:54:43.0678 5492 C:\Windows\System32\shgina.dll - ok
18:54:43.0678 5492 [ 70932D6C3D59B416CBD2BE5A3B3D4BE6 ] C:\Windows\System32\shacct.dll
18:54:43.0678 5492 C:\Windows\System32\shacct.dll - ok
18:54:43.0693 5492 [ 67058C46504BC12D821F38CF99B7B28F ] C:\Windows\System32\es.dll
18:54:43.0693 5492 C:\Windows\System32\es.dll - ok
18:54:43.0693 5492 [ 7DACD94118E2D8B6D72F47ADEB0367BF ] C:\Windows\System32\propsys.dll
18:54:43.0693 5492 C:\Windows\System32\propsys.dll - ok
18:54:43.0693 5492 [ A7F8BAD9590ADDC425B4003E94780DFA ] C:\Windows\System32\drivers\spsys.sys
18:54:43.0693 5492 C:\Windows\System32\drivers\spsys.sys - ok
18:54:43.0709 5492 [ 919CC2A0476D5A6A4C935D4B88E29912 ] C:\Windows\System32\ksuser.dll
18:54:43.0709 5492 C:\Windows\System32\ksuser.dll - ok
18:54:43.0709 5492 [ 4DF066ECEE5A7B20BF8B39EF4D646600 ] C:\Windows\System32\wdmaud.drv
18:54:43.0709 5492 C:\Windows\System32\wdmaud.drv - ok
18:54:43.0725 5492 [ DB7F4AB85298F3FE522C5512B8B0F56D ] C:\Windows\System32\AudioEng.dll
18:54:43.0725 5492 C:\Windows\System32\AudioEng.dll - ok
18:54:43.0725 5492 [ 7258434974EA735725FD2D4A65C5E821 ] C:\Windows\System32\AudioSes.dll
18:54:43.0725 5492 C:\Windows\System32\AudioSes.dll - ok
18:54:43.0740 5492 [ 6836D001FC733F205ACB80A7986CB6C9 ] C:\Windows\System32\WindowsCodecs.dll
18:54:43.0740 5492 C:\Windows\System32\WindowsCodecs.dll - ok
18:54:43.0740 5492 [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] C:\Windows\System32\drivers\fltMgr.sys
18:54:43.0740 5492 C:\Windows\System32\drivers\fltMgr.sys - ok
18:54:43.0756 5492 [ BDBB449425991154135E5ED1559927E6 ] C:\Windows\System32\msacm32.dll
18:54:43.0756 5492 C:\Windows\System32\msacm32.dll - ok
18:54:43.0771 5492 [ 166F004D73EA2CF4AC61800CA469458D ] C:\Windows\System32\msacm32.drv
18:54:43.0771 5492 C:\Windows\System32\msacm32.drv - ok
18:54:43.0771 5492 [ 83199EF88D691E730B80666E29F90D58 ] C:\Windows\System32\midimap.dll
18:54:43.0771 5492 C:\Windows\System32\midimap.dll - ok
18:54:43.0787 5492 [ 8269CC01940A202BBB9FDF26705DBD67 ] C:\Windows\System32\hid.dll
18:54:43.0787 5492 C:\Windows\System32\hid.dll - ok
18:54:43.0803 5492 [ 1509E705F3AC1D474C92454A5C2DD81F ] C:\Windows\System32\uxsms.dll
18:54:43.0803 5492 C:\Windows\System32\uxsms.dll - ok
18:54:43.0803 5492 [ 57418956DDAE128D1023C508E7D07071 ] C:\Windows\System32\PSHED.DLL
18:54:43.0803 5492 C:\Windows\System32\PSHED.DLL - ok
18:54:43.0818 5492 [ 296937202E4D930AAE98085B99D744D8 ] C:\Windows\System32\AUDIOKSE.dll
18:54:43.0818 5492 C:\Windows\System32\AUDIOKSE.dll - ok
18:54:43.0818 5492 [ 0727200F10320A6BA7E59433094FBBA7 ] C:\Windows\System32\WMALFXGFXDSP.dll
18:54:43.0818 5492 C:\Windows\System32\WMALFXGFXDSP.dll - ok
18:54:43.0834 5492 [ BF142D4F8C61ED3629A9CDD7BA867900 ] C:\Windows\System32\mfplat.dll
18:54:43.0834 5492 C:\Windows\System32\mfplat.dll - ok
18:54:43.0849 5492 [ D1C5883087A0C3F1344D9D55A44901F6 ] C:\Windows\System32\drivers\lltdio.sys
18:54:43.0849 5492 C:\Windows\System32\drivers\lltdio.sys - ok
18:54:43.0849 5492 [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] C:\Windows\System32\drivers\nwifi.sys
18:54:43.0849 5492 C:\Windows\System32\drivers\nwifi.sys - ok
18:54:43.0865 5492 [ D6973AA34C4D5D76C0430B181C3CD389 ] C:\Windows\System32\drivers\ndisuio.sys
18:54:43.0865 5492 C:\Windows\System32\drivers\ndisuio.sys - ok
18:54:43.0881 5492 [ 3DE33BCE4A930EDF57BD1F742823BCD8 ] C:\Windows\System32\drivers\pnarp.sys
18:54:43.0881 5492 C:\Windows\System32\drivers\pnarp.sys - ok
18:54:43.0881 5492 [ 53EFA6066E7FFAA1AD91C7FB40FFD2EC ] C:\Windows\System32\drivers\purendis.sys
18:54:43.0881 5492 C:\Windows\System32\drivers\purendis.sys - ok
18:54:43.0896 5492 [ 9C508F4074A39E8B4B31D27198146FAD ] C:\Windows\System32\drivers\rspndr.sys
18:54:43.0896 5492 C:\Windows\System32\drivers\rspndr.sys - ok
18:54:43.0896 5492 [ 57D762F6F5974AF0DA2BE88A3349BAAA ] C:\Windows\System32\dnsrslvr.dll
18:54:43.0896 5492 C:\Windows\System32\dnsrslvr.dll - ok
18:54:43.0912 5492 [ 3AB4023CBD406AC33AB8CDFF6C8079A0 ] C:\Windows\System32\eapphost.dll
18:54:43.0912 5492 C:\Windows\System32\eapphost.dll - ok
18:54:43.0927 5492 [ 3B0489DE8CC3058B48471660C60A7B75 ] C:\Windows\System32\rastls.dll
18:54:43.0927 5492 C:\Windows\System32\rastls.dll - ok
18:54:43.0927 5492 [ 82A79D5BE740D0AE9C91AA6DE4B3AC5A ] C:\Windows\System32\raschap.dll
18:54:43.0927 5492 C:\Windows\System32\raschap.dll - ok
18:54:43.0943 5492 [ E45051C374F845EDF3DB02A35BA13193 ] C:\Windows\System32\umb.dll
18:54:43.0943 5492 C:\Windows\System32\umb.dll - ok
18:54:43.0943 5492 [ 3727F8B85E24BBDD325BFF75F029DDE3 ] C:\Windows\System32\wlanmsm.dll
18:54:43.0943 5492 C:\Windows\System32\wlanmsm.dll - ok
18:54:43.0959 5492 [ 4662AF853DFAD5648CE3814E7D9EF3D6 ] C:\Windows\System32\wlansec.dll
18:54:43.0959 5492 C:\Windows\System32\wlansec.dll - ok
18:54:43.0974 5492 [ B64AC7967D6B9FB2D6152AC768A1CB88 ] C:\Windows\System32\onex.dll
18:54:43.0974 5492 C:\Windows\System32\onex.dll - ok
18:54:43.0974 5492 [ 9D9FFC923FADBB575E0452EA0BBB15BD ] C:\Windows\System32\eappprxy.dll
18:54:43.0974 5492 C:\Windows\System32\eappprxy.dll - ok
18:54:43.0990 5492 [ 5D0FE613570CABE3992F7DBCD68E61D1 ] C:\Windows\System32\eappcfg.dll
18:54:43.0990 5492 C:\Windows\System32\eappcfg.dll - ok
18:54:43.0990 5492 [ 91D995A67D9447592A1BF21CBC15C628 ] C:\Windows\System32\wlgpclnt.dll
18:54:43.0990 5492 C:\Windows\System32\wlgpclnt.dll - ok
18:54:44.0005 5492 [ 19FFAD68A02AF1BF0BC336EE26CD6767 ] C:\Windows\System32\l2gpstore.dll
18:54:44.0005 5492 C:\Windows\System32\l2gpstore.dll - ok
18:54:44.0021 5492 [ EB2170D0DDF3B2A92506AE16BC524B0B ] C:\Windows\System32\wlanutil.dll
18:54:44.0021 5492 C:\Windows\System32\wlanutil.dll - ok
18:54:44.0021 5492 [ 0296DAEB5555A248E8ABF7E5012A37A6 ] C:\Windows\System32\msxml6.dll
18:54:44.0021 5492 C:\Windows\System32\msxml6.dll - ok
18:54:44.0037 5492 [ 28D6701C710AD7BA3CB95E75F8F1A9AA ] C:\Program Files\AVAST Software\Avast\AvastSvc.exe
18:54:44.0037 5492 C:\Program Files\AVAST Software\Avast\AvastSvc.exe - ok
18:54:44.0052 5492 [ 54AE15322C30814FC23FC26907A563B3 ] C:\Program Files\AVAST Software\Avast\aswCmnBS.dll
18:54:44.0052 5492 C:\Program Files\AVAST Software\Avast\aswCmnBS.dll - ok
18:54:44.0052 5492 [ 40F2889475EDC401F98FD7938F0BBF66 ] C:\Program Files\AVAST Software\Avast\aswCmnOS.dll
18:54:44.0052 5492 C:\Program Files\AVAST Software\Avast\aswCmnOS.dll - ok
18:54:44.0068 5492 [ 1F9319EA6D87522C70271A55AC3BE365 ] C:\Program Files\AVAST Software\Avast\aswCmnIS.dll
18:54:44.0068 5492 C:\Program Files\AVAST Software\Avast\aswCmnIS.dll - ok
18:54:44.0068 5492 [ CDBE9690CF2B8409FACAD94FAC9479C9 ] C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
18:54:44.0068 5492 C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll - ok
18:54:44.0083 5492 [ 4C39358EBDD2FFCD9132A30E1EC31E16 ] C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcp90.dll
18:54:44.0083 5492 C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcp90.dll - ok
18:54:44.0099 5492 [ 0C70F8F5CC8359AC633724BECF6ABAF3 ] C:\Program Files\AVAST Software\Avast\ashBase.dll
18:54:44.0099 5492 C:\Program Files\AVAST Software\Avast\ashBase.dll - ok
18:54:44.0115 5492 [ E582816A4855914DEFFC212E12B3B744 ] C:\Windows\System32\wsock32.dll
18:54:44.0115 5492 C:\Windows\System32\wsock32.dll - ok
18:54:44.0115 5492 [ F79B2469046122E24450FB66AE580C83 ] C:\Program Files\AVAST Software\Avast\aswEngLdr.dll
18:54:44.0115 5492 C:\Program Files\AVAST Software\Avast\aswEngLdr.dll - ok
18:54:44.0130 5492 [ C86121BF74BB07FC99DB9DB0ED1B49FF ] C:\Program Files\AVAST Software\Avast\avBugReport.exe
18:54:44.0130 5492 C:\Program Files\AVAST Software\Avast\avBugReport.exe - ok
18:54:44.0130 5492 [ D068312FEC645A9D7C1398808734B142 ] C:\Program Files\AVAST Software\Avast\aswProperty.dll
18:54:44.0130 5492 C:\Program Files\AVAST Software\Avast\aswProperty.dll - ok
18:54:44.0146 5492 [ 64BF5CD9B9D7BD391CBC9EDE847A2902 ] C:\Program Files\AVAST Software\Avast\AavmRpch.dll
18:54:44.0146 5492 C:\Program Files\AVAST Software\Avast\AavmRpch.dll - ok
18:54:44.0146 5492 [ 5C5E3AFD499E5146FEF1DA5EF8A23205 ] C:\Program Files\AVAST Software\Avast\dbghelp.dll
18:54:44.0146 5492 C:\Program Files\AVAST Software\Avast\dbghelp.dll - ok
18:54:44.0146 5492 [ 920B4D089E02FB4A3F8ADA8B4BEF9B26 ] C:\Program Files\AVAST Software\Avast\1033\Base.dll
18:54:44.0146 5492 C:\Program Files\AVAST Software\Avast\1033\Base.dll - ok
18:54:44.0161 5492 [ DA8B8A95780F406EBB213C1C5D4C0D90 ] C:\Program Files\AVAST Software\Avast\ashServ.dll
18:54:44.0161 5492 C:\Program Files\AVAST Software\Avast\ashServ.dll - ok
18:54:44.0161 5492 [ 35ACD5EA63D75E97DD0E9A1629E582B2 ] C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.6002.18305_none_88f3a38569c2c436\comctl32.dll
18:54:44.0161 5492 C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.6002.18305_none_88f3a38569c2c436\comctl32.dll - ok
18:54:44.0161 5492 [ D873AF6112E377CDBCBF3055B86C30A9 ] C:\Program Files\AVAST Software\Avast\aswAux.dll
18:54:44.0161 5492 C:\Program Files\AVAST Software\Avast\aswAux.dll - ok
18:54:44.0177 5492 [ 69B9DD83535C421F229227B0B303082A ] C:\Program Files\AVAST Software\Avast\ashTask.dll
18:54:44.0177 5492 C:\Program Files\AVAST Software\Avast\ashTask.dll - ok
18:54:44.0177 5492 [ 91F1D56F6DC6B2AEC45369765787B64D ] C:\Program Files\AVAST Software\Avast\ashTaskEx.dll
18:54:44.0177 5492 C:\Program Files\AVAST Software\Avast\ashTaskEx.dll - ok
18:54:44.0193 5492 [ 1919B2A6BB69BD206A4F0C20FBA5E4B6 ] C:\Program Files\AVAST Software\Avast\aswLog.dll
18:54:44.0193 5492 C:\Program Files\AVAST Software\Avast\aswLog.dll - ok
18:54:44.0193 5492 [ B3B4DDCD7263993FA3C42573066A16BE ] C:\Program Files\AVAST Software\Avast\aswSqLt.dll
18:54:44.0193 5492 C:\Program Files\AVAST Software\Avast\aswSqLt.dll - ok
18:54:44.0208 5492 [ 7D289D7E6253BC998F51CAADB54C5192 ] C:\Program Files\AVAST Software\Avast\Aavm4h.dll
18:54:44.0208 5492 C:\Program Files\AVAST Software\Avast\Aavm4h.dll - ok
18:54:44.0208 5492 [ E43B269964099D96DDDAAED0E57F109E ] C:\Program Files\AVAST Software\Avast\avastIP.dll
18:54:44.0208 5492 C:\Program Files\AVAST Software\Avast\avastIP.dll - ok
18:54:44.0208 5492 [ 79B5BAEC23456D3F7EC10FC8374DA2CC ] C:\Program Files\AVAST Software\Avast\aswIdle.dll
18:54:44.0208 5492 C:\Program Files\AVAST Software\Avast\aswIdle.dll - ok
18:54:44.0224 5492 [ BB2BE07A396B5B22AC56787FACF8D86F ] C:\Program Files\AVAST Software\Avast\aswDld.dll
18:54:44.0224 5492 C:\Program Files\AVAST Software\Avast\aswDld.dll - ok
18:54:44.0224 5492 [ 52D0FE133CBE687ED4E83FBDA70EBC9C ] C:\Program Files\AVAST Software\Avast\aswStrm.dll
18:54:44.0224 5492 C:\Program Files\AVAST Software\Avast\aswStrm.dll - ok
18:54:44.0239 5492 [ CA0B849566776A17F35F0339BE17DFD9 ] C:\Windows\System32\ktmw32.dll
18:54:44.0239 5492 C:\Windows\System32\ktmw32.dll - ok
18:54:44.0239 5492 [ D0A95E567224B4C347CBDD6541E5D928 ] C:\Windows\System32\wscisvif.dll
18:54:44.0239 5492 C:\Windows\System32\wscisvif.dll - ok
18:54:44.0239 5492 [ A0F4852A5DB9754BEC06F84B400AE743 ] C:\Windows\System32\wscapi.dll
18:54:44.0239 5492 C:\Windows\System32\wscapi.dll - ok
18:54:44.0255 5492 [ 2A6A2C09ECC2CB495628E45F1379ECE8 ] C:\Windows\System32\taskcomp.dll
18:54:44.0255 5492 C:\Windows\System32\taskcomp.dll - ok
18:54:44.0255 5492 [ 2400A2B7020CEEE84B0E2CB75A0E0C2E ] C:\Program Files\AVAST Software\Avast\defs\13063000\aswEngin.dll
18:54:44.0255 5492 C:\Program Files\AVAST Software\Avast\defs\13063000\aswEngin.dll - ok
18:54:44.0271 5492 [ F870AA3E254628EBEAFE754108D664DE ] C:\Windows\System32\drivers\http.sys
18:54:44.0271 5492 C:\Windows\System32\drivers\http.sys - ok
18:54:44.0271 5492 [ 73FE2E5FA55088A241AA2732F5D387D6 ] C:\Windows\System32\wiarpc.dll
18:54:44.0271 5492 C:\Windows\System32\wiarpc.dll - ok
18:54:44.0271 5492 [ E79FDA8D320147FDC347C504B3487F87 ] C:\Windows\System32\spoolss.dll
18:54:44.0271 5492 C:\Windows\System32\spoolss.dll - ok
18:54:44.0286 5492 [ 7605C0E1D01A08F3ECD743F38B834A44 ] C:\Windows\System32\drivers\srvnet.sys
18:54:44.0286 5492 C:\Windows\System32\drivers\srvnet.sys - ok
18:54:44.0286 5492 [ C4689286E13EB33929B219C010BB44C1 ] C:\Program Files\AVAST Software\Avast\defs\13063000\aswCmnIS.dll
18:54:44.0286 5492 C:\Program Files\AVAST Software\Avast\defs\13063000\aswCmnIS.dll - ok
18:54:44.0302 5492 [ 701BFC8672B9AA1BC9190157BF764C8D ] C:\Program Files\AVAST Software\Avast\defs\13063000\aswCmnOS.dll
18:54:44.0302 5492 C:\Program Files\AVAST Software\Avast\defs\13063000\aswCmnOS.dll - ok
18:54:44.0302 5492 [ 603103B004A4335713C962A2442C01C5 ] C:\Program Files\AVAST Software\Avast\defs\13063000\aswCmnBS.dll
18:54:44.0302 5492 C:\Program Files\AVAST Software\Avast\defs\13063000\aswCmnBS.dll - ok
18:54:44.0317 5492 [ B0D12F4344EB2AE96E487D2DF6F74413 ] C:\Windows\System32\FWPUCLNT.DLL
18:54:44.0317 5492 C:\Windows\System32\FWPUCLNT.DLL - ok
18:54:44.0317 5492 [ F0A7639DE0A66BBB92E8912CDEB1A567 ] C:\Program Files\AVAST Software\Avast\defs\13063000\aswScan.dll
18:54:44.0317 5492 C:\Program Files\AVAST Software\Avast\defs\13063000\aswScan.dll - ok
18:54:44.0317 5492 [ 32ED62D8C410117E09B0B7CA44FC4456 ] C:\Program Files\AVAST Software\Avast\defs\13063000\aswRep.dll
18:54:44.0317 5492 C:\Program Files\AVAST Software\Avast\defs\13063000\aswRep.dll - ok
18:54:44.0333 5492 [ 35F376253F687BDE63976CCB3F2108CA ] C:\Windows\System32\drivers\bowser.sys
18:54:44.0333 5492 C:\Windows\System32\drivers\bowser.sys - ok
18:54:44.0333 5492 [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] C:\Windows\System32\drivers\mpsdrv.sys
18:54:44.0333 5492 C:\Windows\System32\drivers\mpsdrv.sys - ok
18:54:44.0349 5492 [ 5DE62C6E9108F14F6794060A9BDECAEC ] C:\Windows\System32\MPSSVC.dll
18:54:44.0349 5492 C:\Windows\System32\MPSSVC.dll - ok
18:54:44.0349 5492 [ 82CEA0395524AACFEB58BA1448E8325C ] C:\Windows\System32\drivers\mrxdav.sys
18:54:44.0349 5492 C:\Windows\System32\drivers\mrxdav.sys - ok
18:54:44.0349 5492 [ 2399F8068E969D9C25A05B6F779A790A ] C:\Program Files\AVAST Software\Avast\defs\13063000\aswFiDb.dll
18:54:44.0349 5492 C:\Program Files\AVAST Software\Avast\defs\13063000\aswFiDb.dll - ok
18:54:44.0364 5492 [ 1E94971C4B446AB2290DEB71D01CF0C2 ] C:\Windows\System32\drivers\mrxsmb.sys
18:54:44.0364 5492 C:\Windows\System32\drivers\mrxsmb.sys - ok
18:54:44.0364 5492 [ 4FCCB34D793B116423209C0F8B7A3B03 ] C:\Windows\System32\drivers\mrxsmb10.sys
18:54:44.0364 5492 C:\Windows\System32\drivers\mrxsmb10.sys - ok
18:54:44.0380 5492 [ C3CB1B40AD4A0124D617A1199B0B9D7C ] C:\Windows\System32\drivers\mrxsmb20.sys
18:54:44.0380 5492 C:\Windows\System32\drivers\mrxsmb20.sys - ok
18:54:44.0380 5492 [ FF33AFF99564B1AA534F58868CBE41EF ] C:\Windows\System32\drivers\srv2.sys
18:54:44.0380 5492 C:\Windows\System32\drivers\srv2.sys - ok
18:54:44.0380 5492 [ 41987F9FC0E61ADF54F581E15029AD91 ] C:\Windows\System32\drivers\srv.sys
18:54:44.0380 5492 C:\Windows\System32\drivers\srv.sys - ok
18:54:44.0395 5492 [ 8F7C21DDD16002943ECD371C74FD8B38 ] C:\Program Files\AVAST Software\Avast\defs\13063000\algo.dll
18:54:44.0395 5492 C:\Program Files\AVAST Software\Avast\defs\13063000\algo.dll - ok
18:54:44.0395 5492 [ 0745D6EAD386710110817FBEC03F5161 ] C:\Windows\System32\wfapigp.dll
18:54:44.0395 5492 C:\Windows\System32\wfapigp.dll - ok
18:54:44.0411 5492 [ 5F1DEC3824E566457F53F24F493FEF08 ] C:\Windows\System32\mscms.dll
18:54:44.0411 5492 C:\Windows\System32\mscms.dll - ok
18:54:44.0411 5492 [ 1311171CF8F6D2954441EF2A42693035 ] C:\Windows\System32\WsmRes.dll
18:54:44.0411 5492 C:\Windows\System32\WsmRes.dll - ok
18:54:44.0411 5492 [ BA22D16186D770B3E23F514352E1097F ] C:\Windows\System32\rsmsink.exe
18:54:44.0411 5492 C:\Windows\System32\rsmsink.exe - ok
18:54:44.0427 5492 [ E230F3776F373F4C5E788794B53101E4 ] C:\Windows\System32\plasrv.exe
18:54:44.0427 5492 C:\Windows\System32\plasrv.exe - ok
18:54:44.0427 5492 [ C1DD6288ABA16EECBA39C3299C4040FE ] C:\Program Files\AVAST Software\Avast\Setup\setiface.dll
18:54:44.0427 5492 C:\Program Files\AVAST Software\Avast\Setup\setiface.dll - ok
18:54:44.0442 5492 [ A9542FF2E9A82CF100E5729EC79068F0 ] C:\Windows\System32\fltLib.dll
18:54:44.0442 5492 C:\Windows\System32\fltLib.dll - ok
18:54:44.0442 5492 [ E385B9E07B08C3F686B45D52C9F5A9B9 ] C:\Program Files\AVAST Software\Avast\AhResBhv.dll
18:54:44.0442 5492 C:\Program Files\AVAST Software\Avast\AhResBhv.dll - ok
18:54:44.0458 5492 [ E28034BDEDD48E44C889FF40C462005D ] C:\Program Files\AVAST Software\Avast\AhResJs.dll
18:54:44.0458 5492 C:\Program Files\AVAST Software\Avast\AhResJs.dll - ok
18:54:44.0458 5492 [ B20C06BDE50900C33CEE861E5B288ABF ] C:\Program Files\AVAST Software\Avast\AhResMai.dll
18:54:44.0458 5492 C:\Program Files\AVAST Software\Avast\AhResMai.dll - ok
18:54:44.0473 5492 [ DAC5B3F300E08EFA9782F6DD0E4A9FDA ] C:\Program Files\AVAST Software\Avast\AhResMes.dll
18:54:44.0473 5492 C:\Program Files\AVAST Software\Avast\AhResMes.dll - ok
18:54:44.0489 5492 [ 5B07E1B2414CE6A7F8942493F194B697 ] C:\Program Files\AVAST Software\Avast\AhResNS.dll
18:54:44.0489 5492 C:\Program Files\AVAST Software\Avast\AhResNS.dll - ok
18:54:44.0489 5492 [ F9AA8285BE0CCB3BDD77549DFC817423 ] C:\Program Files\AVAST Software\Avast\AhResP2P.dll
18:54:44.0489 5492 C:\Program Files\AVAST Software\Avast\AhResP2P.dll - ok
18:54:44.0505 5492 [ 90622E62EABD12FFEACEF083E765707C ] C:\Program Files\AVAST Software\Avast\AhResStd.dll
18:54:44.0505 5492 C:\Program Files\AVAST Software\Avast\AhResStd.dll - ok
18:54:44.0520 5492 [ B7F721185071CF20CAB25CC2869BE0C2 ] C:\Program Files\AVAST Software\Avast\AhResWS.dll
18:54:44.0520 5492 C:\Program Files\AVAST Software\Avast\AhResWS.dll - ok
18:54:44.0520 5492 [ 17C0E094BEE5BC03CF491972F71AA6EF ] C:\Windows\System32\wlanapi.dll
18:54:44.0520 5492 C:\Windows\System32\wlanapi.dll - ok
18:54:44.0536 5492 [ E98E402067978DB38282158F9E8609CA ] C:\Windows\System32\netshell.dll
18:54:44.0536 5492 C:\Windows\System32\netshell.dll - ok
18:54:44.0551 5492 [ 5D95FBFFCADED2660663EA3FAF3C00DA ] C:\Program Files\AVAST Software\Avast\defs\13063000\aswAR.dll
18:54:44.0551 5492 C:\Program Files\AVAST Software\Avast\defs\13063000\aswAR.dll - ok
18:54:44.0551 5492 [ 1EC4FB3EE4185A22E2869C66A6E6E8ED ] C:\Program Files\AVAST Software\Avast\defs\13063000\aswRawFS.dll
18:54:44.0551 5492 C:\Program Files\AVAST Software\Avast\defs\13063000\aswRawFS.dll - ok
18:54:44.0567 5492 [ C411C80F90D6732380352B98B37BBD53 ] C:\Windows\System32\winrnr.dll
18:54:44.0567 5492 C:\Windows\System32\winrnr.dll - ok
18:54:44.0567 5492 [ 40947436A70E0034E41123DF5A0A7702 ] C:\Program Files\Bonjour\mdnsNSP.dll
18:54:44.0567 5492 C:\Program Files\Bonjour\mdnsNSP.dll - ok
18:54:44.0583 5492 [ 10AA3E99691C9782308A4768F0485D8D ] C:\Program Files\AVAST Software\Avast\aswPatchMgt.dll
18:54:44.0583 5492 C:\Program Files\AVAST Software\Avast\aswPatchMgt.dll - ok
18:54:44.0598 5492 [ A7D525E5C0D91C8C1D84C6BCD25AD77D ] C:\Windows\System32\rasadhlp.dll
18:54:44.0598 5492 C:\Windows\System32\rasadhlp.dll - ok
18:54:44.0598 5492 [ E2479E294B30A70E19E99995FEEE7789 ] C:\Program Files\AVAST Software\Avast\defs\13063000\swhealthex.dll
18:54:44.0598 5492 C:\Program Files\AVAST Software\Avast\defs\13063000\swhealthex.dll - ok
18:54:44.0614 5492 [ A324D72A06C110152E7607745F39BFA1 ] C:\Windows\System32\netmsg.dll
18:54:44.0614 5492 C:\Windows\System32\netmsg.dll - ok
18:54:44.0629 5492 [ D333058925CE305E39DE8D5AD2B52A46 ] C:\Windows\System32\clusapi.dll
18:54:44.0629 5492 C:\Windows\System32\clusapi.dll - ok
18:54:44.0629 5492 [ 452341E471D2D961229DFE0842957272 ] C:\Windows\System32\sscore.dll
18:54:44.0629 5492 C:\Windows\System32\sscore.dll - ok
18:54:44.0645 5492 [ 6468C3FF6D0C7874FA8C619AF3E23B22 ] C:\Windows\System32\activeds.dll
18:54:44.0645 5492 C:\Windows\System32\activeds.dll - ok
18:54:44.0645 5492 [ E9B9C1B98C8D6D48407E1C1203EAC659 ] C:\Windows\System32\adsldpc.dll
18:54:44.0645 5492 C:\Windows\System32\adsldpc.dll - ok
18:54:44.0661 5492 [ 93E317D7AD783D8EAEE2E3500BFE889D ] C:\Windows\System32\credui.dll
18:54:44.0661 5492 C:\Windows\System32\credui.dll - ok
18:54:44.0676 5492 [ B9F3FF52B84FD9E3CAFB29B8EE385E5B ] C:\Windows\System32\resutils.dll
18:54:44.0676 5492 C:\Windows\System32\resutils.dll - ok
18:54:44.0676 5492 [ 5EC8FB83F31AA2D6F421F02C3F4F4475 ] C:\Windows\System32\winspool.drv
18:54:44.0676 5492 C:\Windows\System32\winspool.drv - ok
18:54:44.0692 5492 [ 63396CBB1365769D520E0FD89C2419F2 ] C:\Windows\System32\localspl.dll
18:54:44.0692 5492 C:\Windows\System32\localspl.dll - ok
18:54:44.0692 5492 [ 8598C2AE3A7C7281B1290297C7CCFD57 ] C:\Program Files\AVAST Software\Avast\Setup\avast.setup
18:54:44.0692 5492 C:\Program Files\AVAST Software\Avast\Setup\avast.setup - ok
18:54:44.0692 5492 [ F4E1AA5D59C849A4AB47E895DC76B9C8 ] C:\Windows\System32\sfc.dll
18:54:44.0692 5492 C:\Windows\System32\sfc.dll - ok
18:54:44.0707 5492 [ 0264E74C080A52D0DF1272FEFC44A92C ] C:\Windows\System32\CNMLMA0.DLL
18:54:44.0707 5492 C:\Windows\System32\CNMLMA0.DLL - ok
18:54:44.0707 5492 [ 04ED6818993ACA2EF887E2246B21CB66 ] C:\Windows\System32\CNMLM95.DLL
18:54:44.0707 5492 C:\Windows\System32\CNMLM95.DLL - ok
18:54:44.0707 5492 [ 4C0EA0EF66573C26984D508D4C152EE7 ] C:\Windows\System32\CNMNPPM.DLL
18:54:44.0707 5492 C:\Windows\System32\CNMNPPM.DLL - ok
18:54:44.0723 5492 [ 4BAB0D62FABAEE4ED54E921442D61DE0 ] C:\Windows\System32\CNCF2Le.DLL
18:54:44.0723 5492 C:\Windows\System32\CNCF2Le.DLL - ok
18:54:44.0723 5492 [ 49BBD258D07BB53C5F3584437FA1AD9C ] C:\Windows\System32\dopdfmn7.dll
18:54:44.0723 5492 C:\Windows\System32\dopdfmn7.dll - ok
18:54:44.0739 5492 [ 80BD4B26E2CBC0D65445D0463DFF6FC2 ] C:\Windows\System32\oledlg.dll
18:54:44.0739 5492 C:\Windows\System32\oledlg.dll - ok
18:54:44.0739 5492 [ 1DACD1530C6E58AEAE9F6DE7DA851935 ] C:\Windows\System32\shimeng.dll
18:54:44.0739 5492 C:\Windows\System32\shimeng.dll - ok
18:54:44.0739 5492 [ FD647CA82ACF232DBE5F20345647B948 ] C:\Windows\AppPatch\AcGenral.dll
18:54:44.0739 5492 C:\Windows\AppPatch\AcGenral.dll - ok
18:54:44.0754 5492 [ 9B96F6952186336CC6E3D4E08BE2E0AF ] C:\Windows\System32\dwmapi.dll
18:54:44.0754 5492 C:\Windows\System32\dwmapi.dll - ok
18:54:44.0754 5492 [ 12BCF4DAD8E5A1B3D5FA7AB4A79DA105 ] C:\Windows\System32\sfc_os.dll
18:54:44.0754 5492 C:\Windows\System32\sfc_os.dll - ok
18:54:44.0754 5492 [ C52CE534397E1D3A442FB4C88A3CBE42 ] C:\Windows\System32\msonpmon.dll
18:54:44.0754 5492 C:\Windows\System32\msonpmon.dll - ok
18:54:44.0770 5492 [ C9564CF4976E7E96B4052737AA2492B4 ] C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcr80.dll
18:54:44.0770 5492 C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcr80.dll - ok
18:54:44.0770 5492 [ 401DFFDBBBD3F07C747ED1AE2BB88106 ] C:\Windows\System32\msi.dll
18:54:44.0770 5492 C:\Windows\System32\msi.dll - ok
18:54:44.0785 5492 [ AF24A9DF84637BF9858EC6FB88EBA7B2 ] C:\Windows\System32\snmpapi.dll
18:54:44.0785 5492 C:\Windows\System32\snmpapi.dll - ok
18:54:44.0785 5492 [ BB0EB921877A1A7EF15AE2D97A71CBA9 ] C:\Windows\System32\tcpmon.dll
18:54:44.0785 5492 C:\Windows\System32\tcpmon.dll - ok
18:54:44.0785 5492 [ 1EDE113859276E4B0F19B80F39E2CC95 ] C:\Windows\System32\wsnmp32.dll
18:54:44.0785 5492 C:\Windows\System32\wsnmp32.dll - ok
18:54:44.0801 5492 [ B4F5DE3DAD8E6B97272F45DB97674878 ] C:\Windows\System32\mgmtapi.dll
18:54:44.0801 5492 C:\Windows\System32\mgmtapi.dll - ok
18:54:44.0801 5492 [ 5091452DC719281CF1DD69367E13B494 ] C:\Windows\System32\tcpmib.dll
18:54:44.0801 5492 C:\Windows\System32\tcpmib.dll - ok
18:54:44.0801 5492 [ 0BF0BB276F17B6AD61A8694D2551EC28 ] C:\Windows\System32\usbmon.dll
18:54:44.0801 5492 C:\Windows\System32\usbmon.dll - ok
18:54:44.0817 5492 [ 0EB1CC5EBFCAAB7DBAEE881E2887F7F9 ] C:\Windows\System32\WSDMon.dll
18:54:44.0817 5492 C:\Windows\System32\WSDMon.dll - ok
18:54:44.0817 5492 [ 1A09CB187440993FA5E24DE1EEB7B916 ] C:\Windows\System32\cfgmgr32.dll
18:54:44.0817 5492 C:\Windows\System32\cfgmgr32.dll - ok
18:54:44.0832 5492 [ F86293D93760C70ADF4F19E66E3FA5E8 ] C:\Windows\System32\httpapi.dll
18:54:44.0832 5492 C:\Windows\System32\httpapi.dll - ok
18:54:44.0832 5492 [ AD48183027CAFCEBC322CB9CAC60F9B8 ] C:\Windows\System32\WSDApi.dll
18:54:44.0832 5492 C:\Windows\System32\WSDApi.dll - ok
18:54:44.0832 5492 [ 4EDA94333BDB75B1BC0A7610BED34F00 ] C:\Windows\System32\fundisc.dll
18:54:44.0832 5492 C:\Windows\System32\fundisc.dll - ok
18:54:44.0848 5492 [ 6ABD253226770EAE1292B4C945ED4B4B ] C:\Windows\System32\msxml3.dll
18:54:44.0848 5492 C:\Windows\System32\msxml3.dll - ok
18:54:44.0848 5492 [ 428AC07A4F033D592C754CD6C2F6AB86 ] C:\Windows\System32\spool\prtprocs\w32x86\CNMPD95.DLL
18:54:44.0848 5492 C:\Windows\System32\spool\prtprocs\w32x86\CNMPD95.DLL - ok
18:54:44.0848 5492 [ F4BF27A9DBB69FDC3D19C2BEC1A7FA9C ] C:\Windows\System32\spool\prtprocs\w32x86\CNMPDA0.DLL
18:54:44.0848 5492 C:\Windows\System32\spool\prtprocs\w32x86\CNMPDA0.DLL - ok
18:54:44.0863 5492 [ F348280907B38FDBDB3CEF55D456E149 ] C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
18:54:44.0863 5492 C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll - ok
18:54:44.0863 5492 [ A4E7946B71BBDF8708C7AC97FD9E9008 ] C:\Windows\System32\win32spl.dll
18:54:44.0863 5492 C:\Windows\System32\win32spl.dll - ok
18:54:44.0879 5492 [ 4BF053944E973C073339BE841C9ECF28 ] C:\Windows\System32\netrap.dll
18:54:44.0879 5492 C:\Windows\System32\netrap.dll - ok
18:54:44.0879 5492 [ 2D3D47B93E0BE86EEBB261734AB5B6A1 ] C:\Windows\System32\printcom.dll
18:54:44.0879 5492 C:\Windows\System32\printcom.dll - ok
18:54:44.0879 5492 [ EC760B0B76A4353DE49D66520EB2141F ] C:\Windows\System32\SensApi.dll
18:54:44.0879 5492 C:\Windows\System32\SensApi.dll - ok
18:54:44.0895 5492 [ 2E8E30F3B318A9FDA5A2485723F4C2B3 ] C:\Windows\System32\inetpp.dll
18:54:44.0895 5492 C:\Windows\System32\inetpp.dll - ok
18:54:44.0895 5492 [ 0FA9B5055484649D63C303FE404E5F4D ] C:\Windows\System32\drivers\parport.sys
18:54:44.0895 5492 C:\Windows\System32\drivers\parport.sys - ok
18:54:44.0895 5492 [ 4FE5C6D40664AE07BE5105874357D2ED ] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
18:54:44.0895 5492 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe - ok
18:54:44.0910 5492 [ DFAE18C675D71FD06D57DC69D2913975 ] C:\Windows\System32\inetsrv\apphostsvc.dll
18:54:44.0910 5492 C:\Windows\System32\inetsrv\apphostsvc.dll - ok
18:54:44.0910 5492 [ 52ECAE4129916223A7C4FAB216D43BF8 ] C:\Windows\System32\inetsrv\iisutil.dll
18:54:44.0910 5492 C:\Windows\System32\inetsrv\iisutil.dll - ok
18:54:44.0926 5492 [ F34C83591C0E70E3E434F312EDCD6B72 ] C:\Windows\System32\inetsrv\nativerd.dll
18:54:44.0926 5492 C:\Windows\System32\inetsrv\nativerd.dll - ok
18:54:44.0926 5492 [ 17FC3EDA0162F513E858B8C8FA7FA6E0 ] C:\Windows\System32\vssapi.dll
18:54:44.0926 5492 C:\Windows\System32\vssapi.dll - ok
18:54:44.0926 5492 [ 0B3595A4FF0B36D68E5FC67FD7D70FDC ] C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcp80.dll
18:54:44.0926 5492 C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcp80.dll - ok
18:54:44.0941 5492 [ 80942B137077DA7D2375B3041DA9127F ] C:\Program Files\Common Files\Apple\Apple Application Support\AppleVersions.dll
18:54:44.0941 5492 C:\Program Files\Common Files\Apple\Apple Application Support\AppleVersions.dll - ok
18:54:44.0941 5492 [ 6D41F6AA35220E7A54543075B27E8F83 ] C:\Program Files\Common Files\Apple\Apple Application Support\YSCrashDump.dll
18:54:44.0941 5492 C:\Program Files\Common Files\Apple\Apple Application Support\YSCrashDump.dll - ok
18:54:44.0957 5492 [ DC3AE9F1554DCD97F90983DDBDACD83D ] C:\Windows\System32\vsstrace.dll
18:54:44.0957 5492 C:\Windows\System32\vsstrace.dll - ok
18:54:44.0957 5492 [ 6953E980ADCA0BE816C7FF463695499A ] C:\Program Files\Common Files\Apple\Apple Application Support\CoreFoundation.dll
18:54:44.0957 5492 C:\Program Files\Common Files\Apple\Apple Application Support\CoreFoundation.dll - ok
18:54:44.0957 5492 [ 15530639789C990827E594344EACC465 ] C:\Program Files\Common Files\Apple\Apple Application Support\pthreadVC2.dll
18:54:44.0957 5492 C:\Program Files\Common Files\Apple\Apple Application Support\pthreadVC2.dll - ok
18:54:44.0973 5492 [ 3EB6D30D82F0E300FCFBAD0498F654FD ] C:\Windows\System32\mlang.dll
18:54:44.0973 5492 C:\Windows\System32\mlang.dll - ok
18:54:44.0988 5492 [ 78865ABC5F5D13190F8B35BD9044714A ] C:\Program Files\Common Files\Apple\Apple Application Support\objc.dll
18:54:44.0988 5492 C:\Program Files\Common Files\Apple\Apple Application Support\objc.dll - ok
18:54:44.0988 5492 [ FF9831030678C7B6D70BAC00F68F8976 ] C:\Program Files\Common Files\Apple\Apple Application Support\libdispatch.dll
18:54:44.0988 5492 C:\Program Files\Common Files\Apple\Apple Application Support\libdispatch.dll - ok
18:54:45.0004 5492 [ E5B6D88B36BDDAD5039764FBF80284DD ] C:\Program Files\Common Files\Apple\Apple Application Support\libicuin.dll
18:54:45.0004 5492 C:\Program Files\Common Files\Apple\Apple Application Support\libicuin.dll - ok
18:54:45.0019 5492 [ 1D75BC73585969F41BA7EF0C882DFF2B ] C:\Program Files\Common Files\Apple\Apple Application Support\libicuuc.dll
18:54:45.0019 5492 C:\Program Files\Common Files\Apple\Apple Application Support\libicuuc.dll - ok
18:54:45.0019 5492 [ FC7A868DECC3AB027F29178EC8A7F252 ] C:\Program Files\Common Files\Apple\Apple Application Support\icudt46.dll
18:54:45.0019 5492 C:\Program Files\Common Files\Apple\Apple Application Support\icudt46.dll - ok
18:54:45.0035 5492 [ F6FD367C9EAAEDF90CD7A7952AE0B336 ] C:\Program Files\Common Files\Apple\Apple Application Support\ASL.dll
18:54:45.0035 5492 C:\Program Files\Common Files\Apple\Apple Application Support\ASL.dll - ok
18:54:45.0051 5492 [ 4327CF9A9D0864CA0FFC97FCDA97315A ] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService_main.dll
18:54:45.0051 5492 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService_main.dll - ok
18:54:45.0051 5492 [ 062373995EAE5F0EAC9EAA9192136BFB ] C:\Windows\System32\dnssd.dll
18:54:45.0051 5492 C:\Windows\System32\dnssd.dll - ok
18:54:45.0066 5492 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] C:\Program Files\Bonjour\mDNSResponder.exe
18:54:45.0066 5492 C:\Program Files\Bonjour\mDNSResponder.exe - ok
18:54:45.0082 5492 [ 24665B221424FFD7B71F0D2C398F2F4F ] C:\Program Files\Common Files\Apple\Mobile Device Support\MobileDevice.dll
18:54:45.0082 5492 C:\Program Files\Common Files\Apple\Mobile Device Support\MobileDevice.dll - ok
18:54:45.0082 5492 [ B458B58F7BB97C48D01AC3CF5805AAAC ] C:\Windows\System32\Query.dll
18:54:45.0082 5492 C:\Windows\System32\Query.dll - ok
18:54:45.0097 5492 [ A84509C6AB1C764C592F192AA89DA830 ] C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
18:54:45.0097 5492 C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll - ok
18:54:45.0113 5492 [ 52E129522C1775DBB8CC252E7A0655C7 ] C:\Windows\System32\taskschd.dll
18:54:45.0113 5492 C:\Windows\System32\taskschd.dll - ok
18:54:45.0113 5492 [ E7D0F91E44D9D3B2116FA549BDCDB756 ] C:\Windows\System32\wdscore.dll
18:54:45.0113 5492 C:\Windows\System32\wdscore.dll - ok
18:54:45.0129 5492 [ 9340105C246B16EE661FD8FCE579B117 ] C:\Windows\System32\cryptnet.dll
18:54:45.0129 5492 C:\Windows\System32\cryptnet.dll - ok
18:54:45.0129 5492 [ 7ADD03E75BEB9E6DD102C3081D29840A ] C:\Windows\System32\drivers\cdfs.sys
18:54:45.0129 5492 C:\Windows\System32\drivers\cdfs.sys - ok
18:54:45.0144 5492 [ 87365FFA68CFFAF6E260677FF0ACFE7C ] C:\Program Files\Common Files\LightScribe\LSSProxy.dll
18:54:45.0144 5492 C:\Program Files\Common Files\LightScribe\LSSProxy.dll - ok
18:54:45.0144 5492 [ 75AC54B996F7C8E17594EBC32B6614BD ] C:\Program Files\Common Files\LightScribe\LSSrvc.exe
18:54:45.0144 5492 C:\Program Files\Common Files\LightScribe\LSSrvc.exe - ok
18:54:45.0160 5492 [ A7DDDDE163F16AB49DF3DE9EEC715495 ] C:\Program Files\Common Files\Apple\Apple Application Support\CFNetwork.dll
18:54:45.0160 5492 C:\Program Files\Common Files\Apple\Apple Application Support\CFNetwork.dll - ok
18:54:45.0160 5492 [ 1CB81B6BD906BDA8A3A95E30B626B710 ] C:\Program Files\Common Files\LightScribe\LSLog.dll
18:54:45.0160 5492 C:\Program Files\Common Files\LightScribe\LSLog.dll - ok
18:54:45.0175 5492 [ 1DFC366D2154EF2B381A7F2CB165C7F4 ] C:\Windows\System32\diagperf.dll
18:54:45.0175 5492 C:\Windows\System32\diagperf.dll - ok
18:54:45.0175 5492 [ 0CEA2D0D3FA284B85ED5B68365114F76 ] C:\Windows\System32\drivers\mdmxsdk.sys
18:54:45.0175 5492 C:\Windows\System32\drivers\mdmxsdk.sys - ok
18:54:45.0191 5492 [ F4D9ED6BD74AD7CC0BEC83C43A1CB76B ] C:\Windows\System32\ncsi.dll
18:54:45.0191 5492 C:\Windows\System32\ncsi.dll - ok
18:54:45.0207 5492 [ 01BCD91CC2B0EFDA4890F547010750BD ] C:\Windows\System32\ssdpapi.dll
18:54:45.0207 5492 C:\Windows\System32\ssdpapi.dll - ok
18:54:45.0207 5492 [ 6349F6ED9C623B44B52EA3C63C831A92 ] C:\Windows\System32\drivers\PEAuth.sys
18:54:45.0207 5492 C:\Windows\System32\drivers\PEAuth.sys - ok
18:54:45.0222 5492 [ D0494460421A03CD5225CCA0059AA146 ] C:\Windows\System32\IPSECSVC.DLL
18:54:45.0222 5492 C:\Windows\System32\IPSECSVC.DLL - ok
18:54:45.0222 5492 [ 90A3935D05B494A5A39D37E71F09A677 ] C:\Windows\System32\drivers\secdrv.sys
18:54:45.0222 5492 C:\Windows\System32\drivers\secdrv.sys - ok
18:54:45.0222 5492 [ A275FBB7C99458C12E088DFF3E58EB4D ] C:\Windows\System32\TCPSVCS.EXE
18:54:45.0222 5492 C:\Windows\System32\TCPSVCS.EXE - ok
18:54:45.0238 5492 [ 608C345A255D82A6289C2D468EB41FD7 ] C:\Windows\System32\drivers\tcpipreg.sys
18:54:45.0238 5492 C:\Windows\System32\drivers\tcpipreg.sys - ok
18:54:45.0238 5492 [ 42608AE9AF2641EE473A1797C25CFFC2 ] C:\Windows\System32\FwRemoteSvr.dll
18:54:45.0238 5492 C:\Windows\System32\FwRemoteSvr.dll - ok
18:54:45.0253 5492 [ 0C84B6AFFA7486422235584110D7176F ] C:\Windows\System32\icaapi.dll
18:54:45.0253 5492 C:\Windows\System32\icaapi.dll - ok
18:54:45.0253 5492 [ 428FF21418ADCD6FAD6189CD9520A67B ] C:\Windows\System32\wiatrace.dll
18:54:45.0253 5492 C:\Windows\System32\wiatrace.dll - ok
18:54:45.0269 5492 [ 4DBA143F06BAD1DF935CB9603140CF2A ] C:\Windows\System32\wsdchngr.dll
18:54:45.0269 5492 C:\Windows\System32\wsdchngr.dll - ok
18:54:45.0285 5492 [ 92E6CA0178E105EEC8A0DF2D7DE82EEB ] C:\Windows\System32\inetsrv\httpmib.dll
18:54:45.0285 5492 C:\Windows\System32\inetsrv\httpmib.dll - ok
18:54:45.0285 5492 [ 8E0F7A0A9ADFAB75699276961435EEA6 ] C:\Windows\System32\evntagnt.dll
18:54:45.0285 5492 C:\Windows\System32\evntagnt.dll - ok
18:54:45.0300 5492 [ CDF6950048B056F43CCDD03A0DC72385 ] C:\Windows\System32\hostmib.dll
18:54:45.0300 5492 C:\Windows\System32\hostmib.dll - ok
18:54:45.0300 5492 [ 12E8A79644955A6D1D371CBD7DA7C871 ] C:\Windows\System32\inetmib1.dll
18:54:45.0300 5492 C:\Windows\System32\inetmib1.dll - ok
18:54:45.0316 5492 [ B7CC006AB21B7826B3A58C0C408BA9D2 ] C:\Windows\System32\snmpmib.dll
18:54:45.0316 5492 C:\Windows\System32\snmpmib.dll - ok
18:54:45.0331 5492 [ 21322832C99E8DE85BD047689A2A69DB ] C:\Windows\System32\pnpts.dll
18:54:45.0331 5492 C:\Windows\System32\pnpts.dll - ok
18:54:45.0331 5492 [ 0A855F27A1E48991D14C593CB930D2B2 ] C:\Program Files\Common Files\Apple\Apple Application Support\SQLite3.dll
18:54:45.0331 5492 C:\Program Files\Common Files\Apple\Apple Application Support\SQLite3.dll - ok
18:54:45.0347 5492 [ E8F932E855CBF23ED4632439A35E7354 ] C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
18:54:45.0347 5492 C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll - ok
18:54:45.0363 5492 [ 7A27399C36A9B1DA132DCE91A41A0B77 ] C:\Windows\System32\lmmib2.dll
18:54:45.0363 5492 C:\Windows\System32\lmmib2.dll - ok
18:54:45.0363 5492 [ 137B36FFED1BE31BA64BF7872460B5D4 ] C:\Windows\System32\CNC700C.DLL
18:54:45.0363 5492 C:\Windows\System32\CNC700C.DLL - ok
18:54:45.0378 5492 [ 5851854931789774202C5968BBFB3D59 ] C:\Windows\System32\CNC700L.DLL
18:54:45.0378 5492 C:\Windows\System32\CNC700L.DLL - ok
18:54:45.0378 5492 [ 76783FCB42E603A5839E33E97130D02D ] C:\Windows\System32\CNC560C.dll
18:54:45.0378 5492 C:\Windows\System32\CNC560C.dll - ok
18:54:45.0394 5492 [ 28DAFF4640FE4AB37BA90A91AB4CB51E ] C:\Windows\twain_32\MX700 series\USDRESUS.DLL
18:54:45.0394 5492 C:\Windows\twain_32\MX700 series\USDRESUS.DLL - ok
18:54:45.0409 5492 [ 91BBA91FC550A18FFACB8F82E9D6C837 ] C:\Windows\System32\CNC560L.dll
18:54:45.0409 5492 C:\Windows\System32\CNC560L.dll - ok
18:54:45.0409 5492 [ A8F2F04937360EA80A766A4757F1B2CE ] C:\Windows\twain_32\MP560 series\SG_ENU.dll
18:54:45.0409 5492 C:\Windows\twain_32\MP560 series\SG_ENU.dll - ok
18:54:45.0425 5492 [ D16CF34B17899F90A8FCF2A3F77B4A27 ] C:\Windows\System32\CNHMCA.dll
18:54:45.0425 5492 C:\Windows\System32\CNHMCA.dll - ok
18:54:45.0425 5492 [ 4F887D2C0362E1B4183139A5EB926A50 ] C:\Program Files\Updater By SweetPacks\ExtensionUpdaterService.exe
18:54:45.0441 5492 C:\Program Files\Updater By SweetPacks\ExtensionUpdaterService.exe - ok
18:54:45.0441 5492 [ 9CA92191C8F18E8B491A5B28E63C07B7 ] C:\Windows\System32\inetsrv\iisw3adm.dll
18:54:45.0441 5492 C:\Windows\System32\inetsrv\iisw3adm.dll - ok
18:54:45.0456 5492 [ DA152F2672E0FF2E353C72992ABB8A7A ] C:\Windows\System32\inetsrv\w3tp.dll
18:54:45.0456 5492 C:\Windows\System32\inetsrv\w3tp.dll - ok
18:54:45.0456 5492 [ 74B8C2EA72D43727142D12397D5A49F9 ] C:\Windows\System32\wbemcomn.dll
18:54:45.0456 5492 C:\Windows\System32\wbemcomn.dll - ok
18:54:45.0472 5492 [ 2205A220A264E8C8B86492BF3D112907 ] C:\Windows\System32\PortableDeviceApi.dll
18:54:45.0472 5492 C:\Windows\System32\PortableDeviceApi.dll - ok
18:54:45.0472 5492 [ DEB9D08750423069647C3A066CEC7A1B ] C:\Windows\System32\tquery.dll
18:54:45.0472 5492 C:\Windows\System32\tquery.dll - ok
18:54:45.0472 5492 [ 1F18B9EA1BBFF033413414C3BEA13AD6 ] C:\Windows\System32\wbem\WinMgmtR.dll
18:54:45.0472 5492 C:\Windows\System32\wbem\WinMgmtR.dll - ok
18:54:45.0487 5492 [ B53BD9E63867CD9FD853F666CA172713 ] C:\Windows\System32\PortableDeviceConnectApi.dll
18:54:45.0487 5492 C:\Windows\System32\PortableDeviceConnectApi.dll - ok
18:54:45.0487 5492 [ 867C301E8B790040AE9CF6486E8041DF ] C:\Windows\System32\drivers\WUDFRd.sys
18:54:45.0487 5492 C:\Windows\System32\drivers\WUDFRd.sys - ok
18:54:45.0487 5492 [ 218B73EA8341EA9FDF018D43052E790A ] C:\Windows\System32\mssrch.dll
18:54:45.0487 5492 C:\Windows\System32\mssrch.dll - ok
18:54:45.0503 5492 [ 3D50C4B10352367D5CB20ED1F50F8DA2 ] C:\Windows\System32\taskeng.exe
18:54:45.0503 5492 C:\Windows\System32\taskeng.exe - ok
18:54:45.0503 5492 [ 4934241CD20AC87D78121352E3BA8318 ] C:\Windows\System32\dbghelp.dll
18:54:45.0503 5492 C:\Windows\System32\dbghelp.dll - ok
18:54:45.0503 5492 [ CD5F291A1161F15896D1A4D63DAFF5DF ] C:\Windows\System32\drivers\XAudio.exe
18:54:45.0503 5492 C:\Windows\System32\drivers\XAudio.exe - ok
18:54:45.0519 5492 [ DAB33CFA9DD24251AAA389FF36B64D4B ] C:\Windows\System32\drivers\XAudio.sys
18:54:45.0519 5492 C:\Windows\System32\drivers\XAudio.sys - ok
18:54:45.0519 5492 [ AAB5FEAABF4CB6F76D794203831C8D94 ] C:\Windows\System32\msidle.dll
18:54:45.0519 5492 C:\Windows\System32\msidle.dll - ok
18:54:45.0519 5492 [ B11FDCA4410D6252964EF97F9A47DE74 ] C:\Windows\System32\TSChannel.dll
18:54:45.0519 5492 C:\Windows\System32\TSChannel.dll - ok
18:54:45.0534 5492 [ 4B555106290BD117334E9A08761C035A ] C:\Windows\System32\rundll32.exe
18:54:45.0534 5492 C:\Windows\System32\rundll32.exe - ok
18:54:45.0534 5492 [ D6804F089CBB6749E95124E7C4D80900 ] C:\Windows\AppPatch\AcLayers.dll
18:54:45.0534 5492 C:\Windows\AppPatch\AcLayers.dll - ok
18:54:45.0550 5492 [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] C:\Windows\System32\netprofm.dll
18:54:45.0550 5492 C:\Windows\System32\netprofm.dll - ok
18:54:45.0550 5492 [ BF7E4D6F60A6D9E866432855C6F8C262 ] C:\Windows\System32\sqmapi.dll
18:54:45.0550 5492 C:\Windows\System32\sqmapi.dll - ok
18:54:45.0550 5492 [ CD569FA91EC6F59D045C19D0D3850F44 ] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
18:54:45.0550 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe - ok
18:54:45.0565 5492 [ DFCAB29E8FD38F95650CC1E203E8D318 ] C:\Windows\System32\npmproxy.dll
18:54:45.0565 5492 C:\Windows\System32\npmproxy.dll - ok
18:54:45.0565 5492 [ 6BC5FCEF351E4CB5A269C1E84B5A06DA ] C:\Windows\System32\netcfgx.dll
18:54:45.0565 5492 C:\Windows\System32\netcfgx.dll - ok
18:54:45.0581 5492 [ 980B6A5F92B8DB235C4A26728C2BE732 ] C:\Windows\System32\WUDFHost.exe
18:54:45.0581 5492 C:\Windows\System32\WUDFHost.exe - ok
18:54:45.0581 5492 [ A952D0DED445F26AEFCF593A935AB300 ] C:\Windows\System32\hnetcfg.dll
18:54:45.0581 5492 C:\Windows\System32\hnetcfg.dll - ok
18:54:45.0581 5492 [ 295363D4317820AED0D527E15B90A8ED ] C:\Windows\System32\pdh.dll
18:54:45.0581 5492 C:\Windows\System32\pdh.dll - ok
18:54:45.0597 5492 [ A36F7A256E65D858A7039DB00ADEEBDD ] C:\Windows\System32\WUDFx.dll
18:54:45.0597 5492 C:\Windows\System32\WUDFx.dll - ok
18:54:45.0597 5492 [ 8A38B5E8493A9D103083B8620AC5F3A1 ] C:\Windows\System32\tdh.dll
18:54:45.0597 5492 C:\Windows\System32\tdh.dll - ok
18:54:45.0597 5492 [ 30F0DC266B46118E9FBCF5B2A30EB1DB ] C:\Windows\System32\wbem\wbemprox.dll
18:54:45.0597 5492 C:\Windows\System32\wbem\wbemprox.dll - ok
18:54:45.0612 5492 [ 119A487B94FCB54D5154EBFBFA124755 ] C:\Windows\System32\drivers\UMDF\WpdFs.dll
18:54:45.0612 5492 C:\Windows\System32\drivers\UMDF\WpdFs.dll - ok
18:54:45.0612 5492 [ D922592AB65C5D9B88B30B4510A3464E ] C:\Windows\System32\cscapi.dll
18:54:45.0612 5492 C:\Windows\System32\cscapi.dll - ok
18:54:45.0612 5492 [ 50ABE7CDA2DAE898216121D14092C182 ] C:\Windows\System32\WMVCORE.DLL
18:54:45.0612 5492 C:\Windows\System32\WMVCORE.DLL - ok
18:54:45.0628 5492 [ FC1EEE57EB9CD57279D70BA2A9131C38 ] C:\Windows\System32\wbem\wbemcore.dll
18:54:45.0628 5492 C:\Windows\System32\wbem\wbemcore.dll - ok
18:54:45.0628 5492 [ C10E13721B0AAEBEB5EBA914F1D18181 ] C:\Windows\System32\wbem\esscli.dll
18:54:45.0628 5492 C:\Windows\System32\wbem\esscli.dll - ok
18:54:45.0643 5492 [ BC5A34B6A14C93BF04E3F4E8EA57090A ] C:\Windows\System32\wbem\fastprox.dll
18:54:45.0643 5492 C:\Windows\System32\wbem\fastprox.dll - ok
18:54:45.0643 5492 [ 36CCD8A79539C4ACE3BABE09C2CFBA16 ] C:\Windows\System32\WMASF.DLL
18:54:45.0643 5492 C:\Windows\System32\WMASF.DLL - ok
18:54:45.0643 5492 [ B2B117BD8D1EA80536CDD91797EF4A0A ] C:\Windows\System32\PortableDeviceClassExtension.dll
18:54:45.0643 5492 C:\Windows\System32\PortableDeviceClassExtension.dll - ok
18:54:45.0659 5492 [ 834933F16EA839AC5AC7CBF88638DF27 ] C:\Windows\System32\wbem\repdrvfs.dll
18:54:45.0659 5492 C:\Windows\System32\wbem\repdrvfs.dll - ok
18:54:45.0659 5492 [ DB0F37DBA4C245C61E5936DDBDE62438 ] C:\Windows\System32\wbem\wbemsvc.dll
18:54:45.0659 5492 C:\Windows\System32\wbem\wbemsvc.dll - ok
18:54:45.0675 5492 [ 2C3B09E586BDA2CC49A292BE7BADC589 ] C:\Windows\System32\wbem\wmiutils.dll
18:54:45.0675 5492 C:\Windows\System32\wbem\wmiutils.dll - ok
18:54:45.0675 5492 [ 883D02AB5D350BC45E0F60E8CFA97FDC ] C:\Windows\System32\PortableDeviceTypes.dll
18:54:45.0675 5492 C:\Windows\System32\PortableDeviceTypes.dll - ok
18:54:45.0675 5492 [ 7D1A10A1F3562CCA1FD38E9BADA8FEC0 ] C:\Windows\System32\perfos.dll
18:54:45.0675 5492 C:\Windows\System32\perfos.dll - ok
18:54:45.0690 5492 [ C2C6C014B96581EC8BF0C8604DE1743E ] C:\Windows\System32\wbem\WmiPrvSD.dll
18:54:45.0690 5492 C:\Windows\System32\wbem\WmiPrvSD.dll - ok
18:54:45.0690 5492 [ A609A192E98934A8D352704C99AB8577 ] C:\Windows\System32\wbem\wbemess.dll
18:54:45.0690 5492 C:\Windows\System32\wbem\wbemess.dll - ok
18:54:45.0690 5492 [ B81388E9FE895065FD5CEAF3C11FDC3F ] C:\Windows\System32\ieframe.dll
18:54:45.0690 5492 C:\Windows\System32\ieframe.dll - ok
18:54:45.0706 5492 [ B8A21907FE2F1A113F3487D9AB60BEF9 ] C:\Windows\System32\en-US\tquery.dll.mui
18:54:45.0706 5492 C:\Windows\System32\en-US\tquery.dll.mui - ok
18:54:45.0706 5492 [ B288FF7C1987A736726E87C79148C360 ] C:\Windows\System32\PortableDeviceWiaCompat.dll
18:54:45.0706 5492 C:\Windows\System32\PortableDeviceWiaCompat.dll - ok
18:54:45.0721 5492 [ 22DC784B32BEE306A99F50D6DC2460BC ] C:\Windows\System32\esent.dll
18:54:45.0721 5492 C:\Windows\System32\esent.dll - ok
18:54:45.0721 5492 [ F85134BF76CB335A39F8D7BC4173D4FB ] C:\Windows\System32\msscb.dll
18:54:45.0721 5492 C:\Windows\System32\msscb.dll - ok
18:54:45.0721 5492 [ 75C1CA5B61414748CE9BCF3C7A52C39F ] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvclb.dll
18:54:45.0721 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvclb.dll - ok
18:54:45.0737 5492 [ 5CAAE5333EF36DB4A8D294418AB37E80 ] C:\Windows\System32\p2pcollab.dll
18:54:45.0737 5492 C:\Windows\System32\p2pcollab.dll - ok
18:54:45.0753 5492 [ 1F174A1BF0B7718ECB8D1821AD1D3166 ] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmagnt.dll
18:54:45.0753 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmagnt.dll - ok
18:54:45.0753 5492 [ 1D6B95871DC006190964B04E5657E35F ] C:\Windows\System32\rastapi.dll
18:54:45.0753 5492 C:\Windows\System32\rastapi.dll - ok
18:54:45.0768 5492 [ B96B60EC821F86D445C9739A0F3DED59 ] C:\Windows\System32\unimdm.tsp
18:54:45.0768 5492 C:\Windows\System32\unimdm.tsp - ok
18:54:45.0768 5492 [ 54E18ADDC60A2054CF99B2E847A6D378 ] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmcore.dll
18:54:45.0768 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmcore.dll - ok
18:54:45.0784 5492 [ DFBAADF1B624DC71E88D34D86B3595BE ] C:\Windows\System32\uniplat.dll
18:54:45.0784 5492 C:\Windows\System32\uniplat.dll - ok
18:54:45.0799 5492 [ 6BCBED73231F5D30B92DEE591B6679E9 ] C:\Program Files\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll
18:54:45.0799 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll - ok
18:54:45.0799 5492 [ B80933A7E3D63277A23F9882BF839DB5 ] C:\Program Files\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll
18:54:45.0799 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll - ok
18:54:45.0815 5492 [ 2E837F3D406224DF131C34BC8F71621E ] C:\Windows\System32\modemui.dll
18:54:45.0815 5492 C:\Windows\System32\modemui.dll - ok
18:54:45.0831 5492 [ 0B71899E60D1265229BF3D080EAB573D ] C:\Windows\System32\unimdmat.dll
18:54:45.0831 5492 C:\Windows\System32\unimdmat.dll - ok
18:54:45.0831 5492 [ DE35EFF35C9EB0B381709CF979537E2A ] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmrasv.dll
18:54:45.0831 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmrasv.dll - ok
18:54:45.0846 5492 [ 953193A9DEA40348C1086D171F6440AE ] C:\Windows\System32\kmddsp.tsp
18:54:45.0846 5492 C:\Windows\System32\kmddsp.tsp - ok
18:54:45.0862 5492 [ 2F6776ACEFE41EE889C464EA407918F2 ] C:\Windows\System32\ndptsp.tsp
18:54:45.0862 5492 C:\Windows\System32\ndptsp.tsp - ok
18:54:45.0862 5492 [ B4B59AC042EE3733A862F26CBC0B17FC ] C:\Windows\System32\hidphone.tsp
18:54:45.0862 5492 C:\Windows\System32\hidphone.tsp - ok
18:54:45.0877 5492 [ 9495FCC01D7AB7B60E5B8BA7AEFE9E3D ] C:\Windows\System32\wbem\WmiPrvSE.exe
18:54:45.0877 5492 C:\Windows\System32\wbem\WmiPrvSE.exe - ok
18:54:45.0877 5492 [ 8B645890A93F1FBBC7DA3E07CC72D762 ] C:\Windows\System32\rasppp.dll
18:54:45.0877 5492 C:\Windows\System32\rasppp.dll - ok
18:54:45.0893 5492 [ 56E315ACFB08A177B4D01E42B9044DB5 ] C:\Windows\System32\mprapi.dll
18:54:45.0893 5492 C:\Windows\System32\mprapi.dll - ok
18:54:45.0893 5492 [ 769D027B977CED05658C85E698D3C5B1 ] C:\Windows\System32\QUTIL.DLL
18:54:45.0893 5492 C:\Windows\System32\QUTIL.DLL - ok
18:54:45.0909 5492 [ 88225070DD2F7B0B2ED51E7935078641 ] C:\Windows\System32\rasqec.dll
18:54:45.0909 5492 C:\Windows\System32\rasqec.dll - ok
18:54:45.0909 5492 [ F723422A11CD6FA13036746272200993 ] C:\Windows\System32\wbem\cimwin32.dll
18:54:45.0909 5492 C:\Windows\System32\wbem\cimwin32.dll - ok
18:54:45.0909 5492 [ 248A1F31ABB58DDDDC01490EF0BDC777 ] C:\Windows\System32\cryptui.dll
18:54:45.0909 5492 C:\Windows\System32\cryptui.dll - ok
18:54:45.0924 5492 [ 67BB7141F7F5F37411F796943B3418B6 ] C:\Windows\System32\framedynos.dll
18:54:45.0924 5492 C:\Windows\System32\framedynos.dll - ok
18:54:45.0924 5492 [ 87CDFFCBD09C1CA03A068343D5D93250 ] C:\Windows\System32\wmi.dll
18:54:45.0924 5492 C:\Windows\System32\wmi.dll - ok
18:54:45.0940 5492 [ 3192ED5E2FFDF5B630541B9643AE1AA3 ] C:\Windows\System32\upnp.dll
18:54:45.0940 5492 C:\Windows\System32\upnp.dll - ok
18:54:45.0940 5492 [ FEA6D21F78922D641A0C9346D885133B ] C:\Windows\System32\mssprxy.dll
18:54:45.0940 5492 C:\Windows\System32\mssprxy.dll - ok
18:54:45.0940 5492 [ 3606CE1AC3D6A9A9CB7DB35D7F5C54EC ] C:\Windows\System32\shfolder.dll
18:54:45.0940 5492 C:\Windows\System32\shfolder.dll - ok
18:54:45.0955 5492 [ F21F255B91CA4F04E4250DECD2067CBB ] C:\Windows\System32\bitsperf.dll
18:54:45.0955 5492 C:\Windows\System32\bitsperf.dll - ok
18:54:45.0955 5492 [ 632557F2495931D952161465AA177B3B ] C:\Windows\System32\bitsigd.dll
18:54:45.0955 5492 C:\Windows\System32\bitsigd.dll - ok
18:54:45.0971 5492 [ F0062778F50838145AC46B384FFB4FA3 ] C:\Windows\System32\pcadm.dll
18:54:45.0971 5492 C:\Windows\System32\pcadm.dll - ok
18:54:45.0971 5492 [ 10F13FFF542FEC4A2C4FA734EEBE56B9 ] C:\Windows\System32\qmgrprxy.dll
18:54:45.0971 5492 C:\Windows\System32\qmgrprxy.dll - ok
18:54:45.0971 5492 [ 95110A1C5A1D228AC1DDF6AB67D00BEB ] C:\Program Files\Mozilla Firefox\firefox.exe
18:54:45.0971 5492 C:\Program Files\Mozilla Firefox\firefox.exe - ok
18:54:45.0987 5492 [ 60EDF8622CAD337A3629E9E6561EAC73 ] C:\Program Files\VideoLAN\VLC\vlc.exe
18:54:45.0987 5492 C:\Program Files\VideoLAN\VLC\vlc.exe - ok
18:54:45.0987 5492 [ 5521928AA79079565B7CB8FCE6806131 ] C:\Program Files\Google\Chrome\Application\chrome.exe
18:54:45.0987 5492 C:\Program Files\Google\Chrome\Application\chrome.exe - ok
18:54:46.0002 5492 [ 67EE46FD4D3B56531C5DD1BDC149275A ] C:\Program Files\Internet Explorer\iexplore.exe
18:54:46.0002 5492 C:\Program Files\Internet Explorer\iexplore.exe - ok
18:54:46.0002 5492 [ 3CE62C1A0BC2DDCACD00E4CA77E0785D ] C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll
18:54:46.0002 5492 C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll - ok
18:54:46.0018 5492 [ C5520FEB7AD5F6E3692B6DE41F6A1A27 ] C:\Program Files\Opera\opera.exe
18:54:46.0018 5492 C:\Program Files\Opera\opera.exe - ok
18:54:46.0018 5492 [ 53B249C9AC2575FA531BD7C959C14CF9 ] C:\Program Files\iTunes\iTunes.exe
18:54:46.0018 5492 C:\Program Files\iTunes\iTunes.exe - ok
18:54:46.0018 5492 [ 898ABECCD5F0B9A8E8F1318DDB234685 ] C:\Windows\System32\dot3api.dll
18:54:46.0018 5492 C:\Windows\System32\dot3api.dll - ok
18:54:46.0033 5492 [ 8D544AC1B7AA7FB9DFF0C3E7DA6AD295 ] C:\Windows\System32\wlanhlp.dll
18:54:46.0033 5492 C:\Windows\System32\wlanhlp.dll - ok
18:54:46.0033 5492 [ C8DBFEF835FF54467425C8F3ABCF7046 ] C:\Windows\System32\dssenh.dll
18:54:46.0033 5492 C:\Windows\System32\dssenh.dll - ok
18:54:46.0033 5492 [ 3FCB7347D2DE38488C85A31EA7838A3C ] C:\Windows\System32\WinSATAPI.dll
18:54:46.0033 5492 C:\Windows\System32\WinSATAPI.dll - ok
18:54:46.0049 5492 [ 2424231BBD703A677D115C29983B4293 ] C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
18:54:46.0049 5492 C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL - ok
18:54:46.0049 5492 [ 8AAEEE8E59A70F37579993D118A34EE0 ] C:\Windows\System32\d3d9.dll
18:54:46.0049 5492 C:\Windows\System32\d3d9.dll - ok
18:54:46.0065 5492 [ CD6DA5770CAE9D5E6E86722E17B442E0 ] C:\Windows\System32\d3d8thk.dll
18:54:46.0065 5492 C:\Windows\System32\d3d8thk.dll - ok
18:54:46.0065 5492 [ F0A7639DE0A66BBB92E8912CDEB1A567 ] C:\Program Files\AVAST Software\Avast\defs\13063001\aswScan.dll
18:54:46.0065 5492 C:\Program Files\AVAST Software\Avast\defs\13063001\aswScan.dll - ok
18:54:46.0065 5492 [ 2400A2B7020CEEE84B0E2CB75A0E0C2E ] C:\Program Files\AVAST Software\Avast\defs\13063001\aswEngin.dll
18:54:46.0065 5492 C:\Program Files\AVAST Software\Avast\defs\13063001\aswEngin.dll - ok
18:54:46.0080 5492 [ C4689286E13EB33929B219C010BB44C1 ] C:\Program Files\AVAST Software\Avast\defs\13063001\aswCmnIS.dll
18:54:46.0080 5492 C:\Program Files\AVAST Software\Avast\defs\13063001\aswCmnIS.dll - ok
18:54:46.0080 5492 [ 603103B004A4335713C962A2442C01C5 ] C:\Program Files\AVAST Software\Avast\defs\13063001\aswCmnBS.dll
18:54:46.0080 5492 C:\Program Files\AVAST Software\Avast\defs\13063001\aswCmnBS.dll - ok
18:54:46.0096 5492 [ 701BFC8672B9AA1BC9190157BF764C8D ] C:\Program Files\AVAST Software\Avast\defs\13063001\aswCmnOS.dll
18:54:46.0096 5492 C:\Program Files\AVAST Software\Avast\defs\13063001\aswCmnOS.dll - ok
18:54:46.0096 5492 [ 2399F8068E969D9C25A05B6F779A790A ] C:\Program Files\AVAST Software\Avast\defs\13063001\aswFiDb.dll
18:54:46.0096 5492 C:\Program Files\AVAST Software\Avast\defs\13063001\aswFiDb.dll - ok
18:54:46.0111 5492 [ 32ED62D8C410117E09B0B7CA44FC4456 ] C:\Program Files\AVAST Software\Avast\defs\13063001\aswRep.dll
18:54:46.0111 5492 C:\Program Files\AVAST Software\Avast\defs\13063001\aswRep.dll - ok
18:54:46.0111 5492 [ 70C6489D56008D75DEDF73226FA63C11 ] C:\Windows\System32\dimsjob.dll
18:54:46.0111 5492 C:\Windows\System32\dimsjob.dll - ok
18:54:46.0111 5492 [ 5CE2C1433B9B634591F0A1C4C1203A0B ] C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
18:54:46.0111 5492 C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe - ok
18:54:46.0127 5492 [ 98638A4CA187245C469DA0DEC4F04A45 ] C:\Windows\System32\pautoenr.dll
18:54:46.0127 5492 C:\Windows\System32\pautoenr.dll - ok
18:54:46.0127 5492 [ AC48FD62E22C4425879FCA5A63F50497 ] C:\Windows\System32\certcli.dll
18:54:46.0127 5492 C:\Windows\System32\certcli.dll - ok
18:54:46.0143 5492 [ 0053319C4438CDE659AA75C19BBD22F1 ] C:\Windows\System32\CertEnroll.dll
18:54:46.0143 5492 C:\Windows\System32\CertEnroll.dll - ok
18:54:46.0143 5492 [ 4CBA851D51CAF73C3ADFB7FDEF3B4017 ] C:\Program Files\AVAST Software\Avast\defs\13063001\algo.dll
18:54:46.0143 5492 C:\Program Files\AVAST Software\Avast\defs\13063001\algo.dll - ok
18:54:46.0158 5492 [ BE01E566D1F569AAB32D0335613E1EEA ] C:\Windows\System32\dllhost.exe
18:54:46.0158 5492 C:\Windows\System32\dllhost.exe - ok
18:54:46.0158 5492 [ E2479E294B30A70E19E99995FEEE7789 ] C:\Program Files\AVAST Software\Avast\defs\13063001\swhealthex.dll
18:54:46.0158 5492 C:\Program Files\AVAST Software\Avast\defs\13063001\swhealthex.dll - ok
18:54:46.0158 5492 [ B6D90C99A72044AEF85A2B7D78FEBEF4 ] C:\Program Files\AVAST Software\Avast\defs\13063001\exts.dll
18:54:46.0158 5492 C:\Program Files\AVAST Software\Avast\defs\13063001\exts.dll - ok
18:54:46.0174 5492 [ 0E135526E9785D085BCD9AEDE6FBCBF9 ] C:\Windows\System32\userinit.exe
18:54:46.0174 5492 C:\Windows\System32\userinit.exe - ok
18:54:46.0174 5492 [ D80C6539C00CB4F5D59066865479C308 ] C:\Windows\System32\dwmredir.dll
18:54:46.0174 5492 C:\Windows\System32\dwmredir.dll - ok
18:54:46.0189 5492 [ F02A533F517EB38333CB12A9E8963773 ] C:\Program Files\Google\Update\GoogleUpdate.exe
18:54:46.0189 5492 C:\Program Files\Google\Update\GoogleUpdate.exe - ok
18:54:46.0189 5492 [ 0DCB9E3407D8994C72283274C7B26CDE ] C:\Program Files\RegCure\RegCure.exe
18:54:46.0189 5492 C:\Program Files\RegCure\RegCure.exe - ok
18:54:46.0189 5492 [ C99403A5B641520DAED0021DDA06F272 ] C:\Windows\System32\milcore.dll
18:54:46.0189 5492 C:\Windows\System32\milcore.dll - ok
18:54:46.0205 5492 [ D07D4C3038F3578FFCE1C0237F2A1253 ] C:\Windows\explorer.exe
18:54:46.0205 5492 C:\Windows\explorer.exe - ok
18:54:46.0205 5492 [ 758D99511FD82B6C55E70494039E9F1A ] C:\Program Files\Google\Update\1.3.21.145\goopdate.dll
18:54:46.0205 5492 C:\Program Files\Google\Update\1.3.21.145\goopdate.dll - ok
18:54:46.0221 5492 [ 782C8019C89920A77B1907AD3B4C8FF9 ] C:\Windows\System32\HotStartUserAgent.dll
18:54:46.0221 5492 C:\Windows\System32\HotStartUserAgent.dll - ok
18:54:46.0221 5492 [ 57125869A7B9638A5D11DD685AA65EB4 ] C:\Windows\System32\PlaySndSrv.dll
18:54:46.0221 5492 C:\Windows\System32\PlaySndSrv.dll - ok
18:54:46.0221 5492 [ 43E1054C713C48D252A1826C5E14AACA ] C:\Windows\System32\MsCtfMonitor.dll
18:54:46.0221 5492 C:\Windows\System32\MsCtfMonitor.dll - ok
18:54:46.0236 5492 [ C6DA42ADA0C5FC8CB05744229D632B47 ] C:\Windows\System32\msutb.dll
18:54:46.0236 5492 C:\Windows\System32\msutb.dll - ok
18:54:46.0236 5492 [ 293C5CCD99D332ECC94637FEDA38D1F2 ] C:\Windows\System32\TMM.dll
18:54:46.0236 5492 C:\Windows\System32\TMM.dll - ok
18:54:46.0252 5492 [ 92A9E0684878CD1655E8F248561E4A90 ] C:\Windows\System32\nvd3dum.dll
18:54:46.0252 5492 C:\Windows\System32\nvd3dum.dll - ok
18:54:46.0252 5492 [ 03B567382F990C08C827398325E0D7CA ] C:\Windows\System32\nvapi.dll
18:54:46.0252 5492 C:\Windows\System32\nvapi.dll - ok
18:54:46.0267 5492 [ 7082CCBED79BEFE85C7F1949C04474C5 ] C:\Program Files\RegCure\AutoUpdate.dll
18:54:46.0267 5492 C:\Program Files\RegCure\AutoUpdate.dll - ok
18:54:46.0267 5492 [ 5161648A3A88C31FBECB0FE59552E72C ] C:\Program Files\RegCure\zlibwapi.dll
18:54:46.0267 5492 C:\Program Files\RegCure\zlibwapi.dll - ok
18:54:46.0283 5492 [ A6E127E241535C02DE9B9E5C25B70345 ] C:\Windows\System32\crtdll.dll
18:54:46.0283 5492 C:\Windows\System32\crtdll.dll - ok
18:54:46.0283 5492 [ FE3702015BE4D214808A2FBC07B8E5FF ] C:\Windows\System32\wscproxystub.dll
18:54:46.0283 5492 C:\Windows\System32\wscproxystub.dll - ok
18:54:46.0299 5492 [ BDE89AB6F15F0093A2A7861D1FC413ED ] C:\Windows\System32\QAGENT.DLL
18:54:46.0299 5492 C:\Windows\System32\QAGENT.DLL - ok
18:54:46.0314 5492 [ 76B35CB0F3A4E69D6DFF27F542B9F856 ] C:\Program Files\Google\Update\1.3.21.145\GoogleCrashHandler.exe
18:54:46.0314 5492 C:\Program Files\Google\Update\1.3.21.145\GoogleCrashHandler.exe - ok
18:54:46.0314 5492 [ 73FD66B14D3C4252F7A524B8836A4359 ] C:\Windows\System32\mstask.dll
18:54:46.0314 5492 C:\Windows\System32\mstask.dll - ok
18:54:46.0330 5492 [ 167AC31450C0C53A01FA1491E94D7678 ] C:\Windows\System32\shdocvw.dll
18:54:46.0330 5492 C:\Windows\System32\shdocvw.dll - ok
18:54:46.0330 5492 [ C8AE490A93C3CC2E537B6E06247785A1 ] C:\Windows\System32\wbem\NCProv.dll
18:54:46.0330 5492 C:\Windows\System32\wbem\NCProv.dll - ok
18:54:46.0345 5492 [ 4504819D18FAC09B6108D8728467E5B2 ] C:\Windows\System32\browseui.dll
18:54:46.0345 5492 C:\Windows\System32\browseui.dll - ok
18:54:46.0345 5492 [ E3F535656B5ABF249702EB64F3CF9AF0 ] C:\Windows\System32\wbem\wbemcons.dll
18:54:46.0345 5492 C:\Windows\System32\wbem\wbemcons.dll - ok
18:54:46.0345 5492 [ CD89FA96371429B0BEE893B156DB8932 ] C:\Program Files\AVAST Software\Avast\ashShell.dll
18:54:46.0345 5492 C:\Program Files\AVAST Software\Avast\ashShell.dll - ok
18:54:46.0361 5492 [ 14E4470BF8ACA69A85D741BA99F75F96 ] C:\Windows\System32\EhStorShell.dll
18:54:46.0361 5492 C:\Windows\System32\EhStorShell.dll - ok
18:54:46.0361 5492 [ 30DB64D316F502558DB2380F7343C9FD ] C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
18:54:46.0361 5492 C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll - ok
18:54:46.0377 5492 [ 207204AF80505AF51271FE164B56F662 ] C:\Program Files\Microsoft Office\Office12\GrooveUtil.dll
18:54:46.0377 5492 C:\Program Files\Microsoft Office\Office12\GrooveUtil.dll - ok
18:54:46.0377 5492 [ 30EFEBDC960A482E3E188B9960B286E2 ] C:\Program Files\Microsoft Office\Office12\GrooveNew.dll
18:54:46.0377 5492 C:\Program Files\Microsoft Office\Office12\GrooveNew.dll - ok
18:54:46.0377 5492 [ D5E459BED3DB9CF7FC6CC1455F177D2D ] C:\Windows\winsxs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d1cb102c435421de\ATL80.dll
18:54:46.0377 5492 C:\Windows\winsxs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d1cb102c435421de\ATL80.dll - ok
18:54:46.0392 5492 [ 111C47816F39A91EAAA18DA0A54E8E63 ] C:\Windows\System32\imageres.dll
18:54:46.0392 5492 C:\Windows\System32\imageres.dll - ok
18:54:46.0392 5492 [ 08578F3CA5365F896D90CE2BF97FD000 ] C:\Windows\System32\IconCodecService.dll
18:54:46.0392 5492 C:\Windows\System32\IconCodecService.dll - ok
18:54:46.0392 5492 [ 9A6A653ADF28D9D69670B48F535E6B90 ] C:\Windows\System32\runonce.exe
18:54:46.0392 5492 C:\Windows\System32\runonce.exe - ok
18:54:46.0408 5492 [ 74F26FC01B180D4A99A168ED69C30A53 ] C:\Windows\System32\cmd.exe
18:54:46.0408 5492 C:\Windows\System32\cmd.exe - ok
18:54:46.0408 5492 [ 178A34E5554DCE485E1262DDF027960C ] C:\Users\Trudy Stewart\AppData\Local\temp\3C9BA3C1-82D3-4246-A83C-A61985E90898.exe
18:54:46.0408 5492 C:\Users\Trudy Stewart\AppData\Local\temp\3C9BA3C1-82D3-4246-A83C-A61985E90898.exe - ok
18:54:46.0423 5492 [ C0B8B96D018849FD8CCF15FED84E8782 ] C:\Windows\System32\ie4uinit.exe
18:54:46.0423 5492 C:\Windows\System32\ie4uinit.exe - ok
18:54:46.0423 5492 [ F0FEFB0B5D25A75D478A4317139D937E ] C:\Windows\System32\iedkcs32.dll
18:54:46.0423 5492 C:\Windows\System32\iedkcs32.dll - ok
18:54:46.0439 5492 [ 4B19A9A4191353007E9819A832B81186 ] C:\Windows\System32\timedate.cpl
18:54:46.0439 5492 C:\Windows\System32\timedate.cpl - ok
18:54:46.0439 5492 [ 8D78BA30DB4AE040A52EDEE725782715 ] C:\Windows\System32\actxprxy.dll
18:54:46.0439 5492 C:\Windows\System32\actxprxy.dll - ok
18:54:46.0439 5492 [ 2A8681AEA24003040CA7D677BE9F1702 ] C:\Windows\System32\drivers\42882255.sys
18:54:46.0439 5492 C:\Windows\System32\drivers\42882255.sys - ok
18:54:46.0455 5492 [ 2AC2716E2083A949437CEDB2B6A2E89A ] C:\Program Files\Windows Media Player\wmpband.dll
18:54:46.0455 5492 C:\Program Files\Windows Media Player\wmpband.dll - ok
18:54:46.0455 5492 [ A8F2BB769FA35F9C2867746B671EB662 ] C:\Program Files\Common Files\microsoft shared\ink\TipBand.dll
18:54:46.0455 5492 C:\Program Files\Common Files\microsoft shared\ink\TipBand.dll - ok
18:54:46.0470 5492 [ 6996FDF4B921F20B7AF285F7C4AC4A29 ] C:\Program Files\iTunes\iTunesMiniPlayer.dll
18:54:46.0470 5492 C:\Program Files\iTunes\iTunesMiniPlayer.dll - ok
18:54:46.0470 5492 [ 6948970FC25089080F2922962EC08624 ] C:\Program Files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
18:54:46.0470 5492 C:\Program Files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll - ok
18:54:46.0470 5492 [ 710077AC05E3AC5DA3BF46006ADD41D4 ] C:\Program Files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
18:54:46.0470 5492 C:\Program Files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll - ok
18:54:46.0486 5492 [ FF41E1AC301F51E16F61AD7C0F45467C ] C:\Windows\System32\msshsq.dll
18:54:46.0486 5492 C:\Windows\System32\msshsq.dll - ok
18:54:46.0486 5492 [ 1CE4A2790EB4A96F4ED1E4264866AFE6 ] C:\Windows\System32\NaturalLanguage6.dll
18:54:46.0486 5492 C:\Windows\System32\NaturalLanguage6.dll - ok
18:54:46.0501 5492 [ AA111488C03C58A2BF66509ABB4FDE60 ] C:\Windows\System32\NlsData0009.dll
18:54:46.0501 5492 C:\Windows\System32\NlsData0009.dll - ok
18:54:46.0501 5492 [ 0CFCDE5D9D074D96B78D1F1CBF1AAB1D ] C:\Windows\System32\riched20.dll
18:54:46.0501 5492 C:\Windows\System32\riched20.dll - ok
18:54:46.0501 5492 [ 8629B71343F61E1140243581C63BC0C7 ] C:\Windows\System32\NlsLexicons0009.dll
18:54:46.0501 5492 C:\Windows\System32\NlsLexicons0009.dll - ok
18:54:46.0517 5492 [ 24F90AEFEBE601D427CB4511E74CDCB6 ] C:\Windows\System32\linkinfo.dll
18:54:46.0517 5492 C:\Windows\System32\linkinfo.dll - ok
18:54:46.0517 5492 [ 2D821AFA5A1A9CA7F9F997A1AAD09E72 ] C:\Program Files\Windows Media Player\wmplayer.exe
18:54:46.0517 5492 C:\Program Files\Windows Media Player\wmplayer.exe - ok
18:54:46.0533 5492 [ D8C2B95BC2353E1F18850D6B8F5DBA13 ] C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
18:54:46.0533 5492 C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll - ok
18:54:46.0533 5492 [ 533AECD1B5356870AE2D905B4D3B42B7 ] C:\Program Files\Microsoft Office\Office12\GrooveMisc.dll
18:54:46.0533 5492 C:\Program Files\Microsoft Office\Office12\GrooveMisc.dll - ok
18:54:46.0548 5492 [ 04044BF8E6989BE45FA718C24407CA28 ] C:\Windows\System32\networkexplorer.dll
18:54:46.0548 5492 C:\Windows\System32\networkexplorer.dll - ok
18:54:46.0548 5492 [ 67908FFF414C4BA8019BCDE44281CE9F ] C:\Windows\RtHDVCpl.exe
18:54:46.0548 5492 C:\Windows\RtHDVCpl.exe - ok
18:54:46.0548 5492 [ 0554A3186A28B099E82818EA8CAE40E6 ] C:\Program Files\Adobe\Acrobat.com\Acrobat.com.exe
18:54:46.0548 5492 C:\Program Files\Adobe\Acrobat.com\Acrobat.com.exe - ok
18:54:46.0564 5492 [ F8D427DAE2984A4968E2D1CB53634784 ] C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
18:54:46.0564 5492 C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe - ok
18:54:46.0564 5492 [ 32F1A63C86D009D95994B543511D6E5C ] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
18:54:46.0564 5492 C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe - ok
18:54:46.0564 5492 [ FBA22C413FE8B13BA49D7535174DDBEF ] C:\Program Files\ScanSoft\OmniPageSE4\OpHookSE4.dll
18:54:46.0564 5492 C:\Program Files\ScanSoft\OmniPageSE4\OpHookSE4.dll - ok
18:54:46.0579 5492 [ F6D01B49CEFE36286A1FD8BAE8F2D6A3 ] C:\Windows\KHALMNPR.Exe
18:54:46.0579 5492 C:\Windows\KHALMNPR.Exe - ok
18:54:46.0579 5492 [ 314C76642049DD4E9B964BC333A620B1 ] C:\Windows\Installer\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}\AppleSoftwareUpdateIco.exe
18:54:46.0579 5492 C:\Windows\Installer\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}\AppleSoftwareUpdateIco.exe - ok
18:54:46.0595 5492 [ 7FBDB0CEFBAB3A0C28C8B1A3A5A252A7 ] C:\Windows\System32\jureg.exe
18:54:46.0595 5492 C:\Windows\System32\jureg.exe - ok
18:54:46.0595 5492 [ 0D5B5FDF57E92B54B7D9EA78B3FB6A09 ] C:\Program Files\CyberLink\DVD Suite Deluxe\PowerStarter.exe
18:54:46.0595 5492 C:\Program Files\CyberLink\DVD Suite Deluxe\PowerStarter.exe - ok
18:54:46.0595 5492 [ 5016B8FC59AD616F03813FBE63295081 ] C:\Windows\System32\thumbcache.dll
18:54:46.0595 5492 C:\Windows\System32\thumbcache.dll - ok
18:54:46.0611 5492 [ 84B8827562B005C118CADBA0F25DB2C6 ] C:\Windows\System32\dsound.dll
18:54:46.0611 5492 C:\Windows\System32\dsound.dll - ok
18:54:46.0611 5492 [ 027E5E14C9CFF810377701BDEAD8210F ] C:\Windows\System32\control.exe
18:54:46.0611 5492 C:\Windows\System32\control.exe - ok
18:54:46.0626 5492 [ BADC359C9A0D9C217B7E8DA17BF3F5BB ] C:\Windows\System32\ntshrui.dll
18:54:46.0626 5492 C:\Windows\System32\ntshrui.dll - ok
18:54:46.0626 5492 [ 8D40FA84FB925E1324D4DE4F619CDEE6 ] C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE
18:54:46.0626 5492 C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE - ok
18:54:46.0626 5492 [ DE7F813217EC88C0A6D4D8F2F39D7949 ] C:\Windows\System32\msiltcfg.dll
18:54:46.0626 5492 C:\Windows\System32\msiltcfg.dll - ok
18:54:46.0642 5492 [ B5950DF243837D8217F4E597919B224A ] C:\Windows\System32\stobject.dll
18:54:46.0642 5492 C:\Windows\System32\stobject.dll - ok
18:54:46.0642 5492 [ EC69B16644C613F41A57169F8D068F1D ] C:\Windows\System32\batmeter.dll
18:54:46.0642 5492 C:\Windows\System32\batmeter.dll - ok
18:54:46.0657 5492 [ DAF60E13E96ECB67F0EDAA89C6B01B8D ] C:\Windows\System32\notepad.exe
18:54:46.0657 5492 C:\Windows\System32\notepad.exe - ok
18:54:46.0657 5492 [ 4E553CBAE02C0ECBB172976B9AA3E1F5 ] C:\Program Files\Inkscape\inkscape.exe
18:54:46.0657 5492 C:\Program Files\Inkscape\inkscape.exe - ok
18:54:46.0657 5492 [ E324CF74D9C0A71947CAA1BA2D8B7A0A ] C:\Windows\System32\nvcpl.dll
18:54:46.0657 5492 C:\Windows\System32\nvcpl.dll - ok
18:54:46.0673 5492 [ 46063990D786DB593CF9035DE808C54B ] C:\Windows\System32\nvsvc.dll
18:54:46.0673 5492 C:\Windows\System32\nvsvc.dll - ok
18:54:46.0673 5492 [ 10DE220BDFE330073762F89974DB8403 ] C:\Windows\System32\wbem\wmiprov.dll
18:54:46.0673 5492 C:\Windows\System32\wbem\wmiprov.dll - ok
18:54:46.0689 5492 [ 3D1ABC78415C78A9BA7F3FC2BB8EDC9A ] C:\Windows\System32\wbem\mofd.dll
18:54:46.0689 5492 C:\Windows\System32\wbem\mofd.dll - ok
18:54:46.0689 5492 [ 6CE25A4F4F2F70EBF004C9006C647F32 ] C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\pubs.exe
18:54:46.0689 5492 C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\pubs.exe - ok
18:54:46.0689 5492 [ C9C5957BCB83C0162C562E3C08A7A73B ] C:\Windows\System32\nvmctray.dll
18:54:46.0689 5492 C:\Windows\System32\nvmctray.dll - ok
18:54:46.0704 5492 [ C5A75EB48E2344ABDC162BDA79E16841 ] C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:54:46.0704 5492 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - ok
18:54:46.0704 5492 [ 61216539E55DDF2F78E421E7EF140650 ] C:\Windows\System32\ExplorerFrame.dll
18:54:46.0704 5492 C:\Windows\System32\ExplorerFrame.dll - ok
18:54:46.0720 5492 [ 30F02D9C55053367E26A11482F51E255 ] C:\Windows\System32\SndVolSSO.dll
18:54:46.0720 5492 C:\Windows\System32\SndVolSSO.dll - ok
18:54:46.0720 5492 [ E80DB295132C5EF0C623935422BD0FC7 ] C:\Windows\System32\SnippingTool.exe
18:54:46.0720 5492 C:\Windows\System32\SnippingTool.exe - ok
18:54:46.0735 5492 [ 7E6EA9CB72B5DE84A5D700BED877E5F9 ] C:\Program Files\Windows Mail\WinMail.exe
18:54:46.0735 5492 C:\Program Files\Windows Mail\WinMail.exe - ok
18:54:46.0735 5492 [ E5F7C30EDF0892667933BE879F067D67 ] C:\Windows\System32\msvcr100_clr0400.dll
18:54:46.0735 5492 C:\Windows\System32\msvcr100_clr0400.dll - ok
18:54:46.0735 5492 [ 1F171553F1138DC0062A71A7D275055A ] C:\Windows\System32\schtasks.exe
18:54:46.0735 5492 C:\Windows\System32\schtasks.exe - ok
18:54:46.0751 5492 [ 3B545B4CAFCC6203C4522F268077BF98 ] C:\Program Files\PowerISO\PowerISO.exe
18:54:46.0751 5492 C:\Program Files\PowerISO\PowerISO.exe - ok
18:54:46.0751 5492 [ 128DD9AF8640DBCC711940903C8B554F ] C:\Windows\System32\mscoree.dll
18:54:46.0751 5492 C:\Windows\System32\mscoree.dll - ok
18:54:46.0767 5492 [ 178A34E5554DCE485E1262DDF027960C ] C:\Users\Trudy Stewart\Downloads\tdsskiller.exe
18:54:46.0767 5492 C:\Users\Trudy Stewart\Downloads\tdsskiller.exe - ok
18:54:46.0767 5492 [ 79979253DF215587F29028D8E70F3132 ] C:\Program Files\Ace CD Burner\UNWISE.EXE
18:54:46.0767 5492 C:\Program Files\Ace CD Burner\UNWISE.EXE - ok
18:54:46.0767 5492 [ 313B30189557A2E2793F845DE0F0A4D5 ] C:\Windows\ehome\ehSSO.dll
18:54:46.0767 5492 C:\Windows\ehome\ehSSO.dll - ok
18:54:46.0782 5492 [ C4D3D068829BD2159111D8FA299DB750 ] C:\PROGRA~1\ACECDB~1\AceCDBurner.exe
18:54:46.0782 5492 C:\PROGRA~1\ACECDB~1\AceCDBurner.exe - ok
18:54:46.0782 5492 [ 966F4E151B1D175AC6DF750FB3B0636C ] C:\Program Files\19th Parallel\LightBox\LightBoxFree.exe
18:54:46.0782 5492 C:\Program Files\19th Parallel\LightBox\LightBoxFree.exe - ok
18:54:46.0798 5492 [ 924DF421B6C94D2BFFFDD22CCDCB3753 ] C:\Windows\OEM05Mon.exe
18:54:46.0798 5492 C:\Windows\OEM05Mon.exe - ok
18:54:46.0798 5492 [ 75AD59B9B12EB194486BE8D97B062994 ] C:\Windows\System32\pnidui.dll
18:54:46.0798 5492 C:\Windows\System32\pnidui.dll - ok
18:54:46.0798 5492 [ ABAEAEE763E287BDD39094C4165E1F3F ] C:\Windows\System32\fdProxy.dll
18:54:46.0798 5492 C:\Windows\System32\fdProxy.dll - ok
18:54:46.0813 5492 [ 4BAEC13BCAA595639EBB5185278DEFEA ] C:\Windows\System32\fdWSD.dll
18:54:46.0813 5492 C:\Windows\System32\fdWSD.dll - ok
18:54:46.0813 5492 [ A5CBDC87E694154F90DBA134733E7E8B ] C:\Windows\System32\brcpl.dll
18:54:46.0813 5492 C:\Windows\System32\brcpl.dll - ok
18:54:46.0813 5492 [ 2DD6AF8E97F59C9D39329BBC2A81F13F ] C:\Windows\System32\rasdlg.dll
18:54:46.0813 5492 C:\Windows\System32\rasdlg.dll - ok
18:54:46.0829 5492 [ 443C5961CACD4ABC16648874AF06E4A0 ] C:\Windows\System32\fdSSDP.dll
18:54:46.0829 5492 C:\Windows\System32\fdSSDP.dll - ok
18:54:46.0829 5492 [ 29FE522DDCE8724B0942ADB36E4E90C4 ] C:\Users\Trudy Stewart\AppData\Local\temp\ICReinstall_ZipOpenerSetup.exe
18:54:46.0829 5492 C:\Users\Trudy Stewart\AppData\Local\temp\ICReinstall_ZipOpenerSetup.exe - ok
18:54:46.0845 5492 [ 7E188D14654DF813F4F4C53286C62859 ] C:\Windows\Installer\{11E568E0-3244-4BCB-875E-F334269DFDCB}\iTunesIco.exe
18:54:46.0845 5492 C:\Windows\Installer\{11E568E0-3244-4BCB-875E-F334269DFDCB}\iTunesIco.exe - ok
18:54:46.0845 5492 [ 35937EAD711207544E219C2A19A78A7D ] C:\Program Files\Windows Media Player\wmpnscfg.exe
18:54:46.0845 5492 C:\Program Files\Windows Media Player\wmpnscfg.exe - ok
18:54:46.0860 5492 [ F043FE6A119ACEAA0C0209E01ADA8230 ] C:\Program Files\QuickTime\QuickTimePlayer.exe
18:54:46.0860 5492 C:\Program Files\QuickTime\QuickTimePlayer.exe - ok
18:54:46.0860 5492 [ 0E34B7BB1FCF22BCC1E394D16F9E992B ] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
18:54:46.0860 5492 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe - ok
18:54:46.0860 5492 [ 8728A91948AC0FE779BDF47BC551BAF5 ] C:\Windows\Installer\{95120000-00AF-0409-0000-0000000FF1CE}\ppvwicon.exe
18:54:46.0860 5492 C:\Windows\Installer\{95120000-00AF-0409-0000-0000000FF1CE}\ppvwicon.exe - ok
18:54:46.0876 5492 [ 1284283FBF24A780135740B28070E3C8 ] C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
18:54:46.0876 5492 C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe - ok
18:54:46.0876 5492 [ E46A4765F8E6D631C9C9CB0B083602F5 ] C:\Program Files\Windows Media Player\wmpnssci.dll
18:54:46.0876 5492 C:\Program Files\Windows Media Player\wmpnssci.dll - ok
18:54:46.0891 5492 [ 648AB74D9C104FB500B6C4EEDC6A8772 ] C:\Windows\System32\wmpmde.dll
18:54:46.0891 5492 C:\Windows\System32\wmpmde.dll - ok
18:54:46.0891 5492 [ 5C24852FB8A910FA0C6AEC0DD10FA85E ] C:\Program Files\Opera\opera.dll
18:54:46.0891 5492 C:\Program Files\Opera\opera.dll - ok
18:54:46.0891 5492 [ 67D16247C56C26A4F0D79D1A7F272B8F ] C:\Windows\System32\mf.dll
18:54:46.0891 5492 C:\Windows\System32\mf.dll - ok
18:54:46.0907 5492 [ 2495C4204C63678F8FD5D488CA7DAD26 ] C:\Windows\System32\evr.dll
18:54:46.0907 5492 C:\Windows\System32\evr.dll - ok
18:54:46.0907 5492 [ 4DF10CE50010D70152944B51E03588B0 ] C:\Windows\System32\wmdrmsdk.dll
18:54:46.0907 5492 C:\Windows\System32\wmdrmsdk.dll - ok
18:54:46.0923 5492 [ EFD278F8129EE12F1D4AE0250494B791 ] C:\Windows\System32\dxva2.dll
18:54:46.0923 5492 C:\Windows\System32\dxva2.dll - ok
18:54:46.0923 5492 [ 015E99A7634B93E8BB0380C70F3D2CC3 ] C:\Windows\System32\wmp.dll
18:54:46.0923 5492 C:\Windows\System32\wmp.dll - ok
18:54:46.0923 5492 [ 11AFB3767663997E0CE911CD015599C9 ] C:\Program Files\Google\Update\1.3.21.145\goopdateres_en.dll
18:54:46.0923 5492 C:\Program Files\Google\Update\1.3.21.145\goopdateres_en.dll - ok
18:54:46.0938 5492 [ 0D26C438E2938A3E6BDD91173BC96FF0 ] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
18:54:46.0938 5492 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe - ok
18:54:46.0938 5492 [ 4A839160ED1963F9A1526DDA2D1233B2 ] C:\Windows\System32\AltTab.dll
18:54:46.0938 5492 C:\Windows\System32\AltTab.dll - ok
18:54:46.0954 5492 [ 6B5C53E0932C510606D700B7A896EF73 ] C:\Windows\System32\WPDShServiceObj.dll
18:54:46.0954 5492 C:\Windows\System32\WPDShServiceObj.dll - ok
18:54:46.0954 5492 [ 3F11B20D12D89365D7721BDC860CE5F0 ] C:\Program Files\AVAST Software\Avast\AvastUI.exe
18:54:46.0954 5492 C:\Program Files\AVAST Software\Avast\AvastUI.exe - ok
18:54:46.0954 5492 [ AB347BDF952A41BA18196B40C0381407 ] C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
18:54:46.0954 5492 C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe - ok
18:54:46.0969 5492 [ 484ACF6AF85A29AC52F3CF054DFDE9D3 ] C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\wordicon.exe
18:54:46.0969 5492 C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\wordicon.exe - ok
18:54:46.0969 5492 [ F5DF6846F30E9F54EA60CCAEB3FB2055 ] C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
18:54:46.0969 5492 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll - ok
18:54:46.0985 5492 [ 4E289C24E5BEB5FF9CF5B118AB96FDB0 ] C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
18:54:46.0985 5492 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll - ok
18:54:46.0985 5492 [ 941486AB385556BF6A62342F8CA15BD8 ] C:\Windows\System32\accessibilitycpl.dll
18:54:46.0985 5492 C:\Windows\System32\accessibilitycpl.dll - ok
18:54:47.0001 5492 [ EACACA0F2FF4CC54A909E3C5721FCDE8 ] C:\Windows\System32\msvfw32.dll
18:54:47.0001 5492 C:\Windows\System32\msvfw32.dll - ok
18:54:47.0001 5492 [ EF24642D5FB52A1EEF56DE9E47CBB993 ] C:\Windows\System32\mfc42.dll
18:54:47.0001 5492 C:\Windows\System32\mfc42.dll - ok
18:54:47.0001 5492 [ 9441A231C0AA0712F7CF3B10D9CFCF76 ] C:\Windows\System32\wmploc.DLL
18:54:47.0001 5492 C:\Windows\System32\wmploc.DLL - ok
18:54:47.0016 5492 [ BECEEE04AAB6388B66D1FCBD2A9F19A1 ] C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\outicon.exe
18:54:47.0016 5492 C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\outicon.exe - ok
18:54:47.0016 5492 [ 6D796D59977EB52B33B966EAB9C73E6A ] C:\Program Files\Microsoft Works\MSWorks.exe
18:54:47.0016 5492 C:\Program Files\Microsoft Works\MSWorks.exe - ok
18:54:47.0032 5492 [ E47C854A28A81F2939F42CBE9FEA994C ] C:\Windows\System32\Magnify.exe
18:54:47.0032 5492 C:\Windows\System32\Magnify.exe - ok
18:54:47.0032 5492 [ 73BFDC88C6EF9715CDF57134A438837A ] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
18:54:47.0032 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe - ok
18:54:47.0032 5492 [ C03AC1FBCD625F93D2C245D97E06F270 ] C:\Program Files\Windows Photo Gallery\WindowsPhotoGallery.exe
18:54:47.0047 5492 C:\Program Files\Windows Photo Gallery\WindowsPhotoGallery.exe - ok
18:54:47.0047 5492 [ B0D16BC319E37E875C4B491460807051 ] C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\2227d1559f87943255069398608d5c56\mscorlib.ni.dll
18:54:47.0047 5492 C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\2227d1559f87943255069398608d5c56\mscorlib.ni.dll - ok
18:54:47.0047 5492 [ 8BC00165083171F8DE760AE39D76D003 ] C:\Program Files\Microsoft Works\wksdb.exe
18:54:47.0047 5492 C:\Program Files\Microsoft Works\wksdb.exe - ok
18:54:47.0063 5492 [ 861797D3C83A6EBA05FB2C63B1A45E82 ] C:\Windows\System32\ksproxy.ax
18:54:47.0063 5492 C:\Windows\System32\ksproxy.ax - ok
18:54:47.0063 5492 [ A2418D3C557C0A0C634DA713A8AC3789 ] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
18:54:47.0063 5492 C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe - ok
18:54:47.0079 5492 [ 27BB54357A51594D9F9B6257B5B9A879 ] C:\Windows\System32\Narrator.exe
18:54:47.0079 5492 C:\Windows\System32\Narrator.exe - ok
18:54:47.0079 5492 [ 24081AE1E47A890025A91A25D79EC9B0 ] C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll
18:54:47.0079 5492 C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll - ok
18:54:47.0079 5492 [ 06DC277C7A54550F65558182BA8208EA ] C:\Program Files\Google\Picasa3\Picasa3.exe
18:54:47.0079 5492 C:\Program Files\Google\Picasa3\Picasa3.exe - ok
18:54:47.0094 5492 [ 9BE95786D648A9D0D31CAF5D98DBE3A2 ] C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll
18:54:47.0094 5492 C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll - ok
18:54:47.0094 5492 [ 617F9A5813E69F6E9ED94B811EC75396 ] C:\Windows\System32\wmpps.dll
18:54:47.0094 5492 C:\Windows\System32\wmpps.dll - ok
18:54:47.0110 5492 [ C8D8B847C46EFE3496311AF5EBFB9B62 ] C:\Windows\System32\RtkAPO.dll
18:54:47.0110 5492 C:\Windows\System32\RtkAPO.dll - ok
18:54:47.0110 5492 [ A8E2F76F136A0E664B68A48028D4AF93 ] C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
18:54:47.0110 5492 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll - ok
18:54:47.0110 5492 [ 92D1B7E3981A24B8F3093CE42AB31C68 ] C:\Windows\assembly\NativeImages_v2.0.50727_32\System\cc149d08e75f8c53cd28ac926b38c370\System.ni.dll
18:54:47.0110 5492 C:\Windows\assembly\NativeImages_v2.0.50727_32\System\cc149d08e75f8c53cd28ac926b38c370\System.ni.dll - ok
18:54:47.0125 5492 [ 744F08CF9ACFFB1C715191D04DEEE907 ] C:\Windows\System32\srchadmin.dll
18:54:47.0125 5492 C:\Windows\System32\srchadmin.dll - ok
18:54:47.0125 5492 [ A105048D68A1075837219DCA7BBFD5AE ] C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\Artist.exe
18:54:47.0125 5492 C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\Artist.exe - ok
18:54:47.0141 5492 [ 5193DE33F3284C447E0D31DAFBF92570 ] C:\Windows\System32\webcheck.dll
18:54:47.0141 5492 C:\Windows\System32\webcheck.dll - ok
18:54:47.0141 5492 [ 04E59EEA7C306C3C3B25A37FCE825758 ] C:\Program Files\Image Mender\IM.exe
18:54:47.0141 5492 C:\Program Files\Image Mender\IM.exe - ok
18:54:47.0157 5492 [ 593555359AC8A70A59BC3A4EAE154F26 ] C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\15e2d7f51f15830591727d6d6a1e4032\System.ServiceProcess.ni.dll
18:54:47.0157 5492 C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\15e2d7f51f15830591727d6d6a1e4032\System.ServiceProcess.ni.dll - ok
18:54:47.0157 5492 [ CECB7971499C5E84F701AFABDDFFA27C ] C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b5df40c22ab563a816103629e2ca99d4\System.Runtime.Remoting.ni.dll
18:54:47.0157 5492 C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b5df40c22ab563a816103629e2ca99d4\System.Runtime.Remoting.ni.dll - ok
18:54:47.0172 5492 [ 0775A7424B1828AD1452BAE43F7069A8 ] C:\Windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll
18:54:47.0172 5492 C:\Windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll - ok
18:54:47.0172 5492 [ 4ACEA0C4BB15ACE55E3AE5EC4E88DD55 ] C:\Windows\System32\SyncCenter.dll
18:54:47.0172 5492 C:\Windows\System32\SyncCenter.dll - ok
18:54:47.0172 5492 [ 877F2939794EBA4F3D1BB967007E99E8 ] C:\Windows\System32\osk.exe
18:54:47.0172 5492 C:\Windows\System32\osk.exe - ok
18:54:47.0188 5492 [ 0B5AC46982E77CAF3EC1D55C9AC6AB56 ] C:\Windows\System32\wscntfy.dll
18:54:47.0188 5492 C:\Windows\System32\wscntfy.dll - ok
18:54:47.0188 5492 [ 9B0726A03B790E5B82BED44D24009BEF ] C:\Windows\System32\imapi2.dll
18:54:47.0188 5492 C:\Windows\System32\imapi2.dll - ok
18:54:47.0203 5492 [ C0ABD66F31C0B84CD944802E6D3D02C2 ] C:\Windows\System32\bthprops.cpl
18:54:47.0203 5492 C:\Windows\System32\bthprops.cpl - ok
18:54:47.0203 5492 [ F4F7C86191A981C804326E2EF6F3604F ] C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
18:54:47.0203 5492 C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe - ok
18:54:47.0203 5492 [ 1A04ECFEFEC96A31A89E2AC3EE96C1B9 ] C:\Program Files\ColorPic 4.1\ColorPic.exe
18:54:47.0203 5492 C:\Program Files\ColorPic 4.1\ColorPic.exe - ok
18:54:47.0219 5492 [ 0EF9876FA3041574F4C6E6FA1B646D2A ] C:\PROGRA~1\MICROS~3\Office12\Moc.exe
18:54:47.0219 5492 C:\PROGRA~1\MICROS~3\Office12\Moc.exe - ok
18:54:47.0219 5492 [ 3B3F2BD230D4B8DBA97676793D1DB061 ] C:\Users\Trudy Stewart\Desktop\nmsetup.exe
18:54:47.0219 5492 C:\Users\Trudy Stewart\Desktop\nmsetup.exe - ok
18:54:47.0235 5492 [ E7FC2CFE8953E69D665A4A798F4D69D4 ] C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll
18:54:47.0235 5492 C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll - ok
18:54:47.0235 5492 [ 48BE298F7FD1BEF4D8FBACB04D8D95C4 ] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
18:54:47.0235 5492 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe - ok
18:54:47.0235 5492 [ F92B3868E3801653AF196C76078829FA ] C:\Program Files\AVAST Software\Avast\aswUtil.dll
18:54:47.0235 5492 C:\Program Files\AVAST Software\Avast\aswUtil.dll - ok
18:54:47.0250 5492 [ 588302BB062725488C31FD797F11788F ] C:\Program Files\Evernote\Evernote3\Evernote.exe
18:54:47.0250 5492 C:\Program Files\Evernote\Evernote3\Evernote.exe - ok
18:54:47.0250 5492 [ D63797E8E7781EE1500A810CB6194FA6 ] C:\Program Files\Common Files\Java\Java Update\jusched.exe
18:54:47.0250 5492 C:\Program Files\Common Files\Java\Java Update\jusched.exe - ok
18:54:47.0266 5492 [ DF3F8F6F8662AF38F8EEC0CBE9D85861 ] C:\Program Files\Chief Architect Inc\Picture Painter Home and Landscape\Picture Painter.exe
18:54:47.0266 5492 C:\Program Files\Chief Architect Inc\Picture Painter Home and Landscape\Picture Painter.exe - ok
18:54:47.0266 5492 [ 43D083268A0919F3527A2837390BAF63 ] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
18:54:47.0266 5492 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe - ok
18:54:47.0281 5492 [ B5114FFF39C291E769C3A6C01B20C44A ] C:\Program Files\CoffeeCup Software\Coffee.exe
18:54:47.0281 5492 C:\Program Files\CoffeeCup Software\Coffee.exe - ok
18:54:47.0281 5492 [ DF3F8F6F8662AF38F8EEC0CBE9D85861 ] C:\Windows\Installer\{C86B0A93-6134-462A-A510-A6ED6F043982}\Icon.exe
18:54:47.0281 5492 C:\Windows\Installer\{C86B0A93-6134-462A-A510-A6ED6F043982}\Icon.exe - ok
18:54:47.0297 5492 [ 61E4289E91E88C90478D7F4BEB10DCF7 ] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
18:54:47.0297 5492 C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe - ok
18:54:47.0313 5492 [ 1AAE9B679065F72E60FA27661D927C87 ] C:\Program Files\Photo Story 3 for Windows\PhotoStory3.exe
18:54:47.0313 5492 C:\Program Files\Photo Story 3 for Windows\PhotoStory3.exe - ok
18:54:47.0313 5492 [ 069385484EA57B663D688894C88975C5 ] C:\Windows\System32\wuapp.exe
18:54:47.0313 5492 C:\Windows\System32\wuapp.exe - ok
18:54:47.0328 5492 [ 285C594C4913FA9DC7BB6BA3AD6F101A ] C:\Windows\System32\wucltux.dll
18:54:47.0328 5492 C:\Windows\System32\wucltux.dll - ok
18:54:47.0344 5492 [ B5D03EBFF05D9670EBF329A31A2F62ED ] C:\Program Files\FastStone Image Viewer\FSViewer.exe
18:54:47.0344 5492 C:\Program Files\FastStone Image Viewer\FSViewer.exe - ok
18:54:47.0344 5492 [ 21709901950C57965AACEBEEC9CD9597 ] C:\Program Files\Chief Architect Inc\Interior Designer 8\Interior Designer 8.exe
18:54:47.0344 5492 C:\Program Files\Chief Architect Inc\Interior Designer 8\Interior Designer 8.exe - ok
18:54:47.0344 5492 [ 862363973DCBCC31DD161EF41A69153C ] C:\Windows\System32\odbc32.dll
18:54:47.0344 5492 C:\Windows\System32\odbc32.dll - ok
18:54:47.0359 5492 [ 9ACCBC5891BA51B5B29C1A88F80D4CE3 ] C:\Program Files\QuickTime\QTTask.exe
18:54:47.0359 5492 C:\Program Files\QuickTime\QTTask.exe - ok
18:54:47.0359 5492 [ 21709901950C57965AACEBEEC9CD9597 ] C:\Windows\Installer\{64FFDCF5-740E-ECA2-DAA2-2C9E190A7D88}\Icon.exe
18:54:47.0359 5492 C:\Windows\Installer\{64FFDCF5-740E-ECA2-DAA2-2C9E190A7D88}\Icon.exe - ok
18:54:47.0359 5492 [ B7ED332A57FC78CA29E40D3619550225 ] C:\Windows\ehome\ehshell.exe
18:54:47.0359 5492 C:\Windows\ehome\ehshell.exe - ok
18:54:47.0375 5492 [ 2F0F0E6AA6F5874E13E792996077138B ] C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
18:54:47.0375 5492 C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE - ok
18:54:47.0375 5492 [ 986E409D9C31A89BE9CB0373EC6E17E7 ] C:\Program Files\NewSoft\Presto! PageManager 7.15\Prestopm.exe
18:54:47.0375 5492 C:\Program Files\NewSoft\Presto! PageManager 7.15\Prestopm.exe - ok
18:54:47.0391 5492 [ 4476C54D84C792E6B9ECFE4C68BE50D0 ] C:\Program Files\iTunes\iTunesHelper.exe
18:54:47.0391 5492 C:\Program Files\iTunes\iTunesHelper.exe - ok
18:54:47.0391 5492 [ E952C981228FFF5C014CFB7C6D82EE65 ] C:\Program Files\Online Services\MSN90\msnsusii.exe
18:54:47.0391 5492 C:\Program Files\Online Services\MSN90\msnsusii.exe - ok
18:54:47.0406 5492 [ 91502087751A869A151F4D67E4EB27AA ] C:\Program Files\iTunes\iTunesHelper.dll
18:54:47.0406 5492 C:\Program Files\iTunes\iTunesHelper.dll - ok
18:54:47.0406 5492 [ 355A719E6B7531B1EC0BDBC5F68AEFDD ] C:\Program Files\PowerISO\PWRISOVM.EXE
18:54:47.0406 5492 C:\Program Files\PowerISO\PWRISOVM.EXE - ok
18:54:47.0406 5492 [ 707A19FFC158ABA45F1CA94CB470A1C5 ] C:\Program Files\Online Services\MSN90\LaunchMsn.exe
18:54:47.0406 5492 C:\Program Files\Online Services\MSN90\LaunchMsn.exe - ok
18:54:47.0422 5492 [ F990765DC7D1D3FEC5AAABD065B7CF0D ] C:\Program Files\Hewlett-Packard\SDP\HPSdpApp.exe
18:54:47.0422 5492 C:\Program Files\Hewlett-Packard\SDP\HPSdpApp.exe - ok
18:54:47.0422 5492 [ BF08674925F151BD4537B89A493E3E0C ] C:\Windows\ehome\ehtray.exe
18:54:47.0422 5492 C:\Windows\ehome\ehtray.exe - ok
18:54:47.0437 5492 [ 94F4216412907FF0E2DCFECC9BCBC568 ] C:\Program Files\Canon\MP Navigator EX 1.0\mpnex10.exe
18:54:47.0437 5492 C:\Program Files\Canon\MP Navigator EX 1.0\mpnex10.exe - ok
18:54:47.0437 5492 [ 324B89224856904DF332D8CF4FAE3DAB ] C:\Program Files\Canon\Easy-PhotoPrint EX\CNEZMAIN.EXE
18:54:47.0437 5492 C:\Program Files\Canon\Easy-PhotoPrint EX\CNEZMAIN.EXE - ok
18:54:47.0437 5492 [ A46207DB3A971124989E963B2CAE027C ] C:\Program Files\Darq Software\Transmute\Transmute.exe
18:54:47.0437 5492 C:\Program Files\Darq Software\Transmute\Transmute.exe - ok
18:54:47.0453 5492 [ FEDB6110D3E0A7EFE6996F93CD8C48E7 ] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE
18:54:47.0453 5492 C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE - ok
18:54:47.0453 5492 [ 6FF5F0DAAE4D297BE6ECA215587D8CF4 ] C:\Program Files\Canon\Canon IJ Network Tool\CNMNPUT.EXE
18:54:47.0453 5492 C:\Program Files\Canon\Canon IJ Network Tool\CNMNPUT.EXE - ok
18:54:47.0469 5492 [ 8078F8F8F7A79E2E6B494523A828C585 ] C:\Windows\System32\msdtckrm.dll
18:54:47.0469 5492 C:\Windows\System32\msdtckrm.dll - ok
18:54:47.0469 5492 [ A46207DB3A971124989E963B2CAE027C ] C:\Windows\Installer\{4CE8DF60-5468-4E0B-98EA-9F7169DC79D0}\Transmute.exe
18:54:47.0469 5492 C:\Windows\Installer\{4CE8DF60-5468-4E0B-98EA-9F7169DC79D0}\Transmute.exe - ok
18:54:47.0484 5492 [ 6163C0EE9781E3DF79A18D82FCA0AA26 ] C:\Program Files\Microsoft Windows 7 Upgrade Advisor\WindowsUpgradeAdvisor.exe
18:54:47.0484 5492 C:\Program Files\Microsoft Windows 7 Upgrade Advisor\WindowsUpgradeAdvisor.exe - ok
18:54:47.0484 5492 [ 2E6963EB65EE9201C11C0A7EBDB97905 ] C:\Program Files\Photo Effect Studio\PhotoEffectStudio.exe
18:54:47.0484 5492 C:\Program Files\Photo Effect Studio\PhotoEffectStudio.exe - ok
18:54:47.0484 5492 [ 0DAAF8032546D1B4543D7B101B53FD6C ] C:\Windows\System32\odbcint.dll
18:54:47.0484 5492 C:\Windows\System32\odbcint.dll - ok
18:54:47.0500 5492 [ A9760F598C1CBD459C27371B5847B8F4 ] C:\Program Files\Color Style Studio\ColorStyle.exe
18:54:47.0500 5492 C:\Program Files\Color Style Studio\ColorStyle.exe - ok
18:54:47.0500 5492 [ 540699680301843EFD0F04E40EF7839F ] C:\Program Files\Privoxy\privoxy.exe
18:54:47.0500 5492 C:\Program Files\Privoxy\privoxy.exe - ok
18:54:47.0515 5492 [ 993AA630A3044F1C01A99549A4D05A76 ] C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\HelpMain\launchershortcut.exe
18:54:47.0515 5492 C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\HelpMain\launchershortcut.exe - ok
18:54:47.0515 5492 [ 790222D6CCFC576F0D07D418E6115D85 ] C:\Program Files\Windows Calendar\WinCal.exe
18:54:47.0515 5492 C:\Program Files\Windows Calendar\WinCal.exe - ok
18:54:47.0515 5492 [ 775B1AD9857721F2DC61A79C5B9D9412 ] C:\Program Files\NoteTab Light\NoteTab.exe
18:54:47.0515 5492 C:\Program Files\NoteTab Light\NoteTab.exe - ok
18:54:47.0531 5492 [ 52BC119E49F88F2A5D1466230B1275C7 ] C:\Program Files\Windows Collaboration\WinCollab.exe
18:54:47.0531 5492 C:\Program Files\Windows Collaboration\WinCollab.exe - ok
18:54:47.0531 5492 [ 339DFA98DDDA7DDF735CE21C82E6F1DD ] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
18:54:47.0531 5492 C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe - ok
18:54:47.0547 5492 [ 06164026C38AA5366E4D127E2E36FDE8 ] C:\Program Files\Windows Mail\wab.exe
18:54:47.0547 5492 C:\Program Files\Windows Mail\wab.exe - ok
18:54:47.0547 5492 [ EB2543728CED96CAFFC60D252FF8AB92 ] C:\Users\Trudy Stewart\Desktop\herewego.exe
18:54:47.0547 5492 C:\Users\Trudy Stewart\Desktop\herewego.exe - ok
18:54:47.0562 5492 [ BE3AB4803C963BE0357541EC3B17D443 ] C:\Users\Trudy Stewart\Desktop\aswMBR.exe
18:54:47.0562 5492 C:\Users\Trudy Stewart\Desktop\aswMBR.exe - ok
18:54:47.0562 5492 [ 90F8887CBFCD2FF300214C70348E19EC ] C:\Program Files\Privoxy\mgwz.dll
18:54:47.0562 5492 C:\Program Files\Privoxy\mgwz.dll - ok
18:54:47.0578 5492 [ D05D1BBCBA6C6843A7A96C5289DA22BE ] C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
18:54:47.0578 5492 C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe - ok
18:54:47.0593 5492 [ 0D392EDE3B97E0B3131B2F63EF1DB94E ] C:\Program Files\Windows Defender\MSASCui.exe
18:54:47.0593 5492 C:\Program Files\Windows Defender\MSASCui.exe - ok
18:54:47.0593 5492 [ 0F4195B9B348DE5CF9B822F81704B20E ] C:\Windows\ehome\ehmsas.exe
18:54:47.0593 5492 C:\Windows\ehome\ehmsas.exe - ok
18:54:47.0609 5492 [ 395335431AD55C167CFDBBAB8420DA73 ] C:\Program Files\Movie Maker\DVDMaker.exe
18:54:47.0609 5492 C:\Program Files\Movie Maker\DVDMaker.exe - ok
18:54:47.0609 5492 [ C4AB08459CD7B59B410ACFC04D90E87B ] C:\Program Files\Movie Maker\MOVIEMK.exe
18:54:47.0609 5492 C:\Program Files\Movie Maker\MOVIEMK.exe - ok
18:54:47.0625 5492 [ 1ED2124313CCE34C877247574212EFC8 ] C:\Windows\System32\calc.exe
18:54:47.0625 5492 C:\Windows\System32\calc.exe - ok
18:54:47.0625 5492 [ 338104E0E18307CD65604FE317B5FB8D ] C:\Windows\System32\mblctr.exe
18:54:47.0625 5492 C:\Windows\System32\mblctr.exe - ok
18:54:47.0640 5492 [ B1AFF0B6DED627A1D22A6817DD58AC0F ] C:\Windows\System32\NetProj.exe
18:54:47.0640 5492 C:\Windows\System32\NetProj.exe - ok
18:54:47.0656 5492 [ A577868F76CEE16D6A82625FD55F379A ] C:\Windows\System32\NetProjW.dll
18:54:47.0656 5492 C:\Windows\System32\NetProjW.dll - ok
18:54:47.0656 5492 [ 694AF8B27C9A0A99399E02CE977F986B ] C:\Windows\System32\mspaint.exe
18:54:47.0656 5492 C:\Windows\System32\mspaint.exe - ok
18:54:47.0671 5492 [ 16FEE292E95EDC274385103E6B498019 ] C:\Windows\System32\mstsc.exe
18:54:47.0671 5492 C:\Windows\System32\mstsc.exe - ok
18:54:47.0671 5492 [ 9E35FF7F943AE0FB89192BFE058B7FD4 ] C:\Program Files\Windows Sidebar\sidebar.exe
18:54:47.0671 5492 C:\Program Files\Windows Sidebar\sidebar.exe - ok
18:54:47.0687 5492 [ 248F33A6C2380757BC1E20E34D9E827B ] C:\Windows\System32\SoundRecorder.exe
18:54:47.0687 5492 C:\Windows\System32\SoundRecorder.exe - ok
18:54:47.0703 5492 [ 9B89B3BB79EA1ACF041F40A7B6FC5827 ] C:\Windows\System32\mobsync.exe
18:54:47.0703 5492 C:\Windows\System32\mobsync.exe - ok
18:54:47.0703 5492 [ 16FC5B430123238E522B18E63C257AF8 ] C:\Windows\System32\oobefldr.dll
18:54:47.0703 5492 C:\Windows\System32\oobefldr.dll - ok
18:54:47.0718 5492 [ 19D0FC69D4E68D5CE2E4B34940529727 ] C:\Program Files\Windows NT\Accessories\wordpad.exe
18:54:47.0718 5492 C:\Program Files\Windows NT\Accessories\wordpad.exe - ok
18:54:47.0734 5492 [ 105A4D87C8DCF2CF5DB042830B203E5F ] C:\Windows\Speech\Common\sapisvr.exe
18:54:47.0734 5492 C:\Windows\Speech\Common\sapisvr.exe - ok
18:54:47.0734 5492 [ 9AD8AEAAB3EB89277AF1DDF31B14F90F ] C:\Windows\System32\Speech\SpeechUX\sapi.cpl
18:54:47.0734 5492 C:\Windows\System32\Speech\SpeechUX\sapi.cpl - ok
18:54:47.0749 5492 [ A623666C8A8EC9A57DCA07915A3F1EC6 ] C:\Windows\System32\sdclt.exe
18:54:47.0749 5492 C:\Windows\System32\sdclt.exe - ok
18:54:47.0749 5492 [ BB4910DE8B6C5E30DF39EC97308D44BA ] C:\Windows\System32\charmap.exe
18:54:47.0749 5492 C:\Windows\System32\charmap.exe - ok
18:54:47.0765 5492 [ 2327C11B043FCEB80BE00CC8D077E9AA ] C:\Windows\System32\dfrgui.exe
18:54:47.0765 5492 C:\Windows\System32\dfrgui.exe - ok
18:54:47.0781 5492 [ 86AB3F6C784197DC1D994A83AF4259CD ] C:\Windows\System32\cleanmgr.exe
18:54:47.0781 5492 C:\Windows\System32\cleanmgr.exe - ok
18:54:47.0781 5492 [ FBF628702A408977FEB0845D48F4F154 ] C:\Windows\System32\migwiz\migwiz.exe
18:54:47.0781 5492 C:\Windows\System32\migwiz\migwiz.exe - ok
18:54:47.0781 5492 [ D3D1CE8FF30786D50272DA3085149904 ] C:\Windows\System32\msinfo32.exe
18:54:47.0781 5492 C:\Windows\System32\msinfo32.exe - ok
18:54:47.0796 5492 [ 95D5AC5CCBE10E8B4B8A0DF41022568D ] C:\Windows\System32\rstrui.exe
18:54:47.0796 5492 C:\Windows\System32\rstrui.exe - ok
18:54:47.0796 5492 [ B13A8D6F708AA2034A9DE0979F81D890 ] C:\Windows\System32\miguiresource.dll
18:54:47.0796 5492 C:\Windows\System32\miguiresource.dll - ok
18:54:47.0796 5492 [ C9B520028498E5DA23651619F8A556D4 ] C:\Windows\System32\StikyNot.exe
18:54:47.0796 5492 C:\Windows\System32\StikyNot.exe - ok
18:54:47.0812 5492 [ 7122B0AA2212B07BBFC49BD22215BF3B ] C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
18:54:47.0812 5492 C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe - ok
18:54:47.0812 5492 [ C20436B4F0596ACD5569749206F99265 ] C:\Program Files\Windows Journal\Journal.exe
18:54:47.0812 5492 C:\Program Files\Windows Journal\Journal.exe - ok
18:54:47.0827 5492 [ 36B6F71B6D7D280302B348145DB05A9F ] C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
18:54:47.0827 5492 C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - ok
18:54:47.0827 5492 [ DF4217DDB34A0B73DC7AAC7829371C0C ] C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
18:54:47.0827 5492 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - ok
18:54:47.0827 5492 [ 4CAAD229A00C0DEFFF51841AE2B93B46 ] C:\Windows\System32\WindowsPowerShell\v1.0\pwrshmsg.dll
18:54:47.0827 5492 C:\Windows\System32\WindowsPowerShell\v1.0\pwrshmsg.dll - ok
18:54:47.0843 5492 [ 7C06CED2F7B9272A126D53A2A9F52AC0 ] C:\Windows\hh.exe
18:54:47.0843 5492 C:\Windows\hh.exe - ok
18:54:47.0843 5492 [ 2CB350B72FEA6FB5A010099A4444B636 ] C:\Windows\System32\mycomput.dll
18:54:47.0843 5492 C:\Windows\System32\mycomput.dll - ok
18:54:47.0859 5492 [ 1C474C0C4CB5F15A555FE912CBF4549C ] C:\Windows\System32\odbcad32.exe
18:54:47.0859 5492 C:\Windows\System32\odbcad32.exe - ok
18:54:47.0859 5492 [ AB3596F706B98504B0007C5363C2B263 ] C:\Windows\System32\inetsrv\InetMgr.exe
18:54:47.0859 5492 C:\Windows\System32\inetsrv\InetMgr.exe - ok
18:54:47.0859 5492 [ 1CB1B95D67BC380FBCCFAEA3CF2DDA80 ] C:\Windows\System32\iscsicpl.exe
18:54:47.0859 5492 C:\Windows\System32\iscsicpl.exe - ok
18:54:47.0874 5492 [ F84D0B1B90404D0A27E86F159FBDAC81 ] C:\Windows\System32\iscsicpl.dll
18:54:47.0874 5492 C:\Windows\System32\iscsicpl.dll - ok
18:54:47.0874 5492 [ 8D865A3E7E2C78317EDE4EAE8316284F ] C:\Windows\System32\MdSched.exe
18:54:47.0874 5492 C:\Windows\System32\MdSched.exe - ok
18:54:47.0874 5492 [ E7A841EBC1C34ED8BA7761DD4AA4AB98 ] C:\Program Files\iTunes\iTunesHelper.Resources\iTunesHelper.dll
18:54:47.0874 5492 C:\Program Files\iTunes\iTunesHelper.Resources\iTunesHelper.dll - ok
18:54:47.0890 5492 [ 79E76DFB12DE84A5DC3F677F6DF172E5 ] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxthl.dll
18:54:47.0890 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxthl.dll - ok
18:54:47.0890 5492 [ 499C796A0D456CF62D50F0B70C5A4202 ] C:\Program Files\iTunes\iTunesHelper.Resources\en.lproj\iTunesHelperLocalized.dll
18:54:47.0890 5492 C:\Program Files\iTunes\iTunesHelper.Resources\en.lproj\iTunesHelperLocalized.dll - ok
18:54:47.0905 5492 [ 550B8CB98A8FA1D7A1A7371055A38DDA ] C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
18:54:47.0905 5492 C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe - ok
18:54:47.0905 5492 [ 1A617835452EEE5060976C9B9F5FE635 ] C:\Windows\System32\wuapi.dll
18:54:47.0905 5492 C:\Windows\System32\wuapi.dll - ok
18:54:47.0905 5492 [ 3458EDA96E30FBD0477A2800D3FB1909 ] C:\Windows\System32\wups.dll
18:54:47.0905 5492 C:\Windows\System32\wups.dll - ok
18:54:47.0921 5492 [ 1959E5AAEE0D988C10F19CEC7DFF2242 ] C:\Windows\System32\wdc.dll
18:54:47.0921 5492 C:\Windows\System32\wdc.dll - ok
18:54:47.0921 5492 [ 90438B514A5AC6A23602484A907E20A7 ] C:\Windows\System32\filemgmt.dll
18:54:47.0921 5492 C:\Windows\System32\filemgmt.dll - ok
18:54:47.0921 5492 [ 7629E9BB2FF06EACA62580A2C1D4FE6A ] C:\Windows\System32\msconfig.exe
18:54:47.0921 5492 C:\Windows\System32\msconfig.exe - ok
18:54:47.0937 5492 [ 0ADED25D371AE14665CE514E413988E7 ] C:\Windows\System32\AuthFWGP.dll
18:54:47.0937 5492 C:\Windows\System32\AuthFWGP.dll - ok
18:54:47.0937 5492 [ C3FBF2830BB3E7B594C1F01E49993F49 ] C:\Program Files\Ambient Design\ArtRage 2 Starter Edition\ArtRage 2 Starter Edition.exe
18:54:47.0937 5492 C:\Program Files\Ambient Design\ArtRage 2 Starter Edition\ArtRage 2 Starter Edition.exe - ok
18:54:47.0952 5492 [ 568D3B92044CC88C81A1E3ACF367EAD2 ] C:\Program Files\BitTorrent\bittorrent.exe
18:54:47.0952 5492 C:\Program Files\BitTorrent\bittorrent.exe - ok
18:54:47.0952 5492 [ 5A9BE134D65E5360E010343A0561F182 ] C:\Program Files\BitTorrent\uninst.exe
18:54:47.0952 5492 C:\Program Files\BitTorrent\uninst.exe - ok
18:54:47.0952 5492 [ 9E2FA2219BAE372C3461CF525C6B3FAC ] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
18:54:47.0952 5492 C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE - ok
18:54:47.0968 5492 [ 695288CB7283DDE95D5ECE4F962202F7 ] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSU.EXE
18:54:47.0968 5492 C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSU.EXE - ok
18:54:47.0968 5492 [ 61A3F0F3E34039C6531221CBA3BEFA7D ] C:\Program Files\Canon\Canon IJ Network Tool\CNMNUU.exe
18:54:47.0968 5492 C:\Program Files\Canon\Canon IJ Network Tool\CNMNUU.exe - ok
18:54:47.0983 5492 [ FCADD0CF3E4A840C0B0D906B6F74B14A ] C:\Windows\System32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP560_series\DelDrv.exe
18:54:47.0983 5492 C:\Windows\System32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP560_series\DelDrv.exe - ok
18:54:47.0983 5492 [ E2073FDBB5F137CA0A9D3DE9F91C87C6 ] C:\Windows\System32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX700_series\DelDrv.exe
18:54:47.0983 5492 C:\Windows\System32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX700_series\DelDrv.exe - ok
18:54:47.0983 5492 [ 8F54191F5F8345E995F92D538BE9ECF3 ] C:\Program Files\Canon\IJ Manual\MX700 SERIES\uninstall.exe
18:54:47.0983 5492 C:\Program Files\Canon\IJ Manual\MX700 SERIES\uninstall.exe - ok
18:54:47.0999 5492 [ D67F427114DE61D4C497BC84722EFCE7 ] C:\Program Files\Canon\Easy-PhotoPrint EX\uninst.exe
18:54:47.0999 5492 C:\Program Files\Canon\Easy-PhotoPrint EX\uninst.exe - ok
18:54:47.0999 5492 [ C4EB244C2CDF404CB56DF79482AC5514 ] C:\Program Files\Canon\MP Navigator EX 1.0\Maint.exe
18:54:47.0999 5492 C:\Program Files\Canon\MP Navigator EX 1.0\Maint.exe - ok
18:54:48.0015 5492 [ D67F427114DE61D4C497BC84722EFCE7 ] C:\Program Files\Canon\MyPrinter\uninst.exe
18:54:48.0015 5492 C:\Program Files\Canon\MyPrinter\uninst.exe - ok
18:54:48.0015 5492 [ D67F427114DE61D4C497BC84722EFCE7 ] C:\Program Files\Canon\SolutionMenu\uninst.exe
18:54:48.0015 5492 C:\Program Files\Canon\SolutionMenu\uninst.exe - ok
18:54:48.0015 5492 [ F61715A2E34BAED328A315139DEE1A08 ] C:\Program Files\Color Style Studio\ColorsReg.exe
18:54:48.0015 5492 C:\Program Files\Color Style Studio\ColorsReg.exe - ok
18:54:48.0030 5492 [ A1CA097D756AE7F36E8FE733FCD12722 ] C:\Program Files\Color Style Studio\CSettings.exe
18:54:48.0030 5492 C:\Program Files\Color Style Studio\CSettings.exe - ok
18:54:48.0030 5492 [ 03DDDC20BF3A82927151C10C07072675 ] C:\Program Files\Color Style Studio\ImModelsReg.exe
18:54:48.0030 5492 C:\Program Files\Color Style Studio\ImModelsReg.exe - ok
18:54:48.0046 5492 [ 877007102FB96AE826FE9E959CF72726 ] C:\Program Files\Color Style Studio\FieldsEditor.exe
18:54:48.0046 5492 C:\Program Files\Color Style Studio\FieldsEditor.exe - ok
18:54:48.0046 5492 [ 82AA5375CBFA3A38812E3E07DC548BDD ] C:\Windows\ColorPic Uninstaller.exe
18:54:48.0046 5492 C:\Windows\ColorPic Uninstaller.exe - ok
18:54:48.0046 5492 [ E1160FC69AF77D7300F1FA346A2C660F ] C:\Windows\System32\OEM05Cvw.crl
18:54:48.0046 5492 C:\Windows\System32\OEM05Cvw.crl - ok
18:54:48.0061 5492 [ 3BA0E38044B47567CD44B7D961837BE1 ] C:\Program Files\Softland\doPDF 7\dopdf.exe
18:54:48.0061 5492 C:\Program Files\Softland\doPDF 7\dopdf.exe - ok
18:54:48.0061 5492 [ 5E41139EC6EFBCAFFD96D46925E544AB ] C:\Windows\System32\mspatcha.dll
18:54:48.0061 5492 C:\Windows\System32\mspatcha.dll - ok
18:54:48.0077 5492 [ 0DBE261E7F933583BF0CCEB50CAAAB15 ] C:\Program Files\Softland\doPDF 7\unins000.exe
18:54:48.0077 5492 C:\Program Files\Softland\doPDF 7\unins000.exe - ok
18:54:48.0077 5492 [ 626F198768F67A0FEB3AD909E638F551 ] C:\Windows\System32\WindowsAnytimeUpgrade.exe
18:54:48.0077 5492 C:\Windows\System32\WindowsAnytimeUpgrade.exe - ok
18:54:48.0077 5492 [ 554BF617B3BBE4F2F73BF201B05438DE ] C:\Windows\System32\WindowsAnytimeUpgradeCPL.dll
18:54:48.0077 5492 C:\Windows\System32\WindowsAnytimeUpgradeCPL.dll - ok
18:54:48.0093 5492 [ 662E37A8C69DF2C0B7A06924517946C1 ] C:\Program Files\FastStone Image Viewer\uninst.exe
18:54:48.0093 5492 C:\Program Files\FastStone Image Viewer\uninst.exe - ok
18:54:48.0093 5492 [ 4304D04DFDAAE621171A2F955981016E ] C:\Program Files\Microsoft Games\Chess\Chess.exe
18:54:48.0093 5492 C:\Program Files\Microsoft Games\Chess\Chess.exe - ok
18:54:48.0108 5492 [ 21AD332BE723EFE40D9F32AD97BA8376 ] C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe
18:54:48.0108 5492 C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe - ok
18:54:48.0108 5492 [ 9A75518600FBA10980EE94267CA98489 ] C:\Windows\System32\gameux.dll
18:54:48.0108 5492 C:\Windows\System32\gameux.dll - ok
18:54:48.0108 5492 [ 6ED28075D6D9E0C0464048A30432A142 ] C:\Program Files\Microsoft Games\Hearts\Hearts.exe
18:54:48.0108 5492 C:\Program Files\Microsoft Games\Hearts\Hearts.exe - ok
18:54:48.0124 5492 [ EFF7DBEE92519EB96F70E1E31FDE7098 ] C:\Program Files\Microsoft Games\inkball\inkball.exe
18:54:48.0124 5492 C:\Program Files\Microsoft Games\inkball\inkball.exe - ok
18:54:48.0124 5492 [ 7A88900F2F11882FFCE3BF3D4EAEFB4B ] C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe
18:54:48.0124 5492 C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe - ok
18:54:48.0124 5492 [ C8C383E6AA546780B2AD3034D6F6ACEF ] C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe
18:54:48.0124 5492 C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe - ok
18:54:48.0139 5492 [ 3F903BDD206EB3C688651048B5E304E1 ] C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe
18:54:48.0139 5492 C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe - ok
18:54:48.0139 5492 [ 07302F014858D038CB93CC349505D0E6 ] C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe
18:54:48.0139 5492 C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe - ok
18:54:48.0155 5492 [ 401A203AB058DEC44BD44AA81BF2CB64 ] C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe
18:54:48.0155 5492 C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe - ok
18:54:48.0155 5492 [ E616725538326A77CE516034E1D80D66 ] C:\Program Files\HP\HP Software Update\HPWUCli.exe
18:54:48.0155 5492 C:\Program Files\HP\HP Software Update\HPWUCli.exe - ok
18:54:48.0171 5492 [ E616725538326A77CE516034E1D80D66 ] C:\Windows\Installer\{11B83AD3-7A46-4C2E-A568-9505981D4C6F}\HPSUShortcut_BB85ED9CAFC943BDB8DC258C3C7DF72E.exe
18:54:48.0171 5492 C:\Windows\Installer\{11B83AD3-7A46-4C2E-A568-9505981D4C6F}\HPSUShortcut_BB85ED9CAFC943BDB8DC258C3C7DF72E.exe - ok
18:54:48.0186 5492 [ 4A307E58F649D5DCB43B89C3AFD3A879 ] C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe
18:54:48.0186 5492 C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe - ok
18:54:48.0186 5492 [ 5C67BC54A3CA35C52019ACC108711FC8 ] C:\Program Files\Common Files\Apple\Internet Services\iCloudWeb.exe
18:54:48.0186 5492 C:\Program Files\Common Files\Apple\Internet Services\iCloudWeb.exe - ok
18:54:48.0202 5492 [ EA2B5B64A9691265FA8FC07DB9C5C12C ] C:\Program Files\Common Files\Apple\Internet Services\iCloud.exe
18:54:48.0202 5492 C:\Program Files\Common Files\Apple\Internet Services\iCloud.exe - ok
18:54:48.0217 5492 [ 7C0DADFE9A383E9E73F9048CF23374BC ] C:\Program Files\Common Files\Apple\Internet Services\PhotoStream.exe
18:54:48.0217 5492 C:\Program Files\Common Files\Apple\Internet Services\PhotoStream.exe - ok
18:54:48.0217 5492 [ 7D2E06D1473E901C5AFA93B5168715F1 ] C:\Program Files\Individual Software\Professor Answers\Professor Answers.exe
18:54:48.0217 5492 C:\Program Files\Individual Software\Professor Answers\Professor Answers.exe - ok
18:54:48.0233 5492 [ E2C9BAF1E320816A2CEC35905F8C3736 ] C:\Program Files\Individual Software\Professor Teaches Windows Vista Premium\ISI Updater.exe
18:54:48.0233 5492 C:\Program Files\Individual Software\Professor Teaches Windows Vista Premium\ISI Updater.exe - ok
18:54:48.0249 5492 [ 2AA61F5D966D7176C5984F4604ADF088 ] C:\Program Files\Individual Software\Professor Teaches Windows Vista Premium\REGISTER.EXE
18:54:48.0249 5492 C:\Program Files\Individual Software\Professor Teaches Windows Vista Premium\REGISTER.EXE - ok
18:54:48.0264 5492 [ C62A13761585F4F5BD20979C48C82F25 ] C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\Converter.exe
18:54:48.0264 5492 C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\Converter.exe - ok
18:54:48.0264 5492 [ DDD2CDFBDE83A7CB7E1FCDA6B4B976FA ] C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\rawPhoto.exe
18:54:48.0264 5492 C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\rawPhoto.exe - ok
18:54:48.0280 5492 [ 41A4B7E29BAB500D119BD3346D803755 ] C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\Viewer.exe
18:54:48.0280 5492 C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\Viewer.exe - ok
18:54:48.0295 5492 [ E1BC7BFEDC9E2B21A332E09E3825DCD5 ] C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\Setup.exe
18:54:48.0295 5492 C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\Setup.exe - ok
18:54:48.0295 5492 [ FE96E7FE9BF13725FE3014D51D816D2A ] C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\Version.exe
18:54:48.0295 5492 C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\Version.exe - ok
18:54:48.0311 5492 [ F3E42F916CBA91B2655E4835CA3DEC2D ] C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\Config.exe
18:54:48.0311 5492 C:\Program Files\John Paul Chacha's Lab\Chasys Draw IES\Config.exe - ok
18:54:48.0327 5492 [ 4A938E44BEB41641B70175DACAB1BBB0 ] C:\Windows\ehome\ehProxy.dll
18:54:48.0327 5492 C:\Windows\ehome\ehProxy.dll - ok
18:54:48.0327 5492 [ FD99CF5D637113D6857213FA7F57A1A4 ] C:\Program Files\Common Files\LightScribe\LSLauncher.exe
18:54:48.0327 5492 C:\Program Files\Common Files\LightScribe\LSLauncher.exe - ok
18:54:48.0342 5492 [ 09B689E7601B608EF3326CD63940B46D ] C:\Windows\Installer\{E6CFBFB5-9232-410C-B353-AF6E614B2681}\NewShortcut2_C673DF680CDE41FC9DFBF63D31DE4F28.exe
18:54:48.0342 5492 C:\Windows\Installer\{E6CFBFB5-9232-410C-B353-AF6E614B2681}\NewShortcut2_C673DF680CDE41FC9DFBF63D31DE4F28.exe - ok
18:54:48.0358 5492 [ BD89A9D4A3D265E722A0274D743F1357 ] C:\Program Files\CyberLink\LabelPrint\LabelPrint.exe
18:54:48.0358 5492 C:\Program Files\CyberLink\LabelPrint\LabelPrint.exe - ok
18:54:48.0358 5492 [ 6FD87AF132064CDA05AE934FF6588F3A ] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
18:54:48.0358 5492 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe - ok
18:54:48.0373 5492 [ CC4094AFBBDB7488A0D6D018FBC7778A ] C:\Windows\Installer\{E6CFBFB5-9232-410C-B353-AF6E614B2681}\NewShortcut1_FE82206EF6124B479F4EDD27A1E056A4.exe
18:54:48.0373 5492 C:\Windows\Installer\{E6CFBFB5-9232-410C-B353-AF6E614B2681}\NewShortcut1_FE82206EF6124B479F4EDD27A1E056A4.exe - ok
18:54:48.0389 5492 [ C98A568451384331CC47AB5896590360 ] C:\Program Files\LightScribeTemplateLabeler\TemplateLabeler.exe
18:54:48.0389 5492 C:\Program Files\LightScribeTemplateLabeler\TemplateLabeler.exe - ok
18:54:48.0389 5492 [ 65446C52E140C417277404D14BD6E51E ] C:\Windows\Installer\{3EBA6E7C-3DF6-48AE-B87B-4CAFB2C1C3F7}\NewShortcut1_3BC5BC30773746439FA3047F389574CE.exe
18:54:48.0389 5492 C:\Windows\Installer\{3EBA6E7C-3DF6-48AE-B87B-4CAFB2C1C3F7}\NewShortcut1_3BC5BC30773746439FA3047F389574CE.exe - ok
18:54:48.0405 5492 [ BF899F57858B8C6F162D9EEB2370641C ] C:\Windows\System32\wercon.exe
18:54:48.0405 5492 C:\Windows\System32\wercon.exe - ok
18:54:48.0405 5492 [ 4BC63466E104393AE3A4729B8122D299 ] C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\HelpMain\Main_help.dll
18:54:48.0405 5492 C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\HelpMain\Main_help.dll - ok
18:54:48.0420 5492 [ 8FAD04A00BFE6977AA4743C067364B5F ] C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll
18:54:48.0420 5492 C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll - ok
18:54:48.0420 5492 [ CEF58ABD7D7CC34431C9AD79D123F37D ] C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll
18:54:48.0420 5492 C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll - ok
18:54:48.0420 5492 [ CA6ADE4F7761BB15B3325356DC3B82BB ] C:\Windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_4bf7e3e2bf9ada4c\mfc90u.dll
18:54:48.0420 5492 C:\Windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_4bf7e3e2bf9ada4c\mfc90u.dll - ok
18:54:48.0436 5492 [ 3141224EEBA075BC085175E60CD14782 ] C:\Windows\System32\msra.exe
18:54:48.0436 5492 C:\Windows\System32\msra.exe - ok
18:54:48.0436 5492 [ 37CF3324F46CEB3A4F2686C617CBB35C ] C:\Program Files\Common Files\Apple\Mobile Device Support\iTunesMobileDevice.dll
18:54:48.0436 5492 C:\Program Files\Common Files\Apple\Mobile Device Support\iTunesMobileDevice.dll - ok
18:54:48.0451 5492 [ D960AB4131A0568ED12C6BCEDA95F618 ] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxt.dll
18:54:48.0451 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxt.dll - ok
18:54:48.0451 5492 [ B68770B9ED42428A11DE53796EC46BB0 ] C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe
18:54:48.0451 5492 C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe - ok
18:54:48.0451 5492 [ E3E71649A926CB34FA4D7AB75DCE126C ] C:\Program Files\iPod\bin\iPodService.exe
18:54:48.0451 5492 C:\Program Files\iPod\bin\iPodService.exe - ok
18:54:48.0467 5492 [ 08457294C7E98C5D3E5EE8CDC25FA537 ] C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\accicons.exe
18:54:48.0467 5492 C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\accicons.exe - ok
18:54:48.0467 5492 [ 21EF4BB2A6FF4116FD83FAEE52D4A416 ] C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\xlicons.exe
18:54:48.0467 5492 C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\xlicons.exe - ok
18:54:48.0483 5492 [ BFE69C991171F6527B5BF625ED048471 ] C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\inficon.exe
18:54:48.0483 5492 C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\inficon.exe - ok
18:54:48.0483 5492 [ 7E2CF680C69680064D43F4FFE5831DD1 ] C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\joticon.exe
18:54:48.0483 5492 C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\joticon.exe - ok
18:54:48.0498 5492 [ C0F4A57BA5E09A28AE3D2F67ED219EEA ] C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\pptico.exe
18:54:48.0498 5492 C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\pptico.exe - ok
18:54:48.0498 5492 [ FF6669F7A1782D54E338F5C6EC806E1E ] C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\misc.exe
18:54:48.0498 5492 C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\misc.exe - ok
18:54:48.0498 5492 [ E1AB2AC4A4D50B479DF1B1CEA4A7409B ] C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\cagicon.exe
18:54:48.0498 5492 C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\cagicon.exe - ok
18:54:48.0514 5492 [ 3E5AA6A816FA331E64C38A45C6FF5637 ] C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\oisicon.exe
18:54:48.0514 5492 C:\Windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\oisicon.exe - ok
18:54:48.0514 5492 [ F721DA9797379AD77617E754E3334376 ] C:\Program Files\Microsoft Silverlight\5.1.20125.0\Silverlight.Configuration.exe
18:54:48.0514 5492 C:\Program Files\Microsoft Silverlight\5.1.20125.0\Silverlight.Configuration.exe - ok
18:54:48.0529 5492 [ 1BE86CAA2F2B22AFFADC5758AA24E015 ] C:\Windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIconDll
18:54:48.0529 5492 C:\Windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIconDll - ok
18:54:48.0529 5492 [ 206EE4B42D11585EB53C47FB69F69E54 ] C:\Windows\Installer\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}\WksCal.exe
18:54:48.0529 5492 C:\Windows\Installer\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}\WksCal.exe - ok
18:54:48.0545 5492 [ 8BC00165083171F8DE760AE39D76D003 ] C:\Windows\Installer\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}\wksdb.exe
18:54:48.0545 5492 C:\Windows\Installer\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}\wksdb.exe - ok
18:54:48.0545 5492 [ 528DA0632ACC3EC0DABF0EE8F1DD5C20 ] C:\Windows\Installer\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}\WksSb.exe
18:54:48.0545 5492 C:\Windows\Installer\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}\WksSb.exe - ok
18:54:48.0545 5492 [ 08BC7211E4E06A47CAC85D5A73D006E2 ] C:\Windows\Installer\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}\wksss.exe
18:54:48.0545 5492 C:\Windows\Installer\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}\wksss.exe - ok
18:54:48.0561 5492 [ 5C373483418D410C75BD3E53FEEC9070 ] C:\Windows\Installer\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}\WksWP.exe
18:54:48.0561 5492 C:\Windows\Installer\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}\WksWP.exe - ok
18:54:48.0561 5492 [ 6F9B53B68FAF0317DE68B992FBEF43EE ] C:\Program Files\muvee Technologies\muvee autoProducer 6.1 - HPD\muveeapp.exe
18:54:48.0561 5492 C:\Program Files\muvee Technologies\muvee autoProducer 6.1 - HPD\muveeapp.exe - ok
18:54:48.0576 5492 [ 130203D3313A0323DC333B941C3AA87A ] C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll
18:54:48.0576 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll - ok
18:54:48.0576 5492 [ E01A3A0B77F1C01F0C1289AC29114AEE ] C:\Program Files\Common Files\Pure Networks Shared\Platform\11.2.09195.1.nmcorePS.dll
18:54:48.0576 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\11.2.09195.1.nmcorePS.dll - ok
18:54:48.0576 5492 [ 7F7812941DAF35862E6BA0BDDD324D8D ] C:\Program Files\muvee Technologies\muvee autoProducer 6.1 - HPD\LaunchHelp.exe
18:54:48.0576 5492 C:\Program Files\muvee Technologies\muvee autoProducer 6.1 - HPD\LaunchHelp.exe - ok
18:54:48.0592 5492 [ A2A73BDE9CE44FE01FD32DDFBE2763A7 ] C:\Program Files\muvee Technologies\muvee autoProducer 6.1 - HPD\LaunchFlash.exe
18:54:48.0592 5492 C:\Program Files\muvee Technologies\muvee autoProducer 6.1 - HPD\LaunchFlash.exe - ok
18:54:48.0592 5492 [ 7B8851E5CEA4B4AE704C709A30F406C2 ] C:\Program Files\NoteTab Light\unins000.exe
18:54:48.0592 5492 C:\Program Files\NoteTab Light\unins000.exe - ok
18:54:48.0607 5492 [ AC4BE6114FEB2B225D92BAE8D11ACFE4 ] C:\Program Files\Online Services\Netzero_du_ca\NetZeroHSSetup.exe
18:54:48.0607 5492 C:\Program Files\Online Services\Netzero_du_ca\NetZeroHSSetup.exe - ok
18:54:48.0607 5492 [ AC4BE6114FEB2B225D92BAE8D11ACFE4 ] C:\Program Files\Online Services\Netzero_Acc_ca\NetZeroHSSetup.exe
18:54:48.0607 5492 C:\Program Files\Online Services\Netzero_Acc_ca\NetZeroHSSetup.exe - ok
18:54:48.0623 5492 [ EAF54CDB76D19D6586D5BDBECF8DE5A3 ] C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\CameraHelperUI.dll
18:54:48.0623 5492 C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\CameraHelperUI.dll - ok
18:54:48.0623 5492 [ 44750400065E54491115D85B7FD6E204 ] C:\Program Files\Online Services\EarthLink\InstallEarthLink.exe
18:54:48.0623 5492 C:\Program Files\Online Services\EarthLink\InstallEarthLink.exe - ok
18:54:48.0639 5492 [ 00F3DC848586750301F390169D9C1D7B ] C:\Program Files\Online Services\EarthLink\EarthLink Setup.exe
18:54:48.0639 5492 C:\Program Files\Online Services\EarthLink\EarthLink Setup.exe - ok
18:54:48.0639 5492 [ 928DA6D3AA629966F0DB510EFDF67340 ] C:\Program Files\Online Services\JunoUS\JunoTurboSetup.exe
18:54:48.0639 5492 C:\Program Files\Online Services\JunoUS\JunoTurboSetup.exe - ok
18:54:48.0654 5492 [ AC4BE6114FEB2B225D92BAE8D11ACFE4 ] C:\Program Files\Online Services\NetzeroUS_du\NetZeroHSSetup.exe
18:54:48.0654 5492 C:\Program Files\Online Services\NetzeroUS_du\NetZeroHSSetup.exe - ok
18:54:48.0654 5492 [ AC4BE6114FEB2B225D92BAE8D11ACFE4 ] C:\Program Files\Online Services\NetzeroUS_Acc\NetZeroHSSetup.exe
18:54:48.0654 5492 C:\Program Files\Online Services\NetzeroUS_Acc\NetZeroHSSetup.exe - ok
18:54:48.0654 5492 [ FF60C47DAF6A69CC637AB659D29A185A ] C:\Program Files\Online Services\Aolus\InstallAol.exe
18:54:48.0654 5492 C:\Program Files\Online Services\Aolus\InstallAol.exe - ok
18:54:48.0670 5492 [ 2E9657672BAB283E29ACF41E23DB7C94 ] C:\Program Files\OpenOffice.org 2.4\program\sbase.exe
18:54:48.0670 5492 C:\Program Files\OpenOffice.org 2.4\program\sbase.exe - ok
18:54:48.0670 5492 [ 71606E2D42BA575D0C387C6163CB35ED ] C:\Program Files\OpenOffice.org 2.4\program\scalc.exe
18:54:48.0670 5492 C:\Program Files\OpenOffice.org 2.4\program\scalc.exe - ok
18:54:48.0670 5492 [ 1AFAA90E94179157160D77B9807EC1CC ] C:\Program Files\OpenOffice.org 2.4\program\sdraw.exe
18:54:48.0670 5492 C:\Program Files\OpenOffice.org 2.4\program\sdraw.exe - ok
18:54:48.0685 5492 [ 4FE3D2FCA33D031CA3BBADA316CBEAD8 ] C:\Program Files\OpenOffice.org 2.4\program\simpress.exe
18:54:48.0685 5492 C:\Program Files\OpenOffice.org 2.4\program\simpress.exe - ok
18:54:48.0685 5492 [ D91EB24D2F6F258A05C5EEF2C06901FA ] C:\Program Files\OpenOffice.org 2.4\program\smath.exe
18:54:48.0685 5492 C:\Program Files\OpenOffice.org 2.4\program\smath.exe - ok
18:54:48.0701 5492 [ BA950F7B3D97031A203D570BAB3D632C ] C:\Program Files\OpenOffice.org 2.4\program\swriter.exe
18:54:48.0701 5492 C:\Program Files\OpenOffice.org 2.4\program\swriter.exe - ok
18:54:48.0701 5492 [ 2277871D6CAB9FBBE90EA0F51166143A ] C:\hp\support\HPSysInfo.exe
18:54:48.0701 5492 C:\hp\support\HPSysInfo.exe - ok
18:54:48.0701 5492 [ 68EA19E1F5D51E6F0E7125A115EE9223 ] C:\Windows\SMINST\CD Creator.exe
18:54:48.0701 5492 C:\Windows\SMINST\CD Creator.exe - ok
18:54:48.0717 5492 [ 9CFA020E00262841C85618CE50B5DCFF ] C:\Windows\SMINST\Restore7.exe
18:54:48.0717 5492 C:\Windows\SMINST\Restore7.exe - ok
18:54:48.0717 5492 [ 628128EC5FBE77F5B9202B5F602D683D ] C:\Program Files\iPod\bin\iPodService.Resources\iPodService.dll
18:54:48.0717 5492 C:\Program Files\iPod\bin\iPodService.Resources\iPodService.dll - ok
18:54:48.0732 5492 [ 7698F96B92B071C51D96201DA42B4A52 ] C:\Program Files\iPod\bin\iPodService.Resources\en.lproj\iPodServiceLocalized.dll
18:54:48.0732 5492 C:\Program Files\iPod\bin\iPodService.Resources\en.lproj\iPodServiceLocalized.dll - ok
18:54:48.0732 5492 [ 4ED98C230294041EA9EDFE7462ABB972 ] C:\Program Files\Photo Effect Studio\unins000.exe
18:54:48.0732 5492 C:\Program Files\Photo Effect Studio\unins000.exe - ok
18:54:48.0732 5492 [ 0BD8F90130C1C347A642C629B17B1CE3 ] C:\Program Files\Google\Picasa3\PicasaPhotoViewer.exe
18:54:48.0732 5492 C:\Program Files\Google\Picasa3\PicasaPhotoViewer.exe - ok
18:54:48.0748 5492 [ 59B5B68435E53BA2D251A28BA96E5101 ] C:\Program Files\Google\Picasa3\Uninstall.exe
18:54:48.0748 5492 C:\Program Files\Google\Picasa3\Uninstall.exe - ok
18:54:48.0748 5492 [ 1687F6DE43055AFFD36474859BA22C54 ] C:\Program Files\PowerISO\uninstall.exe
18:54:48.0748 5492 C:\Program Files\PowerISO\uninstall.exe - ok
18:54:48.0763 5492 [ 4F2E398A7048E9059679481C14EF0B0C ] C:\Program Files\NewSoft\Presto! PageManager 7.15\Convert.exe
18:54:48.0763 5492 C:\Program Files\NewSoft\Presto! PageManager 7.15\Convert.exe - ok
18:54:48.0779 5492 [ F8A362B8F164B6362488D9CA07DFC9C9 ] C:\Program Files\Privoxy\privoxy_uninstall.exe
18:54:48.0779 5492 C:\Program Files\Privoxy\privoxy_uninstall.exe - ok
18:54:48.0779 5492 [ C559672F31ABE6BA7277DD73C4502238 ] C:\Windows\System32\msiexec.exe
18:54:48.0779 5492 C:\Windows\System32\msiexec.exe - ok
18:54:48.0795 5492 [ 0C0BC8F1EEB979605754176CA36BB87D ] C:\Program Files\RegCure\uninst.exe
18:54:48.0795 5492 C:\Program Files\RegCure\uninst.exe - ok
18:54:48.0795 5492 [ CF514CE8A21808ABD84CE8F307B02BDD ] C:\Program Files\Common Files\Pure Networks Shared\Platform\11.2.09195.1.nmctxtPS.dll
18:54:48.0795 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\11.2.09195.1.nmctxtPS.dll - ok
18:54:48.0810 5492 [ C4B99E802989AEB93051B278547BCE90 ] C:\Program Files\ScanSoft\OmniPageSE4\OmniPage.exe
18:54:48.0810 5492 C:\Program Files\ScanSoft\OmniPageSE4\OmniPage.exe - ok
18:54:48.0826 5492 [ DE60BC80B8F723EF15BD521ED473FC29 ] C:\Windows\Installer\{B2F3DBD9-A9D2-4838-B45D-C917DAB32BC3}\NewShortcut15_27BC537B086D42E19CB39D115FA043BF.exe
18:54:48.0826 5492 C:\Windows\Installer\{B2F3DBD9-A9D2-4838-B45D-C917DAB32BC3}\NewShortcut15_27BC537B086D42E19CB39D115FA043BF.exe - ok
18:54:48.0841 5492 [ 1128417E0C92A53704C4ACA86F4A6995 ] C:\Program Files\ScanSoft\OmniPageSE4\ScannerWizard.exe
18:54:48.0841 5492 C:\Program Files\ScanSoft\OmniPageSE4\ScannerWizard.exe - ok
18:54:48.0841 5492 [ E4F674A05F9E58CF04B05ED48ED29299 ] C:\Windows\Installer\{B2F3DBD9-A9D2-4838-B45D-C917DAB32BC3}\NewShortcut2_03F5AFAB31864557B26FA1619E6E19CD.pdf
18:54:48.0841 5492 C:\Windows\Installer\{B2F3DBD9-A9D2-4838-B45D-C917DAB32BC3}\NewShortcut2_03F5AFAB31864557B26FA1619E6E19CD.pdf - ok
18:54:48.0841 5492 [ 7198CEAC5A21834B53BD156196C968A0 ] C:\Program Files\Security Task Manager\Setup.exe
18:54:48.0841 5492 C:\Program Files\Security Task Manager\Setup.exe - ok
18:54:48.0857 5492 [ E401BFFF6F4894A73D4F8F37D48950C5 ] C:\Program Files\Linksys\Linksys Wireless Manager\lcid\1033\nmasrsrc.dll
18:54:48.0857 5492 C:\Program Files\Linksys\Linksys Wireless Manager\lcid\1033\nmasrsrc.dll - ok
18:54:48.0857 5492 [ 7F140B1A02C33C116C638D183E561656 ] C:\Program Files\Security Task Manager\TaskMan.exe
18:54:48.0857 5492 C:\Program Files\Security Task Manager\TaskMan.exe - ok
18:54:48.0873 5492 [ 6358BB7AD64E28755784F325BF19BF72 ] C:\Program Files\Security Task Manager\SpyProtector.exe
18:54:48.0873 5492 C:\Program Files\Security Task Manager\SpyProtector.exe - ok
18:54:48.0873 5492 [ 376F3FF24CB45FAEC3C615E48A176B3D ] C:\Program Files\Security Task Manager\uninstal.exe
18:54:48.0873 5492 C:\Program Files\Security Task Manager\uninstal.exe - ok
18:54:48.0888 5492 [ 7F20C0BF9277426022CF63EA4A04F9DD ] C:\ProgramData\WeCareReminder\ChromeRemove.exe
18:54:48.0888 5492 C:\ProgramData\WeCareReminder\ChromeRemove.exe - ok
18:54:48.0888 5492 [ 1B50F466F2696F5445AB1FCF416AF226 ] C:\Program Files\WinPcap\Uninstall.exe
18:54:48.0888 5492 C:\Program Files\WinPcap\Uninstall.exe - ok
18:54:48.0888 5492 [ 644579C375F63692FC313A09BE7EFB27 ] C:\Program Files\Common Files\Pure Networks Shared\Platform\AVManagerUnified.dll
18:54:48.0888 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\AVManagerUnified.dll - ok
18:54:48.0904 5492 [ FBFCA1A574D47EE575448B719CBBF2E4 ] C:\Windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_49768ef57548175e\MFC90ENU.DLL
18:54:48.0904 5492 C:\Windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_49768ef57548175e\MFC90ENU.DLL - ok
18:54:48.0904 5492 [ 56DB34F4DC39CECBC871A895C6FCF1C3 ] C:\Program Files\AVAST Software\Avast\aswAra.dll
18:54:48.0904 5492 C:\Program Files\AVAST Software\Avast\aswAra.dll - ok
18:54:48.0919 5492 [ 9D65F8999D15EAB0CC8229D41DF7EC64 ] C:\Program Files\Linksys\Linksys Wireless Manager\x86\difxapi.dll
18:54:48.0919 5492 C:\Program Files\Linksys\Linksys Wireless Manager\x86\difxapi.dll - ok
18:54:48.0919 5492 [ 8ED6DA45BAB5CFC809229F26D4D4A2CE ] C:\Program Files\AVAST Software\Avast\libeay32.dll
18:54:48.0919 5492 C:\Program Files\AVAST Software\Avast\libeay32.dll - ok
18:54:48.0935 5492 [ 44BD658E0E4D21C42023AD9EBEFFDB90 ] C:\Program Files\AVAST Software\Avast\ssleay32.dll
18:54:48.0935 5492 C:\Program Files\AVAST Software\Avast\ssleay32.dll - ok
18:54:48.0935 5492 [ 3851909899A5E6210C58DB9CC02068D3 ] C:\Program Files\AVAST Software\Avast\aswData.dll
18:54:48.0935 5492 C:\Program Files\AVAST Software\Avast\aswData.dll - ok
18:54:48.0935 5492 [ BDC0C99E472176C8C2C853A68ADC5073 ] C:\Windows\System32\wups2.dll
18:54:48.0935 5492 C:\Windows\System32\wups2.dll - ok
18:54:48.0951 5492 [ 3BEBF344E8802E89DD7FC24135C38315 ] C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\CameraControlsUI.dll
18:54:48.0951 5492 C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\CameraControlsUI.dll - ok
18:54:48.0951 5492 [ A3BB91467FBDDA34039686C95A31C8C2 ] C:\Program Files\AVAST Software\Avast\1033\uiLangRes.dll
18:54:48.0951 5492 C:\Program Files\AVAST Software\Avast\1033\uiLangRes.dll - ok
18:54:48.0951 5492 [ 5684CD3B207C1668DEE6BD2802C25B19 ] C:\Program Files\AVAST Software\Avast\CommonRes.dll
18:54:48.0951 5492 C:\Program Files\AVAST Software\Avast\CommonRes.dll - ok
18:54:48.0966 5492 [ 9AA71850A5CA7DE612DCAF8AC93A3355 ] C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\VFXCore.dll
18:54:48.0966 5492 C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\VFXCore.dll - ok
18:54:48.0966 5492 [ 34489A2258CCF7637192169FB0949CC9 ] C:\Program Files\Common Files\Pure Networks Shared\Platform\FWManager.dll
18:54:48.0966 5492 C:\Program Files\Common Files\Pure Networks Shared\Platform\FWManager.dll - ok
18:54:48.0982 5492 [ A1AAC0D6828D2A69A952321AA9950A47 ] C:\Windows\System32\netsh.exe
18:54:48.0982 5492 C:\Windows\System32\netsh.exe - ok
18:54:48.0982 5492 [ 16D2A7921649EAFE90DF6E50CD55D022 ] C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\CameraControls_Core.dll
18:54:48.0982 5492 C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\CameraControls_Core.dll - ok
18:54:48.0997 5492 [ 907484E1017E4C98C3E73464DC9EBB5F ] C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\VideoEffects.dll
18:54:48.0997 5492 C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\VideoEffects.dll - ok
18:54:48.0997 5492 [ 060D77BFD6076EFD7029DB2B3F63B202 ] C:\Windows\System32\fwcfg.dll
18:54:48.0997 5492 C:\Windows\System32\fwcfg.dll - ok
18:54:48.0997 5492 [ F824AB6B4F32CDA2F1750D3D9F5318B7 ] C:\Windows\System32\Firewall.cpl
18:54:48.0997 5492 C:\Windows\System32\Firewall.cpl - ok
18:54:49.0013 5492 [ F3CD3269896D64ECAEA4CA34BCEAC381 ] C:\Program Files\AVAST Software\Avast\snxhk.dll
18:54:49.0013 5492 C:\Program Files\AVAST Software\Avast\snxhk.dll - ok
18:54:49.0013 5492 [ 27B873A624C65E12A253D865FFD1F685 ] C:\Program Files\Google\Chrome\Application\27.0.1453.116\chrome.dll
18:54:49.0013 5492 C:\Program Files\Google\Chrome\Application\27.0.1453.116\chrome.dll - ok
18:54:49.0029 5492 [ E202B6E55B42A709886481F0DA53212D ] C:\Program Files\AVAST Software\Avast\aswJsFlt.dll
18:54:49.0029 5492 C:\Program Files\AVAST Software\Avast\aswJsFlt.dll - ok
18:54:49.0029 5492 [ C1B26E8D34B6245F9F66B42B3998E4DF ] C:\Program Files\Google\Chrome\Application\27.0.1453.116\icudt.dll
18:54:49.0029 5492 C:\Program Files\Google\Chrome\Application\27.0.1453.116\icudt.dll - ok
18:54:49.0044 5492 [ 714BBABD673A433805BB414F42FDB722 ] C:\Windows\System32\prntvpt.dll
18:54:49.0044 5492 C:\Windows\System32\prntvpt.dll - ok
18:54:49.0044 5492 [ 9D8F3B5E2FACDAF0183CAA834AAD7171 ] C:\Windows\System32\Macromed\Flash\Flash32_11_7_700_169.ocx
18:54:49.0044 5492 C:\Windows\System32\Macromed\Flash\Flash32_11_7_700_169.ocx - ok
18:54:49.0044 5492 [ 55FE8FAC73A5BFEDDBB507DA2C592FBB ] C:\Windows\System32\spool\drivers\w32x86\3\msonpdrv.dll
18:54:49.0044 5492 C:\Windows\System32\spool\drivers\w32x86\3\msonpdrv.dll - ok
18:54:49.0060 5492 [ 4C52847B1D3C4B9A9DE31C899841BA91 ] C:\Windows\System32\spool\drivers\w32x86\3\UNIDRV.DLL
18:54:49.0060 5492 C:\Windows\System32\spool\drivers\w32x86\3\UNIDRV.DLL - ok
18:54:49.0060 5492 [ E92B1E9547EE8C46C044E1A85F99377B ] C:\Windows\System32\spool\drivers\w32x86\3\mxdwdrv.dll
18:54:49.0060 5492 C:\Windows\System32\spool\drivers\w32x86\3\mxdwdrv.dll - ok
18:54:49.0075 5492 [ 9689D0FFFCE5645B697D0BA86A849DA6 ] C:\Windows\System32\spool\drivers\w32x86\3\dopdfpr7.dll
18:54:49.0075 5492 C:\Windows\System32\spool\drivers\w32x86\3\dopdfpr7.dll - ok
18:54:49.0075 5492 [ 13820B972D74B3DE4F6552A57AC799A7 ] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon_main.dll
18:54:49.0075 5492 C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon_main.dll - ok
18:54:49.0091 5492 [ A3333049C92CC656033E793AB96B9590 ] C:\Windows\System32\spool\drivers\w32x86\3\CNMDR95.DLL
18:54:49.0091 5492 C:\Windows\System32\spool\drivers\w32x86\3\CNMDR95.DLL - ok
18:54:49.0091 5492 [ A5FF4C0602D6A3A17F51FA2DF22C088B ] C:\Windows\System32\spool\drivers\w32x86\3\CNCF2Ge.dll
18:54:49.0091 5492 C:\Windows\System32\spool\drivers\w32x86\3\CNCF2Ge.dll - ok
18:54:49.0091 5492 [ 545018C88A1C420573E646125C690AD8 ] C:\Windows\System32\spool\drivers\w32x86\3\CNMDRA0.DLL
18:54:49.0091 5492 C:\Windows\System32\spool\drivers\w32x86\3\CNMDRA0.DLL - ok
18:54:49.0107 5492 [ 3A2EEE8444A8E5C1A454C57B2198F5FC ] C:\Windows\System32\ntlanman.dll
18:54:49.0107 5492 C:\Windows\System32\ntlanman.dll - ok
18:54:49.0107 5492 [ 582EFE56FC0858E58A6CEBA2A64B02C7 ] C:\Windows\System32\drprov.dll
18:54:49.0107 5492 C:\Windows\System32\drprov.dll - ok
18:54:49.0122 5492 [ CFBD2E1FE18B50748A76703A2DC6D4E3 ] C:\Windows\System32\davclnt.dll
18:54:49.0122 5492 C:\Windows\System32\davclnt.dll - ok
18:54:49.0122 5492 [ 00F00E9A7C416B3C1D87FE640D124BE1 ] C:\Program Files\Google\Chrome\Application\27.0.1453.116\pdf.dll
18:54:49.0122 5492 C:\Program Files\Google\Chrome\Application\27.0.1453.116\pdf.dll - ok
18:54:49.0122 5492 [ 8A639A8A43B031B0BCDD1C164C681315 ] C:\Windows\System32\spool\drivers\w32x86\3\CNMUIA0.DLL
18:54:49.0122 5492 C:\Windows\System32\spool\drivers\w32x86\3\CNMUIA0.DLL - ok
18:54:49.0138 5492 [ 3279AE608749A1A730811DACB6D30849 ] C:\Windows\System32\spool\drivers\w32x86\3\CNMCPA0.DLL
18:54:49.0138 5492 C:\Windows\System32\spool\drivers\w32x86\3\CNMCPA0.DLL - ok
18:54:49.0138 5492 [ CBA7CF140B167FB9B5ED11A5902E1F86 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0401\CNMurA0.dll
18:54:49.0138 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0401\CNMurA0.dll - ok
18:54:49.0153 5492 [ 420A29820B44FE8E950B8B6C7FAE14F1 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0404\CNMurA0.dll
18:54:49.0153 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0404\CNMurA0.dll - ok
18:54:49.0153 5492 [ 50EAF1EADCEA9B897073AECAAA04D874 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0405\CNMurA0.dll
18:54:49.0153 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0405\CNMurA0.dll - ok
18:54:49.0169 5492 [ 999E4A0F5E3460AD9AD874E7E41125BA ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0406\CNMurA0.dll
18:54:49.0169 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0406\CNMurA0.dll - ok
18:54:49.0169 5492 [ 93BFD1F54B06BAF0C55518B876077A2B ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0407\CNMurA0.dll
18:54:49.0169 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0407\CNMurA0.dll - ok
18:54:49.0185 5492 [ 3586E688E06EC137CAE2CBD88B37431F ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0408\CNMurA0.dll
18:54:49.0185 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0408\CNMurA0.dll - ok
18:54:49.0185 5492 [ FD8B87F7FCFBAAF14F9110C62EF85BDA ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0409\CNMurA0.dll
18:54:49.0185 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0409\CNMurA0.dll - ok
18:54:49.0200 5492 [ E73107D07DCD3B130C80B638734A9F91 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\040b\CNMurA0.dll
18:54:49.0200 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\040b\CNMurA0.dll - ok
18:54:49.0200 5492 [ 144678D508E78AF6683A16854AFE1BD7 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\040c\CNMurA0.dll
18:54:49.0200 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\040c\CNMurA0.dll - ok
18:54:49.0200 5492 [ 054685D216469AF6647A2EFFDC9AC2CB ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\040e\CNMurA0.dll
18:54:49.0200 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\040e\CNMurA0.dll - ok
18:54:49.0216 5492 [ D8019F434C9B91FBF3E964738322647E ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0410\CNMurA0.dll
18:54:49.0216 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0410\CNMurA0.dll - ok
18:54:49.0216 5492 [ 1460334356E7464D54A18CDF58C77962 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0411\CNMurA0.dll
18:54:49.0216 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0411\CNMurA0.dll - ok
18:54:49.0231 5492 [ E642504891A09F716791F7277E370953 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0412\CNMurA0.dll
18:54:49.0231 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0412\CNMurA0.dll - ok
18:54:49.0231 5492 [ 1F5C3EE60299EECB268844703BCF5815 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0413\CNMurA0.dll
18:54:49.0231 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0413\CNMurA0.dll - ok
18:54:49.0247 5492 [ 2E65ED8608826407403599E83EC22125 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0414\CNMurA0.dll
18:54:49.0247 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0414\CNMurA0.dll - ok
18:54:49.0247 5492 [ C791019956C3A3A81FBCA3A44D969A85 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0415\CNMurA0.dll
18:54:49.0247 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0415\CNMurA0.dll - ok
18:54:49.0247 5492 [ 94F8D325ED75BE9565BE78BB35BE0237 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0419\CNMurA0.dll
18:54:49.0247 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0419\CNMurA0.dll - ok
18:54:49.0263 5492 [ AFAE6E1E35031DAC38045819749F95E1 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\041D\CNMurA0.dll
18:54:49.0263 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\041D\CNMurA0.dll - ok
18:54:49.0263 5492 [ 3ABF2433B50D17FDB4FC512D11E476E4 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\041E\CNMurA0.dll
18:54:49.0263 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\041E\CNMurA0.dll - ok
18:54:49.0278 5492 [ B0121335804BA2B5FFCF6B2DED86039E ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\041F\CNMurA0.dll
18:54:49.0278 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\041F\CNMurA0.dll - ok
18:54:49.0278 5492 [ 963C63A51149B6A6AC67712FB099F4DB ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0421\CNMurA0.dll
18:54:49.0278 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0421\CNMurA0.dll - ok
18:54:49.0294 5492 [ A89E17BFA59C1D990F859A8CF162807D ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0804\CNMurA0.dll
18:54:49.0294 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0804\CNMurA0.dll - ok
18:54:49.0294 5492 [ 68BD28EFFD097C71E32E911236CE66A0 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0816\CNMurA0.dll
18:54:49.0294 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0816\CNMurA0.dll - ok
18:54:49.0309 5492 [ 3F99215C91722D8A1921309822E53FA8 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0c0a\CNMurA0.dll
18:54:49.0309 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MP560 series Printer\LanguageModules\0c0a\CNMurA0.dll - ok
18:54:49.0309 5492 [ 58E57D6E1D3E498D149BC8B5E1D98596 ] C:\Windows\System32\spool\drivers\w32x86\3\CNMUBA0.DLL
18:54:49.0309 5492 C:\Windows\System32\spool\drivers\w32x86\3\CNMUBA0.DLL - ok
18:54:49.0325 5492 [ 484AA49B35405AF338EFD1C5EA8A0C43 ] C:\Windows\System32\spool\drivers\w32x86\3\CNCF2Ue.dll
18:54:49.0325 5492 C:\Windows\System32\spool\drivers\w32x86\3\CNCF2Ue.dll - ok
18:54:49.0325 5492 [ 7BEAFB273E20D8A5F2633D12776F75E2 ] C:\Windows\System32\spool\drivers\w32x86\3\dopdfui7.dll
18:54:49.0325 5492 C:\Windows\System32\spool\drivers\w32x86\3\dopdfui7.dll - ok
18:54:49.0325 5492 [ F63819344F8777411591058263FD9688 ] C:\Windows\System32\spool\drivers\w32x86\3\CNMUI95.DLL
18:54:49.0325 5492 C:\Windows\System32\spool\drivers\w32x86\3\CNMUI95.DLL - ok
18:54:49.0341 5492 [ 8598D8AF83E7F14AA3967AAA7180FFA7 ] C:\Windows\System32\spool\drivers\w32x86\3\unidrvui.dll
18:54:49.0341 5492 C:\Windows\System32\spool\drivers\w32x86\3\unidrvui.dll - ok
18:54:49.0341 5492 [ C4F4CCE4B87D0DCEFE0A82DC17EE697A ] C:\Windows\System32\spool\drivers\w32x86\3\CNMCP95.DLL
18:54:49.0341 5492 C:\Windows\System32\spool\drivers\w32x86\3\CNMCP95.DLL - ok
18:54:49.0356 5492 [ 255067890FB0D4666DB013DBDBC86969 ] C:\Windows\System32\spool\drivers\w32x86\3\msonpui.dll
18:54:49.0356 5492 C:\Windows\System32\spool\drivers\w32x86\3\msonpui.dll - ok
18:54:49.0356 5492 [ 0970F9E08668FF9EE1EA71A140A4D841 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MX700 series Printer\LanguageModules\0409\CNMur95.dll
18:54:49.0356 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MX700 series Printer\LanguageModules\0409\CNMur95.dll - ok
18:54:49.0372 5492 [ 2310A32BB0164552A311BFA02102A3D6 ] C:\Windows\System32\msvcp60.dll
18:54:49.0372 5492 C:\Windows\System32\msvcp60.dll - ok
18:54:49.0372 5492 [ D73CA7281036C7F48710CB107D149C6A ] C:\Windows\System32\spool\drivers\w32x86\3\NSUI.dll
18:54:49.0372 5492 C:\Windows\System32\spool\drivers\w32x86\3\NSUI.dll - ok
18:54:49.0372 5492 [ 0691B1AD2E55BAA71B14E13439D55E2E ] C:\Windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_4bf7e3e2bf9ada4c\mfcm90u.dll
18:54:49.0372 5492 C:\Windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_4bf7e3e2bf9ada4c\mfcm90u.dll - ok
18:54:49.0387 5492 [ 6BC2D2FE9A4D52A1EFE51D7D44481A30 ] C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MX700 series Printer\LanguageModules\0411\CNMur95.dll
18:54:49.0387 5492 C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MX700 series Printer\LanguageModules\0411\CNMur95.dll - ok
18:54:49.0387 5492 [ F19EF79481B83549A8BF3042CBC803BD ] C:\Program Files\AVAST Software\Avast\defs\13063001\uiext.dll
18:54:49.0387 5492 C:\Program Files\AVAST Software\Avast\defs\13063001\uiext.dll - ok
18:54:49.0403 5492 [ AF2CAAAF1E82C14F37F5BD7D1E6E18E1 ] C:\Windows\System32\compstui.dll
18:54:49.0403 5492 C:\Windows\System32\compstui.dll - ok
18:54:49.0403 5492 [ CE683F9B7482B31D0EC5D04FD7533F54 ] C:\Windows\System32\adsldp.dll
18:54:49.0403 5492 C:\Windows\System32\adsldp.dll - ok
18:54:49.0419 5492 [ 661EE79702B7F8A62285B8C63F721F40 ] C:\Windows\System32\spool\drivers\w32x86\3\UNIRES.DLL
18:54:49.0419 5492 C:\Windows\System32\spool\drivers\w32x86\3\UNIRES.DLL - ok
18:54:49.0419 5492 [ 1843E81FA7ACFFF4344A7DD4328D7DA0 ] C:\Program Files\Microsoft Office\Office12\1033\ONINTL.DLL
18:54:49.0419 5492 C:\Program Files\Microsoft Office\Office12\1033\ONINTL.DLL - ok
18:54:49.0419 5492 [ B092A8A1DA7466D23802204207531BA0 ] C:\Windows\System32\spool\drivers\w32x86\3\mxdwdui.dll
18:54:49.0419 5492 C:\Windows\System32\spool\drivers\w32x86\3\mxdwdui.dll - ok
18:54:49.0434 5492 [ B8DBE01DAE93A58BC1F1ACB3BC6E1BBF ] C:\Windows\System32\spool\drivers\w32x86\3\CNMUB95.DLL
18:54:49.0434 5492 C:\Windows\System32\spool\drivers\w32x86\3\CNMUB95.DLL - ok
18:54:49.0434 5492 [ 0DE6939A255F38537E322E45DBB34AD2 ] C:\Windows\System32\spool\drivers\w32x86\3\CNCF2Me.DLL
18:54:49.0434 5492 C:\Windows\System32\spool\drivers\w32x86\3\CNCF2Me.DLL - ok
18:54:49.0450 5492 [ 809AD44BAFCA825F5A32FDC2C3A09710 ] C:\Windows\System32\spool\drivers\w32x86\3\CNCFCeUS.DLL
18:54:49.0450 5492 C:\Windows\System32\spool\drivers\w32x86\3\CNCFCeUS.DLL - ok
18:54:49.0450 5492 [ 2CDE07EC7995C3B210156634D14F8425 ] C:\Windows\System32\spool\drivers\w32x86\3\NSUNI.dll
18:54:49.0450 5492 C:\Windows\System32\spool\drivers\w32x86\3\NSUNI.dll - ok
18:54:49.0450 5492 [ 5B6FC238D984921D6AA14BDCDA6D51CD ] C:\Windows\System32\spool\drivers\w32x86\3\NsPdfMdl.dll
18:54:49.0450 5492 C:\Windows\System32\spool\drivers\w32x86\3\NsPdfMdl.dll - ok
18:54:49.0465 5492 [ FE5372B0B1A34728106845F5B5AF131D ] C:\Windows\System32\fontsub.dll
18:54:49.0465 5492 C:\Windows\System32\fontsub.dll - ok
18:54:49.0465 5492 [ 60830E4CDB591327ED6A190B38A7F327 ] C:\Windows\System32\spool\drivers\w32x86\3\Ism.dll
18:54:49.0465 5492 C:\Windows\System32\spool\drivers\w32x86\3\Ism.dll - ok
18:54:49.0481 5492 [ 8A64A3F68F0E24917759852C842DCD74 ] C:\Windows\System32\l3codeca.acm
18:54:49.0481 5492 C:\Windows\System32\l3codeca.acm - ok
18:54:49.0481 5492 [ 902054D6B4292329F9594FFF24EE02DB ] C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
18:54:49.0481 5492 C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe - ok
18:54:49.0481 5492 [ EA94014EE762C7F86DADF303AF267ABA ] C:\Windows\System32\spool\drivers\w32x86\3\FIOALL32.DLL
18:54:49.0481 5492 C:\Windows\System32\spool\drivers\w32x86\3\FIOALL32.DLL - ok
18:54:49.0497 5492 [ 37E19EAD45E737A7F87F9CF0A027F5E1 ] C:\Windows\System32\spool\drivers\w32x86\3\PDFWrtDrv.dll
18:54:49.0497 5492 C:\Windows\System32\spool\drivers\w32x86\3\PDFWrtDrv.dll - ok
18:54:49.0497 5492 [ 280C7E63290B46532114799E596A39FA ] C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManagerPS.dll
18:54:49.0497 5492 C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManagerPS.dll - ok
18:54:49.0512 5492 [ 0115EC6D62C585F2E912953AC602C392 ] C:\Windows\System32\spool\drivers\w32x86\3\pdflib.dll
18:54:49.0512 5492 C:\Windows\System32\spool\drivers\w32x86\3\pdflib.dll - ok
18:54:49.0512 5492 [ F81DF86E490C567B682A1CE93ABC88F6 ] C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
18:54:49.0512 5492 C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll - ok
18:54:49.0512 5492 ============================================================
18:54:49.0512 5492 Scan finished
18:54:49.0512 5492 ============================================================
18:54:49.0543 5484 Detected object count: 2
18:54:49.0543 5484 Actual detected object count: 2
18:55:41.0991 5484 HP Health Check Service ( UnsignedFile.Multi.Generic ) - skipped by user
18:55:41.0991 5484 HP Health Check Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:55:42.0006 5484 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
18:55:42.0006 5484 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip

I hope that is everything, Trudy


----------



## kevinf80 (Mar 21, 2006)

TDSSKiller log is clean, no issues. OK if you are still having redirects etc run the following in the order given:

Download http://www.bleepingcomputer.com/download/adwcleaner/ by Xplode onto your Desktop.


 Please close all open programs and internet browsers.
 Double click on *Adwcleaner.exe* to run the tool.
 Click on *Delete*.
 Confirm each time with OK.
 Your computer will be rebooted automatically. A text file will open after the restart.
 Please post the content of that logfile in your reply.
 You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.

Next,

download Junkware Removal tool from this link:
http://www.bleepingcomputer.com/download/junkware-removal-tool/
Save to your desktop.


*Shut down your Security Protection software now to avoid potential conflicts*.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator. Follow prompts as they come.
The tool will open and start scanning your system. (Press any key when prompted to continue)
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post JRT.txt to your next message.

Next,

download RKill from here: http://www.bleepingcomputer.com/download/rkill/

There are three buttons to choose from with different names on, select the first one and save it to your desktop.


 Double-click on the Rkill desktop icon to run the tool.
 If using Vista or Windows 7, right-click on it and Run As Administrator.
 A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
 A log pops up at the end of the run. This log file is located at C:\rkill.log. Please post this in your next reply.
 If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time.
 If the tool does not run from any of the links provided, please let me know.

Next,

Open Malwarebytes, check for updates then run *Full* scan. Instructions follow if Malwarebytes is not installed:

Download Malwarebytes from one of the following links and save it to your desktop.:

http://www.malwarebytes.org/mbam.php 
http://www.softpedia.com/get/Antivirus/Malwarebytes-Anti-Malware.shtml
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html

Double Click mbam-setup.exe to install the application.

 Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
 If an update is found, it will download and install the latest version.
 Once the program has loaded, select "Perform *Full* Scan", then click Scan.
 The scan may take some time to finish,so please be patient.
 When the scan is complete, click OK, then Show Results to view the results.
 Make sure that everything is checked, and click Remove Selected.
 When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
 Please save the log to a location you will remember.
 The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
 Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Let me see those 4 logs.. Also give update on any remaining issues or concerns when scans are done.


----------



## Trutalley (Mar 10, 2013)

Hello Kevin, I am currently working on my almost not sick computer, no ads, bing is still given me problems, not working at all except the first time after the computer starts. Chrome has lost my personal settings. The Opera browser and google search engine are still working but bing is not. I am hesitant to open Mozilla because it is set to automatic update & there were problems with that before. I ran RKill before I ran JRT, it found a lot of stuff, 3 pages on my printer. I then ran JRT, then RKill. Lastly the MAMB. So here we go!

# AdwCleaner v2.303 - Logfile created 07/01/2013 at 09:34:02
# Updated 08/06/2013 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Trudy Stewart - TRUDYSTEWART-PC
# Boot Mode : Normal
# Running from : C:\Users\Trudy Stewart\Downloads\AdwCleaner (1).exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\Program Files\jZip
Deleted on reboot : C:\Program Files\Updater By SweetPacks
File Deleted : C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
File Deleted : C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\searchplugins\SweetIm.xml
File Deleted : C:\Windows\system32\dmwu.exe
File Deleted : C:\Windows\system32\ImhxxpComm.dll
Folder Deleted : C:\Program Files\SweetIM
Folder Deleted : C:\ProgramData\WeCareReminder
Folder Deleted : C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj
Folder Deleted : C:\Windows\system32\WNLT

***** [Registry] *****

Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{DD85D6BF-4787-4A93-99A5-3F0CF0AE8834}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WNLT
Key Deleted : HKCU\Software\wecarereminder
Key Deleted : HKCU\Software\WNLT
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4FBBF769-ECEB-420A-B536-133B1D505C36}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\IEHelperv2.5.0.DLL
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F773BB94-6C19-4643-A570-0E429103D1C3}
Key Deleted : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Key Deleted : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Key Deleted : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminder
Key Deleted : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminder.1
Key Deleted : HKLM\Software\Classes\Installer\Features\FB6D58DD787439A4995AF3C00FEA8843
Key Deleted : HKLM\Software\Classes\Installer\Products\FB6D58DD787439A4995AF3C00FEA8843
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F773BB94-6C19-4643-A570-0E429103D1C3}
Key Deleted : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Key Deleted : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Key Deleted : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Key Deleted : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B12920CF-BE13-4C09-890D-1B6EFFFE2FBE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AC5B6CDA-8F90-4740-9A8C-28AC5D3C73FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EDC790504E1834DBC20C9A04328FD2
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7F556BF224D804D96A96F0F6344789
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE21F3FD57B244142880EF15A165A156
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\FB6D58DD787439A4995AF3C00FEA8843
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DD85D6BF-4787-4A93-99A5-3F0CF0AE8834}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT
Key Deleted : HKLM\Software\WNLT
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16490

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10045&barid={759BD106-DFB3-11E2-8B05-001E8C3FFC8B} --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10045&barid={759BD106-DFB3-11E2-8B05-001E8C3FFC8B} --> hxxp://www.google.com

-\\ Mozilla Firefox v21.0 (en-US)

File : C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\prefs.js

Deleted : user_pref("keyword.URL", "hxxp://start.sweetpacks.com/?src=2&st=12&crg=3.5000006.10045&barid={759BD1[...]

-\\ Google Chrome v27.0.1453.116

File : C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.83] : search_url = "hxxp://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&ba[...]
Deleted [l.5782] : urls_to_restore_on_startup = [ "hxxp://www.googlechrome/", "hxxp://www.bing.com/", "hxxp://st[...]

-\\ Opera v12.15.1748.0

File : C:\Users\Trudy Stewart\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [18567 octets] - [18/06/2013 18:12:16]
AdwCleaner[R2].txt - [9765 octets] - [01/07/2013 09:22:08]
AdwCleaner[R3].txt - [9829 octets] - [01/07/2013 09:32:29]
AdwCleaner[R555].txt - [9829 octets] - [01/07/2013 09:33:20]
AdwCleaner[S1].txt - [19017 octets] - [18/06/2013 19:24:54]
AdwCleaner[S2].txt - [9673 octets] - [01/07/2013 09:34:02]

########## EOF - C:\AdwCleaner[S2].txt - [9733 octets] ##########

the first RKill
Rkill 2.5.3 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 07/01/2013 09:50:05 AM in x86 mode.
Windows Version: Windows Vista (TM) Home Premium Service Pack 2

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe (PID: 2120) [WD-HEUR]
* C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe (PID: 3564) [WD-HEUR]

2 proccesses terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Reparse Point/Junctions Found (Most likely legitimate)!

* C:\Windows\System32\config\systemprofile\AppData\Local\Application Data => C:\Windows\system32\config\systemprofile\AppData\Local [Dir]
* C:\Windows\System32\config\systemprofile\AppData\Local\History => C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History [Dir]
* C:\Windows\System32\config\systemprofile\AppData\Local\Temporary Internet Files => C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files [Dir]
* C:\Windows\System32\config\systemprofile\Application Data => C:\Windows\system32\config\systemprofile\AppData\Roaming [Dir]
* C:\Windows\System32\config\systemprofile\Documents\My Music => C:\Windows\system32\config\systemprofile\Music [Dir]
* C:\Windows\System32\config\systemprofile\Documents\My Pictures => C:\Windows\system32\config\systemprofile\Pictures [Dir]
* C:\Windows\System32\config\systemprofile\Documents\My Videos => C:\Windows\system32\config\systemprofile\Videos [Dir]
* C:\Windows\System32\config\systemprofile\Local Settings => C:\Windows\system32\config\systemprofile\AppData\Local [Dir]
* C:\Windows\System32\config\systemprofile\My Documents => C:\Windows\system32\config\systemprofile\Documents [Dir]
* C:\Windows\System32\config\systemprofile\NetHood => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts [Dir]
* C:\Windows\System32\config\systemprofile\PrintHood => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts [Dir]
* C:\Windows\System32\config\systemprofile\Recent => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent [Dir]
* C:\Windows\System32\config\systemprofile\SendTo => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo [Dir]
* C:\Windows\System32\config\systemprofile\Start Menu => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu [Dir]
* C:\Windows\System32\config\systemprofile\Templates => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates [Dir]

* No issues found.

Checking Windows Service Integrity:

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 07/01/2013 09:51:38 AM
Execution time: 0 hours(s), 1 minute(s), and 32 seconds(s)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Trudy Stewart on Mon 07/01/2013 at 10:00:47.39
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

Successfully stopped: [Service] updater by sweetpacks 
Successfully deleted: [Service] updater by sweetpacks

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Program Files\updater by sweetpacks"

~~~ FireFox

Successfully deleted: [File] C:\Users\Trudy Stewart\AppData\Roaming\mozilla\firefox\profiles\yoebz5b8.default-1357333329994\invalidprefs.js
Emptied folder: C:\Users\Trudy Stewart\AppData\Roaming\mozilla\firefox\profiles\yoebz5b8.default-1357333329994\minidumps [3 files]

~~~ Chrome

Successfully deleted: [Registry Key] hkey_local_machine\software\policies\google\chrome\extensioninstallforcelist

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 07/01/2013 at 10:03:48.40
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Rkill 2.5.3 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 07/01/2013 10:10:35 AM in x86 mode.
Windows Version: Windows Vista (TM) Home Premium Service Pack 2

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Reparse Point/Junctions Found (Most likely legitimate)!

* C:\Windows\System32\config\systemprofile\AppData\Local\Application Data => C:\Windows\system32\config\systemprofile\AppData\Local [Dir]
* C:\Windows\System32\config\systemprofile\AppData\Local\History => C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History [Dir]
* C:\Windows\System32\config\systemprofile\AppData\Local\Temporary Internet Files => C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files [Dir]
* C:\Windows\System32\config\systemprofile\Application Data => C:\Windows\system32\config\systemprofile\AppData\Roaming [Dir]
* C:\Windows\System32\config\systemprofile\Documents\My Music => C:\Windows\system32\config\systemprofile\Music [Dir]
* C:\Windows\System32\config\systemprofile\Documents\My Pictures => C:\Windows\system32\config\systemprofile\Pictures [Dir]
* C:\Windows\System32\config\systemprofile\Documents\My Videos => C:\Windows\system32\config\systemprofile\Videos [Dir]
* C:\Windows\System32\config\systemprofile\Local Settings => C:\Windows\system32\config\systemprofile\AppData\Local [Dir]
* C:\Windows\System32\config\systemprofile\My Documents => C:\Windows\system32\config\systemprofile\Documents [Dir]
* C:\Windows\System32\config\systemprofile\NetHood => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts [Dir]
* C:\Windows\System32\config\systemprofile\PrintHood => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts [Dir]
* C:\Windows\System32\config\systemprofile\Recent => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent [Dir]
* C:\Windows\System32\config\systemprofile\SendTo => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo [Dir]
* C:\Windows\System32\config\systemprofile\Start Menu => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu [Dir]
* C:\Windows\System32\config\systemprofile\Templates => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates [Dir]

* No issues found.

Checking Windows Service Integrity:

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 07/01/2013 10:10:53 AM
Execution time: 0 hours(s), 0 minute(s), and 17 seconds(s)
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.07.01.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Trudy Stewart :: TRUDYSTEWART-PC [administrator]

7/1/2013 1:38:41 PM
mbam-log-2013-07-01 (13-38-41).txt

Scan type: Full scan (C:\|D:\|E:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 449264
Time elapsed: 2 hour(s), 1 minute(s), 14 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Trudy Stewart\Downloads\Firefox_setup.exe (PUP.IBryte) -> Quarantined and deleted successfully.

(end)
Hope this helps. Thanks, Trudy


----------



## Trutalley (Mar 10, 2013)

Kevin, It was Adware Cleaner that found so much stuff, so the logs are correct. My shortcuts on my desktop are now working.
I am able to uninstall programs. Trudy


----------



## kevinf80 (Mar 21, 2006)

Yep lots of browser hijacker/adware, hence the browser issues. Run AdwCleaner one more time from "Delete" function and post that log.

Next,

Download *OTL* from any of the following links and save to your desktop.

http://itxassociates.com/OT-Tools/OTL.com
http://oldtimer.geekstogo.com/OTL.exe
http://www.itxassociates.com/OT-Tools/OTL.scr

Double click the OTL icon to start the tool. (Note: If you are running on Vista or Windows 7 accept UAC alert)


 Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
 When the window appears, underneath Output at the top change it to Standard Output.
 Select the following:
*All Users*
*LOP Check*
*Purity Check*
 Under the Standard Registry box change it to All
 Please copy the text in the code box below and paste it in the Custom Scans/Fixes box in OTL:


```
netsvcs
activex
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%windir%\Installer\*.*
%windir%\system32\tasks\*.*
%windir%\system32\tasks\*.* /64
%systemroot%\Fonts\*.exe
%systemroot%\*. /mp /s
/md5start
consrv.dll
explorer.exe
winlogon.exe
regedit.exe
Userinit.exe
svchost.exe
services.exe
user32.dll
ATAPI.SYS
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
%Temp%\smtmp\* \s
%Temp%\smtmp\1\*.*
%Temp%\smtmp\2\*.*
%Temp%\smtmp\3\*.*
%Temp%\smtmp\4\*.*
dir "%systemdrive%\*" /S /A:L /C
CREATERESTOREPOINT
```

 Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
 A black box will appear, this is part of the custom scan, so don't be alarmed

*IF OTL SAYS 'NOT RESPONDING' DON'T USE YOUR PC. IT WILL CARRY ON SCANNING AFTER A FEW MINUTES*

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

Let me see those logs..


----------



## Trutalley (Mar 10, 2013)

Kevin, Here are the two OTL logs you requested.

OTL logfile created on: 6/20/2013 10:38:13 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Trudy Stewart\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.81 Gb Available Physical Memory | 60.37% Memory free
6.20 Gb Paging File | 4.73 Gb Available in Paging File | 76.40% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.49 Gb Total Space | 194.48 Gb Free Space | 67.41% Space Free | Partition Type: NTFS
Drive D: | 9.60 Gb Total Space | 1.29 Gb Free Space | 13.48% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 294.68 Gb Free Space | 98.86% Space Free | Partition Type: NTFS

Computer Name: TRUDYSTEWART-PC | User Name: Trudy Stewart | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/20 10:37:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Trudy Stewart\Downloads\OTL.com
PRC - [2013/05/29 01:27:40 | 000,825,808 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2013/05/09 04:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2013/01/30 21:50:30 | 000,370,176 | ---- | M] (The Privoxy team - www.privoxy.org) -- C:\Program Files\Privoxy\privoxy.exe
PRC - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe
PRC - [2011/11/11 14:08:06 | 000,205,336 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
PRC - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
PRC - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/16 05:44:55 | 001,358,384 | R--- | M] (Linksys, LLC) -- C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
PRC - [2008/03/25 04:28:03 | 000,054,672 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\jureg.exe
PRC - [2008/01/19 03:33:27 | 000,151,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\schtasks.exe
PRC - [2007/10/25 09:52:08 | 004,702,208 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/05/09 01:00:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM05Mon.exe
PRC - [2007/02/04 12:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
PRC - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Modules (No Company Name) ==========

MOD - [2013/06/13 18:47:34 | 013,140,872 | ---- | M] () -- C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\PepperFlash\11.7.700.225\pepflashplayer.dll
MOD - [2013/05/29 01:27:38 | 000,393,168 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.110\ppgooglenaclpluginchrome.dll
MOD - [2013/05/29 01:27:35 | 004,051,408 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.110\pdf.dll
MOD - [2013/05/29 01:26:36 | 001,597,392 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.110\ffmpegsumo.dll
MOD - [2013/01/30 21:50:30 | 000,086,528 | ---- | M] () -- C:\Program Files\Privoxy\mgwz.dll
MOD - [2012/10/11 21:56:46 | 000,087,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/10/11 21:56:22 | 001,242,512 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/11/11 14:09:20 | 000,336,408 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
MOD - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
MOD - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
MOD - [2010/05/07 18:37:40 | 000,126,808 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll
MOD - [2010/05/07 18:37:40 | 000,027,480 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll
MOD - [2010/05/07 18:36:54 | 000,340,824 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll
MOD - [2010/05/07 18:35:56 | 007,954,776 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll
MOD - [2010/05/07 18:35:44 | 002,143,576 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll
MOD - [2009/07/13 18:37:04 | 000,152,112 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll
MOD - [2009/07/13 18:37:04 | 000,098,304 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll
MOD - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
MOD - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe -- (RoxLiveShare9)
SRV - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2013/04/10 02:58:17 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2009/04/11 02:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/11/06 16:22:26 | 000,092,792 | ---- | M] (CACE Technologies) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2006/11/02 08:36:18 | 000,029,696 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\iprip.dll -- (iprip)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfSysMon.sys -- (TfSysMon)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\TfNetMon.sys -- (TfNetMon)
DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfFsMon.sys -- (TfFsMon)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (RimUsb)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pctplsg.sys -- (pctplsg)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\PCTINDIS5.SYS -- (PCTINDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lvpopflt.sys -- (lvpopflt)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jubusenum.sys -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\TRUDYS~1\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2013/05/09 04:59:10 | 000,765,736 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2013/05/09 04:59:10 | 000,368,944 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2013/05/09 04:59:10 | 000,174,664 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswVmm.sys -- (aswVmm)
DRV - [2013/05/09 04:59:10 | 000,056,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2013/05/09 04:59:10 | 000,049,376 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswRvrt.sys -- (aswRvrt)
DRV - [2013/05/09 04:59:09 | 000,066,336 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2013/05/09 04:59:09 | 000,049,760 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2013/05/09 04:59:08 | 000,029,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/01/18 02:44:52 | 004,332,960 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUVC.sys -- (LVUVC)
DRV - [2012/01/18 02:44:28 | 000,312,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2012/01/18 02:44:14 | 000,022,176 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvbusflt.sys -- (CompFilter)
DRV - [2011/03/30 23:54:32 | 001,073,216 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AE1200vista.sys -- (Linksys_adapter)
DRV - [2010/05/07 18:43:30 | 000,025,824 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009/07/07 15:48:44 | 000,027,696 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\purendis.sys -- (purendis)
DRV - [2009/07/07 15:48:44 | 000,026,672 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pnarp.sys -- (pnarp)
DRV - [2008/12/04 09:17:15 | 000,645,120 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WUSB54GCv3.sys -- (WUSB54GCv3)
DRV - [2008/08/01 19:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008/05/08 05:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2008/05/08 05:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)
DRV - [2007/11/06 16:22:06 | 000,034,064 | ---- | M] (CACE Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2007/10/26 07:51:22 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007/10/18 07:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/10/12 02:00:44 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/09/07 10:36:08 | 000,156,928 | ---- | M] (ViXS Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\xcbda.sys -- (xcbdaNtsc)
DRV - [2007/08/27 14:59:00 | 007,574,976 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/07/20 01:00:00 | 000,235,616 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vid.sys -- (OEM05Vid)
DRV - [2007/06/08 01:00:02 | 000,141,376 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\OEM05Afx.sys -- (OEM05Afx)
DRV - [2007/04/11 15:33:06 | 000,079,376 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2007/04/11 15:32:58 | 000,036,112 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007/04/11 15:32:52 | 000,034,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2007/04/11 15:32:38 | 000,063,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2007/04/11 15:32:30 | 000,020,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007/03/05 18:45:04 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vfx.sys -- (OEM05Vfx)
DRV - [2005/12/12 13:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{11D231C8-2FE5-4B8A-B2F9-B1736520C7A2}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?PC=BNHP
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes,DefaultScope = {759B6E70-7A7D-4FE5-82BF-EA161AA627D9}
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{637897BC-FCE2-4DEA-8938-5BA57BAEB440}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE8SRC&src=IE-SearchBox
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{759B6E70-7A7D-4FE5-82BF-EA161AA627D9}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=800236&p={searchTerms}
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: extension21804%40extension21804.com:0.91.48
FF - prefs.js..extensions.enabledAddons: infoatoms%40infoatoms.com:1.5.0.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/05/27 18:14:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/27 13:00:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/27 13:00:06 | 000,000,000 | ---D | M]

[2008/09/08 20:54:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Extensions
[2013/06/19 21:43:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\extensions
[2013/06/19 21:43:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/02/02 15:07:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/02/02 15:07:01 | 000,000,000 | ---D | M] (The Browser Highlighter) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\extensions
[2013/06/12 20:46:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\updated\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/06/12 20:46:17 | 000,000,000 | ---D | M] (The Browser Highlighter) -- C:\Program Files\Mozilla Firefox\updated\extensions\[email protected]
[2013/06/12 20:46:17 | 000,000,000 | ---D | M] (InfoAtoms) -- C:\Program Files\Mozilla Firefox\updated\extensions\[email protected]
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\[email protected]
File not found (No name found) -- C:\USERS\TRUDY STEWART\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YOEBZ5B8.DEFAULT-1357333329994\EXTENSIONS\[email protected]
[2013/04/10 02:58:33 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2008/09/03 20:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\mozilla firefox\plugins\npbittorrent.dll
[2013/04/10 02:57:54 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013/04/10 02:57:54 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Bing (Enabled)
CHR - default_search_provider: search_url = http://www.bing.com/search?setmkt=en-US&q={searchTerms}
CHR - default_search_provider: suggest_url = http://api.bing.com/osjson.aspx?query={searchTerms}&language={language},
CHR - homepage: 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.110\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_278.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.110\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U35 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.350.10 (Enabled) = C:\Windows\system32\npdeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Envelopes for Google Docs = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaclkeicedlkpjgnnfkedjomkkhmgcod\2_0\
CHR - Extension: Floorplanner = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\abopacaefhbognnmeigicfpgnmpideag\13_0\
CHR - Extension: I Dream of Greenie = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\abpplimpipkdhcobigmhmmjpmmkjneod\0.2_0\
CHR - Extension: Prezi = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\acoonfmhnndodekhecidldfdjgooefpg\1.3_0\
CHR - Extension: Task Timer = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\aomfjmibjhhfdenfkpaodhnlhkolngif\3.9.1_1\
CHR - Extension: Lucidchart: Diagramming = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\apboafhkiegglekeafbckfjldecefkhn\16_0\
CHR - Extension: Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: Loupe = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhaonknplhhecdgjpphnooeomecgipkc\2.0.4_0\
CHR - Extension: Print this page with CleanPrint = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\biafepndnnahkfldhobcjlclklffkibe\4.7.0_0\
CHR - Extension: Tabs Join = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\binjiceocgbfooocmheaenmmcominbpe\2.1_0\
CHR - Extension: Aviary for Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkinocibdedleighgndmbfpbialnblep\1.3_0\
CHR - Extension: YouTube = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: HelloFax: 50 Free Fax Pages = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bocmleclimfnadgmcdgecijlblfcmfnm\1.12_0\
CHR - Extension: Facebook = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\boeajhmfdjldchidhphikilcgdacljfm\1.0.3_0\
CHR - Extension: Revision3 = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\cncldpggpcpckadjcholildoahcgbmfo\1_0\
CHR - Extension: TimelineRemove = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnedfaenfnkikficknkklbdedlecmpgc\1.1.0_1\
CHR - Extension: Sumo Paint = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpgjihldbpodlmnjolekemlfbcajnmod\3.7_0\
CHR - Extension: Easy Clock = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dplbpgapoedppajbikieafefmcceaagn\9.0.6_0\
CHR - Extension: Gravity = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\eboilkbecbgepecmaaicggbpnlbcfagj\1_0\
CHR - Extension: Facebook Disconnect = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpepffjfmamnambagiibghpglaidiec\1.3.0_0\
CHR - Extension: Stupeflix Video Maker = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkdmcfnoimoilncpjchamnenebopocem\1.5_0\
CHR - Extension: Springpad = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkmopoamfjnmppabeaphohombnjcjgla\6_0\
CHR - Extension: EasyDrop = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\flogpfmjdekjoilcnmmchanikomlidie\1.3.0_0\
CHR - Extension: Attachments.me for Gmail, Dropbox, Box, Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdgofjdapkmlgpgjfielacjckplcdjjk\1.7.4_0\
CHR - Extension: Attachments.me for Gmail, Dropbox, Box, Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdgofjdapkmlgpgjfielacjckplcdjjk\1.7.4_0\.mustache
CHR - Extension: Click&Clean = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\8.3_0\
CHR - Extension: DocuSign = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\goblijolcnempeilmnkmfbhohlpngemd\2.1.0.0_0\
CHR - Extension: Drive Notepad = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpgjomejfimnbmobcocilppikhncegaj\1.2_0\
CHR - Extension: Gradient Creator! = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcplneddoadgichngfbobgpllfphdfla\0.2.1.3_0\
CHR - Extension: Vector Paint = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnbpdiengicdefcjecjbnjnoifekhgdo\3.2.0.0_0\
CHR - Extension: Pixlr Editor = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmaknaampgiegkcjlimdiidlhopknpk\1.2_0\
CHR - Extension: persona/ you are what you love = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iehdddmijbgofffjjmhkodckmnombhmf\2.0.9_1\
CHR - Extension: Sync SugarSync, Evernote, and Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifanaabofjmgladnlbckonoiohpmchik\1.2.4.2_0\
CHR - Extension: Pixorial Video = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ilbibicalpgnmbjnganinjppjephokai\1.0.3_0\
CHR - Extension: Sync Dropbox, Evernote, and Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iobcbdgacfkninlcbphihhdlkobkehia\1.2.4.2_0\
CHR - Extension: Dropbox = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioekoebejdcmnlefjiknokhhafglcjdl\3.0.6_1\
CHR - Extension: Save this page with CleanSave = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iplagehfoafmmjppeijnpkohihcllici\4.7.0_0\
CHR - Extension: Free Online PDF Tools = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jddfpnmfhodaljeelokfceepbeapgbdn\1.0.1.2_0\
CHR - Extension: Facebook Like Button = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jehaijobeonhempacbjelicepjkhoidi\1.0.3_0\
CHR - Extension: mydeco 3D planner = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfnniehafojoidolddmhfnpnbiolbppi\2.3_0\
CHR - Extension: Autodesk Homestyler = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdmmkfaghgcicheaimnpffeeekheafkb\2.3_0\
CHR - Extension: eBay Extension for Google Chrome\u2122 (by eBay) = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khhckppjhonfmcpegdjdibmngahahhck\1.6.12_0\
CHR - Extension: HuffingtonPost NewsGlide = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khjialelnkjdomiblmnpcpjongleegef\0.3.2_0\
CHR - Extension: WordPress.com = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khjnjifipfkgglficmipimgjpbmlbemd\1.1.1_0\
CHR - Extension: Magisto for Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\kinnlbfbjboagbejldhemnifjepmkakj\1.0.4_1\
CHR - Extension: CanvasDraw = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\knfimpamngmggpbamfoomdpebdoleghe\2_0\
CHR - Extension: DriveTunes = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\labgcacinobdnkfndodfkfeabbjckbnj\3.2.4_0\
CHR - Extension: Evernote Web = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol\1.0.7_0\
CHR - Extension: Sketchpad = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkllajgbhondgjjnhmmgbjndmogapinp\1.0.0.4_0\
CHR - Extension: Spanning Backup for Google Apps\u2122 = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lniahgcddkbgipmbmlhjpoafdeephgcf\3.0.1.3_0\
CHR - Extension: Word\u00B2 = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpibnckjjeaabeepofhfmmpjmnomohee\2.5_0\
CHR - Extension: Quick Note = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\mijlebbfndhelmdpmllgcfadlkankhok\1.4.8_0\
CHR - Extension: Free Online PDF Unlocker = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkdknbehfogkgogcennnagfokmnimpab\1.0.1.1_0\
CHR - Extension: deviantART muro = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\namljbfbglehfnlonjmebceimaalofei\1.0_0\
CHR - Extension: InspirARTion = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhbmpilemgmpbdaniehhmodkkppkelec\10_0\
CHR - Extension: Pinterest Keyboard Shortcut | Ctrl+Alt+P = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\npbcjndbpajikchenclendcojmaeaphh\1.2.2_1\
CHR - Extension: Google Chrome to Phone Extension = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oadboiipflhobonjjffjbfekfjcgkhco\2.3.1_0\
CHR - Extension: Todo.ly = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhefmbclkekanpjjpkbciloojcmpkap\2_0\
CHR - Extension: Bolt Save and Share = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofmipocdiiichlijcngflajilbpkkfhj\7.2_0\
CHR - Extension: Photo Collage = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiabhgfgfhoilflkoicbmnejgjjfmhcg\1_0\
CHR - Extension: WeVideo - Video Editor = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\okgjbfikepgflmlelgfgecmgjnmnmnnb\3.1.0_0\
CHR - Extension: Pin Search | Image Search on Pinterest = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\okiaciimfpgbpdhnfdllhdkicpmdoakm\1.0.11_0\
CHR - Extension: SlideRocket = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\omeengfjefdmhnkojnfmncpfdbhnecea\2.0.2_0\
CHR - Extension: Picasa = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb\6.2.2_0\
CHR - Extension: Diigo Web Collector - Capture and Annotate = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oojbgadfejifecebmdnhhkbhdjaphole\2.1.10_0\
CHR - Extension: Click&Clean App = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdabfienifkbhoihedcgeogidfmibmhp\8.0_0\
CHR - Extension: Outlook.com = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfpeapihoiogbcmdmnibeplnikfnhoge\1.0.2_0\
CHR - Extension: Evernote Web Clipper = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc\5.9.16_0\
CHR - Extension: Gmail = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Balsamiq Mockups = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pplbmgaodhjmbklkgkgmlghaekcfhhkk\1.9_0\

O1 HOSTS File: ([2013/02/02 00:35:03 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (jZip Webmail plugin) - {647FD14A-C4F1-46F4-8FC3-0B40F54226F7} - C:\Program Files\jZip\WebmailPlugin.dll (Discordia Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found.
O3 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\Toolbar\WebBrowser: (no name) - {CB789373-04D5-4EF4-9C16-871463FD0830} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Linksys Wireless Manager] C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe (Linksys, LLC)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OEM05Mon.exe] C:\Windows\OEM05Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateReg] C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000..\Run: [B7456CF5EF0D0980D92DD0562D346087910D60E2._service_run] C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Evernote - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Download Link Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_file.htm File not found
O8 - Extra context menu item: Download List Of Files Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_list.htm File not found
O8 - Extra context menu item: Subscribe To RSS/Podcast Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_rss.htm File not found
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 1.7.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 10.21.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{36937FF7-1F22-4576-8665-B5965D4D3BCC}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BBDB5DE6-583B-4601-A391-1DC2D9542FFD}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/01/01 10:56:33 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/06/19 21:40:33 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/06/19 21:40:09 | 000,000,000 | ---D | C] -- C:\JRT
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Local\temp
[2013/06/19 12:33:38 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/06/19 12:10:01 | 005,081,021 | R--- | C] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/18 19:09:10 | 000,000,000 | ---D | C] -- C:\FRST
[2013/06/15 21:27:20 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan
[2013/06/15 21:27:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
[2013/06/15 21:27:12 | 000,000,000 | ---D | C] -- C:\Program Files\Security Task Manager
[2013/06/13 08:35:00 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/06/13 08:34:58 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013/06/13 08:34:58 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013/06/13 08:34:57 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013/06/13 08:34:57 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013/06/13 08:34:55 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013/06/13 08:34:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013/06/13 08:34:53 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013/06/12 11:15:02 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printcom.dll
[2013/06/12 11:14:58 | 000,812,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certutil.exe
[2013/06/12 11:14:57 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certenc.dll
[2013/06/12 11:14:50 | 003,603,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013/06/12 11:14:49 | 003,551,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013/06/12 11:14:40 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cryptdlg.dll
[2013/06/11 14:21:48 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\Desktop\New Folder
[2013/05/27 13:18:56 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Local\Apple Computer
[2013/05/27 13:18:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013/05/27 13:17:10 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013/05/27 13:17:06 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013/05/27 13:17:06 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013/05/27 13:14:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
[2013/05/27 13:14:04 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2013/05/27 12:59:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013/05/27 12:59:26 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2013/05/27 12:59:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2013/05/21 11:29:53 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2013/05/21 11:29:20 | 002,049,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012/10/28 22:15:21 | 011,881,936 | ---- | C] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Users\Trudy Stewart\gosetup.exe
[3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/06/20 10:36:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/20 10:13:19 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/20 10:13:19 | 000,000,454 | ---- | M] () -- C:\Windows\tasks\RegCure Program Check.job
[2013/06/20 10:13:17 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2013/06/20 10:13:07 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/20 10:13:07 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/20 10:13:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/06/20 10:13:00 | 3219,591,168 | -HS- | M] () -- C:\hiberfil.sys
[2013/06/19 21:45:59 | 000,000,935 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Continue Zip Opener Installation.lnk
[2013/06/19 14:29:01 | 000,000,911 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/19 12:10:07 | 005,081,021 | R--- | M] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/18 19:27:16 | 000,000,089 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013/06/11 18:39:35 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013/06/11 18:39:35 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013/06/11 08:41:38 | 000,001,933 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/05/27 20:02:39 | 000,634,834 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/05/27 20:02:39 | 000,112,596 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/05/27 18:14:47 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2013/05/27 13:18:50 | 000,001,626 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013/05/27 12:59:51 | 000,001,688 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2013/05/22 20:32:59 | 000,408,168 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/05/21 15:45:55 | 000,001,849 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/06/19 21:45:59 | 000,000,935 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Continue Zip Opener Installation.lnk
[2013/06/19 14:29:01 | 000,000,911 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/18 19:26:02 | 000,000,089 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013/05/27 13:18:50 | 000,001,626 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013/05/27 12:59:51 | 000,001,688 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2013/04/14 20:49:34 | 000,174,664 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/04/14 20:49:34 | 000,049,376 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013/02/02 00:21:01 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/02/02 00:21:01 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/02/02 00:21:01 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/02/02 00:21:01 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/02/02 00:21:01 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/05/29 13:08:18 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2012/03/31 21:41:09 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012/01/18 02:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2012/01/18 02:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2012/01/18 02:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2011/11/16 21:40:38 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2011/08/12 12:20:14 | 000,015,896 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
[2010/05/07 07:07:08 | 000,000,760 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\setup_ldm.iss
[2010/04/07 12:31:26 | 000,000,000 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\prvlcl.dat
[2009/12/09 22:32:11 | 008,892,928 | ---- | C] () -- C:\ProgramData\atscie.msi
[2009/03/24 22:26:10 | 000,000,050 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-recent-projects.properties
[2009/03/24 22:21:47 | 000,000,745 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-defaults.jap
[2008/12/28 17:31:28 | 000,031,232 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/11/16 00:46:07 | 000,000,138 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\wklnhst.dat
[2008/07/21 16:40:25 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat
[2008/05/20 03:12:40 | 000,001,356 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\d3d9caps.dat

========== ZeroAccess Check ==========

[2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 02:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 02:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2009/04/09 02:14:12 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Ambient Design
[2009/03/28 10:48:26 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Artisteer
[2010/02/26 11:39:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Canon
[2008/09/13 12:52:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/07/21 14:45:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Conceiva
[2009/03/28 22:50:52 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Darq Software
[2013/02/18 15:36:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\DeskSoft
[2012/03/22 16:15:59 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Dropbox
[2008/07/07 15:29:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Individual Software
[2010/06/27 15:16:09 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Inkscape
[2009/03/28 13:18:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Interior Designer 8.0
[2013/01/02 21:57:32 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\IObit
[2012/05/29 17:50:58 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\IrfanView
[2012/05/13 12:44:02 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Leadertech
[2012/05/29 13:24:23 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MAGIX
[2010/06/27 15:30:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MSNInstaller
[2009/03/27 18:55:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NewSoft
[2013/02/01 22:47:11 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NoteTab Light
[2012/03/31 21:23:28 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Opera
[2010/05/29 18:59:53 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoFiltre
[2010/05/29 19:02:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoScape
[2013/04/02 15:29:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\QuickScan
[2008/05/25 20:11:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\ScanSoft
[2008/09/15 22:05:44 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Snapfish
[2013/05/01 20:37:05 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Softland
[2009/04/07 03:05:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\stickies
[2008/11/16 00:46:07 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Template
[2009/03/29 03:17:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\uTorrent

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 284 bytes -> C:\Windows\System32\´ý:@kpctlsp.log
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMPFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:1CA73D29

< End of report >

OTL logfile created on: 7/1/2013 6:18:33 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Trudy Stewart\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.72 Gb Available Physical Memory | 57.40% Memory free
6.20 Gb Paging File | 5.01 Gb Available in Paging File | 80.80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.49 Gb Total Space | 193.84 Gb Free Space | 67.19% Space Free | Partition Type: NTFS
Drive D: | 9.60 Gb Total Space | 1.28 Gb Free Space | 13.39% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 294.65 Gb Free Space | 98.84% Space Free | Partition Type: NTFS

Computer Name: TRUDYSTEWART-PC | User Name: Trudy Stewart | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/07/01 18:15:39 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Trudy Stewart\Downloads\OTL.com
PRC - [2013/06/14 21:28:44 | 000,825,808 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2013/05/09 04:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2013/01/30 21:50:30 | 000,370,176 | ---- | M] (The Privoxy team - www.privoxy.org) -- C:\Program Files\Privoxy\privoxy.exe
PRC - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe
PRC - [2011/11/11 14:08:06 | 000,205,336 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
PRC - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
PRC - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/16 05:44:55 | 001,358,384 | R--- | M] (Linksys, LLC) -- C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
PRC - [2008/03/25 04:28:03 | 000,054,672 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\jureg.exe
PRC - [2008/01/19 03:33:27 | 000,151,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\schtasks.exe
PRC - [2007/10/25 09:52:08 | 004,702,208 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/05/09 01:00:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM05Mon.exe
PRC - [2007/02/04 12:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
PRC - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Modules (No Company Name) ==========

MOD - [2013/06/14 21:28:42 | 000,393,168 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.116\ppgooglenaclpluginchrome.dll
MOD - [2013/06/14 21:28:40 | 004,051,408 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.116\pdf.dll
MOD - [2013/06/14 21:27:48 | 001,597,392 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.116\ffmpegsumo.dll
MOD - [2013/01/30 21:50:30 | 000,086,528 | ---- | M] () -- C:\Program Files\Privoxy\mgwz.dll
MOD - [2012/10/11 21:56:46 | 000,087,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/10/11 21:56:22 | 001,242,512 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/11/11 14:09:20 | 000,336,408 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
MOD - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
MOD - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
MOD - [2010/05/07 18:37:40 | 000,126,808 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll
MOD - [2010/05/07 18:37:40 | 000,027,480 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll
MOD - [2010/05/07 18:36:54 | 000,340,824 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll
MOD - [2010/05/07 18:35:56 | 007,954,776 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll
MOD - [2010/05/07 18:35:44 | 002,143,576 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll
MOD - [2009/07/13 18:37:04 | 000,152,112 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll
MOD - [2009/07/13 18:37:04 | 000,098,304 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll
MOD - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
MOD - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe -- (RoxLiveShare9)
SRV - [2013/06/12 20:46:40 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2009/04/11 02:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/11/06 16:22:26 | 000,092,792 | ---- | M] (CACE Technologies) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2006/11/02 08:36:18 | 000,029,696 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\iprip.dll -- (iprip)

========== Driver Services (SafeList) ==========

DRV - [2013/06/27 20:58:10 | 000,770,344 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2013/06/27 20:58:10 | 000,369,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2013/06/27 20:58:10 | 000,175,176 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswVmm.sys -- (aswVmm)
DRV - [2013/05/09 04:59:10 | 000,056,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2013/05/09 04:59:10 | 000,049,376 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswRvrt.sys -- (aswRvrt)
DRV - [2013/05/09 04:59:09 | 000,066,336 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2013/05/09 04:59:09 | 000,049,760 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2013/05/09 04:59:08 | 000,029,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/01/18 02:44:52 | 004,332,960 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUVC.sys -- (LVUVC)
DRV - [2012/01/18 02:44:28 | 000,312,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2012/01/18 02:44:14 | 000,022,176 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvbusflt.sys -- (CompFilter)
DRV - [2011/03/30 23:54:32 | 001,073,216 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AE1200vista.sys -- (Linksys_adapter)
DRV - [2010/05/07 18:43:30 | 000,025,824 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009/07/07 15:48:44 | 000,027,696 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\purendis.sys -- (purendis)
DRV - [2009/07/07 15:48:44 | 000,026,672 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pnarp.sys -- (pnarp)
DRV - [2008/12/04 09:17:15 | 000,645,120 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WUSB54GCv3.sys -- (WUSB54GCv3)
DRV - [2008/08/01 19:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008/05/08 05:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2008/05/08 05:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)
DRV - [2007/11/06 16:22:06 | 000,034,064 | ---- | M] (CACE Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2007/10/26 07:51:22 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007/10/18 07:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/10/12 02:00:44 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/09/07 10:36:08 | 000,156,928 | ---- | M] (ViXS Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\xcbda.sys -- (xcbdaNtsc)
DRV - [2007/08/27 14:59:00 | 007,574,976 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/07/20 01:00:00 | 000,235,616 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vid.sys -- (OEM05Vid)
DRV - [2007/06/08 01:00:02 | 000,141,376 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\OEM05Afx.sys -- (OEM05Afx)
DRV - [2007/04/11 15:33:06 | 000,079,376 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2007/04/11 15:32:58 | 000,036,112 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007/04/11 15:32:52 | 000,034,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2007/04/11 15:32:38 | 000,063,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2007/04/11 15:32:30 | 000,020,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007/03/05 18:45:04 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vfx.sys -- (OEM05Vfx)
DRV - [2005/12/12 13:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{11D231C8-2FE5-4B8A-B2F9-B1736520C7A2}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{637897BC-FCE2-4DEA-8938-5BA57BAEB440}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE8SRC&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{759B6E70-7A7D-4FE5-82BF-EA161AA627D9}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=800236&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/16 18:38:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/05/27 18:14:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}: C:\Program Files\Updater By SweetPacks\Firefox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/06/12 20:46:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/06/12 20:46:22 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/06/12 20:46:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/06/12 20:46:22 | 000,000,000 | ---D | M]

[2008/09/08 20:54:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Extensions
[2008/09/08 20:54:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2013/07/01 09:34:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\extensions
[2013/06/29 20:38:56 | 000,001,793 | ---- | M] () -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\searchplugins\Bing.xml
[2013/06/20 13:58:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/06/12 20:46:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/06/12 20:46:17 | 000,000,000 | ---D | M] (The Browser Highlighter) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008/09/03 20:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\mozilla firefox\plugins\npbittorrent.dll
[2006/10/26 21:12:16 | 000,016,192 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL
[2013/05/08 03:12:56 | 000,106,088 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2013/05/27 13:00:01 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2013/05/27 13:00:02 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2013/05/27 13:00:03 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2013/05/27 13:00:03 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2013/05/27 13:00:06 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2010/04/07 12:25:17 | 000,001,346 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg_igeared.xml

========== Chrome ==========

CHR - default_search_provider: Bing (Enabled)
CHR - default_search_provider: search_url = http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&barid={759BD106-DFB3-11E2-8B05-001E8C3FFC8B}
CHR - default_search_provider: suggest_url = 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.116\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll
CHR - plugin: Java Deployment Toolkit 7.0.210.11 (Enabled) = C:\Windows\system32\npDeployJava1.dll

O1 HOSTS File: ([2013/02/02 00:35:03 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (jZip Webmail plugin) - {647FD14A-C4F1-46F4-8FC3-0B40F54226F7} - C:\Program Files\jZip\WebmailPlugin.dll (Discordia Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Updater By SweetPacks) - {7D4F1959-3F72-49d5-8E59-F02F8AA6815D} - C:\Program Files\Updater By SweetPacks\Extension32.dll File not found
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Linksys Wireless Manager] C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe (Linksys, LLC)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OEM05Mon.exe] C:\Windows\OEM05Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateReg] C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Oracle Corporation)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKCU..\Run: [B7456CF5EF0D0980D92DD0562D346087910D60E2._service_run] C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O8 - Extra context menu item: Add to Evernote - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Download Link Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_file.htm File not found
O8 - Extra context menu item: Download List Of Files Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_list.htm File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Subscribe To RSS/Podcast Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_rss.htm File not found
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{36937FF7-1F22-4576-8665-B5965D4D3BCC}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BBDB5DE6-583B-4601-A391-1DC2D9542FFD}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/01/01 10:56:33 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files\Google\Chrome\Application\27.0.1453.116\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk - - File not found
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk - - File not found
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk - - File not found
MsConfig - StartUpFolder: C:^Users^Trudy Stewart^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk - - File not found
MsConfig - StartUpFolder: C:^Users^Trudy Stewart^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Oneeko.lnk - - File not found
MsConfig - StartUpFolder: C:^Users^Trudy Stewart^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe - ()
MsConfig - StartUpFolder: C:^Users^Trudy Stewart^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Stickies.lnk - - File not found
MsConfig - StartUpReg: *CanonMyPrinter* - hkey= - key= - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
MsConfig - StartUpReg: *CanonSolutionMenu* - hkey= - key= - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
MsConfig - StartUpReg: *HP Software Update* - hkey= - key= - c:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
MsConfig - StartUpReg: *hpsysdrv* - hkey= - key= - c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
MsConfig - StartUpReg: *KBD* - hkey= - key= - C:\hp\KBD\KbdStub.exe ()
MsConfig - StartUpReg: *OsdMaestro* - hkey= - key= - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
MsConfig - StartUpReg: *SunJavaUpdateReg* - hkey= - key= - File not found
MsConfig - StartUpReg: *Windows Defender* - hkey= - key= - File not found
MsConfig - State: "startup" - 2

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/07/01 10:18:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/07/01 10:18:27 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013/07/01 10:18:27 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013/06/30 02:05:20 | 000,000,000 | ---D | C] -- C:\Windows\Microsoft Antimalware
[2013/06/28 08:03:37 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Roaming\PowerISO
[2013/06/28 01:33:09 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ace CD Burner
[2013/06/28 01:33:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ace CD Burner
[2013/06/28 01:33:08 | 001,703,936 | ---- | C] (NCT Company) -- C:\Windows\System32\NCTAudioFile.dll
[2013/06/28 01:33:08 | 000,892,928 | ---- | C] (NCT Company) -- C:\Windows\System32\NCTAudioInformation.dll
[2013/06/28 01:33:08 | 000,274,432 | ---- | C] (NCT Company) -- C:\Windows\System32\NCTAudioPlayer.dll
[2013/06/28 01:33:07 | 001,388,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00F
[2013/06/28 01:33:07 | 000,589,824 | ---- | C] (NuMedia Soft, Inc.) -- C:\Windows\System32\DVDRProX.dll
[2013/06/28 01:33:07 | 000,380,928 | ---- | C] (NUGROOVZ) -- C:\Windows\System32\CDRipperX.ocx
[2013/06/28 01:33:06 | 000,073,785 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00E
[2013/06/28 01:33:06 | 000,000,000 | ---D | C] -- C:\Program Files\Ace CD Burner
[2013/06/28 01:31:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\We-Care Reminder
[2013/06/28 01:28:10 | 000,000,000 | ---D | C] -- C:\Program Files\PowerISO
[2013/06/28 01:28:04 | 000,000,000 | ---D | C] -- C:\Windows\System32\jmdp
[2013/06/28 01:28:04 | 000,000,000 | ---D | C] -- C:\Windows\System32\ARFC
[2013/06/20 13:58:36 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/06/20 10:37:01 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Trudy Stewart\Desktop\OTL.com
[2013/06/19 21:40:33 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/06/19 21:40:09 | 000,000,000 | ---D | C] -- C:\JRT
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Local\temp
[2013/06/19 12:33:38 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/06/19 12:10:01 | 005,081,021 | R--- | C] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/18 19:09:10 | 000,000,000 | ---D | C] -- C:\FRST
[2013/06/15 21:27:20 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan
[2013/06/15 21:27:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
[2013/06/15 21:27:12 | 000,000,000 | ---D | C] -- C:\Program Files\Security Task Manager
[2013/06/13 08:35:00 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/06/13 08:34:58 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013/06/13 08:34:58 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013/06/13 08:34:57 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013/06/13 08:34:57 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013/06/13 08:34:55 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013/06/13 08:34:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013/06/13 08:34:53 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013/06/12 20:46:12 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/06/12 11:15:02 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printcom.dll
[2013/06/12 11:14:58 | 000,812,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certutil.exe
[2013/06/12 11:14:57 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certenc.dll
[2013/06/12 11:14:50 | 003,603,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013/06/12 11:14:49 | 003,551,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013/06/12 11:14:40 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cryptdlg.dll
[2012/10/28 22:15:21 | 011,881,936 | ---- | C] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Users\Trudy Stewart\gosetup.exe

========== Files - Modified Within 30 Days ==========

[2013/07/01 17:45:42 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/07/01 17:45:42 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/07/01 17:36:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/07/01 17:00:01 | 000,000,454 | ---- | M] () -- C:\Windows\tasks\RegCure Program Check.job
[2013/07/01 15:45:57 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/07/01 15:45:53 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2013/07/01 15:45:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/07/01 15:45:37 | 3219,619,840 | -HS- | M] () -- C:\hiberfil.sys
[2013/07/01 10:18:28 | 000,000,868 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/07/01 10:09:32 | 000,000,571 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\rkill (1) - Shortcut.lnk
[2013/07/01 10:08:46 | 000,000,581 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\RogueKiller - Shortcut.lnk
[2013/07/01 09:59:59 | 000,000,882 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\JRT (1) - Shortcut.lnk
[2013/07/01 09:34:29 | 000,000,232 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013/07/01 09:31:20 | 000,000,917 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\AdwCleaner (1) - Shortcut.lnk
[2013/06/30 18:45:26 | 000,001,325 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\tdsskiller - Shortcut.lnk
[2013/06/29 20:06:56 | 000,634,834 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/06/29 20:06:56 | 000,112,596 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/06/28 01:33:09 | 000,001,687 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Ace CD Burner.lnk
[2013/06/28 01:31:58 | 000,033,958 | ---- | M] () -- C:\ProgramData\uninstaller.exe
[2013/06/27 20:58:10 | 000,770,344 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2013/06/27 20:58:10 | 000,369,584 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2013/06/27 20:58:10 | 000,175,176 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/06/27 20:58:10 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys.sum
[2013/06/27 20:58:10 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswSP.sys.sum
[2013/06/27 20:58:10 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswSnx.sys.sum
[2013/06/20 14:41:24 | 000,001,933 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/06/20 10:37:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Trudy Stewart\Desktop\OTL.com
[2013/06/19 14:29:01 | 000,000,911 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/19 12:10:07 | 005,081,021 | R--- | M] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/11 18:39:35 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013/06/11 18:39:35 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

========== Files Created - No Company Name ==========

[2013/07/01 10:18:28 | 000,000,868 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/07/01 10:09:32 | 000,000,571 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\rkill (1) - Shortcut.lnk
[2013/07/01 10:08:46 | 000,000,581 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\RogueKiller - Shortcut.lnk
[2013/07/01 09:59:59 | 000,000,882 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\JRT (1) - Shortcut.lnk
[2013/07/01 09:31:20 | 000,000,917 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\AdwCleaner (1) - Shortcut.lnk
[2013/06/30 18:44:06 | 000,001,325 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\tdsskiller - Shortcut.lnk
[2013/06/28 01:33:09 | 000,001,687 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Ace CD Burner.lnk
[2013/06/28 01:31:58 | 000,033,958 | ---- | C] () -- C:\ProgramData\uninstaller.exe
[2013/06/27 20:58:10 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys.sum
[2013/06/26 17:22:47 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswSP.sys.sum
[2013/06/26 17:22:47 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswSnx.sys.sum
[2013/06/19 14:29:01 | 000,000,911 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/18 19:26:02 | 000,000,232 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013/05/22 11:21:06 | 004,325,376 | ---- | C] () -- C:\ProgramData\ReadOnlyInstaller.msi
[2013/04/14 20:49:34 | 000,175,176 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/04/14 20:49:34 | 000,049,376 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013/02/02 00:21:01 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/02/02 00:21:01 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/02/02 00:21:01 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/02/02 00:21:01 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/02/02 00:21:01 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/05/29 13:08:18 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2012/03/31 21:41:09 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012/01/18 02:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2012/01/18 02:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2012/01/18 02:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2011/11/16 21:40:38 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2011/08/12 12:20:14 | 000,015,896 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
[2010/05/07 07:07:08 | 000,000,760 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\setup_ldm.iss
[2010/04/07 12:31:26 | 000,000,000 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\prvlcl.dat
[2009/12/09 22:32:11 | 008,892,928 | ---- | C] () -- C:\ProgramData\atscie.msi
[2009/03/24 22:26:10 | 000,000,050 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-recent-projects.properties
[2009/03/24 22:21:47 | 000,000,745 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-defaults.jap
[2008/12/28 17:31:28 | 000,031,232 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/11/16 00:46:07 | 000,000,138 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\wklnhst.dat
[2008/07/21 16:40:25 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat
[2008/05/20 03:12:40 | 000,001,356 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\d3d9caps.dat

========== ZeroAccess Check ==========

[2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 02:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 02:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2009/04/09 02:14:12 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Ambient Design
[2009/03/28 10:48:26 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Artisteer
[2010/02/26 11:39:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Canon
[2008/09/13 12:52:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/07/21 14:45:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Conceiva
[2009/03/28 22:50:52 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Darq Software
[2013/02/18 15:36:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\DeskSoft
[2012/03/22 16:15:59 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Dropbox
[2008/07/07 15:29:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Individual Software
[2013/07/01 16:37:04 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Inkscape
[2009/03/28 13:18:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Interior Designer 8.0
[2012/05/29 17:50:58 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\IrfanView
[2012/05/13 12:44:02 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Leadertech
[2012/05/29 13:24:23 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MAGIX
[2010/06/27 15:30:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MSNInstaller
[2009/03/27 18:55:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NewSoft
[2013/02/01 22:47:11 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NoteTab Light
[2012/03/31 21:23:28 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Opera
[2010/05/29 18:59:53 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoFiltre
[2010/05/29 19:02:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoScape
[2013/06/28 08:03:37 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PowerISO
[2013/04/02 15:29:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\QuickScan
[2008/05/25 20:11:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\ScanSoft
[2008/09/15 22:05:44 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Snapfish
[2013/05/01 20:37:05 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Softland
[2009/04/07 03:05:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\stickies
[2008/11/16 00:46:07 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Template
[2009/03/29 03:17:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\uTorrent

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*. >
[2013/06/19 12:33:38 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2009/09/13 13:20:35 | 000,000,000 | ---D | M] -- C:\Boot
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2013/06/18 19:09:10 | 000,000,000 | ---D | M] -- C:\FRST
[2008/05/26 17:15:34 | 000,000,000 | ---D | M] -- C:\hp
[2008/06/18 23:31:56 | 000,000,000 | ---D | M] -- C:\inetpub
[2013/07/01 10:00:17 | 000,000,000 | ---D | M] -- C:\JRT
[2009/02/18 17:04:55 | 000,000,000 | R--D | M] -- C:\MSOCache
[2008/06/18 23:31:56 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2013/07/01 10:18:27 | 000,000,000 | ---D | M] -- C:\Program Files
[2013/07/01 09:34:09 | 000,000,000 | ---D | M] -- C:\ProgramData
[2013/06/19 12:34:22 | 000,000,000 | ---D | M] -- C:\Qoobox
[2013/07/01 18:21:01 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2008/05/19 19:38:38 | 000,000,000 | R--D | M] -- C:\Users
[2013/06/30 02:05:20 | 000,000,000 | ---D | M] -- C:\Windows
[2013/06/20 13:58:36 | 000,000,000 | ---D | M] -- C:\_OTL

< %PROGRAMFILES%\*.exe >

< %LOCALAPPDATA%\*.exe >

< %windir%\Installer\*.* >
[2013/05/21 11:36:03 | 000,022,528 | ---- | M] () -- C:\Windows\Installer\10e595.msi
[2012/07/18 15:53:56 | 005,009,920 | R--- | M] () -- C:\Windows\Installer\112052.msp
[2012/07/18 15:53:36 | 010,937,344 | R--- | M] () -- C:\Windows\Installer\11205c.msp
[2012/07/18 15:46:48 | 000,593,408 | R--- | M] () -- C:\Windows\Installer\112092.msp
[2012/07/25 16:59:06 | 011,032,064 | R--- | M] () -- C:\Windows\Installer\1120aa.msp
[2012/06/26 18:03:12 | 003,875,840 | R--- | M] () -- C:\Windows\Installer\1120b4.msp
[2009/02/18 17:05:41 | 002,397,184 | ---- | M] () -- C:\Windows\Installer\112cdc7.msi
[2009/02/18 17:05:52 | 000,501,248 | ---- | M] () -- C:\Windows\Installer\112cdce.msi
[2009/02/18 17:06:19 | 001,713,152 | ---- | M] () -- C:\Windows\Installer\112cdd5.msi
[2009/02/18 17:06:38 | 002,022,912 | ---- | M] () -- C:\Windows\Installer\112cddc.msi
[2009/02/18 17:06:48 | 001,640,960 | ---- | M] () -- C:\Windows\Installer\112cde3.msi
[2009/02/18 17:06:56 | 001,647,616 | ---- | M] () -- C:\Windows\Installer\112cdea.msi
[2009/02/18 17:06:59 | 000,501,248 | ---- | M] () -- C:\Windows\Installer\112cdf1.msi
[2009/02/18 17:07:07 | 002,319,872 | ---- | M] () -- C:\Windows\Installer\112cdf8.msi
[2009/02/18 17:07:16 | 000,513,024 | ---- | M] () -- C:\Windows\Installer\112cdff.msi
[2009/02/18 17:07:22 | 000,516,608 | ---- | M] () -- C:\Windows\Installer\112ce07.msi
[2009/02/18 17:07:30 | 000,506,880 | ---- | M] () -- C:\Windows\Installer\112ce0f.msi
[2009/02/18 17:07:34 | 000,501,248 | ---- | M] () -- C:\Windows\Installer\112ce16.msi
[2009/02/18 17:07:41 | 001,652,736 | ---- | M] () -- C:\Windows\Installer\112ce1d.msi
[2009/02/18 17:07:51 | 001,652,736 | ---- | M] () -- C:\Windows\Installer\112ce24.msi
[2009/02/18 17:08:06 | 001,652,736 | ---- | M] () -- C:\Windows\Installer\112ce2b.msi
[2009/02/18 17:08:09 | 000,501,248 | ---- | M] () -- C:\Windows\Installer\112ce32.msi
[2009/02/18 17:08:16 | 001,640,960 | ---- | M] () -- C:\Windows\Installer\112ce39.msi
[2009/02/18 17:13:01 | 018,181,632 | ---- | M] () -- C:\Windows\Installer\112ce47.msi
[2009/04/24 12:28:00 | 004,450,816 | R--- | M] () -- C:\Windows\Installer\1139a97.msp
[2009/04/24 12:38:18 | 001,229,312 | R--- | M] () -- C:\Windows\Installer\1139aa1.msp
[2009/04/24 12:31:18 | 001,425,920 | R--- | M] () -- C:\Windows\Installer\1139aad.msp
[2009/03/28 22:49:25 | 000,885,760 | ---- | M] () -- C:\Windows\Installer\166876.msi
[2007/01/01 10:34:37 | 000,314,880 | ---- | M] () -- C:\Windows\Installer\16ce0.msi
[2011/10/11 14:09:23 | 000,219,648 | ---- | M] () -- C:\Windows\Installer\1a1606.msi
[2008/10/20 11:18:14 | 006,474,240 | R--- | M] () -- C:\Windows\Installer\1bafef8.msp
[2008/10/20 11:22:54 | 011,758,592 | R--- | M] () -- C:\Windows\Installer\1baff02.msp
[2010/05/29 23:18:57 | 000,602,624 | ---- | M] () -- C:\Windows\Installer\1c4c4e0.msi
[2010/04/09 15:21:24 | 005,025,792 | R--- | M] () -- C:\Windows\Installer\1ced69f.msp
[2009/10/16 07:08:48 | 002,237,952 | R--- | M] () -- C:\Windows\Installer\1ced6b7.msp
[2013/06/28 01:28:32 | 001,263,104 | ---- | M] () -- C:\Windows\Installer\1f0f04.msi
[2013/06/28 01:31:57 | 001,276,928 | ---- | M] () -- C:\Windows\Installer\1f0f0b.msi
[2012/03/22 19:35:39 | 001,160,192 | ---- | M] () -- C:\Windows\Installer\1fb477.msi
[2010/03/22 16:03:14 | 011,732,992 | R--- | M] () -- C:\Windows\Installer\21662a.msp
[2008/05/25 21:22:35 | 000,431,104 | ---- | M] () -- C:\Windows\Installer\250767.msi
[2012/05/26 12:50:39 | 000,240,640 | ---- | M] () -- C:\Windows\Installer\25feac.msi
[2009/04/24 12:29:02 | 009,013,760 | R--- | M] () -- C:\Windows\Installer\2b353c.msp
[2009/08/16 18:33:26 | 000,248,832 | ---- | M] () -- C:\Windows\Installer\2b3544.msi
[2009/05/26 18:53:56 | 000,579,072 | R--- | M] () -- C:\Windows\Installer\2b355a.msp
[2009/05/07 09:04:06 | 018,341,376 | R--- | M] () -- C:\Windows\Installer\2b3562.msp
[2009/07/27 04:32:20 | 005,028,352 | R--- | M] () -- C:\Windows\Installer\2b357a.msp
[2009/03/20 11:48:56 | 000,183,808 | R--- | M] () -- C:\Windows\Installer\2b3586.msp
[2009/04/24 12:30:16 | 002,583,552 | R--- | M] () -- C:\Windows\Installer\2b35a0.msp
[2009/05/04 07:47:22 | 009,124,864 | R--- | M] () -- C:\Windows\Installer\2b35c1.msp
[2009/05/26 18:54:44 | 004,192,768 | R--- | M] () -- C:\Windows\Installer\2b35de.msp
[2009/05/04 07:46:14 | 008,299,008 | R--- | M] () -- C:\Windows\Installer\2b35f7.msp
[2009/02/12 12:58:48 | 000,549,888 | R--- | M] () -- C:\Windows\Installer\2b3613.msp
[2009/05/04 07:49:40 | 010,955,776 | R--- | M] () -- C:\Windows\Installer\2b364f.msp
[2009/12/09 22:31:40 | 002,724,352 | ---- | M] () -- C:\Windows\Installer\2bb9f40.msi
[2012/10/21 00:32:14 | 009,590,272 | R--- | M] () -- C:\Windows\Installer\2bbeb7c.msp
[2012/10/21 00:32:14 | 002,830,848 | R--- | M] () -- C:\Windows\Installer\2bbeb86.msp
[2012/11/17 10:36:02 | 005,007,872 | R--- | M] () -- C:\Windows\Installer\2bbebb4.msp
[2013/05/27 12:59:55 | 009,475,584 | ---- | M] () -- C:\Windows\Installer\2c96c5.msi
[2013/02/17 04:46:23 | 003,708,416 | R--- | M] () -- C:\Windows\Installer\2ee8855.msp
[2009/03/28 21:48:00 | 000,789,504 | ---- | M] () -- C:\Windows\Installer\2fece.msi
[2013/02/13 21:04:42 | 005,007,360 | R--- | M] () -- C:\Windows\Installer\304a40.msp
[2009/02/06 23:31:16 | 005,047,808 | R--- | M] () -- C:\Windows\Installer\314ef3a.msp
[2009/03/26 23:24:42 | 000,020,480 | ---- | M] () -- C:\Windows\Installer\316f6c0.msi
[2009/08/18 12:50:38 | 012,022,272 | R--- | M] () -- C:\Windows\Installer\32fea51.msp
[2009/08/18 13:08:34 | 001,373,696 | R--- | M] () -- C:\Windows\Installer\32fea69.msp
[2009/09/18 09:30:44 | 005,016,576 | R--- | M] () -- C:\Windows\Installer\32fea81.msp
[2009/07/27 04:31:24 | 003,738,624 | R--- | M] () -- C:\Windows\Installer\32fea8b.msp
[2009/08/05 07:49:32 | 003,457,024 | R--- | M] () -- C:\Windows\Installer\32feac3.msp
[2008/11/13 03:55:32 | 001,306,624 | R--- | M] () -- C:\Windows\Installer\358ddd9.msp
[2008/10/10 07:39:56 | 018,344,960 | R--- | M] () -- C:\Windows\Installer\358ddf9.msp
[2008/10/10 07:48:06 | 009,688,064 | R--- | M] () -- C:\Windows\Installer\358de03.msp
[2008/05/21 02:30:40 | 014,308,864 | R--- | M] () -- C:\Windows\Installer\358de2d.msp
[2008/05/21 01:45:28 | 005,246,976 | R--- | M] () -- C:\Windows\Installer\358de4a.msp
[2007/10/15 00:43:14 | 229,852,160 | R--- | M] () -- C:\Windows\Installer\358df02.msp
[2007/10/15 00:43:32 | 021,981,184 | R--- | M] () -- C:\Windows\Installer\358df0b.msp
[2007/10/15 00:43:46 | 005,749,760 | R--- | M] () -- C:\Windows\Installer\358df67.msp
[2007/10/15 00:43:38 | 012,743,168 | R--- | M] () -- C:\Windows\Installer\358df7a.msp
[2007/10/15 00:46:48 | 000,324,608 | R--- | M] () -- C:\Windows\Installer\358df89.msp
[2007/10/15 00:44:28 | 000,324,608 | R--- | M] () -- C:\Windows\Installer\358df91.msp
[2008/10/10 07:31:34 | 018,447,872 | R--- | M] () -- C:\Windows\Installer\358df9b.msp
[2008/04/11 19:48:24 | 006,774,272 | R--- | M] () -- C:\Windows\Installer\358dfb5.msp
[2009/01/07 21:25:16 | 005,046,784 | R--- | M] () -- C:\Windows\Installer\358dfe3.msp
[2008/10/10 07:30:10 | 019,258,880 | R--- | M] () -- C:\Windows\Installer\358dfed.msp
[2008/04/11 19:08:12 | 006,302,720 | R--- | M] () -- C:\Windows\Installer\358e009.msp
[2008/10/10 07:39:06 | 001,926,144 | R--- | M] () -- C:\Windows\Installer\358e028.msp
[2008/10/20 11:16:58 | 013,211,648 | R--- | M] () -- C:\Windows\Installer\358e042.msp
[2008/10/10 07:45:48 | 012,962,816 | R--- | M] () -- C:\Windows\Installer\358e062.msp
[2008/10/10 07:52:50 | 005,195,264 | R--- | M] () -- C:\Windows\Installer\358e06c.msp
[2008/11/13 03:54:26 | 009,576,960 | R--- | M] () -- C:\Windows\Installer\358e076.msp
[2008/10/20 11:21:40 | 011,937,280 | R--- | M] () -- C:\Windows\Installer\358e08f.msp
[2008/10/10 07:51:38 | 014,699,520 | R--- | M] () -- C:\Windows\Installer\358e099.msp
[2008/02/15 09:54:20 | 009,736,192 | R--- | M] () -- C:\Windows\Installer\358e0c6.msp
[2009/08/18 13:57:54 | 009,122,304 | R--- | M] () -- C:\Windows\Installer\3830305.msp
[2009/08/18 13:58:56 | 008,301,056 | R--- | M] () -- C:\Windows\Installer\383031d.msp
[2009/08/18 14:19:26 | 010,098,688 | R--- | M] () -- C:\Windows\Installer\383033e.msp
[2009/10/16 08:03:20 | 005,003,776 | R--- | M] () -- C:\Windows\Installer\3830356.msp
[2013/04/02 14:00:20 | 000,430,592 | ---- | M] () -- C:\Windows\Installer\3b2fae.msi
[2013/05/27 13:13:54 | 001,548,800 | ---- | M] () -- C:\Windows\Installer\3b5fbe.msi
[2013/05/27 13:14:08 | 002,002,432 | ---- | M] () -- C:\Windows\Installer\3b5fe1.msi
[2013/05/27 13:14:31 | 005,847,552 | ---- | M] () -- C:\Windows\Installer\3b5fe8.msi
[2013/05/27 13:16:22 | 001,720,832 | ---- | M] () -- C:\Windows\Installer\3b5fef.msi
[2013/05/27 13:19:02 | 004,204,032 | ---- | M] () -- C:\Windows\Installer\3b5ff6.msi
[2009/04/09 02:13:27 | 000,924,160 | ---- | M] () -- C:\Windows\Installer\3eb6a9c.msi
[2007/07/21 14:26:34 | 007,574,016 | R--- | M] () -- C:\Windows\Installer\3f619.msp
[2008/04/18 15:56:18 | 006,215,680 | R--- | M] () -- C:\Windows\Installer\3f62c.msp
[2007/04/21 21:16:22 | 012,490,752 | R--- | M] () -- C:\Windows\Installer\3f636.msp
[2008/09/24 13:05:44 | 016,381,440 | R--- | M] () -- C:\Windows\Installer\3f648.msp
[2008/07/30 00:20:14 | 011,767,296 | R--- | M] () -- C:\Windows\Installer\3f65a.msp
[2008/08/11 12:49:32 | 022,457,344 | R--- | M] () -- C:\Windows\Installer\3f664.msp
[2008/06/19 19:28:04 | 001,573,376 | R--- | M] () -- C:\Windows\Installer\3f677.msp
[2008/08/11 12:51:14 | 015,916,544 | R--- | M] () -- C:\Windows\Installer\3f689.msp
[2010/05/20 19:57:12 | 005,907,456 | R--- | M] () -- C:\Windows\Installer\45a703.msp
[2010/05/20 19:57:18 | 004,989,952 | R--- | M] () -- C:\Windows\Installer\45a704.msp
[2010/11/24 10:51:00 | 002,190,336 | R--- | M] () -- C:\Windows\Installer\45a71d.msp
[2010/08/13 18:00:36 | 009,404,928 | R--- | M] () -- C:\Windows\Installer\45a735.msp
[2012/03/22 15:34:01 | 000,019,968 | ---- | M] () -- C:\Windows\Installer\45a73d.msi
[2010/08/04 15:13:04 | 000,686,080 | R--- | M] () -- C:\Windows\Installer\45a754.msp
[2011/08/10 17:42:04 | 007,070,208 | R--- | M] () -- C:\Windows\Installer\45a75e.msp
[2010/08/13 18:02:20 | 002,545,664 | R--- | M] () -- C:\Windows\Installer\45a77e.msp
[2011/03/17 20:00:20 | 000,090,624 | R--- | M] () -- C:\Windows\Installer\45a79d.msp
[2011/06/21 11:59:26 | 001,764,352 | R--- | M] () -- C:\Windows\Installer\45a7b9.msp
[2011/09/06 21:46:22 | 009,006,080 | R--- | M] () -- C:\Windows\Installer\45a7d1.msp
[2011/04/29 12:28:40 | 001,995,264 | R--- | M] () -- C:\Windows\Installer\45a7db.msp
[2011/08/10 17:43:30 | 003,795,968 | R--- | M] () -- C:\Windows\Installer\45a803.msp
[2011/03/17 20:03:50 | 000,308,736 | R--- | M] () -- C:\Windows\Installer\45a838.msp
[2007/10/15 00:59:26 | 026,614,784 | R--- | M] () -- C:\Windows\Installer\45fd9.msp
[2007/10/15 00:33:24 | 026,646,016 | R--- | M] () -- C:\Windows\Installer\45fe4.msp
[2008/11/14 12:32:40 | 000,432,640 | ---- | M] () -- C:\Windows\Installer\460fa.msi
[2011/10/11 14:58:47 | 000,038,400 | ---- | M] () -- C:\Windows\Installer\47b67a.msi
[2011/10/11 14:58:49 | 020,333,568 | R--- | M] () -- C:\Windows\Installer\47b682.msp
[2012/07/18 15:54:24 | 002,831,360 | R--- | M] () -- C:\Windows\Installer\4a4449.msp
[2012/07/25 16:57:08 | 002,532,864 | R--- | M] () -- C:\Windows\Installer\4a4477.msp
[2012/07/18 15:55:46 | 009,585,664 | R--- | M] () -- C:\Windows\Installer\4a4490.msp
[2012/09/05 16:25:30 | 002,221,568 | R--- | M] () -- C:\Windows\Installer\4a44a1.msp
[2012/07/25 16:57:06 | 003,157,504 | R--- | M] () -- C:\Windows\Installer\4a44b9.msp
[2012/09/25 12:35:46 | 005,009,920 | R--- | M] () -- C:\Windows\Installer\4a44d1.msp
[2013/02/16 11:21:34 | 000,039,936 | ---- | M] () -- C:\Windows\Installer\4b6e4.ipi
[2013/01/23 19:05:40 | 009,765,376 | R--- | M] () -- C:\Windows\Installer\4b6e6.msp
[2012/12/14 11:00:26 | 013,178,368 | R--- | M] () -- C:\Windows\Installer\4b703.msp
[2012/12/19 23:36:38 | 013,662,720 | R--- | M] () -- C:\Windows\Installer\4b71b.msp
[2011/09/06 22:48:02 | 008,181,248 | R--- | M] () -- C:\Windows\Installer\4f27c4.msp
[2013/04/29 21:33:24 | 001,769,984 | ---- | M] () -- C:\Windows\Installer\556c1e.msi
[2012/05/29 13:18:05 | 000,032,256 | ---- | M] () -- C:\Windows\Installer\5807e3.msi
[2012/05/29 13:18:58 | 000,120,832 | ---- | M] () -- C:\Windows\Installer\58080a.msi
[2012/05/29 13:19:06 | 000,026,624 | ---- | M] () -- C:\Windows\Installer\580821.msi
[2012/05/29 13:19:11 | 000,032,768 | ---- | M] () -- C:\Windows\Installer\58082b.msi
[2012/05/29 13:19:18 | 000,029,696 | ---- | M] () -- C:\Windows\Installer\58083a.msi
[2012/05/29 13:19:23 | 000,067,072 | ---- | M] () -- C:\Windows\Installer\58084b.msi
[2012/05/29 13:19:29 | 000,026,624 | ---- | M] () -- C:\Windows\Installer\580860.msi
[2012/05/29 13:19:33 | 000,025,600 | ---- | M] () -- C:\Windows\Installer\580875.msi
[2012/05/29 13:19:36 | 000,025,088 | ---- | M] () -- C:\Windows\Installer\580880.msi
[2012/05/29 13:19:38 | 000,025,088 | ---- | M] () -- C:\Windows\Installer\58088b.msi
[2012/05/29 13:19:40 | 000,025,088 | ---- | M] () -- C:\Windows\Installer\580896.msi
[2012/05/29 13:19:47 | 000,025,600 | ---- | M] () -- C:\Windows\Installer\5808a7.msi
[2012/05/29 13:19:49 | 000,032,768 | ---- | M] () -- C:\Windows\Installer\5808b2.msi
[2009/03/12 14:15:56 | 000,648,192 | ---- | M] () -- C:\Windows\Installer\5b6be6.msi
[2008/12/13 09:58:22 | 000,754,688 | R--- | M] () -- C:\Windows\Installer\5b6bf2.msp
[2012/12/19 13:20:59 | 012,387,840 | R--- | M] () -- C:\Windows\Installer\5c0b84.msp
[2008/05/26 18:39:44 | 000,431,104 | ---- | M] () -- C:\Windows\Installer\5ecd55.msi
[2008/05/25 20:11:44 | 006,668,800 | ---- | M] () -- C:\Windows\Installer\62da76.msi
[2011/05/18 22:55:38 | 019,624,448 | R--- | M] () -- C:\Windows\Installer\64550.msp
[2011/04/13 11:37:02 | 019,201,024 | R--- | M] () -- C:\Windows\Installer\64558.msp
[2011/12/26 05:06:20 | 005,115,392 | R--- | M] () -- C:\Windows\Installer\64560.msp
[2011/10/26 15:38:54 | 002,830,848 | R--- | M] () -- C:\Windows\Installer\64568.msp
[2011/09/15 18:37:40 | 037,148,160 | R--- | M] () -- C:\Windows\Installer\64587.msp
[2011/09/15 18:35:54 | 001,411,072 | R--- | M] () -- C:\Windows\Installer\64594.msp
[2011/09/15 18:37:52 | 034,428,416 | R--- | M] () -- C:\Windows\Installer\64595.msp
[2011/09/15 18:37:28 | 016,691,712 | R--- | M] () -- C:\Windows\Installer\645b2.msp
[2011/09/15 18:34:54 | 428,804,608 | R--- | M] () -- C:\Windows\Installer\6477e.msp
[2011/09/15 18:38:04 | 010,838,528 | R--- | M] () -- C:\Windows\Installer\6478a.msp
[2011/09/15 18:39:22 | 011,163,136 | R--- | M] () -- C:\Windows\Installer\64797.msp
[2011/09/15 18:40:36 | 007,959,552 | R--- | M] () -- C:\Windows\Installer\647a2.msp
[2011/04/06 22:43:30 | 123,313,664 | R--- | M] () -- C:\Windows\Installer\647ba.msp
[2011/07/11 17:19:28 | 010,619,904 | R--- | M] () -- C:\Windows\Installer\647c7.msp
[2011/09/15 18:37:32 | 038,176,256 | R--- | M] () -- C:\Windows\Installer\647df.msp
[2011/07/21 12:34:34 | 003,456,000 | R--- | M] () -- C:\Windows\Installer\647ec.msp
[2011/11/21 23:07:36 | 017,191,936 | R--- | M] () -- C:\Windows\Installer\647fa.msp
[2013/04/26 09:02:00 | 005,284,864 | R--- | M] () -- C:\Windows\Installer\65805.msp
[2013/05/03 11:41:40 | 000,836,096 | R--- | M] () -- C:\Windows\Installer\6580d.msp
[2009/03/31 00:42:46 | 000,136,192 | ---- | M] () -- C:\Windows\Installer\65a5b8.msi
[2013/01/16 13:29:08 | 005,006,848 | R--- | M] () -- C:\Windows\Installer\668e6.msp
[2012/12/06 17:29:48 | 003,721,728 | R--- | M] () -- C:\Windows\Installer\668ef.msp
[2013/01/23 19:05:40 | 009,765,376 | ---- | M] () -- C:\Windows\Installer\668f0.msp
[2009/02/18 17:13:04 | 000,061,952 | ---- | M] () -- C:\Windows\Installer\668f1.mst
[2013/01/23 19:05:40 | 009,765,376 | R--- | M] () -- C:\Windows\Installer\668f7.msp
[2012/09/25 13:39:06 | 001,760,768 | R--- | M] () -- C:\Windows\Installer\670f3.msp
[2012/09/25 13:38:52 | 011,885,568 | R--- | M] () -- C:\Windows\Installer\6710d.msp
[2012/09/25 13:35:18 | 009,101,824 | R--- | M] () -- C:\Windows\Installer\67125.msp
[2012/09/25 13:35:46 | 004,285,952 | R--- | M] () -- C:\Windows\Installer\6712f.msp
[2012/09/25 13:35:30 | 007,695,360 | R--- | M] () -- C:\Windows\Installer\67157.msp
[2012/09/25 13:36:20 | 008,465,408 | R--- | M] () -- C:\Windows\Installer\67177.msp
[2012/09/06 10:22:10 | 013,475,840 | R--- | M] () -- C:\Windows\Installer\6719d.msp
[2012/09/10 09:59:10 | 010,739,712 | R--- | M] () -- C:\Windows\Installer\671ac.msp
[2012/10/24 16:24:30 | 005,007,872 | R--- | M] () -- C:\Windows\Installer\671c3.msp
[2011/04/29 12:30:12 | 001,197,056 | R--- | M] () -- C:\Windows\Installer\687c2b.msp
[2012/01/22 10:09:26 | 001,700,352 | R--- | M] () -- C:\Windows\Installer\69082.msp
[2009/08/18 12:56:58 | 005,020,672 | R--- | M] () -- C:\Windows\Installer\6d204.msp
[2009/11/28 21:46:10 | 000,429,568 | ---- | M] () -- C:\Windows\Installer\6e1bd.msi
[2012/04/04 22:37:36 | 003,149,824 | R--- | M] () -- C:\Windows\Installer\6fb39.msp
[2012/04/04 22:37:40 | 002,540,544 | R--- | M] () -- C:\Windows\Installer\6fb51.msp
[2012/06/19 12:54:42 | 005,009,920 | R--- | M] () -- C:\Windows\Installer\6fb69.msp
[2012/06/19 12:54:40 | 002,239,488 | R--- | M] () -- C:\Windows\Installer\6fb81.msp
[2012/05/30 07:18:24 | 001,739,264 | R--- | M] () -- C:\Windows\Installer\6fb8c.msp
[2012/05/30 07:18:08 | 011,885,056 | R--- | M] () -- C:\Windows\Installer\6fbbd.msp
[2010/07/23 02:04:08 | 011,395,072 | R--- | M] () -- C:\Windows\Installer\71dbc.msp
[2012/01/07 18:56:36 | 000,467,456 | ---- | M] () -- C:\Windows\Installer\71dcc.msi
[2010/11/21 00:33:46 | 001,980,928 | R--- | M] () -- C:\Windows\Installer\71de3.msp
[2011/07/27 08:39:50 | 009,892,352 | R--- | M] () -- C:\Windows\Installer\71df5.msp
[2011/07/27 08:37:28 | 011,592,192 | R--- | M] () -- C:\Windows\Installer\71e39.msp
[2010/07/23 02:03:24 | 000,338,432 | R--- | M] () -- C:\Windows\Installer\71e51.msp
[2013/05/21 13:30:41 | 000,029,696 | ---- | M] () -- C:\Windows\Installer\79c235.msi
[2009/03/31 01:05:21 | 000,437,248 | ---- | M] () -- C:\Windows\Installer\7a208f.msi
[2010/04/24 17:10:46 | 008,486,400 | R--- | M] () -- C:\Windows\Installer\7ba9f.msp
[2010/04/24 17:07:04 | 010,118,144 | R--- | M] () -- C:\Windows\Installer\7bace.msp
[2010/05/18 23:35:24 | 005,023,744 | R--- | M] () -- C:\Windows\Installer\7bae6.msp
[2010/04/24 17:05:14 | 004,199,424 | R--- | M] () -- C:\Windows\Installer\7bafe.msp
[2010/04/24 17:07:58 | 004,667,392 | R--- | M] () -- C:\Windows\Installer\7bb16.msp
[2010/03/24 18:54:54 | 002,516,992 | R--- | M] () -- C:\Windows\Installer\7bb33.msp
[2010/03/24 18:54:48 | 003,126,272 | R--- | M] () -- C:\Windows\Installer\7bb34.msp
[2010/04/24 17:08:48 | 009,129,984 | R--- | M] () -- C:\Windows\Installer\7bb4d.msp
[2010/04/24 17:09:46 | 011,750,912 | R--- | M] () -- C:\Windows\Installer\7bb57.msp
[2009/04/04 10:14:58 | 001,094,656 | R--- | M] () -- C:\Windows\Installer\7f310.msp
[2009/04/04 11:36:32 | 021,390,848 | R--- | M] () -- C:\Windows\Installer\7f311.msp
[2009/04/04 17:09:34 | 015,190,016 | R--- | M] () -- C:\Windows\Installer\7f332.msp
[2009/04/04 17:08:40 | 343,058,432 | R--- | M] () -- C:\Windows\Installer\7f4ad.msp
[2009/04/04 17:10:08 | 009,926,144 | R--- | M] () -- C:\Windows\Installer\7f4b9.msp
[2009/04/04 17:10:16 | 007,888,384 | R--- | M] () -- C:\Windows\Installer\7f4c4.msp
[2009/04/04 17:10:24 | 001,282,560 | R--- | M] () -- C:\Windows\Installer\7f4cd.msp
[2009/04/04 07:35:30 | 038,325,760 | R--- | M] () -- C:\Windows\Installer\7f4dd.msp
[2009/04/04 07:35:48 | 036,977,152 | R--- | M] () -- C:\Windows\Installer\7f4e7.msp
[2009/04/14 04:50:22 | 005,191,680 | R--- | M] () -- C:\Windows\Installer\85dcf.msp
[2009/04/14 03:22:08 | 019,840,000 | R--- | M] () -- C:\Windows\Installer\85dd8.msp
[2009/03/28 09:50:10 | 005,025,792 | R--- | M] () -- C:\Windows\Installer\85df0.msp
[2009/04/14 03:20:06 | 009,573,376 | R--- | M] () -- C:\Windows\Installer\85df8.msp
[2009/02/25 19:08:18 | 008,311,808 | R--- | M] () -- C:\Windows\Installer\85e0f.msp
[2009/04/14 04:56:18 | 020,498,944 | R--- | M] () -- C:\Windows\Installer\85e19.msp
[2009/04/14 04:51:24 | 001,303,040 | R--- | M] () -- C:\Windows\Installer\85e22.msp
[2009/04/14 03:46:12 | 015,438,848 | R--- | M] () -- C:\Windows\Installer\85e2c.msp
[2009/04/14 04:21:34 | 015,303,168 | R--- | M] () -- C:\Windows\Installer\85e36.msp
[2009/04/14 04:18:14 | 009,684,480 | R--- | M] () -- C:\Windows\Installer\85e3e.msp
[2009/04/14 04:49:26 | 001,922,560 | R--- | M] () -- C:\Windows\Installer\85e46.msp
[2009/03/28 13:18:28 | 030,178,304 | ---- | M] () -- C:\Windows\Installer\8853d3.msi
[2010/06/22 01:40:40 | 000,024,064 | ---- | M] () -- C:\Windows\Installer\8be59a.msi
[2011/11/11 16:16:20 | 008,458,240 | R--- | M] () -- C:\Windows\Installer\8c683.msp
[2012/02/29 23:45:14 | 004,989,440 | R--- | M] () -- C:\Windows\Installer\8c6b1.msp
[2011/11/11 16:15:00 | 001,795,584 | R--- | M] () -- C:\Windows\Installer\8c6c9.msp
[2011/11/01 13:34:30 | 002,531,840 | R--- | M] () -- C:\Windows\Installer\8c6d3.msp
[2012/03/22 16:25:14 | 020,333,056 | R--- | M] () -- C:\Windows\Installer\8c6fe.msp
[2011/11/01 13:34:58 | 004,225,536 | R--- | M] () -- C:\Windows\Installer\8c71a.msp
[2011/11/11 16:14:40 | 009,096,192 | R--- | M] () -- C:\Windows\Installer\8c732.msp
[2011/11/01 13:34:28 | 002,247,168 | R--- | M] () -- C:\Windows\Installer\8c74a.msp
[2011/12/25 05:40:46 | 000,819,200 | R--- | M] () -- C:\Windows\Installer\8c75b.msp
[2012/08/30 03:06:58 | 005,007,872 | R--- | M] () -- C:\Windows\Installer\934eb.msp
[2010/03/11 23:59:18 | 005,031,424 | R--- | M] () -- C:\Windows\Installer\9da00.msp
[2010/02/21 01:02:24 | 004,195,840 | R--- | M] () -- C:\Windows\Installer\9da18.msp
[2010/02/21 01:03:34 | 004,472,832 | R--- | M] () -- C:\Windows\Installer\9da36.msp
[2012/10/16 04:12:32 | 000,943,616 | R--- | M] () -- C:\Windows\Installer\9fc33.msp
[2012/10/10 05:27:32 | 011,291,136 | R--- | M] () -- C:\Windows\Installer\9fc45.msp
[2012/11/17 10:36:10 | 003,865,600 | R--- | M] () -- C:\Windows\Installer\9fc4e.msp
[2012/12/19 23:37:38 | 005,007,872 | R--- | M] () -- C:\Windows\Installer\9fc84.msp
[2013/03/28 09:44:51 | 023,765,504 | R--- | M] () -- C:\Windows\Installer\a186b.msp
[2013/01/09 12:39:02 | 019,780,096 | R--- | M] () -- C:\Windows\Installer\a1881.msp
[2013/02/13 21:04:42 | 005,007,360 | ---- | M] () -- C:\Windows\Installer\a1883.msp
[2009/02/18 17:13:04 | 000,061,952 | ---- | M] () -- C:\Windows\Installer\a1884.mst
[2013/03/20 02:59:38 | 005,004,288 | R--- | M] () -- C:\Windows\Installer\a408f.msp
[2008/06/16 13:36:33 | 004,372,992 | ---- | M] () -- C:\Windows\Installer\a73a80.msi
[2012/09/05 17:15:43 | 003,947,520 | ---- | M] () -- C:\Windows\Installer\abb5da.msi
[2012/07/31 12:18:14 | 005,018,624 | R--- | M] () -- C:\Windows\Installer\abb6b6.msp
[2012/03/27 11:47:55 | 004,959,232 | R--- | M] () -- C:\Windows\Installer\abb6b7.msp
[2013/05/22 14:07:58 | 005,008,384 | R--- | M] () -- C:\Windows\Installer\b3ebb.msp
[2010/01/14 22:26:08 | 005,027,840 | R--- | M] () -- C:\Windows\Installer\b94d6.msp
[2009/10/16 08:09:28 | 002,518,016 | R--- | M] () -- C:\Windows\Installer\bacc8.msp
[2009/11/21 00:36:14 | 005,002,752 | R--- | M] () -- C:\Windows\Installer\bace0.msp
[2010/02/04 01:59:48 | 005,031,936 | R--- | M] () -- C:\Windows\Installer\bccb7.msp
[2010/02/21 02:00:02 | 008,480,768 | R--- | M] () -- C:\Windows\Installer\bccc1.msp
[2010/02/04 18:24:30 | 009,122,304 | R--- | M] () -- C:\Windows\Installer\bccef.msp
[2010/03/10 17:32:18 | 000,119,296 | ---- | M] () -- C:\Windows\Installer\bccf7.msi
[2011/11/01 13:34:56 | 004,250,112 | R--- | M] () -- C:\Windows\Installer\bf3cfc.msp
[2011/11/01 13:34:30 | 001,552,384 | R--- | M] () -- C:\Windows\Installer\bf3d06.msp
[2009/11/14 03:47:00 | 000,236,032 | ---- | M] () -- C:\Windows\Installer\c0d754.msi
[2012/03/22 19:12:39 | 000,223,744 | ---- | M] () -- C:\Windows\Installer\c3d54.msi
[2013/03/08 18:34:38 | 005,196,288 | R--- | M] () -- C:\Windows\Installer\c4a32.msp
[2013/02/07 00:30:34 | 001,035,776 | R--- | M] () -- C:\Windows\Installer\c4a3b.msp
[2013/04/16 21:03:18 | 005,004,800 | R--- | M] () -- C:\Windows\Installer\c4a52.msp
[2012/05/13 13:05:35 | 020,343,808 | R--- | M] () -- C:\Windows\Installer\cd157.msp
[2012/02/17 08:45:24 | 002,299,392 | R--- | M] () -- C:\Windows\Installer\cd16d.msp
[2012/04/28 21:43:58 | 008,459,264 | R--- | M] () -- C:\Windows\Installer\cd177.msp
[2012/03/15 02:24:28 | 001,795,584 | R--- | M] () -- C:\Windows\Installer\cd1a5.msp
[2011/12/15 13:40:40 | 023,374,336 | R--- | M] () -- C:\Windows\Installer\cd1bb.msp
[2011/11/01 13:34:26 | 001,169,920 | R--- | M] () -- C:\Windows\Installer\cd1d2.msp
[2012/04/04 22:38:16 | 003,620,864 | R--- | M] () -- C:\Windows\Installer\cd1dc.msp
[2012/04/30 14:38:28 | 005,011,456 | R--- | M] () -- C:\Windows\Installer\cd212.msp
[2012/04/28 21:44:02 | 009,586,176 | R--- | M] () -- C:\Windows\Installer\cd22b.msp
[2012/03/23 14:59:02 | 007,899,648 | R--- | M] () -- C:\Windows\Installer\cd243.msp
[2012/01/19 13:37:24 | 008,999,936 | R--- | M] () -- C:\Windows\Installer\cd24f.msp
[2012/02/22 15:17:30 | 002,221,568 | R--- | M] () -- C:\Windows\Installer\cd25e.msp
[2011/12/22 16:50:54 | 000,256,000 | R--- | M] () -- C:\Windows\Installer\cd266.msp
[2012/04/28 21:44:02 | 009,101,824 | R--- | M] () -- C:\Windows\Installer\cd27e.msp
[2012/04/04 22:38:44 | 002,831,360 | R--- | M] () -- C:\Windows\Installer\cd288.msp
[2010/05/29 18:58:56 | 000,467,968 | ---- | M] () -- C:\Windows\Installer\d66dc8.msi
[2012/04/22 22:37:42 | 001,182,720 | R--- | M] () -- C:\Windows\Installer\e0a05.msp
[2012/03/15 13:43:28 | 004,216,320 | R--- | M] () -- C:\Windows\Installer\e0a0d.msp
[2012/05/30 07:17:06 | 005,010,432 | R--- | M] () -- C:\Windows\Installer\e0a24.msp
[2013/04/29 20:35:12 | 000,883,712 | ---- | M] () -- C:\Windows\Installer\e78b9.msi
[2013/04/29 20:43:45 | 000,180,736 | ---- | M] () -- C:\Windows\Installer\e78c0.msi
[2007/01/01 10:48:47 | 000,398,848 | ---- | M] () -- C:\Windows\Installer\ed9b.msi
[2007/01/01 10:48:48 | 000,180,224 | ---- | M] () -- C:\Windows\Installer\eda2.msi
[2007/01/01 10:48:49 | 000,280,064 | ---- | M] () -- C:\Windows\Installer\eda9.msi
[2007/01/01 10:49:27 | 000,988,160 | ---- | M] () -- C:\Windows\Installer\edb1.msi
[2007/01/01 10:49:29 | 000,510,976 | ---- | M] () -- C:\Windows\Installer\edb8.msi
[2007/01/01 10:49:30 | 000,312,320 | ---- | M] () -- C:\Windows\Installer\edbf.msi
[2007/01/01 10:49:30 | 000,211,968 | ---- | M] () -- C:\Windows\Installer\edc6.msi
[2007/01/01 10:49:31 | 000,623,616 | ---- | M] () -- C:\Windows\Installer\edce.msi
[2007/01/01 10:55:18 | 006,644,224 | ---- | M] () -- C:\Windows\Installer\edd2.msi
[2007/01/01 10:55:48 | 001,827,840 | ---- | M] () -- C:\Windows\Installer\edda.msi
[2007/01/01 10:55:58 | 002,616,832 | ---- | M] () -- C:\Windows\Installer\ede1.msi
[2007/01/01 10:58:04 | 001,505,792 | ---- | M] () -- C:\Windows\Installer\ee02.msi
[2007/01/01 10:58:58 | 008,440,832 | ---- | M] () -- C:\Windows\Installer\ee08.msi
[2007/01/01 10:59:07 | 000,360,448 | ---- | M] () -- C:\Windows\Installer\ee0e.msi
[2007/01/01 10:59:12 | 000,355,840 | ---- | M] () -- C:\Windows\Installer\ee14.msi
[2007/01/01 10:59:29 | 000,321,024 | ---- | M] () -- C:\Windows\Installer\ee1b.msi
[2013/05/08 18:50:34 | 007,371,264 | R--- | M] () -- C:\Windows\Installer\f54067.msp
[2009/03/30 23:18:18 | 013,141,504 | ---- | M] () -- C:\Windows\Installer\fbeee.msi
[2013/06/29 20:08:33 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{3C3901C5-3455-3E0A-A214-0B093A5070A6}.SchedServiceConfig.rmi
[2013/05/27 13:16:21 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{E14ADE0E-75F3-4A46-87E5-26692DD626EC}.SchedServiceConfig.rmi

< %windir%\system32\tasks\*.* >
[2013/07/01 15:47:23 | 000,004,182 | ---- | M] () -- C:\Windows\system32\tasks\avast! Emergency Update
[2009/05/16 12:44:11 | 000,004,058 | ---- | M] () -- C:\Windows\system32\tasks\Go to RoboForm Install page
[2013/05/21 11:31:33 | 000,003,644 | ---- | M] () -- C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore
[2013/05/21 11:31:33 | 000,003,896 | ---- | M] () -- C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA
[2013/02/18 15:23:19 | 000,003,134 | ---- | M] () -- C:\Windows\system32\tasks\HPCeeScheduleForTrudy Stewart
[2007/01/01 11:17:23 | 000,003,334 | ---- | M] () -- C:\Windows\system32\tasks\JavaUpdateAdministrator
[2009/10/28 10:08:20 | 000,003,334 | ---- | M] () -- C:\Windows\system32\tasks\JavaUpdateSYSTEM
[2008/05/19 19:41:56 | 000,003,334 | ---- | M] () -- C:\Windows\system32\tasks\JavaUpdateTrudy Stewart
[2008/06/01 13:58:42 | 000,003,116 | ---- | M] () -- C:\Windows\system32\tasks\RegCure
[2008/06/01 13:58:42 | 000,003,132 | ---- | M] () -- C:\Windows\system32\tasks\RegCure Program Check
[2009/05/16 12:44:10 | 000,003,498 | ---- | M] () -- C:\Windows\system32\tasks\Run RoboForm TaskBar Icon
[2012/06/30 21:57:33 | 000,003,110 | ---- | M] () -- C:\Windows\system32\tasks\{048304D9-44F1-42C2-BFB6-49092A66EC80}
[2008/06/19 23:02:41 | 000,003,098 | ---- | M] () -- C:\Windows\system32\tasks\{16EDDD4E-39BC-4FF3-8543-EAFCA6A07904}
[2010/05/29 19:00:05 | 000,003,148 | ---- | M] () -- C:\Windows\system32\tasks\{9D3DCFBD-ECCD-4870-9EEE-4A7D788D56DC}
[2009/03/31 13:05:53 | 000,003,108 | ---- | M] () -- C:\Windows\system32\tasks\{C24DAC30-258A-4711-A3F9-9B2ECC34D98B}

< %windir%\system32\tasks\*.* /64 >
[2013/07/01 15:47:23 | 000,004,182 | ---- | M] () -- C:\Windows\system32\tasks\avast! Emergency Update
[2009/05/16 12:44:11 | 000,004,058 | ---- | M] () -- C:\Windows\system32\tasks\Go to RoboForm Install page
[2013/05/21 11:31:33 | 000,003,644 | ---- | M] () -- C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore
[2013/05/21 11:31:33 | 000,003,896 | ---- | M] () -- C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA
[2013/02/18 15:23:19 | 000,003,134 | ---- | M] () -- C:\Windows\system32\tasks\HPCeeScheduleForTrudy Stewart
[2007/01/01 11:17:23 | 000,003,334 | ---- | M] () -- C:\Windows\system32\tasks\JavaUpdateAdministrator
[2009/10/28 10:08:20 | 000,003,334 | ---- | M] () -- C:\Windows\system32\tasks\JavaUpdateSYSTEM
[2008/05/19 19:41:56 | 000,003,334 | ---- | M] () -- C:\Windows\system32\tasks\JavaUpdateTrudy Stewart
[2008/06/01 13:58:42 | 000,003,116 | ---- | M] () -- C:\Windows\system32\tasks\RegCure
[2008/06/01 13:58:42 | 000,003,132 | ---- | M] () -- C:\Windows\system32\tasks\RegCure Program Check
[2009/05/16 12:44:10 | 000,003,498 | ---- | M] () -- C:\Windows\system32\tasks\Run RoboForm TaskBar Icon
[2012/06/30 21:57:33 | 000,003,110 | ---- | M] () -- C:\Windows\system32\tasks\{048304D9-44F1-42C2-BFB6-49092A66EC80}
[2008/06/19 23:02:41 | 000,003,098 | ---- | M] () -- C:\Windows\system32\tasks\{16EDDD4E-39BC-4FF3-8543-EAFCA6A07904}
[2010/05/29 19:00:05 | 000,003,148 | ---- | M] () -- C:\Windows\system32\tasks\{9D3DCFBD-ECCD-4870-9EEE-4A7D788D56DC}
[2009/03/31 13:05:53 | 000,003,108 | ---- | M] () -- C:\Windows\system32\tasks\{C24DAC30-258A-4711-A3F9-9B2ECC34D98B}

< %systemroot%\Fonts\*.exe >

< %systemroot%\*. /mp /s >

< MD5 for: ATAPI.SYS >
[2009/04/11 02:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\ERDNT\cache\atapi.sys
[2009/04/11 02:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009/04/11 02:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009/04/11 02:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008/01/19 03:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/19 03:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 05:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008/05/19 20:01:51 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008/05/19 20:01:51 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008/05/19 20:01:50 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: EXPLORER.EXE >
[2008/10/29 02:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008/10/29 02:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/29 23:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2008/05/19 20:03:31 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2008/05/19 20:03:31 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\ERDNT\cache\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008/10/27 22:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006/11/02 05:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008/01/19 03:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: REGEDIT.EXE >
[2008/01/19 03:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\ERDNT\cache\regedit.exe
[2008/01/19 03:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008/01/19 03:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
[2006/11/02 05:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe

< MD5 for: SERVICES.EXE >
[2008/01/19 03:33:28 | 000,279,040 | ---- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
[2006/11/02 05:45:40 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=329CF3C97CE4C19375C8ABCABAE258B0 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6000.16386_none_cd28fe6bd05df036\services.exe
[2009/04/11 02:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\ERDNT\cache\services.exe
[2009/04/11 02:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\System32\services.exe
[2009/04/11 02:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe

< MD5 for: SVCHOST.EXE >
[2006/11/02 05:45:47 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=10DA15933D582D2FEDCF705EFE394B09 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6000.16386_none_b38497a50862ad11\svchost.exe
[2008/01/19 03:33:32 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\ERDNT\cache\svchost.exe
[2008/01/19 03:33:32 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe
[2008/01/19 03:33:32 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: USER32.DLL >
[2007/01/01 10:04:20 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2009/04/11 02:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\ERDNT\cache\user32.dll
[2009/04/11 02:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll
[2009/04/11 02:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2007/01/01 10:04:20 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2008/01/19 03:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006/11/02 05:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll

< MD5 for: USERINIT.EXE >
[2008/01/19 03:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe
[2008/01/19 03:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008/01/19 03:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006/11/02 05:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

< MD5 for: WINLOGON.EXE >
[2009/04/11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006/11/02 05:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/01/19 03:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >
[2006/11/02 09:01:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2006/11/02 09:01:49 | 000,032,542 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2008/06/01 13:58:41 | 000,000,388 | ---- | C] () -- C:\Windows\Tasks\RegCure.job
[2008/06/01 13:58:41 | 000,000,454 | ---- | C] () -- C:\Windows\Tasks\RegCure Program Check.job
[2008/06/21 13:34:35 | 000,000,354 | ---- | C] () -- C:\Windows\Tasks\HPCeeScheduleForTrudy Stewart.job
[2012/09/19 17:15:22 | 000,000,896 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2012/09/19 17:15:24 | 000,000,900 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

< %Temp%\smtmp\* \s >

< %Temp%\smtmp\1\*.* >

< %Temp%\smtmp\2\*.* >

< %Temp%\smtmp\3\*.* >

< %Temp%\smtmp\4\*.* >

< dir "%systemdrive%\*" /S /A:L /C >
Volume in drive C is HP
Volume Serial Number is 7E13-791E
Directory of C:\
11/02/2006 09:02 AM <JUNCTION> Documents and Settings [C:\Users]
0 File(s) 0 bytes
Directory of C:\ProgramData
11/02/2006 09:02 AM <JUNCTION> Application Data [C:\ProgramData]
11/02/2006 09:02 AM <JUNCTION> Desktop [C:\Users\Public\Desktop]
11/02/2006 09:02 AM <JUNCTION> Documents [C:\Users\Public\Documents]
11/02/2006 09:02 AM <JUNCTION> Favorites [C:\Users\Public\Favorites]
11/02/2006 09:02 AM <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
11/02/2006 09:02 AM <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users
11/02/2006 09:02 AM <SYMLINKD> All Users [C:\ProgramData]
11/02/2006 09:02 AM <JUNCTION> Default User [C:\Users\Default]
0 File(s) 0 bytes
Directory of C:\Users\All Users
11/02/2006 09:02 AM <JUNCTION> Application Data [C:\ProgramData]
11/02/2006 09:02 AM <JUNCTION> Desktop [C:\Users\Public\Desktop]
11/02/2006 09:02 AM <JUNCTION> Documents [C:\Users\Public\Documents]
11/02/2006 09:02 AM <JUNCTION> Favorites [C:\Users\Public\Favorites]
11/02/2006 09:02 AM <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
11/02/2006 09:02 AM <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default
11/02/2006 09:02 AM <JUNCTION> Application Data [C:\Users\Default\AppData\Roaming]
11/02/2006 09:02 AM <JUNCTION> Local Settings [C:\Users\Default\AppData\Local]
11/02/2006 09:02 AM <JUNCTION> My Documents [C:\Users\Default\Documents]
11/02/2006 09:02 AM <JUNCTION> NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
11/02/2006 09:02 AM <JUNCTION> PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
11/02/2006 09:02 AM <JUNCTION> Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
11/02/2006 09:02 AM <JUNCTION> SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
11/02/2006 09:02 AM <JUNCTION> Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
11/02/2006 09:02 AM <JUNCTION> Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default\AppData\Local
11/02/2006 09:02 AM <JUNCTION> Application Data [C:\Users\Default\AppData\Local]
11/02/2006 09:02 AM <JUNCTION> History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
11/02/2006 09:02 AM <JUNCTION> Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Default\Documents
11/02/2006 09:02 AM <JUNCTION> My Music [C:\Users\Default\Music]
11/02/2006 09:02 AM <JUNCTION> My Pictures [C:\Users\Default\Pictures]
11/02/2006 09:02 AM <JUNCTION> My Videos [C:\Users\Default\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Public\Documents
11/02/2006 09:02 AM <JUNCTION> My Music [C:\Users\Public\Music]
11/02/2006 09:02 AM <JUNCTION> My Pictures [C:\Users\Public\Pictures]
11/02/2006 09:02 AM <JUNCTION> My Videos [C:\Users\Public\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Trudy Stewart
05/19/2008 07:38 PM <JUNCTION> Application Data [C:\Users\Trudy Stewart\AppData\Roaming]
05/19/2008 07:38 PM <JUNCTION> Cookies [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Cookies]
05/19/2008 07:38 PM <JUNCTION> Local Settings [C:\Users\Trudy Stewart\AppData\Local]
05/19/2008 07:38 PM <JUNCTION> My Documents [C:\Users\Trudy Stewart\Documents]
05/19/2008 07:38 PM <JUNCTION> NetHood [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
05/19/2008 07:38 PM <JUNCTION> PrintHood [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
05/19/2008 07:38 PM <JUNCTION> Recent [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Recent]
05/19/2008 07:38 PM <JUNCTION> SendTo [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\SendTo]
05/19/2008 07:38 PM <JUNCTION> Start Menu [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Start Menu]
05/19/2008 07:38 PM <JUNCTION> Templates [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Trudy Stewart\AppData\Local
05/19/2008 07:38 PM <JUNCTION> Application Data [C:\Users\Trudy Stewart\AppData\Local]
05/19/2008 07:38 PM <JUNCTION> History [C:\Users\Trudy Stewart\AppData\Local\Microsoft\Windows\History]
05/19/2008 07:38 PM <JUNCTION> Temporary Internet Files [C:\Users\Trudy Stewart\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Trudy Stewart\Documents
05/19/2008 07:38 PM <JUNCTION> My Music [C:\Users\Trudy Stewart\Music]
05/19/2008 07:38 PM <JUNCTION> My Pictures [C:\Users\Trudy Stewart\Pictures]
05/19/2008 07:38 PM <JUNCTION> My Videos [C:\Users\Trudy Stewart\Videos]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile
01/31/2009 10:19 PM <JUNCTION> Application Data [C:\Windows\system32\config\systemprofile\AppData\Roaming]
01/31/2009 10:19 PM <JUNCTION> Local Settings [C:\Windows\system32\config\systemprofile\AppData\Local]
01/31/2009 10:19 PM <JUNCTION> My Documents [C:\Windows\system32\config\systemprofile\Documents]
01/31/2009 10:19 PM <JUNCTION> NetHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
01/31/2009 10:19 PM <JUNCTION> PrintHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
01/31/2009 10:19 PM <JUNCTION> Recent [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent]
01/31/2009 10:19 PM <JUNCTION> SendTo [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo]
01/31/2009 10:19 PM <JUNCTION> Start Menu [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu]
01/31/2009 10:19 PM <JUNCTION> Templates [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile\AppData\Local
01/31/2009 10:19 PM <JUNCTION> Application Data [C:\Windows\system32\config\systemprofile\AppData\Local]
01/31/2009 10:19 PM <JUNCTION> History [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History]
01/31/2009 10:19 PM <JUNCTION> Temporary Internet Files [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile\Documents
01/31/2009 10:19 PM <JUNCTION> My Music [C:\Windows\system32\config\systemprofile\Music]
01/31/2009 10:19 PM <JUNCTION> My Pictures [C:\Windows\system32\config\systemprofile\Pictures]
01/31/2009 10:19 PM <JUNCTION> My Videos [C:\Windows\system32\config\systemprofile\Videos]
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
64 Dir(s) 207,581,065,216 bytes free

========== Alternate Data Streams ==========

@Alternate Data Stream - 284 bytes -> C:\Windows\System32\´ý:@kpctlsp.log
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMPFC5A2B2

< End of report >
Thanks again, 
Trudy


----------



## Trutalley (Mar 10, 2013)

OTL logfile created on: 6/20/2013 10:38:13 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Trudy Stewart\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.81 Gb Available Physical Memory | 60.37% Memory free
6.20 Gb Paging File | 4.73 Gb Available in Paging File | 76.40% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.49 Gb Total Space | 194.48 Gb Free Space | 67.41% Space Free | Partition Type: NTFS
Drive D: | 9.60 Gb Total Space | 1.29 Gb Free Space | 13.48% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 294.68 Gb Free Space | 98.86% Space Free | Partition Type: NTFS

Computer Name: TRUDYSTEWART-PC | User Name: Trudy Stewart | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/20 10:37:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Trudy Stewart\Downloads\OTL.com
PRC - [2013/05/29 01:27:40 | 000,825,808 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2013/05/09 04:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2013/01/30 21:50:30 | 000,370,176 | ---- | M] (The Privoxy team - www.privoxy.org) -- C:\Program Files\Privoxy\privoxy.exe
PRC - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe
PRC - [2011/11/11 14:08:06 | 000,205,336 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
PRC - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
PRC - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/16 05:44:55 | 001,358,384 | R--- | M] (Linksys, LLC) -- C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
PRC - [2008/03/25 04:28:03 | 000,054,672 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\jureg.exe
PRC - [2008/01/19 03:33:27 | 000,151,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\schtasks.exe
PRC - [2007/10/25 09:52:08 | 004,702,208 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/05/09 01:00:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM05Mon.exe
PRC - [2007/02/04 12:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
PRC - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Modules (No Company Name) ==========

MOD - [2013/06/13 18:47:34 | 013,140,872 | ---- | M] () -- C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\PepperFlash\11.7.700.225\pepflashplayer.dll
MOD - [2013/05/29 01:27:38 | 000,393,168 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.110\ppgooglenaclpluginchrome.dll
MOD - [2013/05/29 01:27:35 | 004,051,408 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.110\pdf.dll
MOD - [2013/05/29 01:26:36 | 001,597,392 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.110\ffmpegsumo.dll
MOD - [2013/01/30 21:50:30 | 000,086,528 | ---- | M] () -- C:\Program Files\Privoxy\mgwz.dll
MOD - [2012/10/11 21:56:46 | 000,087,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/10/11 21:56:22 | 001,242,512 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/11/11 14:09:20 | 000,336,408 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
MOD - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
MOD - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
MOD - [2010/05/07 18:37:40 | 000,126,808 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll
MOD - [2010/05/07 18:37:40 | 000,027,480 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll
MOD - [2010/05/07 18:36:54 | 000,340,824 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll
MOD - [2010/05/07 18:35:56 | 007,954,776 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll
MOD - [2010/05/07 18:35:44 | 002,143,576 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll
MOD - [2009/07/13 18:37:04 | 000,152,112 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll
MOD - [2009/07/13 18:37:04 | 000,098,304 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll
MOD - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
MOD - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe -- (RoxLiveShare9)
SRV - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2013/04/10 02:58:17 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2009/04/11 02:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/11/06 16:22:26 | 000,092,792 | ---- | M] (CACE Technologies) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2006/11/02 08:36:18 | 000,029,696 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\iprip.dll -- (iprip)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfSysMon.sys -- (TfSysMon)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\TfNetMon.sys -- (TfNetMon)
DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfFsMon.sys -- (TfFsMon)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (RimUsb)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pctplsg.sys -- (pctplsg)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\PCTINDIS5.SYS -- (PCTINDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lvpopflt.sys -- (lvpopflt)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jubusenum.sys -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\TRUDYS~1\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2013/05/09 04:59:10 | 000,765,736 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2013/05/09 04:59:10 | 000,368,944 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2013/05/09 04:59:10 | 000,174,664 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswVmm.sys -- (aswVmm)
DRV - [2013/05/09 04:59:10 | 000,056,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2013/05/09 04:59:10 | 000,049,376 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswRvrt.sys -- (aswRvrt)
DRV - [2013/05/09 04:59:09 | 000,066,336 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2013/05/09 04:59:09 | 000,049,760 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2013/05/09 04:59:08 | 000,029,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/01/18 02:44:52 | 004,332,960 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUVC.sys -- (LVUVC)
DRV - [2012/01/18 02:44:28 | 000,312,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2012/01/18 02:44:14 | 000,022,176 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvbusflt.sys -- (CompFilter)
DRV - [2011/03/30 23:54:32 | 001,073,216 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AE1200vista.sys -- (Linksys_adapter)
DRV - [2010/05/07 18:43:30 | 000,025,824 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009/07/07 15:48:44 | 000,027,696 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\purendis.sys -- (purendis)
DRV - [2009/07/07 15:48:44 | 000,026,672 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pnarp.sys -- (pnarp)
DRV - [2008/12/04 09:17:15 | 000,645,120 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WUSB54GCv3.sys -- (WUSB54GCv3)
DRV - [2008/08/01 19:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008/05/08 05:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2008/05/08 05:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)
DRV - [2007/11/06 16:22:06 | 000,034,064 | ---- | M] (CACE Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2007/10/26 07:51:22 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007/10/18 07:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/10/12 02:00:44 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/09/07 10:36:08 | 000,156,928 | ---- | M] (ViXS Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\xcbda.sys -- (xcbdaNtsc)
DRV - [2007/08/27 14:59:00 | 007,574,976 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/07/20 01:00:00 | 000,235,616 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vid.sys -- (OEM05Vid)
DRV - [2007/06/08 01:00:02 | 000,141,376 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\OEM05Afx.sys -- (OEM05Afx)
DRV - [2007/04/11 15:33:06 | 000,079,376 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2007/04/11 15:32:58 | 000,036,112 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007/04/11 15:32:52 | 000,034,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2007/04/11 15:32:38 | 000,063,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2007/04/11 15:32:30 | 000,020,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007/03/05 18:45:04 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vfx.sys -- (OEM05Vfx)
DRV - [2005/12/12 13:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{11D231C8-2FE5-4B8A-B2F9-B1736520C7A2}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?PC=BNHP
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes,DefaultScope = {759B6E70-7A7D-4FE5-82BF-EA161AA627D9}
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{637897BC-FCE2-4DEA-8938-5BA57BAEB440}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE8SRC&src=IE-SearchBox
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{759B6E70-7A7D-4FE5-82BF-EA161AA627D9}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=800236&p={searchTerms}
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: extension21804%40extension21804.com:0.91.48
FF - prefs.js..extensions.enabledAddons: infoatoms%40infoatoms.com:1.5.0.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/05/27 18:14:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/27 13:00:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/27 13:00:06 | 000,000,000 | ---D | M]

[2008/09/08 20:54:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Extensions
[2013/06/19 21:43:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\extensions
[2013/06/19 21:43:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/02/02 15:07:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/02/02 15:07:01 | 000,000,000 | ---D | M] (The Browser Highlighter) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\extensions
[2013/06/12 20:46:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\updated\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/06/12 20:46:17 | 000,000,000 | ---D | M] (The Browser Highlighter) -- C:\Program Files\Mozilla Firefox\updated\extensions\[email protected]
[2013/06/12 20:46:17 | 000,000,000 | ---D | M] (InfoAtoms) -- C:\Program Files\Mozilla Firefox\updated\extensions\[email protected]
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\[email protected]
File not found (No name found) -- C:\USERS\TRUDY STEWART\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YOEBZ5B8.DEFAULT-1357333329994\EXTENSIONS\[email protected]
[2013/04/10 02:58:33 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2008/09/03 20:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\mozilla firefox\plugins\npbittorrent.dll
[2013/04/10 02:57:54 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013/04/10 02:57:54 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Bing (Enabled)
CHR - default_search_provider: search_url = http://www.bing.com/search?setmkt=en-US&q={searchTerms}
CHR - default_search_provider: suggest_url = http://api.bing.com/osjson.aspx?query={searchTerms}&language={language},
CHR - homepage: 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.110\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_278.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.110\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U35 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.350.10 (Enabled) = C:\Windows\system32\npdeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Envelopes for Google Docs = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaclkeicedlkpjgnnfkedjomkkhmgcod\2_0\
CHR - Extension: Floorplanner = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\abopacaefhbognnmeigicfpgnmpideag\13_0\
CHR - Extension: I Dream of Greenie = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\abpplimpipkdhcobigmhmmjpmmkjneod\0.2_0\
CHR - Extension: Prezi = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\acoonfmhnndodekhecidldfdjgooefpg\1.3_0\
CHR - Extension: Task Timer = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\aomfjmibjhhfdenfkpaodhnlhkolngif\3.9.1_1\
CHR - Extension: Lucidchart: Diagramming = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\apboafhkiegglekeafbckfjldecefkhn\16_0\
CHR - Extension: Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: Loupe = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhaonknplhhecdgjpphnooeomecgipkc\2.0.4_0\
CHR - Extension: Print this page with CleanPrint = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\biafepndnnahkfldhobcjlclklffkibe\4.7.0_0\
CHR - Extension: Tabs Join = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\binjiceocgbfooocmheaenmmcominbpe\2.1_0\
CHR - Extension: Aviary for Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkinocibdedleighgndmbfpbialnblep\1.3_0\
CHR - Extension: YouTube = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: HelloFax: 50 Free Fax Pages = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bocmleclimfnadgmcdgecijlblfcmfnm\1.12_0\
CHR - Extension: Facebook = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\boeajhmfdjldchidhphikilcgdacljfm\1.0.3_0\
CHR - Extension: Revision3 = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\cncldpggpcpckadjcholildoahcgbmfo\1_0\
CHR - Extension: TimelineRemove = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnedfaenfnkikficknkklbdedlecmpgc\1.1.0_1\
CHR - Extension: Sumo Paint = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpgjihldbpodlmnjolekemlfbcajnmod\3.7_0\
CHR - Extension: Easy Clock = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dplbpgapoedppajbikieafefmcceaagn\9.0.6_0\
CHR - Extension: Gravity = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\eboilkbecbgepecmaaicggbpnlbcfagj\1_0\
CHR - Extension: Facebook Disconnect = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpepffjfmamnambagiibghpglaidiec\1.3.0_0\
CHR - Extension: Stupeflix Video Maker = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkdmcfnoimoilncpjchamnenebopocem\1.5_0\
CHR - Extension: Springpad = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkmopoamfjnmppabeaphohombnjcjgla\6_0\
CHR - Extension: EasyDrop = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\flogpfmjdekjoilcnmmchanikomlidie\1.3.0_0\
CHR - Extension: Attachments.me for Gmail, Dropbox, Box, Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdgofjdapkmlgpgjfielacjckplcdjjk\1.7.4_0\
CHR - Extension: Attachments.me for Gmail, Dropbox, Box, Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdgofjdapkmlgpgjfielacjckplcdjjk\1.7.4_0\.mustache
CHR - Extension: Click&Clean = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\8.3_0\
CHR - Extension: DocuSign = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\goblijolcnempeilmnkmfbhohlpngemd\2.1.0.0_0\
CHR - Extension: Drive Notepad = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpgjomejfimnbmobcocilppikhncegaj\1.2_0\
CHR - Extension: Gradient Creator! = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcplneddoadgichngfbobgpllfphdfla\0.2.1.3_0\
CHR - Extension: Vector Paint = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnbpdiengicdefcjecjbnjnoifekhgdo\3.2.0.0_0\
CHR - Extension: Pixlr Editor = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmaknaampgiegkcjlimdiidlhopknpk\1.2_0\
CHR - Extension: persona/ you are what you love = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iehdddmijbgofffjjmhkodckmnombhmf\2.0.9_1\
CHR - Extension: Sync SugarSync, Evernote, and Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifanaabofjmgladnlbckonoiohpmchik\1.2.4.2_0\
CHR - Extension: Pixorial Video = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ilbibicalpgnmbjnganinjppjephokai\1.0.3_0\
CHR - Extension: Sync Dropbox, Evernote, and Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iobcbdgacfkninlcbphihhdlkobkehia\1.2.4.2_0\
CHR - Extension: Dropbox = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioekoebejdcmnlefjiknokhhafglcjdl\3.0.6_1\
CHR - Extension: Save this page with CleanSave = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iplagehfoafmmjppeijnpkohihcllici\4.7.0_0\
CHR - Extension: Free Online PDF Tools = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jddfpnmfhodaljeelokfceepbeapgbdn\1.0.1.2_0\
CHR - Extension: Facebook Like Button = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jehaijobeonhempacbjelicepjkhoidi\1.0.3_0\
CHR - Extension: mydeco 3D planner = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfnniehafojoidolddmhfnpnbiolbppi\2.3_0\
CHR - Extension: Autodesk Homestyler = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdmmkfaghgcicheaimnpffeeekheafkb\2.3_0\
CHR - Extension: eBay Extension for Google Chrome\u2122 (by eBay) = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khhckppjhonfmcpegdjdibmngahahhck\1.6.12_0\
CHR - Extension: HuffingtonPost NewsGlide = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khjialelnkjdomiblmnpcpjongleegef\0.3.2_0\
CHR - Extension: WordPress.com = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khjnjifipfkgglficmipimgjpbmlbemd\1.1.1_0\
CHR - Extension: Magisto for Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\kinnlbfbjboagbejldhemnifjepmkakj\1.0.4_1\
CHR - Extension: CanvasDraw = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\knfimpamngmggpbamfoomdpebdoleghe\2_0\
CHR - Extension: DriveTunes = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\labgcacinobdnkfndodfkfeabbjckbnj\3.2.4_0\
CHR - Extension: Evernote Web = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol\1.0.7_0\
CHR - Extension: Sketchpad = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkllajgbhondgjjnhmmgbjndmogapinp\1.0.0.4_0\
CHR - Extension: Spanning Backup for Google Apps\u2122 = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lniahgcddkbgipmbmlhjpoafdeephgcf\3.0.1.3_0\
CHR - Extension: Word\u00B2 = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpibnckjjeaabeepofhfmmpjmnomohee\2.5_0\
CHR - Extension: Quick Note = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\mijlebbfndhelmdpmllgcfadlkankhok\1.4.8_0\
CHR - Extension: Free Online PDF Unlocker = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkdknbehfogkgogcennnagfokmnimpab\1.0.1.1_0\
CHR - Extension: deviantART muro = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\namljbfbglehfnlonjmebceimaalofei\1.0_0\
CHR - Extension: InspirARTion = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhbmpilemgmpbdaniehhmodkkppkelec\10_0\
CHR - Extension: Pinterest Keyboard Shortcut | Ctrl+Alt+P = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\npbcjndbpajikchenclendcojmaeaphh\1.2.2_1\
CHR - Extension: Google Chrome to Phone Extension = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oadboiipflhobonjjffjbfekfjcgkhco\2.3.1_0\
CHR - Extension: Todo.ly = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhefmbclkekanpjjpkbciloojcmpkap\2_0\
CHR - Extension: Bolt Save and Share = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofmipocdiiichlijcngflajilbpkkfhj\7.2_0\
CHR - Extension: Photo Collage = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiabhgfgfhoilflkoicbmnejgjjfmhcg\1_0\
CHR - Extension: WeVideo - Video Editor = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\okgjbfikepgflmlelgfgecmgjnmnmnnb\3.1.0_0\
CHR - Extension: Pin Search | Image Search on Pinterest = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\okiaciimfpgbpdhnfdllhdkicpmdoakm\1.0.11_0\
CHR - Extension: SlideRocket = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\omeengfjefdmhnkojnfmncpfdbhnecea\2.0.2_0\
CHR - Extension: Picasa = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb\6.2.2_0\
CHR - Extension: Diigo Web Collector - Capture and Annotate = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oojbgadfejifecebmdnhhkbhdjaphole\2.1.10_0\
CHR - Extension: Click&Clean App = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdabfienifkbhoihedcgeogidfmibmhp\8.0_0\
CHR - Extension: Outlook.com = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfpeapihoiogbcmdmnibeplnikfnhoge\1.0.2_0\
CHR - Extension: Evernote Web Clipper = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc\5.9.16_0\
CHR - Extension: Gmail = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Balsamiq Mockups = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pplbmgaodhjmbklkgkgmlghaekcfhhkk\1.9_0\

O1 HOSTS File: ([2013/02/02 00:35:03 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (jZip Webmail plugin) - {647FD14A-C4F1-46F4-8FC3-0B40F54226F7} - C:\Program Files\jZip\WebmailPlugin.dll (Discordia Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found.
O3 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\Toolbar\WebBrowser: (no name) - {CB789373-04D5-4EF4-9C16-871463FD0830} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Linksys Wireless Manager] C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe (Linksys, LLC)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OEM05Mon.exe] C:\Windows\OEM05Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateReg] C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000..\Run: [B7456CF5EF0D0980D92DD0562D346087910D60E2._service_run] C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Evernote - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Download Link Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_file.htm File not found
O8 - Extra context menu item: Download List Of Files Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_list.htm File not found
O8 - Extra context menu item: Subscribe To RSS/Podcast Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_rss.htm File not found
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 1.7.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 10.21.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{36937FF7-1F22-4576-8665-B5965D4D3BCC}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BBDB5DE6-583B-4601-A391-1DC2D9542FFD}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/01/01 10:56:33 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/06/19 21:40:33 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/06/19 21:40:09 | 000,000,000 | ---D | C] -- C:\JRT
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Local\temp
[2013/06/19 12:33:38 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/06/19 12:10:01 | 005,081,021 | R--- | C] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/18 19:09:10 | 000,000,000 | ---D | C] -- C:\FRST
[2013/06/15 21:27:20 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan
[2013/06/15 21:27:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
[2013/06/15 21:27:12 | 000,000,000 | ---D | C] -- C:\Program Files\Security Task Manager
[2013/06/13 08:35:00 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/06/13 08:34:58 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013/06/13 08:34:58 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013/06/13 08:34:57 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013/06/13 08:34:57 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013/06/13 08:34:55 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013/06/13 08:34:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013/06/13 08:34:53 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013/06/12 11:15:02 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printcom.dll
[2013/06/12 11:14:58 | 000,812,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certutil.exe
[2013/06/12 11:14:57 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certenc.dll
[2013/06/12 11:14:50 | 003,603,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013/06/12 11:14:49 | 003,551,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013/06/12 11:14:40 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cryptdlg.dll
[2013/06/11 14:21:48 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\Desktop\New Folder
[2013/05/27 13:18:56 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Local\Apple Computer
[2013/05/27 13:18:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013/05/27 13:17:10 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013/05/27 13:17:06 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013/05/27 13:17:06 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013/05/27 13:14:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
[2013/05/27 13:14:04 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2013/05/27 12:59:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013/05/27 12:59:26 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2013/05/27 12:59:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2013/05/21 11:29:53 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2013/05/21 11:29:20 | 002,049,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012/10/28 22:15:21 | 011,881,936 | ---- | C] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Users\Trudy Stewart\gosetup.exe
[3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/06/20 10:36:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/20 10:13:19 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/20 10:13:19 | 000,000,454 | ---- | M] () -- C:\Windows\tasks\RegCure Program Check.job
[2013/06/20 10:13:17 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2013/06/20 10:13:07 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/20 10:13:07 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/20 10:13:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/06/20 10:13:00 | 3219,591,168 | -HS- | M] () -- C:\hiberfil.sys
[2013/06/19 21:45:59 | 000,000,935 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Continue Zip Opener Installation.lnk
[2013/06/19 14:29:01 | 000,000,911 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/19 12:10:07 | 005,081,021 | R--- | M] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/18 19:27:16 | 000,000,089 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013/06/11 18:39:35 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013/06/11 18:39:35 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013/06/11 08:41:38 | 000,001,933 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/05/27 20:02:39 | 000,634,834 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/05/27 20:02:39 | 000,112,596 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/05/27 18:14:47 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2013/05/27 13:18:50 | 000,001,626 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013/05/27 12:59:51 | 000,001,688 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2013/05/22 20:32:59 | 000,408,168 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/05/21 15:45:55 | 000,001,849 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/06/19 21:45:59 | 000,000,935 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Continue Zip Opener Installation.lnk
[2013/06/19 14:29:01 | 000,000,911 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/18 19:26:02 | 000,000,089 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013/05/27 13:18:50 | 000,001,626 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013/05/27 12:59:51 | 000,001,688 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2013/04/14 20:49:34 | 000,174,664 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/04/14 20:49:34 | 000,049,376 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013/02/02 00:21:01 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/02/02 00:21:01 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/02/02 00:21:01 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/02/02 00:21:01 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/02/02 00:21:01 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/05/29 13:08:18 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2012/03/31 21:41:09 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012/01/18 02:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2012/01/18 02:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2012/01/18 02:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2011/11/16 21:40:38 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2011/08/12 12:20:14 | 000,015,896 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
[2010/05/07 07:07:08 | 000,000,760 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\setup_ldm.iss
[2010/04/07 12:31:26 | 000,000,000 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\prvlcl.dat
[2009/12/09 22:32:11 | 008,892,928 | ---- | C] () -- C:\ProgramData\atscie.msi
[2009/03/24 22:26:10 | 000,000,050 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-recent-projects.properties
[2009/03/24 22:21:47 | 000,000,745 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-defaults.jap
[2008/12/28 17:31:28 | 000,031,232 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/11/16 00:46:07 | 000,000,138 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\wklnhst.dat
[2008/07/21 16:40:25 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat
[2008/05/20 03:12:40 | 000,001,356 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\d3d9caps.dat

========== ZeroAccess Check ==========

[2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 02:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 02:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2009/04/09 02:14:12 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Ambient Design
[2009/03/28 10:48:26 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Artisteer
[2010/02/26 11:39:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Canon
[2008/09/13 12:52:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/07/21 14:45:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Conceiva
[2009/03/28 22:50:52 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Darq Software
[2013/02/18 15:36:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\DeskSoft
[2012/03/22 16:15:59 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Dropbox
[2008/07/07 15:29:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Individual Software
[2010/06/27 15:16:09 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Inkscape
[2009/03/28 13:18:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Interior Designer 8.0
[2013/01/02 21:57:32 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\IObit
[2012/05/29 17:50:58 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\IrfanView
[2012/05/13 12:44:02 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Leadertech
[2012/05/29 13:24:23 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MAGIX
[2010/06/27 15:30:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MSNInstaller
[2009/03/27 18:55:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NewSoft
[2013/02/01 22:47:11 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NoteTab Light
[2012/03/31 21:23:28 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Opera
[2010/05/29 18:59:53 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoFiltre
[2010/05/29 19:02:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoScape
[2013/04/02 15:29:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\QuickScan
[2008/05/25 20:11:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\ScanSoft
[2008/09/15 22:05:44 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Snapfish
[2013/05/01 20:37:05 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Softland
[2009/04/07 03:05:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\stickies
[2008/11/16 00:46:07 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Template
[2009/03/29 03:17:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\uTorrent

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 284 bytes -> C:\Windows\System32\´ý:@kpctlsp.log
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMPFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:1CA73D29

< End of report >

OTL logfile created on: 7/1/2013 6:18:33 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Trudy Stewart\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.72 Gb Available Physical Memory | 57.40% Memory free
6.20 Gb Paging File | 5.01 Gb Available in Paging File | 80.80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.49 Gb Total Space | 193.84 Gb Free Space | 67.19% Space Free | Partition Type: NTFS
Drive D: | 9.60 Gb Total Space | 1.28 Gb Free Space | 13.39% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 294.65 Gb Free Space | 98.84% Space Free | Partition Type: NTFS

Computer Name: TRUDYSTEWART-PC | User Name: Trudy Stewart | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/07/01 18:15:39 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Trudy Stewart\Downloads\OTL.com
PRC - [2013/06/14 21:28:44 | 000,825,808 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2013/05/09 04:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2013/01/30 21:50:30 | 000,370,176 | ---- | M] (The Privoxy team - www.privoxy.org) -- C:\Program Files\Privoxy\privoxy.exe
PRC - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe
PRC - [2011/11/11 14:08:06 | 000,205,336 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
PRC - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
PRC - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/16 05:44:55 | 001,358,384 | R--- | M] (Linksys, LLC) -- C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
PRC - [2008/03/25 04:28:03 | 000,054,672 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\jureg.exe
PRC - [2008/01/19 03:33:27 | 000,151,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\schtasks.exe
PRC - [2007/10/25 09:52:08 | 004,702,208 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/05/09 01:00:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM05Mon.exe
PRC - [2007/02/04 12:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
PRC - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Modules (No Company Name) ==========

MOD - [2013/06/14 21:28:42 | 000,393,168 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.116\ppgooglenaclpluginchrome.dll
MOD - [2013/06/14 21:28:40 | 004,051,408 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.116\pdf.dll
MOD - [2013/06/14 21:27:48 | 001,597,392 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.116\ffmpegsumo.dll
MOD - [2013/01/30 21:50:30 | 000,086,528 | ---- | M] () -- C:\Program Files\Privoxy\mgwz.dll
MOD - [2012/10/11 21:56:46 | 000,087,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/10/11 21:56:22 | 001,242,512 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/11/11 14:09:20 | 000,336,408 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
MOD - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
MOD - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
MOD - [2010/05/07 18:37:40 | 000,126,808 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll
MOD - [2010/05/07 18:37:40 | 000,027,480 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll
MOD - [2010/05/07 18:36:54 | 000,340,824 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll
MOD - [2010/05/07 18:35:56 | 007,954,776 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll
MOD - [2010/05/07 18:35:44 | 002,143,576 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll
MOD - [2009/07/13 18:37:04 | 000,152,112 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll
MOD - [2009/07/13 18:37:04 | 000,098,304 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll
MOD - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
MOD - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe -- (RoxLiveShare9)
SRV - [2013/06/12 20:46:40 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2009/04/11 02:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/11/06 16:22:26 | 000,092,792 | ---- | M] (CACE Technologies) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2006/11/02 08:36:18 | 000,029,696 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\iprip.dll -- (iprip)

========== Driver Services (SafeList) ==========

DRV - [2013/06/27 20:58:10 | 000,770,344 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2013/06/27 20:58:10 | 000,369,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2013/06/27 20:58:10 | 000,175,176 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswVmm.sys -- (aswVmm)
DRV - [2013/05/09 04:59:10 | 000,056,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2013/05/09 04:59:10 | 000,049,376 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswRvrt.sys -- (aswRvrt)
DRV - [2013/05/09 04:59:09 | 000,066,336 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2013/05/09 04:59:09 | 000,049,760 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2013/05/09 04:59:08 | 000,029,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/01/18 02:44:52 | 004,332,960 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUVC.sys -- (LVUVC)
DRV - [2012/01/18 02:44:28 | 000,312,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2012/01/18 02:44:14 | 000,022,176 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvbusflt.sys -- (CompFilter)
DRV - [2011/03/30 23:54:32 | 001,073,216 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AE1200vista.sys -- (Linksys_adapter)
DRV - [2010/05/07 18:43:30 | 000,025,824 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009/07/07 15:48:44 | 000,027,696 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\purendis.sys -- (purendis)
DRV - [2009/07/07 15:48:44 | 000,026,672 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pnarp.sys -- (pnarp)
DRV - [2008/12/04 09:17:15 | 000,645,120 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WUSB54GCv3.sys -- (WUSB54GCv3)
DRV - [2008/08/01 19:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008/05/08 05:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2008/05/08 05:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)
DRV - [2007/11/06 16:22:06 | 000,034,064 | ---- | M] (CACE Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2007/10/26 07:51:22 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007/10/18 07:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/10/12 02:00:44 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/09/07 10:36:08 | 000,156,928 | ---- | M] (ViXS Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\xcbda.sys -- (xcbdaNtsc)
DRV - [2007/08/27 14:59:00 | 007,574,976 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/07/20 01:00:00 | 000,235,616 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vid.sys -- (OEM05Vid)
DRV - [2007/06/08 01:00:02 | 000,141,376 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\OEM05Afx.sys -- (OEM05Afx)
DRV - [2007/04/11 15:33:06 | 000,079,376 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2007/04/11 15:32:58 | 000,036,112 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007/04/11 15:32:52 | 000,034,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2007/04/11 15:32:38 | 000,063,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2007/04/11 15:32:30 | 000,020,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007/03/05 18:45:04 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vfx.sys -- (OEM05Vfx)
DRV - [2005/12/12 13:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{11D231C8-2FE5-4B8A-B2F9-B1736520C7A2}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{637897BC-FCE2-4DEA-8938-5BA57BAEB440}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE8SRC&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{759B6E70-7A7D-4FE5-82BF-EA161AA627D9}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=800236&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/16 18:38:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/05/27 18:14:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}: C:\Program Files\Updater By SweetPacks\Firefox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/06/12 20:46:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/06/12 20:46:22 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/06/12 20:46:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/06/12 20:46:22 | 000,000,000 | ---D | M]

[2008/09/08 20:54:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Extensions
[2008/09/08 20:54:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2013/07/01 09:34:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\extensions
[2013/06/29 20:38:56 | 000,001,793 | ---- | M] () -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\searchplugins\Bing.xml
[2013/06/20 13:58:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/06/12 20:46:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/06/12 20:46:17 | 000,000,000 | ---D | M] (The Browser Highlighter) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008/09/03 20:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\mozilla firefox\plugins\npbittorrent.dll
[2006/10/26 21:12:16 | 000,016,192 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL
[2013/05/08 03:12:56 | 000,106,088 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2013/05/27 13:00:01 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2013/05/27 13:00:02 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2013/05/27 13:00:03 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2013/05/27 13:00:03 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2013/05/27 13:00:06 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2010/04/07 12:25:17 | 000,001,346 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg_igeared.xml

========== Chrome ==========

CHR - default_search_provider: Bing (Enabled)
CHR - default_search_provider: search_url = http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&barid={759BD106-DFB3-11E2-8B05-001E8C3FFC8B}
CHR - default_search_provider: suggest_url = 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.116\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll
CHR - plugin: Java Deployment Toolkit 7.0.210.11 (Enabled) = C:\Windows\system32\npDeployJava1.dll

O1 HOSTS File: ([2013/02/02 00:35:03 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (jZip Webmail plugin) - {647FD14A-C4F1-46F4-8FC3-0B40F54226F7} - C:\Program Files\jZip\WebmailPlugin.dll (Discordia Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Updater By SweetPacks) - {7D4F1959-3F72-49d5-8E59-F02F8AA6815D} - C:\Program Files\Updater By SweetPacks\Extension32.dll File not found
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Linksys Wireless Manager] C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe (Linksys, LLC)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OEM05Mon.exe] C:\Windows\OEM05Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateReg] C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Oracle Corporation)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKCU..\Run: [B7456CF5EF0D0980D92DD0562D346087910D60E2._service_run] C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O8 - Extra context menu item: Add to Evernote - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Download Link Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_file.htm File not found
O8 - Extra context menu item: Download List Of Files Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_list.htm File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Subscribe To RSS/Podcast Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_rss.htm File not found
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{36937FF7-1F22-4576-8665-B5965D4D3BCC}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BBDB5DE6-583B-4601-A391-1DC2D9542FFD}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/01/01 10:56:33 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files\Google\Chrome\Application\27.0.1453.116\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk - - File not found
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk - - File not found
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk - - File not found
MsConfig - StartUpFolder: C:^Users^Trudy Stewart^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk - - File not found
MsConfig - StartUpFolder: C:^Users^Trudy Stewart^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Oneeko.lnk - - File not found
MsConfig - StartUpFolder: C:^Users^Trudy Stewart^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe - ()
MsConfig - StartUpFolder: C:^Users^Trudy Stewart^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Stickies.lnk - - File not found
MsConfig - StartUpReg: *CanonMyPrinter* - hkey= - key= - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
MsConfig - StartUpReg: *CanonSolutionMenu* - hkey= - key= - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
MsConfig - StartUpReg: *HP Software Update* - hkey= - key= - c:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
MsConfig - StartUpReg: *hpsysdrv* - hkey= - key= - c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
MsConfig - StartUpReg: *KBD* - hkey= - key= - C:\hp\KBD\KbdStub.exe ()
MsConfig - StartUpReg: *OsdMaestro* - hkey= - key= - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
MsConfig - StartUpReg: *SunJavaUpdateReg* - hkey= - key= - File not found
MsConfig - StartUpReg: *Windows Defender* - hkey= - key= - File not found
MsConfig - State: "startup" - 2

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/07/01 10:18:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/07/01 10:18:27 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013/07/01 10:18:27 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013/06/30 02:05:20 | 000,000,000 | ---D | C] -- C:\Windows\Microsoft Antimalware
[2013/06/28 08:03:37 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Roaming\PowerISO
[2013/06/28 01:33:09 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ace CD Burner
[2013/06/28 01:33:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ace CD Burner
[2013/06/28 01:33:08 | 001,703,936 | ---- | C] (NCT Company) -- C:\Windows\System32\NCTAudioFile.dll
[2013/06/28 01:33:08 | 000,892,928 | ---- | C] (NCT Company) -- C:\Windows\System32\NCTAudioInformation.dll
[2013/06/28 01:33:08 | 000,274,432 | ---- | C] (NCT Company) -- C:\Windows\System32\NCTAudioPlayer.dll
[2013/06/28 01:33:07 | 001,388,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00F
[2013/06/28 01:33:07 | 000,589,824 | ---- | C] (NuMedia Soft, Inc.) -- C:\Windows\System32\DVDRProX.dll
[2013/06/28 01:33:07 | 000,380,928 | ---- | C] (NUGROOVZ) -- C:\Windows\System32\CDRipperX.ocx
[2013/06/28 01:33:06 | 000,073,785 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00E
[2013/06/28 01:33:06 | 000,000,000 | ---D | C] -- C:\Program Files\Ace CD Burner
[2013/06/28 01:31:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\We-Care Reminder
[2013/06/28 01:28:10 | 000,000,000 | ---D | C] -- C:\Program Files\PowerISO
[2013/06/28 01:28:04 | 000,000,000 | ---D | C] -- C:\Windows\System32\jmdp
[2013/06/28 01:28:04 | 000,000,000 | ---D | C] -- C:\Windows\System32\ARFC
[2013/06/20 13:58:36 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/06/20 10:37:01 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Trudy Stewart\Desktop\OTL.com
[2013/06/19 21:40:33 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/06/19 21:40:09 | 000,000,000 | ---D | C] -- C:\JRT
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Local\temp
[2013/06/19 12:33:38 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/06/19 12:10:01 | 005,081,021 | R--- | C] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/18 19:09:10 | 000,000,000 | ---D | C] -- C:\FRST
[2013/06/15 21:27:20 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan
[2013/06/15 21:27:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
[2013/06/15 21:27:12 | 000,000,000 | ---D | C] -- C:\Program Files\Security Task Manager
[2013/06/13 08:35:00 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/06/13 08:34:58 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013/06/13 08:34:58 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013/06/13 08:34:57 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013/06/13 08:34:57 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013/06/13 08:34:55 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013/06/13 08:34:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013/06/13 08:34:53 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013/06/12 20:46:12 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/06/12 11:15:02 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printcom.dll
[2013/06/12 11:14:58 | 000,812,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certutil.exe
[2013/06/12 11:14:57 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certenc.dll
[2013/06/12 11:14:50 | 003,603,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013/06/12 11:14:49 | 003,551,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013/06/12 11:14:40 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cryptdlg.dll
[2012/10/28 22:15:21 | 011,881,936 | ---- | C] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Users\Trudy Stewart\gosetup.exe

========== Files - Modified Within 30 Days ==========

[2013/07/01 17:45:42 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/07/01 17:45:42 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/07/01 17:36:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/07/01 17:00:01 | 000,000,454 | ---- | M] () -- C:\Windows\tasks\RegCure Program Check.job
[2013/07/01 15:45:57 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/07/01 15:45:53 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2013/07/01 15:45:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/07/01 15:45:37 | 3219,619,840 | -HS- | M] () -- C:\hiberfil.sys
[2013/07/01 10:18:28 | 000,000,868 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/07/01 10:09:32 | 000,000,571 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\rkill (1) - Shortcut.lnk
[2013/07/01 10:08:46 | 000,000,581 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\RogueKiller - Shortcut.lnk
[2013/07/01 09:59:59 | 000,000,882 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\JRT (1) - Shortcut.lnk
[2013/07/01 09:34:29 | 000,000,232 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013/07/01 09:31:20 | 000,000,917 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\AdwCleaner (1) - Shortcut.lnk
[2013/06/30 18:45:26 | 000,001,325 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\tdsskiller - Shortcut.lnk
[2013/06/29 20:06:56 | 000,634,834 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/06/29 20:06:56 | 000,112,596 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/06/28 01:33:09 | 000,001,687 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Ace CD Burner.lnk
[2013/06/28 01:31:58 | 000,033,958 | ---- | M] () -- C:\ProgramData\uninstaller.exe
[2013/06/27 20:58:10 | 000,770,344 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2013/06/27 20:58:10 | 000,369,584 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2013/06/27 20:58:10 | 000,175,176 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/06/27 20:58:10 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys.sum
[2013/06/27 20:58:10 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswSP.sys.sum
[2013/06/27 20:58:10 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswSnx.sys.sum
[2013/06/20 14:41:24 | 000,001,933 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/06/20 10:37:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Trudy Stewart\Desktop\OTL.com
[2013/06/19 14:29:01 | 000,000,911 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/19 12:10:07 | 005,081,021 | R--- | M] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/11 18:39:35 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013/06/11 18:39:35 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

========== Files Created - No Company Name ==========

[2013/07/01 10:18:28 | 000,000,868 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/07/01 10:09:32 | 000,000,571 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\rkill (1) - Shortcut.lnk
[2013/07/01 10:08:46 | 000,000,581 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\RogueKiller - Shortcut.lnk
[2013/07/01 09:59:59 | 000,000,882 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\JRT (1) - Shortcut.lnk
[2013/07/01 09:31:20 | 000,000,917 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\AdwCleaner (1) - Shortcut.lnk
[2013/06/30 18:44:06 | 000,001,325 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\tdsskiller - Shortcut.lnk
[2013/06/28 01:33:09 | 000,001,687 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Ace CD Burner.lnk
[2013/06/28 01:31:58 | 000,033,958 | ---- | C] () -- C:\ProgramData\uninstaller.exe
[2013/06/27 20:58:10 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys.sum
[2013/06/26 17:22:47 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswSP.sys.sum
[2013/06/26 17:22:47 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswSnx.sys.sum
[2013/06/19 14:29:01 | 000,000,911 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/18 19:26:02 | 000,000,232 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013/05/22 11:21:06 | 004,325,376 | ---- | C] () -- C:\ProgramData\ReadOnlyInstaller.msi
[2013/04/14 20:49:34 | 000,175,176 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/04/14 20:49:34 | 000,049,376 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013/02/02 00:21:01 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/02/02 00:21:01 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/02/02 00:21:01 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/02/02 00:21:01 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/02/02 00:21:01 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/05/29 13:08:18 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2012/03/31 21:41:09 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012/01/18 02:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2012/01/18 02:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2012/01/18 02:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2011/11/16 21:40:38 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2011/08/12 12:20:14 | 000,015,896 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
[2010/05/07 07:07:08 | 000,000,760 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\setup_ldm.iss
[2010/04/07 12:31:26 | 000,000,000 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\prvlcl.dat
[2009/12/09 22:32:11 | 008,892,928 | ---- | C] () -- C:\ProgramData\atscie.msi
[2009/03/24 22:26:10 | 000,000,050 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-recent-projects.properties
[2009/03/24 22:21:47 | 000,000,745 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-defaults.jap
[2008/12/28 17:31:28 | 000,031,232 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/11/16 00:46:07 | 000,000,138 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\wklnhst.dat
[2008/07/21 16:40:25 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat
[2008/05/20 03:12:40 | 000,001,356 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\d3d9caps.dat

========== ZeroAccess Check ==========

[2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 02:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 02:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2009/04/09 02:14:12 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Ambient Design
[2009/03/28 10:48:26 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Artisteer
[2010/02/26 11:39:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Canon
[2008/09/13 12:52:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/07/21 14:45:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Conceiva
[2009/03/28 22:50:52 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Darq Software
[2013/02/18 15:36:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\DeskSoft
[2012/03/22 16:15:59 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Dropbox
[2008/07/07 15:29:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Individual Software
[2013/07/01 16:37:04 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Inkscape
[2009/03/28 13:18:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Interior Designer 8.0
[2012/05/29 17:50:58 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\IrfanView
[2012/05/13 12:44:02 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Leadertech
[2012/05/29 13:24:23 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MAGIX
[2010/06/27 15:30:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MSNInstaller
[2009/03/27 18:55:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NewSoft
[2013/02/01 22:47:11 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NoteTab Light
[2012/03/31 21:23:28 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Opera
[2010/05/29 18:59:53 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoFiltre
[2010/05/29 19:02:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoScape
[2013/06/28 08:03:37 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PowerISO
[2013/04/02 15:29:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\QuickScan
[2008/05/25 20:11:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\ScanSoft
[2008/09/15 22:05:44 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Snapfish
[2013/05/01 20:37:05 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Softland
[2009/04/07 03:05:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\stickies
[2008/11/16 00:46:07 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Template
[2009/03/29 03:17:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\uTorrent

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*. >
[2013/06/19 12:33:38 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2009/09/13 13:20:35 | 000,000,000 | ---D | M] -- C:\Boot
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2013/06/18 19:09:10 | 000,000,000 | ---D | M] -- C:\FRST
[2008/05/26 17:15:34 | 000,000,000 | ---D | M] -- C:\hp
[2008/06/18 23:31:56 | 000,000,000 | ---D | M] -- C:\inetpub
[2013/07/01 10:00:17 | 000,000,000 | ---D | M] -- C:\JRT
[2009/02/18 17:04:55 | 000,000,000 | R--D | M] -- C:\MSOCache
[2008/06/18 23:31:56 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2013/07/01 10:18:27 | 000,000,000 | ---D | M] -- C:\Program Files
[2013/07/01 09:34:09 | 000,000,000 | ---D | M] -- C:\ProgramData
[2013/06/19 12:34:22 | 000,000,000 | ---D | M] -- C:\Qoobox
[2013/07/01 18:21:01 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2008/05/19 19:38:38 | 000,000,000 | R--D | M] -- C:\Users
[2013/06/30 02:05:20 | 000,000,000 | ---D | M] -- C:\Windows
[2013/06/20 13:58:36 | 000,000,000 | ---D | M] -- C:\_OTL

< %PROGRAMFILES%\*.exe >

< %LOCALAPPDATA%\*.exe >

< %windir%\Installer\*.* >
[2013/05/21 11:36:03 | 000,022,528 | ---- | M] () -- C:\Windows\Installer\10e595.msi
[2012/07/18 15:53:56 | 005,009,920 | R--- | M] () -- C:\Windows\Installer\112052.msp
[2012/07/18 15:53:36 | 010,937,344 | R--- | M] () -- C:\Windows\Installer\11205c.msp
[2012/07/18 15:46:48 | 000,593,408 | R--- | M] () -- C:\Windows\Installer\112092.msp
[2012/07/25 16:59:06 | 011,032,064 | R--- | M] () -- C:\Windows\Installer\1120aa.msp
[2012/06/26 18:03:12 | 003,875,840 | R--- | M] () -- C:\Windows\Installer\1120b4.msp
[2009/02/18 17:05:41 | 002,397,184 | ---- | M] () -- C:\Windows\Installer\112cdc7.msi
[2009/02/18 17:05:52 | 000,501,248 | ---- | M] () -- C:\Windows\Installer\112cdce.msi
[2009/02/18 17:06:19 | 001,713,152 | ---- | M] () -- C:\Windows\Installer\112cdd5.msi
[2009/02/18 17:06:38 | 002,022,912 | ---- | M] () -- C:\Windows\Installer\112cddc.msi
[2009/02/18 17:06:48 | 001,640,960 | ---- | M] () -- C:\Windows\Installer\112cde3.msi
[2009/02/18 17:06:56 | 001,647,616 | ---- | M] () -- C:\Windows\Installer\112cdea.msi
[2009/02/18 17:06:59 | 000,501,248 | ---- | M] () -- C:\Windows\Installer\112cdf1.msi
[2009/02/18 17:07:07 | 002,319,872 | ---- | M] () -- C:\Windows\Installer\112cdf8.msi
[2009/02/18 17:07:16 | 000,513,024 | ---- | M] () -- C:\Windows\Installer\112cdff.msi
[2009/02/18 17:07:22 | 000,516,608 | ---- | M] () -- C:\Windows\Installer\112ce07.msi
[2009/02/18 17:07:30 | 000,506,880 | ---- | M] () -- C:\Windows\Installer\112ce0f.msi
[2009/02/18 17:07:34 | 000,501,248 | ---- | M] () -- C:\Windows\Installer\112ce16.msi
[2009/02/18 17:07:41 | 001,652,736 | ---- | M] () -- C:\Windows\Installer\112ce1d.msi
[2009/02/18 17:07:51 | 001,652,736 | ---- | M] () -- C:\Windows\Installer\112ce24.msi
[2009/02/18 17:08:06 | 001,652,736 | ---- | M] () -- C:\Windows\Installer\112ce2b.msi
[2009/02/18 17:08:09 | 000,501,248 | ---- | M] () -- C:\Windows\Installer\112ce32.msi
[2009/02/18 17:08:16 | 001,640,960 | ---- | M] () -- C:\Windows\Installer\112ce39.msi
[2009/02/18 17:13:01 | 018,181,632 | ---- | M] () -- C:\Windows\Installer\112ce47.msi
[2009/04/24 12:28:00 | 004,450,816 | R--- | M] () -- C:\Windows\Installer\1139a97.msp
[2009/04/24 12:38:18 | 001,229,312 | R--- | M] () -- C:\Windows\Installer\1139aa1.msp
[2009/04/24 12:31:18 | 001,425,920 | R--- | M] () -- C:\Windows\Installer\1139aad.msp
[2009/03/28 22:49:25 | 000,885,760 | ---- | M] () -- C:\Windows\Installer\166876.msi
[2007/01/01 10:34:37 | 000,314,880 | ---- | M] () -- C:\Windows\Installer\16ce0.msi
[2011/10/11 14:09:23 | 000,219,648 | ---- | M] () -- C:\Windows\Installer\1a1606.msi
[2008/10/20 11:18:14 | 006,474,240 | R--- | M] () -- C:\Windows\Installer\1bafef8.msp
[2008/10/20 11:22:54 | 011,758,592 | R--- | M] () -- C:\Windows\Installer\1baff02.msp
[2010/05/29 23:18:57 | 000,602,624 | ---- | M] () -- C:\Windows\Installer\1c4c4e0.msi
[2010/04/09 15:21:24 | 005,025,792 | R--- | M] () -- C:\Windows\Installer\1ced69f.msp
[2009/10/16 07:08:48 | 002,237,952 | R--- | M] () -- C:\Windows\Installer\1ced6b7.msp
[2013/06/28 01:28:32 | 001,263,104 | ---- | M] () -- C:\Windows\Installer\1f0f04.msi
[2013/06/28 01:31:57 | 001,276,928 | ---- | M] () -- C:\Windows\Installer\1f0f0b.msi
[2012/03/22 19:35:39 | 001,160,192 | ---- | M] () -- C:\Windows\Installer\1fb477.msi
[2010/03/22 16:03:14 | 011,732,992 | R--- | M] () -- C:\Windows\Installer\21662a.msp
[2008/05/25 21:22:35 | 000,431,104 | ---- | M] () -- C:\Windows\Installer\250767.msi
[2012/05/26 12:50:39 | 000,240,640 | ---- | M] () -- C:\Windows\Installer\25feac.msi
[2009/04/24 12:29:02 | 009,013,760 | R--- | M] () -- C:\Windows\Installer\2b353c.msp
[2009/08/16 18:33:26 | 000,248,832 | ---- | M] () -- C:\Windows\Installer\2b3544.msi
[2009/05/26 18:53:56 | 000,579,072 | R--- | M] () -- C:\Windows\Installer\2b355a.msp
[2009/05/07 09:04:06 | 018,341,376 | R--- | M] () -- C:\Windows\Installer\2b3562.msp
[2009/07/27 04:32:20 | 005,028,352 | R--- | M] () -- C:\Windows\Installer\2b357a.msp
[2009/03/20 11:48:56 | 000,183,808 | R--- | M] () -- C:\Windows\Installer\2b3586.msp
[2009/04/24 12:30:16 | 002,583,552 | R--- | M] () -- C:\Windows\Installer\2b35a0.msp
[2009/05/04 07:47:22 | 009,124,864 | R--- | M] () -- C:\Windows\Installer\2b35c1.msp
[2009/05/26 18:54:44 | 004,192,768 | R--- | M] () -- C:\Windows\Installer\2b35de.msp
[2009/05/04 07:46:14 | 008,299,008 | R--- | M] () -- C:\Windows\Installer\2b35f7.msp
[2009/02/12 12:58:48 | 000,549,888 | R--- | M] () -- C:\Windows\Installer\2b3613.msp
[2009/05/04 07:49:40 | 010,955,776 | R--- | M] () -- C:\Windows\Installer\2b364f.msp
[2009/12/09 22:31:40 | 002,724,352 | ---- | M] () -- C:\Windows\Installer\2bb9f40.msi
[2012/10/21 00:32:14 | 009,590,272 | R--- | M] () -- C:\Windows\Installer\2bbeb7c.msp
[2012/10/21 00:32:14 | 002,830,848 | R--- | M] () -- C:\Windows\Installer\2bbeb86.msp
[2012/11/17 10:36:02 | 005,007,872 | R--- | M] () -- C:\Windows\Installer\2bbebb4.msp
[2013/05/27 12:59:55 | 009,475,584 | ---- | M] () -- C:\Windows\Installer\2c96c5.msi
[2013/02/17 04:46:23 | 003,708,416 | R--- | M] () -- C:\Windows\Installer\2ee8855.msp
[2009/03/28 21:48:00 | 000,789,504 | ---- | M] () -- C:\Windows\Installer\2fece.msi
[2013/02/13 21:04:42 | 005,007,360 | R--- | M] () -- C:\Windows\Installer\304a40.msp
[2009/02/06 23:31:16 | 005,047,808 | R--- | M] () -- C:\Windows\Installer\314ef3a.msp
[2009/03/26 23:24:42 | 000,020,480 | ---- | M] () -- C:\Windows\Installer\316f6c0.msi
[2009/08/18 12:50:38 | 012,022,272 | R--- | M] () -- C:\Windows\Installer\32fea51.msp
[2009/08/18 13:08:34 | 001,373,696 | R--- | M] () -- C:\Windows\Installer\32fea69.msp
[2009/09/18 09:30:44 | 005,016,576 | R--- | M] () -- C:\Windows\Installer\32fea81.msp
[2009/07/27 04:31:24 | 003,738,624 | R--- | M] () -- C:\Windows\Installer\32fea8b.msp
[2009/08/05 07:49:32 | 003,457,024 | R--- | M] () -- C:\Windows\Installer\32feac3.msp
[2008/11/13 03:55:32 | 001,306,624 | R--- | M] () -- C:\Windows\Installer\358ddd9.msp
[2008/10/10 07:39:56 | 018,344,960 | R--- | M] () -- C:\Windows\Installer\358ddf9.msp
[2008/10/10 07:48:06 | 009,688,064 | R--- | M] () -- C:\Windows\Installer\358de03.msp
[2008/05/21 02:30:40 | 014,308,864 | R--- | M] () -- C:\Windows\Installer\358de2d.msp
[2008/05/21 01:45:28 | 005,246,976 | R--- | M] () -- C:\Windows\Installer\358de4a.msp
[2007/10/15 00:43:14 | 229,852,160 | R--- | M] () -- C:\Windows\Installer\358df02.msp
[2007/10/15 00:43:32 | 021,981,184 | R--- | M] () -- C:\Windows\Installer\358df0b.msp
[2007/10/15 00:43:46 | 005,749,760 | R--- | M] () -- C:\Windows\Installer\358df67.msp
[2007/10/15 00:43:38 | 012,743,168 | R--- | M] () -- C:\Windows\Installer\358df7a.msp
[2007/10/15 00:46:48 | 000,324,608 | R--- | M] () -- C:\Windows\Installer\358df89.msp
[2007/10/15 00:44:28 | 000,324,608 | R--- | M] () -- C:\Windows\Installer\358df91.msp
[2008/10/10 07:31:34 | 018,447,872 | R--- | M] () -- C:\Windows\Installer\358df9b.msp
[2008/04/11 19:48:24 | 006,774,272 | R--- | M] () -- C:\Windows\Installer\358dfb5.msp
[2009/01/07 21:25:16 | 005,046,784 | R--- | M] () -- C:\Windows\Installer\358dfe3.msp
[2008/10/10 07:30:10 | 019,258,880 | R--- | M] () -- C:\Windows\Installer\358dfed.msp
[2008/04/11 19:08:12 | 006,302,720 | R--- | M] () -- C:\Windows\Installer\358e009.msp
[2008/10/10 07:39:06 | 001,926,144 | R--- | M] () -- C:\Windows\Installer\358e028.msp
[2008/10/20 11:16:58 | 013,211,648 | R--- | M] () -- C:\Windows\Installer\358e042.msp
[2008/10/10 07:45:48 | 012,962,816 | R--- | M] () -- C:\Windows\Installer\358e062.msp
[2008/10/10 07:52:50 | 005,195,264 | R--- | M] () -- C:\Windows\Installer\358e06c.msp
[2008/11/13 03:54:26 | 009,576,960 | R--- | M] () -- C:\Windows\Installer\358e076.msp
[2008/10/20 11:21:40 | 011,937,280 | R--- | M] () -- C:\Windows\Installer\358e08f.msp
[2008/10/10 07:51:38 | 014,699,520 | R--- | M] () -- C:\Windows\Installer\358e099.msp
[2008/02/15 09:54:20 | 009,736,192 | R--- | M] () -- C:\Windows\Installer\358e0c6.msp
[2009/08/18 13:57:54 | 009,122,304 | R--- | M] () -- C:\Windows\Installer\3830305.msp
[2009/08/18 13:58:56 | 008,301,056 | R--- | M] () -- C:\Windows\Installer\383031d.msp
[2009/08/18 14:19:26 | 010,098,688 | R--- | M] () -- C:\Windows\Installer\383033e.msp
[2009/10/16 08:03:20 | 005,003,776 | R--- | M] () -- C:\Windows\Installer\3830356.msp
[2013/04/02 14:00:20 | 000,430,592 | ---- | M] () -- C:\Windows\Installer\3b2fae.msi
[2013/05/27 13:13:54 | 001,548,800 | ---- | M] () -- C:\Windows\Installer\3b5fbe.msi
[2013/05/27 13:14:08 | 002,002,432 | ---- | M] () -- C:\Windows\Installer\3b5fe1.msi
[2013/05/27 13:14:31 | 005,847,552 | ---- | M] () -- C:\Windows\Installer\3b5fe8.msi
[2013/05/27 13:16:22 | 001,720,832 | ---- | M] () -- C:\Windows\Installer\3b5fef.msi
[2013/05/27 13:19:02 | 004,204,032 | ---- | M] () -- C:\Windows\Installer\3b5ff6.msi
[2009/04/09 02:13:27 | 000,924,160 | ---- | M] () -- C:\Windows\Installer\3eb6a9c.msi
[2007/07/21 14:26:34 | 007,574,016 | R--- | M] () -- C:\Windows\Installer\3f619.msp
[2008/04/18 15:56:18 | 006,215,680 | R--- | M] () -- C:\Windows\Installer\3f62c.msp
[2007/04/21 21:16:22 | 012,490,752 | R--- | M] () -- C:\Windows\Installer\3f636.msp
[2008/09/24 13:05:44 | 016,381,440 | R--- | M] () -- C:\Windows\Installer\3f648.msp
[2008/07/30 00:20:14 | 011,767,296 | R--- | M] () -- C:\Windows\Installer\3f65a.msp
[2008/08/11 12:49:32 | 022,457,344 | R--- | M] () -- C:\Windows\Installer\3f664.msp
[2008/06/19 19:28:04 | 001,573,376 | R--- | M] () -- C:\Windows\Installer\3f677.msp
[2008/08/11 12:51:14 | 015,916,544 | R--- | M] () -- C:\Windows\Installer\3f689.msp
[2010/05/20 19:57:12 | 005,907,456 | R--- | M] () -- C:\Windows\Installer\45a703.msp
[2010/05/20 19:57:18 | 004,989,952 | R--- | M] () -- C:\Windows\Installer\45a704.msp
[2010/11/24 10:51:00 | 002,190,336 | R--- | M] () -- C:\Windows\Installer\45a71d.msp
[2010/08/13 18:00:36 | 009,404,928 | R--- | M] () -- C:\Windows\Installer\45a735.msp
[2012/03/22 15:34:01 | 000,019,968 | ---- | M] () -- C:\Windows\Installer\45a73d.msi
[2010/08/04 15:13:04 | 000,686,080 | R--- | M] () -- C:\Windows\Installer\45a754.msp
[2011/08/10 17:42:04 | 007,070,208 | R--- | M] () -- C:\Windows\Installer\45a75e.msp
[2010/08/13 18:02:20 | 002,545,664 | R--- | M] () -- C:\Windows\Installer\45a77e.msp
[2011/03/17 20:00:20 | 000,090,624 | R--- | M] () -- C:\Windows\Installer\45a79d.msp
[2011/06/21 11:59:26 | 001,764,352 | R--- | M] () -- C:\Windows\Installer\45a7b9.msp
[2011/09/06 21:46:22 | 009,006,080 | R--- | M] () -- C:\Windows\Installer\45a7d1.msp
[2011/04/29 12:28:40 | 001,995,264 | R--- | M] () -- C:\Windows\Installer\45a7db.msp
[2011/08/10 17:43:30 | 003,795,968 | R--- | M] () -- C:\Windows\Installer\45a803.msp
[2011/03/17 20:03:50 | 000,308,736 | R--- | M] () -- C:\Windows\Installer\45a838.msp
[2007/10/15 00:59:26 | 026,614,784 | R--- | M] () -- C:\Windows\Installer\45fd9.msp
[2007/10/15 00:33:24 | 026,646,016 | R--- | M] () -- C:\Windows\Installer\45fe4.msp
[2008/11/14 12:32:40 | 000,432,640 | ---- | M] () -- C:\Windows\Installer\460fa.msi
[2011/10/11 14:58:47 | 000,038,400 | ---- | M] () -- C:\Windows\Installer\47b67a.msi
[2011/10/11 14:58:49 | 020,333,568 | R--- | M] () -- C:\Windows\Installer\47b682.msp
[2012/07/18 15:54:24 | 002,831,360 | R--- | M] () -- C:\Windows\Installer\4a4449.msp
[2012/07/25 16:57:08 | 002,532,864 | R--- | M] () -- C:\Windows\Installer\4a4477.msp
[2012/07/18 15:55:46 | 009,585,664 | R--- | M] () -- C:\Windows\Installer\4a4490.msp
[2012/09/05 16:25:30 | 002,221,568 | R--- | M] () -- C:\Windows\Installer\4a44a1.msp
[2012/07/25 16:57:06 | 003,157,504 | R--- | M] () -- C:\Windows\Installer\4a44b9.msp
[2012/09/25 12:35:46 | 005,009,920 | R--- | M] () -- C:\Windows\Installer\4a44d1.msp
[2013/02/16 11:21:34 | 000,039,936 | ---- | M] () -- C:\Windows\Installer\4b6e4.ipi
[2013/01/23 19:05:40 | 009,765,376 | R--- | M] () -- C:\Windows\Installer\4b6e6.msp
[2012/12/14 11:00:26 | 013,178,368 | R--- | M] () -- C:\Windows\Installer\4b703.msp
[2012/12/19 23:36:38 | 013,662,720 | R--- | M] () -- C:\Windows\Installer\4b71b.msp
[2011/09/06 22:48:02 | 008,181,248 | R--- | M] () -- C:\Windows\Installer\4f27c4.msp
[2013/04/29 21:33:24 | 001,769,984 | ---- | M] () -- C:\Windows\Installer\556c1e.msi
[2012/05/29 13:18:05 | 000,032,256 | ---- | M] () -- C:\Windows\Installer\5807e3.msi
[2012/05/29 13:18:58 | 000,120,832 | ---- | M] () -- C:\Windows\Installer\58080a.msi
[2012/05/29 13:19:06 | 000,026,624 | ---- | M] () -- C:\Windows\Installer\580821.msi
[2012/05/29 13:19:11 | 000,032,768 | ---- | M] () -- C:\Windows\Installer\58082b.msi
[2012/05/29 13:19:18 | 000,029,696 | ---- | M] () -- C:\Windows\Installer\58083a.msi
[2012/05/29 13:19:23 | 000,067,072 | ---- | M] () -- C:\Windows\Installer\58084b.msi
[2012/05/29 13:19:29 | 000,026,624 | ---- | M] () -- C:\Windows\Installer\580860.msi
[2012/05/29 13:19:33 | 000,025,600 | ---- | M] () -- C:\Windows\Installer\580875.msi
[2012/05/29 13:19:36 | 000,025,088 | ---- | M] () -- C:\Windows\Installer\580880.msi
[2012/05/29 13:19:38 | 000,025,088 | ---- | M] () -- C:\Windows\Installer\58088b.msi
[2012/05/29 13:19:40 | 000,025,088 | ---- | M] () -- C:\Windows\Installer\580896.msi
[2012/05/29 13:19:47 | 000,025,600 | ---- | M] () -- C:\Windows\Installer\5808a7.msi
[2012/05/29 13:19:49 | 000,032,768 | ---- | M] () -- C:\Windows\Installer\5808b2.msi
[2009/03/12 14:15:56 | 000,648,192 | ---- | M] () -- C:\Windows\Installer\5b6be6.msi
[2008/12/13 09:58:22 | 000,754,688 | R--- | M] () -- C:\Windows\Installer\5b6bf2.msp
[2012/12/19 13:20:59 | 012,387,840 | R--- | M] () -- C:\Windows\Installer\5c0b84.msp
[2008/05/26 18:39:44 | 000,431,104 | ---- | M] () -- C:\Windows\Installer\5ecd55.msi
[2008/05/25 20:11:44 | 006,668,800 | ---- | M] () -- C:\Windows\Installer\62da76.msi
[2011/05/18 22:55:38 | 019,624,448 | R--- | M] () -- C:\Windows\Installer\64550.msp
[2011/04/13 11:37:02 | 019,201,024 | R--- | M] () -- C:\Windows\Installer\64558.msp
[2011/12/26 05:06:20 | 005,115,392 | R--- | M] () -- C:\Windows\Installer\64560.msp
[2011/10/26 15:38:54 | 002,830,848 | R--- | M] () -- C:\Windows\Installer\64568.msp
[2011/09/15 18:37:40 | 037,148,160 | R--- | M] () -- C:\Windows\Installer\64587.msp
[2011/09/15 18:35:54 | 001,411,072 | R--- | M] () -- C:\Windows\Installer\64594.msp
[2011/09/15 18:37:52 | 034,428,416 | R--- | M] () -- C:\Windows\Installer\64595.msp
[2011/09/15 18:37:28 | 016,691,712 | R--- | M] () -- C:\Windows\Installer\645b2.msp
[2011/09/15 18:34:54 | 428,804,608 | R--- | M] () -- C:\Windows\Installer\6477e.msp
[2011/09/15 18:38:04 | 010,838,528 | R--- | M] () -- C:\Windows\Installer\6478a.msp
[2011/09/15 18:39:22 | 011,163,136 | R--- | M] () -- C:\Windows\Installer\64797.msp
[2011/09/15 18:40:36 | 007,959,552 | R--- | M] () -- C:\Windows\Installer\647a2.msp
[2011/04/06 22:43:30 | 123,313,664 | R--- | M] () -- C:\Windows\Installer\647ba.msp
[2011/07/11 17:19:28 | 010,619,904 | R--- | M] () -- C:\Windows\Installer\647c7.msp
[2011/09/15 18:37:32 | 038,176,256 | R--- | M] () -- C:\Windows\Installer\647df.msp
[2011/07/21 12:34:34 | 003,456,000 | R--- | M] () -- C:\Windows\Installer\647ec.msp
[2011/11/21 23:07:36 | 017,191,936 | R--- | M] () -- C:\Windows\Installer\647fa.msp
[2013/04/26 09:02:00 | 005,284,864 | R--- | M] () -- C:\Windows\Installer\65805.msp
[2013/05/03 11:41:40 | 000,836,096 | R--- | M] () -- C:\Windows\Installer\6580d.msp
[2009/03/31 00:42:46 | 000,136,192 | ---- | M] () -- C:\Windows\Installer\65a5b8.msi
[2013/01/16 13:29:08 | 005,006,848 | R--- | M] () -- C:\Windows\Installer\668e6.msp
[2012/12/06 17:29:48 | 003,721,728 | R--- | M] () -- C:\Windows\Installer\668ef.msp
[2013/01/23 19:05:40 | 009,765,376 | ---- | M] () -- C:\Windows\Installer\668f0.msp
[2009/02/18 17:13:04 | 000,061,952 | ---- | M] () -- C:\Windows\Installer\668f1.mst
[2013/01/23 19:05:40 | 009,765,376 | R--- | M] () -- C:\Windows\Installer\668f7.msp
[2012/09/25 13:39:06 | 001,760,768 | R--- | M] () -- C:\Windows\Installer\670f3.msp
[2012/09/25 13:38:52 | 011,885,568 | R--- | M] () -- C:\Windows\Installer\6710d.msp
[2012/09/25 13:35:18 | 009,101,824 | R--- | M] () -- C:\Windows\Installer\67125.msp
[2012/09/25 13:35:46 | 004,285,952 | R--- | M] () -- C:\Windows\Installer\6712f.msp
[2012/09/25 13:35:30 | 007,695,360 | R--- | M] () -- C:\Windows\Installer\67157.msp
[2012/09/25 13:36:20 | 008,465,408 | R--- | M] () -- C:\Windows\Installer\67177.msp
[2012/09/06 10:22:10 | 013,475,840 | R--- | M] () -- C:\Windows\Installer\6719d.msp
[2012/09/10 09:59:10 | 010,739,712 | R--- | M] () -- C:\Windows\Installer\671ac.msp
[2012/10/24 16:24:30 | 005,007,872 | R--- | M] () -- C:\Windows\Installer\671c3.msp
[2011/04/29 12:30:12 | 001,197,056 | R--- | M] () -- C:\Windows\Installer\687c2b.msp
[2012/01/22 10:09:26 | 001,700,352 | R--- | M] () -- C:\Windows\Installer\69082.msp
[2009/08/18 12:56:58 | 005,020,672 | R--- | M] () -- C:\Windows\Installer\6d204.msp
[2009/11/28 21:46:10 | 000,429,568 | ---- | M] () -- C:\Windows\Installer\6e1bd.msi
[2012/04/04 22:37:36 | 003,149,824 | R--- | M] () -- C:\Windows\Installer\6fb39.msp
[2012/04/04 22:37:40 | 002,540,544 | R--- | M] () -- C:\Windows\Installer\6fb51.msp
[2012/06/19 12:54:42 | 005,009,920 | R--- | M] () -- C:\Windows\Installer\6fb69.msp
[2012/06/19 12:54:40 | 002,239,488 | R--- | M] () -- C:\Windows\Installer\6fb81.msp
[2012/05/30 07:18:24 | 001,739,264 | R--- | M] () -- C:\Windows\Installer\6fb8c.msp
[2012/05/30 07:18:08 | 011,885,056 | R--- | M] () -- C:\Windows\Installer\6fbbd.msp
[2010/07/23 02:04:08 | 011,395,072 | R--- | M] () -- C:\Windows\Installer\71dbc.msp
[2012/01/07 18:56:36 | 000,467,456 | ---- | M] () -- C:\Windows\Installer\71dcc.msi
[2010/11/21 00:33:46 | 001,980,928 | R--- | M] () -- C:\Windows\Installer\71de3.msp
[2011/07/27 08:39:50 | 009,892,352 | R--- | M] () -- C:\Windows\Installer\71df5.msp
[2011/07/27 08:37:28 | 011,592,192 | R--- | M] () -- C:\Windows\Installer\71e39.msp
[2010/07/23 02:03:24 | 000,338,432 | R--- | M] () -- C:\Windows\Installer\71e51.msp
[2013/05/21 13:30:41 | 000,029,696 | ---- | M] () -- C:\Windows\Installer\79c235.msi
[2009/03/31 01:05:21 | 000,437,248 | ---- | M] () -- C:\Windows\Installer\7a208f.msi
[2010/04/24 17:10:46 | 008,486,400 | R--- | M] () -- C:\Windows\Installer\7ba9f.msp
[2010/04/24 17:07:04 | 010,118,144 | R--- | M] () -- C:\Windows\Installer\7bace.msp
[2010/05/18 23:35:24 | 005,023,744 | R--- | M] () -- C:\Windows\Installer\7bae6.msp
[2010/04/24 17:05:14 | 004,199,424 | R--- | M] () -- C:\Windows\Installer\7bafe.msp
[2010/04/24 17:07:58 | 004,667,392 | R--- | M] () -- C:\Windows\Installer\7bb16.msp
[2010/03/24 18:54:54 | 002,516,992 | R--- | M] () -- C:\Windows\Installer\7bb33.msp
[2010/03/24 18:54:48 | 003,126,272 | R--- | M] () -- C:\Windows\Installer\7bb34.msp
[2010/04/24 17:08:48 | 009,129,984 | R--- | M] () -- C:\Windows\Installer\7bb4d.msp
[2010/04/24 17:09:46 | 011,750,912 | R--- | M] () -- C:\Windows\Installer\7bb57.msp
[2009/04/04 10:14:58 | 001,094,656 | R--- | M] () -- C:\Windows\Installer\7f310.msp
[2009/04/04 11:36:32 | 021,390,848 | R--- | M] () -- C:\Windows\Installer\7f311.msp
[2009/04/04 17:09:34 | 015,190,016 | R--- | M] () -- C:\Windows\Installer\7f332.msp
[2009/04/04 17:08:40 | 343,058,432 | R--- | M] () -- C:\Windows\Installer\7f4ad.msp
[2009/04/04 17:10:08 | 009,926,144 | R--- | M] () -- C:\Windows\Installer\7f4b9.msp
[2009/04/04 17:10:16 | 007,888,384 | R--- | M] () -- C:\Windows\Installer\7f4c4.msp
[2009/04/04 17:10:24 | 001,282,560 | R--- | M] () -- C:\Windows\Installer\7f4cd.msp
[2009/04/04 07:35:30 | 038,325,760 | R--- | M] () -- C:\Windows\Installer\7f4dd.msp
[2009/04/04 07:35:48 | 036,977,152 | R--- | M] () -- C:\Windows\Installer\7f4e7.msp
[2009/04/14 04:50:22 | 005,191,680 | R--- | M] () -- C:\Windows\Installer\85dcf.msp
[2009/04/14 03:22:08 | 019,840,000 | R--- | M] () -- C:\Windows\Installer\85dd8.msp
[2009/03/28 09:50:10 | 005,025,792 | R--- | M] () -- C:\Windows\Installer\85df0.msp
[2009/04/14 03:20:06 | 009,573,376 | R--- | M] () -- C:\Windows\Installer\85df8.msp
[2009/02/25 19:08:18 | 008,311,808 | R--- | M] () -- C:\Windows\Installer\85e0f.msp
[2009/04/14 04:56:18 | 020,498,944 | R--- | M] () -- C:\Windows\Installer\85e19.msp
[2009/04/14 04:51:24 | 001,303,040 | R--- | M] () -- C:\Windows\Installer\85e22.msp
[2009/04/14 03:46:12 | 015,438,848 | R--- | M] () -- C:\Windows\Installer\85e2c.msp
[2009/04/14 04:21:34 | 015,303,168 | R--- | M] () -- C:\Windows\Installer\85e36.msp
[2009/04/14 04:18:14 | 009,684,480 | R--- | M] () -- C:\Windows\Installer\85e3e.msp
[2009/04/14 04:49:26 | 001,922,560 | R--- | M] () -- C:\Windows\Installer\85e46.msp
[2009/03/28 13:18:28 | 030,178,304 | ---- | M] () -- C:\Windows\Installer\8853d3.msi
[2010/06/22 01:40:40 | 000,024,064 | ---- | M] () -- C:\Windows\Installer\8be59a.msi
[2011/11/11 16:16:20 | 008,458,240 | R--- | M] () -- C:\Windows\Installer\8c683.msp
[2012/02/29 23:45:14 | 004,989,440 | R--- | M] () -- C:\Windows\Installer\8c6b1.msp
[2011/11/11 16:15:00 | 001,795,584 | R--- | M] () -- C:\Windows\Installer\8c6c9.msp
[2011/11/01 13:34:30 | 002,531,840 | R--- | M] () -- C:\Windows\Installer\8c6d3.msp
[2012/03/22 16:25:14 | 020,333,056 | R--- | M] () -- C:\Windows\Installer\8c6fe.msp
[2011/11/01 13:34:58 | 004,225,536 | R--- | M] () -- C:\Windows\Installer\8c71a.msp
[2011/11/11 16:14:40 | 009,096,192 | R--- | M] () -- C:\Windows\Installer\8c732.msp
[2011/11/01 13:34:28 | 002,247,168 | R--- | M] () -- C:\Windows\Installer\8c74a.msp
[2011/12/25 05:40:46 | 000,819,200 | R--- | M] () -- C:\Windows\Installer\8c75b.msp
[2012/08/30 03:06:58 | 005,007,872 | R--- | M] () -- C:\Windows\Installer\934eb.msp
[2010/03/11 23:59:18 | 005,031,424 | R--- | M] () -- C:\Windows\Installer\9da00.msp
[2010/02/21 01:02:24 | 004,195,840 | R--- | M] () -- C:\Windows\Installer\9da18.msp
[2010/02/21 01:03:34 | 004,472,832 | R--- | M] () -- C:\Windows\Installer\9da36.msp
[2012/10/16 04:12:32 | 000,943,616 | R--- | M] () -- C:\Windows\Installer\9fc33.msp
[2012/10/10 05:27:32 | 011,291,136 | R--- | M] () -- C:\Windows\Installer\9fc45.msp
[2012/11/17 10:36:10 | 003,865,600 | R--- | M] () -- C:\Windows\Installer\9fc4e.msp
[2012/12/19 23:37:38 | 005,007,872 | R--- | M] () -- C:\Windows\Installer\9fc84.msp
[2013/03/28 09:44:51 | 023,765,504 | R--- | M] () -- C:\Windows\Installer\a186b.msp
[2013/01/09 12:39:02 | 019,780,096 | R--- | M] () -- C:\Windows\Installer\a1881.msp
[2013/02/13 21:04:42 | 005,007,360 | ---- | M] () -- C:\Windows\Installer\a1883.msp
[2009/02/18 17:13:04 | 000,061,952 | ---- | M] () -- C:\Windows\Installer\a1884.mst
[2013/03/20 02:59:38 | 005,004,288 | R--- | M] () -- C:\Windows\Installer\a408f.msp
[2008/06/16 13:36:33 | 004,372,992 | ---- | M] () -- C:\Windows\Installer\a73a80.msi
[2012/09/05 17:15:43 | 003,947,520 | ---- | M] () -- C:\Windows\Installer\abb5da.msi
[2012/07/31 12:18:14 | 005,018,624 | R--- | M] () -- C:\Windows\Installer\abb6b6.msp
[2012/03/27 11:47:55 | 004,959,232 | R--- | M] () -- C:\Windows\Installer\abb6b7.msp
[2013/05/22 14:07:58 | 005,008,384 | R--- | M] () -- C:\Windows\Installer\b3ebb.msp
[2010/01/14 22:26:08 | 005,027,840 | R--- | M] () -- C:\Windows\Installer\b94d6.msp
[2009/10/16 08:09:28 | 002,518,016 | R--- | M] () -- C:\Windows\Installer\bacc8.msp
[2009/11/21 00:36:14 | 005,002,752 | R--- | M] () -- C:\Windows\Installer\bace0.msp
[2010/02/04 01:59:48 | 005,031,936 | R--- | M] () -- C:\Windows\Installer\bccb7.msp
[2010/02/21 02:00:02 | 008,480,768 | R--- | M] () -- C:\Windows\Installer\bccc1.msp
[2010/02/04 18:24:30 | 009,122,304 | R--- | M] () -- C:\Windows\Installer\bccef.msp
[2010/03/10 17:32:18 | 000,119,296 | ---- | M] () -- C:\Windows\Installer\bccf7.msi
[2011/11/01 13:34:56 | 004,250,112 | R--- | M] () -- C:\Windows\Installer\bf3cfc.msp
[2011/11/01 13:34:30 | 001,552,384 | R--- | M] () -- C:\Windows\Installer\bf3d06.msp
[2009/11/14 03:47:00 | 000,236,032 | ---- | M] () -- C:\Windows\Installer\c0d754.msi
[2012/03/22 19:12:39 | 000,223,744 | ---- | M] () -- C:\Windows\Installer\c3d54.msi
[2013/03/08 18:34:38 | 005,196,288 | R--- | M] () -- C:\Windows\Installer\c4a32.msp
[2013/02/07 00:30:34 | 001,035,776 | R--- | M] () -- C:\Windows\Installer\c4a3b.msp
[2013/04/16 21:03:18 | 005,004,800 | R--- | M] () -- C:\Windows\Installer\c4a52.msp
[2012/05/13 13:05:35 | 020,343,808 | R--- | M] () -- C:\Windows\Installer\cd157.msp
[2012/02/17 08:45:24 | 002,299,392 | R--- | M] () -- C:\Windows\Installer\cd16d.msp
[2012/04/28 21:43:58 | 008,459,264 | R--- | M] () -- C:\Windows\Installer\cd177.msp
[2012/03/15 02:24:28 | 001,795,584 | R--- | M] () -- C:\Windows\Installer\cd1a5.msp
[2011/12/15 13:40:40 | 023,374,336 | R--- | M] () -- C:\Windows\Installer\cd1bb.msp
[2011/11/01 13:34:26 | 001,169,920 | R--- | M] () -- C:\Windows\Installer\cd1d2.msp
[2012/04/04 22:38:16 | 003,620,864 | R--- | M] () -- C:\Windows\Installer\cd1dc.msp
[2012/04/30 14:38:28 | 005,011,456 | R--- | M] () -- C:\Windows\Installer\cd212.msp
[2012/04/28 21:44:02 | 009,586,176 | R--- | M] () -- C:\Windows\Installer\cd22b.msp
[2012/03/23 14:59:02 | 007,899,648 | R--- | M] () -- C:\Windows\Installer\cd243.msp
[2012/01/19 13:37:24 | 008,999,936 | R--- | M] () -- C:\Windows\Installer\cd24f.msp
[2012/02/22 15:17:30 | 002,221,568 | R--- | M] () -- C:\Windows\Installer\cd25e.msp
[2011/12/22 16:50:54 | 000,256,000 | R--- | M] () -- C:\Windows\Installer\cd266.msp
[2012/04/28 21:44:02 | 009,101,824 | R--- | M] () -- C:\Windows\Installer\cd27e.msp
[2012/04/04 22:38:44 | 002,831,360 | R--- | M] () -- C:\Windows\Installer\cd288.msp
[2010/05/29 18:58:56 | 000,467,968 | ---- | M] () -- C:\Windows\Installer\d66dc8.msi
[2012/04/22 22:37:42 | 001,182,720 | R--- | M] () -- C:\Windows\Installer\e0a05.msp
[2012/03/15 13:43:28 | 004,216,320 | R--- | M] () -- C:\Windows\Installer\e0a0d.msp
[2012/05/30 07:17:06 | 005,010,432 | R--- | M] () -- C:\Windows\Installer\e0a24.msp
[2013/04/29 20:35:12 | 000,883,712 | ---- | M] () -- C:\Windows\Installer\e78b9.msi
[2013/04/29 20:43:45 | 000,180,736 | ---- | M] () -- C:\Windows\Installer\e78c0.msi
[2007/01/01 10:48:47 | 000,398,848 | ---- | M] () -- C:\Windows\Installer\ed9b.msi
[2007/01/01 10:48:48 | 000,180,224 | ---- | M] () -- C:\Windows\Installer\eda2.msi
[2007/01/01 10:48:49 | 000,280,064 | ---- | M] () -- C:\Windows\Installer\eda9.msi
[2007/01/01 10:49:27 | 000,988,160 | ---- | M] () -- C:\Windows\Installer\edb1.msi
[2007/01/01 10:49:29 | 000,510,976 | ---- | M] () -- C:\Windows\Installer\edb8.msi
[2007/01/01 10:49:30 | 000,312,320 | ---- | M] () -- C:\Windows\Installer\edbf.msi
[2007/01/01 10:49:30 | 000,211,968 | ---- | M] () -- C:\Windows\Installer\edc6.msi
[2007/01/01 10:49:31 | 000,623,616 | ---- | M] () -- C:\Windows\Installer\edce.msi
[2007/01/01 10:55:18 | 006,644,224 | ---- | M] () -- C:\Windows\Installer\edd2.msi
[2007/01/01 10:55:48 | 001,827,840 | ---- | M] () -- C:\Windows\Installer\edda.msi
[2007/01/01 10:55:58 | 002,616,832 | ---- | M] () -- C:\Windows\Installer\ede1.msi
[2007/01/01 10:58:04 | 001,505,792 | ---- | M] () -- C:\Windows\Installer\ee02.msi
[2007/01/01 10:58:58 | 008,440,832 | ---- | M] () -- C:\Windows\Installer\ee08.msi
[2007/01/01 10:59:07 | 000,360,448 | ---- | M] () -- C:\Windows\Installer\ee0e.msi
[2007/01/01 10:59:12 | 000,355,840 | ---- | M] () -- C:\Windows\Installer\ee14.msi
[2007/01/01 10:59:29 | 000,321,024 | ---- | M] () -- C:\Windows\Installer\ee1b.msi
[2013/05/08 18:50:34 | 007,371,264 | R--- | M] () -- C:\Windows\Installer\f54067.msp
[2009/03/30 23:18:18 | 013,141,504 | ---- | M] () -- C:\Windows\Installer\fbeee.msi
[2013/06/29 20:08:33 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{3C3901C5-3455-3E0A-A214-0B093A5070A6}.SchedServiceConfig.rmi
[2013/05/27 13:16:21 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{E14ADE0E-75F3-4A46-87E5-26692DD626EC}.SchedServiceConfig.rmi

< %windir%\system32\tasks\*.* >
[2013/07/01 15:47:23 | 000,004,182 | ---- | M] () -- C:\Windows\system32\tasks\avast! Emergency Update
[2009/05/16 12:44:11 | 000,004,058 | ---- | M] () -- C:\Windows\system32\tasks\Go to RoboForm Install page
[2013/05/21 11:31:33 | 000,003,644 | ---- | M] () -- C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore
[2013/05/21 11:31:33 | 000,003,896 | ---- | M] () -- C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA
[2013/02/18 15:23:19 | 000,003,134 | ---- | M] () -- C:\Windows\system32\tasks\HPCeeScheduleForTrudy Stewart
[2007/01/01 11:17:23 | 000,003,334 | ---- | M] () -- C:\Windows\system32\tasks\JavaUpdateAdministrator
[2009/10/28 10:08:20 | 000,003,334 | ---- | M] () -- C:\Windows\system32\tasks\JavaUpdateSYSTEM
[2008/05/19 19:41:56 | 000,003,334 | ---- | M] () -- C:\Windows\system32\tasks\JavaUpdateTrudy Stewart
[2008/06/01 13:58:42 | 000,003,116 | ---- | M] () -- C:\Windows\system32\tasks\RegCure
[2008/06/01 13:58:42 | 000,003,132 | ---- | M] () -- C:\Windows\system32\tasks\RegCure Program Check
[2009/05/16 12:44:10 | 000,003,498 | ---- | M] () -- C:\Windows\system32\tasks\Run RoboForm TaskBar Icon
[2012/06/30 21:57:33 | 000,003,110 | ---- | M] () -- C:\Windows\system32\tasks\{048304D9-44F1-42C2-BFB6-49092A66EC80}
[2008/06/19 23:02:41 | 000,003,098 | ---- | M] () -- C:\Windows\system32\tasks\{16EDDD4E-39BC-4FF3-8543-EAFCA6A07904}
[2010/05/29 19:00:05 | 000,003,148 | ---- | M] () -- C:\Windows\system32\tasks\{9D3DCFBD-ECCD-4870-9EEE-4A7D788D56DC}
[2009/03/31 13:05:53 | 000,003,108 | ---- | M] () -- C:\Windows\system32\tasks\{C24DAC30-258A-4711-A3F9-9B2ECC34D98B}

< %windir%\system32\tasks\*.* /64 >
[2013/07/01 15:47:23 | 000,004,182 | ---- | M] () -- C:\Windows\system32\tasks\avast! Emergency Update
[2009/05/16 12:44:11 | 000,004,058 | ---- | M] () -- C:\Windows\system32\tasks\Go to RoboForm Install page
[2013/05/21 11:31:33 | 000,003,644 | ---- | M] () -- C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore
[2013/05/21 11:31:33 | 000,003,896 | ---- | M] () -- C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA
[2013/02/18 15:23:19 | 000,003,134 | ---- | M] () -- C:\Windows\system32\tasks\HPCeeScheduleForTrudy Stewart
[2007/01/01 11:17:23 | 000,003,334 | ---- | M] () -- C:\Windows\system32\tasks\JavaUpdateAdministrator
[2009/10/28 10:08:20 | 000,003,334 | ---- | M] () -- C:\Windows\system32\tasks\JavaUpdateSYSTEM
[2008/05/19 19:41:56 | 000,003,334 | ---- | M] () -- C:\Windows\system32\tasks\JavaUpdateTrudy Stewart
[2008/06/01 13:58:42 | 000,003,116 | ---- | M] () -- C:\Windows\system32\tasks\RegCure
[2008/06/01 13:58:42 | 000,003,132 | ---- | M] () -- C:\Windows\system32\tasks\RegCure Program Check
[2009/05/16 12:44:10 | 000,003,498 | ---- | M] () -- C:\Windows\system32\tasks\Run RoboForm TaskBar Icon
[2012/06/30 21:57:33 | 000,003,110 | ---- | M] () -- C:\Windows\system32\tasks\{048304D9-44F1-42C2-BFB6-49092A66EC80}
[2008/06/19 23:02:41 | 000,003,098 | ---- | M] () -- C:\Windows\system32\tasks\{16EDDD4E-39BC-4FF3-8543-EAFCA6A07904}
[2010/05/29 19:00:05 | 000,003,148 | ---- | M] () -- C:\Windows\system32\tasks\{9D3DCFBD-ECCD-4870-9EEE-4A7D788D56DC}
[2009/03/31 13:05:53 | 000,003,108 | ---- | M] () -- C:\Windows\system32\tasks\{C24DAC30-258A-4711-A3F9-9B2ECC34D98B}

< %systemroot%\Fonts\*.exe >

< %systemroot%\*. /mp /s >

< MD5 for: ATAPI.SYS >
[2009/04/11 02:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\ERDNT\cache\atapi.sys
[2009/04/11 02:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009/04/11 02:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009/04/11 02:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008/01/19 03:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/19 03:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 05:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008/05/19 20:01:51 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008/05/19 20:01:51 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008/05/19 20:01:50 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: EXPLORER.EXE >
[2008/10/29 02:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008/10/29 02:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/29 23:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2008/05/19 20:03:31 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2008/05/19 20:03:31 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\ERDNT\cache\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008/10/27 22:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006/11/02 05:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008/01/19 03:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: REGEDIT.EXE >
[2008/01/19 03:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\ERDNT\cache\regedit.exe
[2008/01/19 03:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008/01/19 03:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
[2006/11/02 05:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe

< MD5 for: SERVICES.EXE >
[2008/01/19 03:33:28 | 000,279,040 | ---- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
[2006/11/02 05:45:40 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=329CF3C97CE4C19375C8ABCABAE258B0 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6000.16386_none_cd28fe6bd05df036\services.exe
[2009/04/11 02:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\ERDNT\cache\services.exe
[2009/04/11 02:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\System32\services.exe
[2009/04/11 02:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe

< MD5 for: SVCHOST.EXE >
[2006/11/02 05:45:47 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=10DA15933D582D2FEDCF705EFE394B09 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6000.16386_none_b38497a50862ad11\svchost.exe
[2008/01/19 03:33:32 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\ERDNT\cache\svchost.exe
[2008/01/19 03:33:32 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe
[2008/01/19 03:33:32 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: USER32.DLL >
[2007/01/01 10:04:20 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2009/04/11 02:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\ERDNT\cache\user32.dll
[2009/04/11 02:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll
[2009/04/11 02:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2007/01/01 10:04:20 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2008/01/19 03:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006/11/02 05:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll

< MD5 for: USERINIT.EXE >
[2008/01/19 03:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe
[2008/01/19 03:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008/01/19 03:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006/11/02 05:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

< MD5 for: WINLOGON.EXE >
[2009/04/11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006/11/02 05:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/01/19 03:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >
[2006/11/02 09:01:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2006/11/02 09:01:49 | 000,032,542 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2008/06/01 13:58:41 | 000,000,388 | ---- | C] () -- C:\Windows\Tasks\RegCure.job
[2008/06/01 13:58:41 | 000,000,454 | ---- | C] () -- C:\Windows\Tasks\RegCure Program Check.job
[2008/06/21 13:34:35 | 000,000,354 | ---- | C] () -- C:\Windows\Tasks\HPCeeScheduleForTrudy Stewart.job
[2012/09/19 17:15:22 | 000,000,896 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2012/09/19 17:15:24 | 000,000,900 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

< %Temp%\smtmp\* \s >

< %Temp%\smtmp\1\*.* >

< %Temp%\smtmp\2\*.* >

< %Temp%\smtmp\3\*.* >

< %Temp%\smtmp\4\*.* >

< dir "%systemdrive%\*" /S /A:L /C >
Volume in drive C is HP
Volume Serial Number is 7E13-791E
Directory of C:\
11/02/2006 09:02 AM <JUNCTION> Documents and Settings [C:\Users]
0 File(s) 0 bytes
Directory of C:\ProgramData
11/02/2006 09:02 AM <JUNCTION> Application Data [C:\ProgramData]
11/02/2006 09:02 AM <JUNCTION> Desktop [C:\Users\Public\Desktop]
11/02/2006 09:02 AM <JUNCTION> Documents [C:\Users\Public\Documents]
11/02/2006 09:02 AM <JUNCTION> Favorites [C:\Users\Public\Favorites]
11/02/2006 09:02 AM <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
11/02/2006 09:02 AM <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users
11/02/2006 09:02 AM <SYMLINKD> All Users [C:\ProgramData]
11/02/2006 09:02 AM <JUNCTION> Default User [C:\Users\Default]
0 File(s) 0 bytes
Directory of C:\Users\All Users
11/02/2006 09:02 AM <JUNCTION> Application Data [C:\ProgramData]
11/02/2006 09:02 AM <JUNCTION> Desktop [C:\Users\Public\Desktop]
11/02/2006 09:02 AM <JUNCTION> Documents [C:\Users\Public\Documents]
11/02/2006 09:02 AM <JUNCTION> Favorites [C:\Users\Public\Favorites]
11/02/2006 09:02 AM <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
11/02/2006 09:02 AM <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default
11/02/2006 09:02 AM <JUNCTION> Application Data [C:\Users\Default\AppData\Roaming]
11/02/2006 09:02 AM <JUNCTION> Local Settings [C:\Users\Default\AppData\Local]
11/02/2006 09:02 AM <JUNCTION> My Documents [C:\Users\Default\Documents]
11/02/2006 09:02 AM <JUNCTION> NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
11/02/2006 09:02 AM <JUNCTION> PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
11/02/2006 09:02 AM <JUNCTION> Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
11/02/2006 09:02 AM <JUNCTION> SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
11/02/2006 09:02 AM <JUNCTION> Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
11/02/2006 09:02 AM <JUNCTION> Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default\AppData\Local
11/02/2006 09:02 AM <JUNCTION> Application Data [C:\Users\Default\AppData\Local]
11/02/2006 09:02 AM <JUNCTION> History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
11/02/2006 09:02 AM <JUNCTION> Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Default\Documents
11/02/2006 09:02 AM <JUNCTION> My Music [C:\Users\Default\Music]
11/02/2006 09:02 AM <JUNCTION> My Pictures [C:\Users\Default\Pictures]
11/02/2006 09:02 AM <JUNCTION> My Videos [C:\Users\Default\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Public\Documents
11/02/2006 09:02 AM <JUNCTION> My Music [C:\Users\Public\Music]
11/02/2006 09:02 AM <JUNCTION> My Pictures [C:\Users\Public\Pictures]
11/02/2006 09:02 AM <JUNCTION> My Videos [C:\Users\Public\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Trudy Stewart
05/19/2008 07:38 PM <JUNCTION> Application Data [C:\Users\Trudy Stewart\AppData\Roaming]
05/19/2008 07:38 PM <JUNCTION> Cookies [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Cookies]
05/19/2008 07:38 PM <JUNCTION> Local Settings [C:\Users\Trudy Stewart\AppData\Local]
05/19/2008 07:38 PM <JUNCTION> My Documents [C:\Users\Trudy Stewart\Documents]
05/19/2008 07:38 PM <JUNCTION> NetHood [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
05/19/2008 07:38 PM <JUNCTION> PrintHood [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
05/19/2008 07:38 PM <JUNCTION> Recent [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Recent]
05/19/2008 07:38 PM <JUNCTION> SendTo [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\SendTo]
05/19/2008 07:38 PM <JUNCTION> Start Menu [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Start Menu]
05/19/2008 07:38 PM <JUNCTION> Templates [C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Trudy Stewart\AppData\Local
05/19/2008 07:38 PM <JUNCTION> Application Data [C:\Users\Trudy Stewart\AppData\Local]
05/19/2008 07:38 PM <JUNCTION> History [C:\Users\Trudy Stewart\AppData\Local\Microsoft\Windows\History]
05/19/2008 07:38 PM <JUNCTION> Temporary Internet Files [C:\Users\Trudy Stewart\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Trudy Stewart\Documents
05/19/2008 07:38 PM <JUNCTION> My Music [C:\Users\Trudy Stewart\Music]
05/19/2008 07:38 PM <JUNCTION> My Pictures [C:\Users\Trudy Stewart\Pictures]
05/19/2008 07:38 PM <JUNCTION> My Videos [C:\Users\Trudy Stewart\Videos]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile
01/31/2009 10:19 PM <JUNCTION> Application Data [C:\Windows\system32\config\systemprofile\AppData\Roaming]
01/31/2009 10:19 PM <JUNCTION> Local Settings [C:\Windows\system32\config\systemprofile\AppData\Local]
01/31/2009 10:19 PM <JUNCTION> My Documents [C:\Windows\system32\config\systemprofile\Documents]
01/31/2009 10:19 PM <JUNCTION> NetHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
01/31/2009 10:19 PM <JUNCTION> PrintHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
01/31/2009 10:19 PM <JUNCTION> Recent [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent]
01/31/2009 10:19 PM <JUNCTION> SendTo [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo]
01/31/2009 10:19 PM <JUNCTION> Start Menu [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu]
01/31/2009 10:19 PM <JUNCTION> Templates [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile\AppData\Local
01/31/2009 10:19 PM <JUNCTION> Application Data [C:\Windows\system32\config\systemprofile\AppData\Local]
01/31/2009 10:19 PM <JUNCTION> History [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History]
01/31/2009 10:19 PM <JUNCTION> Temporary Internet Files [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile\Documents
01/31/2009 10:19 PM <JUNCTION> My Music [C:\Windows\system32\config\systemprofile\Music]
01/31/2009 10:19 PM <JUNCTION> My Pictures [C:\Windows\system32\config\systemprofile\Pictures]
01/31/2009 10:19 PM <JUNCTION> My Videos [C:\Windows\system32\config\systemprofile\Videos]
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
64 Dir(s) 207,581,065,216 bytes free

========== Alternate Data Streams ==========

@Alternate Data Stream - 284 bytes -> C:\Windows\System32\´ý:@kpctlsp.log
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMPFC5A2B2

< End of report >


----------



## kevinf80 (Mar 21, 2006)

Re-Run







by double left click, Vista and Widows 7 users accept UAC alert.


Under the







box at the bottom, paste in the following, start with and include the colon plus OTL . *:OTL*


```
:OTL
DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfSysMon.sys -- (TfSysMon)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\TfNetMon.sys -- (TfNetMon)
DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\TfFsMon.sys -- (TfFsMon)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (RimUsb)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pctplsg.sys -- (pctplsg)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\PCTINDIS5.SYS -- (PCTINDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lvpopflt.sys -- (lvpopflt)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jubusenum.sys -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\TRUDYS~1\AppData\Local\Temp\catchme.sys -- (catchme)
[2013/06/12 20:46:17 | 000,000,000 | ---D | M] (InfoAtoms) -- C:\Program Files\Mozilla Firefox\updated\extensions\[email protected]
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\[email protected]
File not found (No name found) -- C:\USERS\TRUDY STEWART\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YOEBZ5B8.DEFAULT-1357333329994\EXTENSIONS\[email protected]
[2008/09/03 20:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\mozilla firefox\plugins\npbittorrent.dll
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found.
O3 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\Toolbar\WebBrowser: (no name) - {CB789373-04D5-4EF4-9C16-871463FD0830} - No CLSID value found.
[3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[2013/01/02 21:57:32 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\IObit
@Alternate Data Stream - 284 bytes -> C:\Windows\System32\´ý:@kpctlsp.log
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMPFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:1CA73D29
:Files
ipconfig /flushdns /c
:Commands
[emptytemp]
[CREATERESTOREPOINT]
```

Then click







button at the top
Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
Please post that log in your next reply.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.
If you are asked to reboot the machine choose *Yes*. In this case, after the reboot, open Notepad (Start > All Programs > Accessories > Notepad), click File > Open, in the File Name box enter **.log* and press the Enter key, navigate to the *C:\_OTL\MovedFiles folder*, and open the newest *.log* file present, and copy/paste the contents of that document back here in your next post.

Give an update on any remaining issues or concerns..

Kevin


----------



## Trutalley (Mar 10, 2013)

Kevin, Below is the log you requested. All OTL default selections were left as it was shown since no instructions were given for changes as previously instructed.

Update:
shortcuts are iffy. take forever if they open at all. chrome shortcut is working
no ads are showing up
bing is still wonky and not working without a security captcha box, but eventually quits working altogetherAll processes killed
========== OTL ==========
Error: No service named TfSysMon was found to stop!
Service\Driver key TfSysMon not found.
File system32\drivers\TfSysMon.sys not found.
Error: No service named TfNetMon was found to stop!
Service\Driver key TfNetMon not found.
File C:\Windows\system32\drivers\TfNetMon.sys not found.
Error: No service named TfFsMon was found to stop!
Service\Driver key TfFsMon not found.
File system32\drivers\TfFsMon.sys not found.
Error: No service named SymIMMP was found to stop!
Service\Driver key SymIMMP not found.
File system32\DRIVERS\SymIM.sys not found.
Error: No service named RimUsb was found to stop!
Service\Driver key RimUsb not found.
Error: No service named pctplsg was found to stop!
Service\Driver key pctplsg not found.
File C:\Windows\System32\drivers\pctplsg.sys not found.
Error: No service named PCTINDIS5 was found to stop!
Service\Driver key PCTINDIS5 not found.
File C:\Windows\system32\PCTINDIS5.SYS not found.
Error: No service named NwlnkFwd was found to stop!
Service\Driver key NwlnkFwd not found.
Error: No service named NwlnkFlt was found to stop!
Service\Driver key NwlnkFlt not found.
Error: No service named lvpopflt was found to stop!
Service\Driver key lvpopflt not found.
File system32\DRIVERS\lvpopflt.sys not found.
Error: No service named IpInIp was found to stop!
Service\Driver key IpInIp not found.
Error: No service named huawei_enumerator was found to stop!
Service\Driver key huawei_enumerator not found.
File system32\DRIVERS\ew_jubusenum.sys not found.
Error: No service named catchme was found to stop!
Service\Driver key catchme not found.
File C:\Users\TRUDYS~1\AppData\Local\Temp\catchme.sys not found.
Folder C:\Program Files\Mozilla Firefox\updated\extensions\[email protected]\ not found.
C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
Registry value HKEY_USERS\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{724D43A0-0D85-11D4-9908-00400523E39A} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{724D43A0-0D85-11D4-9908-00400523E39A}\ not found.
Registry value HKEY_USERS\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CB789373-04D5-4EF4-9C16-871463FD0830} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CB789373-04D5-4EF4-9C16-871463FD0830}\ not found.
File/Folder C:\Windows\System32\*.tmp not found.
Folder C:\Users\Trudy Stewart\AppData\Roaming\IObit\ not found.
Unable to delete ADS C:\Windows\System32\待: @k pctlsp.log .
Unable to delete ADS C:\ProgramData\TEMPFC5A2B2 .
Unable to delete ADS C:\ProgramData\TEMP:1CA73D29 .
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Trudy Stewart\Desktop\cmd.bat deleted successfully.
C:\Users\Trudy Stewart\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Trudy Stewart
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1313962 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 13434276 bytes
->Google Chrome cache emptied: 284746294 bytes
->Opera cache emptied: 240 bytes
->Flash cache emptied: 711 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 176496438 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 454.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 07022013_224654

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Hope this is what you wanted. Thanks! Trudy


----------



## kevinf80 (Mar 21, 2006)

Hiya Trudy,

Uninstall the following program:

*Privoxy*

Next,

Run AdwCleaner again from the *Delete* tab option.

Next,

Run Junkware Removal Tool.

See if your system has improved, post both above logs. If no improvement run OTL again...

Download *OTL* from any of the following links and save to your desktop (if required).

http://itxassociates.com/OT-Tools/OTL.com
http://oldtimer.geekstogo.com/OTL.exe
http://www.itxassociates.com/OT-Tools/OTL.scr

Double click the OTL icon to start the tool. (Note: If you are running on Vista or Windows 7 accept UAC alert)


 When the window appears, underneath *Output* at the top, make sure *Standard output* is selected.
 Select *Scan all users*
Change *Drivers* to *All*
 Under the *Extra Registry* section, check *Use SafeList*
 In the lower right corner, checkmark *"LOP Check"* and checkmark *"Purity Check".*
 Click *Run Scan* and let the program run uninterrupted.
 When the scan is complete, two text files will be created on your Desktop.
 *OTL.Txt* <- this one will be opened
 *Extras.txt* <- this one will be minimized

Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of *OTL.Txt* and the *Extras.txt* in your next reply.

Kevin,,


----------



## Trutalley (Mar 10, 2013)

Kevin, I think part of my problem is not being able to save otl to the desktop. all the other programs save a shortcut to the desktop. my computer does not give me the option to save to the desktop after the download, and not before the download.
I can right click on the download(no option to run as administrator) and instead of selecting open and then run i select show in folder. this takes me to all my download folders. otl is highlighted and i right click and send it to the desktop. however when otl gets to the desktop it was showing a vista page instead of otl logo. when i click on this it runs otl ( from several times back)
now however as my shortcut issues have gotten a bit worse it shows what looks like a notepad page when i click on it it shows a black box very quickly and then goes away. the last otl was from the original vista page saved to desktop. i have tried other links but still can't save to desktop. Now since we ran adware I no longer have my personal settings should i make changes or anything else you want done? Thanks, Trudy


----------



## kevinf80 (Mar 21, 2006)

Are you using Firefox?


 Open FireFox and select "Tools" from the menu bar.
 Select "General Tab"
 In "Downloads" Section make sure that:

1. "Show the Downloads window when downloading a file *IS* ticked
2. "Always ask me where to save files *IS* ticked










 Select *OK*


----------



## Trutalley (Mar 10, 2013)

Keven, Is the site having issues. I can't load my reply and aaaaargh then it all disappears. Hmmm. I'll try again. different browser. Trudy


----------



## Trutalley (Mar 10, 2013)

# AdwCleaner v2.304 - Logfile created 07/03/2013 at 11:24:28
# Updated 03/07/2013 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Trudy Stewart - TRUDYSTEWART-PC
# Boot Mode : Normal
# Running from : C:\Users\Trudy Stewart\Desktop\AdwCleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Deleted on reboot : C:\Program Files\jZip
***** [Registry] *****
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7D4F1959-3F72-49D5-8E59-F02F8AA6815D}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7D4F1959-3F72-49D5-8E59-F02F8AA6815D}
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16490
[OK] Registry is clean.
-\\ Mozilla Firefox v21.0 (en-US)
File : C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\prefs.js
[OK] File is clean.
-\\ Google Chrome v27.0.1453.116
File : C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Preferences
Deleted [l.29] : search_url = "hxxp://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&ba[...]
-\\ Opera v12.15.1748.0
File : C:\Users\Trudy Stewart\AppData\Roaming\Opera\Opera\operaprefs.ini
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [18567 octets] - [18/06/2013 18:12:16]
AdwCleaner[R2].txt - [9765 octets] - [01/07/2013 09:22:08]
AdwCleaner[R3].txt - [9829 octets] - [01/07/2013 09:32:29]
AdwCleaner[R555].txt - [9829 octets] - [01/07/2013 09:33:20]
AdwCleaner[S1].txt - [19017 octets] - [18/06/2013 19:24:54]
AdwCleaner[S2].txt - [9802 octets] - [01/07/2013 09:34:02]
AdwCleaner[S3].txt - [1715 octets] - [03/07/2013 11:24:28]
########## EOF - C:\AdwCleaner[S3].txt - [1775 octets] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Trudy Stewart on Wed 07/03/2013 at 11:34:28.00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ FireFox
Emptied folder: C:\Users\Trudy Stewart\AppData\Roaming\mozilla\firefox\profiles\yoebz5b8.default-1357333329994\minidumps [3 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 07/03/2013 at 11:37:30.15
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

OTL logfile created on: 7/3/2013 11:40:08 AM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Trudy Stewart\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.06 Gb Available Physical Memory | 68.84% Memory free
6.20 Gb Paging File | 5.29 Gb Available in Paging File | 85.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.49 Gb Total Space | 193.45 Gb Free Space | 67.06% Space Free | Partition Type: NTFS
Drive D: | 9.60 Gb Total Space | 1.28 Gb Free Space | 13.39% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 294.65 Gb Free Space | 98.84% Space Free | Partition Type: NTFS

Computer Name: TRUDYSTEWART-PC | User Name: Trudy Stewart | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/07/03 10:49:27 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Trudy Stewart\Desktop\OTL.exe
PRC - [2013/06/04 10:58:48 | 002,095,752 | ---- | M] () -- C:\Program Files\Comodo\Dragon\dragon_updater.exe
PRC - [2013/05/09 04:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe
PRC - [2011/11/11 14:08:06 | 000,205,336 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
PRC - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
PRC - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/16 05:44:55 | 001,358,384 | R--- | M] (Linksys, LLC) -- C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
PRC - [2007/10/25 09:52:08 | 004,702,208 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/05/09 01:00:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM05Mon.exe
PRC - [2007/02/04 12:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
PRC - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Modules (No Company Name) ==========

MOD - [2012/10/11 21:56:46 | 000,087,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/10/11 21:56:22 | 001,242,512 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/11/11 14:09:20 | 000,336,408 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
MOD - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
MOD - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
MOD - [2010/05/07 18:37:40 | 000,126,808 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll
MOD - [2010/05/07 18:37:40 | 000,027,480 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll
MOD - [2010/05/07 18:36:54 | 000,340,824 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll
MOD - [2010/05/07 18:35:56 | 007,954,776 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll
MOD - [2010/05/07 18:35:44 | 002,143,576 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll
MOD - [2009/07/13 18:37:04 | 000,152,112 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll
MOD - [2009/07/13 18:37:04 | 000,098,304 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll
MOD - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
MOD - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe -- (RoxLiveShare9)
SRV - [2013/06/12 20:46:40 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/06/04 10:58:48 | 002,095,752 | ---- | M] () [Auto | Running] -- C:\Program Files\Comodo\Dragon\dragon_updater.exe -- (DragonUpdater)
SRV - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2009/04/11 02:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/11/06 16:22:26 | 000,092,792 | ---- | M] (CACE Technologies) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2006/11/02 08:36:18 | 000,029,696 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\iprip.dll -- (iprip)

========== Driver Services (All) ==========

DRV - File not found [Kernel | Disabled | Stopped] -- -- (blbdrive)
DRV - [2013/06/27 20:58:10 | 000,770,344 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2013/06/27 20:58:10 | 000,369,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2013/06/27 20:58:10 | 000,175,176 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswVmm.sys -- (aswVmm)
DRV - [2013/05/09 04:59:10 | 000,056,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2013/05/09 04:59:10 | 000,049,376 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswRvrt.sys -- (aswRvrt)
DRV - [2013/05/09 04:59:09 | 000,066,336 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2013/05/09 04:59:09 | 000,049,760 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2013/05/09 04:59:08 | 000,029,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2013/05/08 00:37:21 | 000,905,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tcpip.sys -- (Tcpip6)
DRV - [2013/05/08 00:37:21 | 000,905,576 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\tcpip.sys -- (Tcpip)
DRV - [2013/04/15 10:20:04 | 000,638,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dxgkrnl.sys -- (DXGKrnl)
DRV - [2013/03/03 15:07:52 | 001,082,232 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\ntfs.sys -- (Ntfs)
DRV - [2012/08/21 13:01:22 | 000,026,840 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2012/08/21 07:47:42 | 000,224,640 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\volsnap.sys -- (volsnap)
DRV - [2012/07/25 23:39:21 | 000,526,952 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\Wdf01000.sys -- (Wdf01000)
DRV - [2012/07/25 22:33:43 | 000,066,560 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WUDFPf.sys -- (WudfPf)
DRV - [2012/07/25 22:32:51 | 000,155,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WUDFRd.sys -- (WUDFRd)
DRV - [2012/06/04 11:26:04 | 000,440,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ksecdd.sys -- (KSecDD)
DRV - [2012/05/01 10:03:49 | 000,180,736 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpwd.sys -- (RDPWD)
DRV - [2012/03/20 19:28:50 | 000,053,120 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\partmgr.sys -- (partmgr)
DRV - [2012/02/29 09:32:37 | 000,012,800 | ---- | M] (Microsoft Corporation) [Recognizer | System | Unknown] -- C:\Windows\System32\drivers\fs_rec.sys -- (Fs_Rec)
DRV - [2012/01/18 02:44:52 | 004,332,960 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUVC.sys -- (LVUVC)
DRV - [2012/01/18 02:44:28 | 000,312,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2012/01/18 02:44:14 | 000,022,176 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvbusflt.sys -- (CompFilter)
DRV - [2011/07/06 11:31:47 | 000,214,016 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mrxsmb10.sys -- (mrxsmb10)
DRV - [2011/04/29 09:25:10 | 000,146,432 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\srv2.sys -- (srv2)
DRV - [2011/04/29 09:25:09 | 000,102,400 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\srvnet.sys -- (srvnet)
DRV - [2011/04/29 09:24:42 | 000,079,872 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mrxsmb20.sys -- (mrxsmb20)
DRV - [2011/04/29 09:24:40 | 000,106,496 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mrxsmb.sys -- (mrxsmb)
DRV - [2011/04/21 09:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\afd.sys -- (AFD)
DRV - [2011/04/14 10:59:03 | 000,075,264 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\System32\drivers\dfsc.sys -- (DfsC)
DRV - [2011/03/30 23:54:32 | 001,073,216 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AE1200vista.sys -- (Linksys_adapter)
DRV - [2011/02/22 09:23:55 | 000,069,632 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\bowser.sys -- (bowser)
DRV - [2011/02/18 10:03:32 | 000,305,152 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\srv.sys -- (srv)
DRV - [2010/05/07 18:43:30 | 000,025,824 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2010/02/20 16:53:34 | 000,411,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\http.sys -- (HTTP)
DRV - [2010/02/18 07:28:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tunnel.sys -- (tunnel)
DRV - [2009/12/08 13:26:18 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tcpipreg.sys -- (tcpipreg)
DRV - [2009/07/07 15:48:44 | 000,027,696 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\purendis.sys -- (purendis)
DRV - [2009/07/07 15:48:44 | 000,026,672 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pnarp.sys -- (pnarp)
DRV - [2009/04/11 02:33:03 | 000,292,840 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\volmgrx.sys -- (volmgrx)
DRV - [2009/04/11 02:32:55 | 000,149,480 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pci.sys -- (pci)
DRV - [2009/04/11 02:32:52 | 000,053,224 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\termdd.sys -- (TermDD)
DRV - [2009/04/11 02:32:49 | 000,527,848 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ndis.sys -- (NDIS)
DRV - [2009/04/11 02:32:49 | 000,014,312 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pciide.sys -- (pciide)
DRV - [2009/04/11 02:32:46 | 000,265,688 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\acpi.sys -- (ACPI)
DRV - [2009/04/11 02:32:46 | 000,245,736 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\clfs.sys -- (CLFS)
DRV - [2009/04/11 02:32:46 | 000,190,424 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\fltMgr.sys -- (FltMgr)
DRV - [2009/04/11 02:32:46 | 000,161,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\msrpc.sys -- (MsRPC)
DRV - [2009/04/11 02:32:43 | 000,141,288 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ecache.sys -- (Ecache)
DRV - [2009/04/11 02:32:31 | 000,053,736 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\disk.sys -- (disk)
DRV - [2009/04/11 02:32:31 | 000,048,104 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\mup.sys -- (Mup)
DRV - [2009/04/11 02:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\atapi.sys -- (atapi)
DRV - [2009/04/11 00:46:40 | 000,069,120 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rassstp.sys -- (RasSstp)
DRV - [2009/04/11 00:46:32 | 000,121,344 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ndiswan.sys -- (NdisWan)
DRV - [2009/04/11 00:46:30 | 000,041,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\raspppoe.sys -- (RasPppoe)
DRV - [2009/04/11 00:45:56 | 000,072,192 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\tdx.sys -- (tdx)
DRV - [2009/04/11 00:45:51 | 000,072,192 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\pacer.sys -- (PSched)
DRV - [2009/04/11 00:45:37 | 000,185,856 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\netbt.sys -- (netbt)
DRV - [2009/04/11 00:45:22 | 000,066,560 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\smb.sys -- (Smb)
DRV - [2009/04/11 00:43:28 | 000,148,480 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nwifi.sys -- (NativeWifiP)
DRV - [2009/04/11 00:43:16 | 000,196,096 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbhub.sys -- (usbhub)
DRV - [2009/04/11 00:43:04 | 000,062,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ohci1394.sys -- (ohci1394)
DRV - [2009/04/11 00:42:55 | 000,065,536 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\USBSTOR.SYS -- (USBSTOR)
DRV - [2009/04/11 00:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio)
DRV - [2009/04/11 00:42:52 | 000,039,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbehci.sys -- (usbehci)
DRV - [2009/04/11 00:42:52 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbohci.sys -- (usbohci)
DRV - [2009/04/11 00:42:48 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hidusb.sys -- (HidUsb)
DRV - [2009/04/11 00:39:17 | 000,067,072 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\cdrom.sys -- (cdrom)
DRV - [2009/04/11 00:14:40 | 000,114,688 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mrxdav.sys -- (MRxDAV)
DRV - [2009/04/11 00:14:29 | 000,225,280 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\System32\drivers\rdbss.sys -- (rdbss)
DRV - [2009/04/11 00:14:01 | 000,035,328 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\System32\drivers\npfs.sys -- (Npfs)
DRV - [2009/04/11 00:13:59 | 000,226,816 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\udfs.sys -- (udfs)
DRV - [2009/04/11 00:13:53 | 000,136,704 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\exfat.sys -- (exfat)
DRV - [2009/04/11 00:13:52 | 000,142,848 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\fastfat.sys -- (fastfat)
DRV - [2009/02/11 12:38:14 | 002,324,512 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService)
DRV - [2008/12/04 09:17:15 | 000,645,120 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WUSB54GCv3.sys -- (WUSB54GCv3)
DRV - [2008/08/01 19:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008/05/08 05:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2008/05/08 05:04:16 | 000,661,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2008/05/08 05:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)
DRV - [2008/01/19 03:42:35 | 000,181,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\msiscsi.sys -- (iScsiPrt)
DRV - [2008/01/19 03:42:31 | 000,058,936 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\fileinfo.sys -- (FileInfo)
DRV - [2008/01/19 03:42:28 | 000,057,400 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\mountmgr.sys -- (MountMgr)
DRV - [2008/01/19 03:42:18 | 000,052,792 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\volmgr.sys -- (volmgr)
DRV - [2008/01/19 03:41:52 | 000,035,384 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\kbdclass.sys -- (kbdclass)
DRV - [2008/01/19 03:41:52 | 000,034,360 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\mouclass.sys -- (mouclass)
DRV - [2008/01/19 03:41:49 | 000,031,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mssmbios.sys -- (mssmbios)
DRV - [2008/01/19 03:41:30 | 000,021,048 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\spldr.sys -- (spldr)
DRV - [2008/01/19 03:41:14 | 000,016,440 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\msisadrv.sys -- (msisadrv)
DRV - [2008/01/19 03:41:14 | 000,015,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\swenum.sys -- (swenum)
DRV - [2008/01/19 02:14:40 | 000,018,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbprint.sys -- (usbprint)
DRV - [2008/01/19 02:14:10 | 000,009,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\serscan.sys -- (StillCam)
DRV - [2008/01/19 02:14:09 | 000,035,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbscan.sys -- (usbscan)
DRV - [2008/01/19 02:01:15 | 000,023,552 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tssecsrv.sys -- (tssecsrv)
DRV - [2008/01/19 02:01:09 | 000,006,144 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\RDPENCDD.sys -- (RDPENCDD)
DRV - [2008/01/19 02:01:08 | 000,029,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tdtcp.sys -- (TDTCP)
DRV - [2008/01/19 02:01:08 | 000,006,144 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\RDPCDD.sys -- (RDPCDD)
DRV - [2008/01/19 02:01:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tdpipe.sys -- (TDPIPE)
DRV - [2008/01/19 01:57:16 | 000,031,744 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\modem.sys -- (Modem)
DRV - [2008/01/19 01:57:15 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rootmdm.sys -- (ROOTMODEM)
DRV - [2008/01/19 01:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\ws2ifsl.sys -- (ws2ifsl)
DRV - [2008/01/19 01:56:34 | 000,076,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rasl2tp.sys -- (Rasl2tp)
DRV - [2008/01/19 01:56:34 | 000,062,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\raspptp.sys -- (PptpMiniport)
DRV - [2008/01/19 01:56:31 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\wanarp.sys -- (Wanarpv6)
DRV - [2008/01/19 01:56:31 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wanarp.sys -- (Wanarp)
DRV - [2008/01/19 01:56:31 | 000,011,776 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\rasacd.sys -- (RasAcd)
DRV - [2008/01/19 01:56:29 | 000,017,408 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\asyncmac.sys -- (AsyncMac)
DRV - [2008/01/19 01:56:28 | 000,100,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ipnat.sys -- (IPNAT)
DRV - [2008/01/19 01:56:28 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ndproxy.sys -- (NDProxy)
DRV - [2008/01/19 01:56:24 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ndistapi.sys -- (NdisTapi)
DRV - [2008/01/19 01:56:23 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ipfltdrv.sys -- (IpFilterDriver)
DRV - [2008/01/19 01:56:07 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\qwavedrv.sys -- (QWAVEdrv)
DRV - [2008/01/19 01:55:50 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\nsiproxy.sys -- (nsiproxy)
DRV - [2008/01/19 01:55:45 | 000,035,840 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\System32\drivers\netbios.sys -- (NetBIOS)
DRV - [2008/01/19 01:55:41 | 000,015,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\TUNMP.SYS -- (tunmp)
DRV - [2008/01/19 01:55:40 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ndisuio.sys -- (Ndisuio)
DRV - [2008/01/19 01:55:19 | 000,013,312 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\irenum.sys -- (IRENUM)
DRV - [2008/01/19 01:55:03 | 000,060,416 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rspndr.sys -- (rspndr)
DRV - [2008/01/19 01:55:03 | 000,047,104 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lltdio.sys -- (lltdio)
DRV - [2008/01/19 01:54:46 | 000,064,000 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mpsdrv.sys -- (mpsdrv)
DRV - [2008/01/19 01:53:40 | 000,034,816 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\umbus.sys -- (umbus)
DRV - [2008/01/19 01:53:38 | 000,134,016 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbvideo.sys -- (usbvideo)
DRV - [2008/01/19 01:53:29 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbccgp.sys -- (usbccgp)
DRV - [2008/01/19 01:53:16 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\drmkaud.sys -- (drmkaud)
DRV - [2008/01/19 01:52:19 | 000,041,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\monitor.sys -- (monitor)
DRV - [2008/01/19 01:52:06 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vga.sys -- (VgaSave)
DRV - [2008/01/19 01:49:20 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mskssrv.sys -- (MSKSSRV)
DRV - [2008/01/19 01:49:19 | 000,006,016 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mstee.sys -- (MSTEE)
DRV - [2008/01/19 01:49:18 | 000,054,784 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\i8042prt.sys -- (i8042prt)
DRV - [2008/01/19 01:49:18 | 000,005,888 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mspclock.sys -- (MSPCLOCK)
DRV - [2008/01/19 01:49:18 | 000,005,504 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mspqm.sys -- (MSPQM)
DRV - [2008/01/19 01:49:16 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sermouse.sys -- (sermouse)
DRV - [2008/01/19 01:49:16 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mouhid.sys -- (mouhid)
DRV - [2008/01/19 01:49:12 | 000,004,608 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\null.sys -- (Null)
DRV - [2008/01/19 01:49:10 | 000,006,144 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\beep.sys -- (Beep)
DRV - [2008/01/19 01:30:36 | 000,084,480 | ---- | M] (Microsoft Corporation) [File_System | Auto | Running] -- C:\Windows\System32\drivers\luafv.sys -- (luafv)
DRV - [2008/01/19 01:30:23 | 000,027,648 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\filetrace.sys -- (Filetrace)
DRV - [2008/01/19 01:28:09 | 000,022,528 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\System32\drivers\msfs.sys -- (Msfs)
DRV - [2008/01/19 01:28:02 | 000,070,144 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Running] -- C:\Windows\System32\drivers\cdfs.sys -- (cdfs)
DRV - [2008/01/19 01:27:21 | 000,040,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\processr.sys -- (Processor)
DRV - [2008/01/19 00:30:49 | 000,053,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007/11/06 16:22:06 | 000,034,064 | ---- | M] (CACE Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2007/10/26 07:51:22 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007/10/18 07:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/10/12 02:00:44 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/09/07 10:36:08 | 000,156,928 | ---- | M] (ViXS Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\xcbda.sys -- (xcbdaNtsc)
DRV - [2007/08/27 14:59:00 | 007,574,976 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/07/20 01:00:00 | 000,235,616 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vid.sys -- (OEM05Vid)
DRV - [2007/06/08 01:00:02 | 000,141,376 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\OEM05Afx.sys -- (OEM05Afx)
DRV - [2007/04/11 15:33:06 | 000,079,376 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2007/04/11 15:32:58 | 000,036,112 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007/04/11 15:32:52 | 000,034,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2007/04/11 15:32:38 | 000,063,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2007/04/11 15:32:30 | 000,020,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007/03/05 18:45:04 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vfx.sys -- (OEM05Vfx)
DRV - [2007/01/18 11:24:58 | 000,026,496 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RimSerial.sys -- (RimVSerPort)
DRV - [2007/01/01 10:07:44 | 000,013,312 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sffdisk.sys -- (sffdisk)
DRV - [2007/01/01 10:07:44 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sffp_sd.sys -- (sffp_sd)
DRV - [2007/01/01 10:07:44 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sffp_mmc.sys -- (sffp_mmc)
DRV - [2006/11/02 05:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 05:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 05:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 05:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 05:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 05:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\iaStorV.sys -- (iaStorV)
DRV - [2006/11/02 05:51:12 | 000,167,528 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\pcmcia.sys -- (pcmcia)
DRV - [2006/11/02 05:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 05:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 05:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 05:50:40 | 000,106,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NV_AGP.SYS -- (nv_agp)
DRV - [2006/11/02 05:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 05:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 05:50:24 | 000,047,208 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\isapnp.sys -- (isapnp)
DRV - [2006/11/02 05:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 05:50:17 | 000,080,488 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\msdsm.sys -- (msdsm)
DRV - [2006/11/02 05:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 05:50:16 | 000,078,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\mpio.sys -- (mpio)
DRV - [2006/11/02 05:50:16 | 000,076,392 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sbp2port.sys -- (sbp2port)
DRV - [2006/11/02 05:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 05:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 05:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 05:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 05:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 05:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 05:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\HpCISSs.sys -- (HpCISSs)
DRV - [2006/11/02 05:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 05:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 05:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 05:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 05:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 05:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 05:50:04 | 000,058,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\GAGP30KX.SYS -- (gagp30kx)
DRV - [2006/11/02 05:50:04 | 000,058,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ULIAGPKX.SYS -- (uliagpkx)
DRV - [2006/11/02 05:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 05:49:59 | 000,056,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\UAGP35.SYS -- (uagp35)
DRV - [2006/11/02 05:49:59 | 000,054,888 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AMDAGP.SYS -- (amdagp)
DRV - [2006/11/02 05:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\Mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 05:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 05:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 05:49:52 | 000,054,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VIAAGP.SYS -- (viaagp)
DRV - [2006/11/02 05:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGP440.sys -- (agp440)
DRV - [2006/11/02 05:49:51 | 000,053,352 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SISAGP.SYS -- (sisagp)
DRV - [2006/11/02 05:49:49 | 000,027,752 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\i2omp.sys -- (i2omp)
DRV - [2006/11/02 05:49:44 | 000,023,144 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\msahci.sys -- (msahci)
DRV - [2006/11/02 05:49:43 | 000,022,632 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\crcdisk.sys -- (crcdisk)
DRV - [2006/11/02 05:49:38 | 000,019,560 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\wd.sys -- (Wd)
DRV - [2006/11/02 05:49:32 | 000,018,280 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\compbatt.sys -- (Compbatt)
DRV - [2006/11/02 05:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 05:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 05:49:26 | 000,015,464 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\amdide.sys -- (amdide)
DRV - [2006/11/02 05:49:24 | 000,014,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\intelide.sys -- (intelide)
DRV - [2006/11/02 05:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 05:04:35 | 000,878,080 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\PEAuth.sys -- (PEAUTH)
DRV - [2006/11/02 05:03:00 | 000,242,688 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\rdpdr.sys -- (rdpdr)
DRV - [2006/11/02 04:55:23 | 000,039,936 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\bthmodem.sys -- (BTHMODEM)
DRV - [2006/11/02 04:55:22 | 000,029,184 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\hidbth.sys -- (HidBth)
DRV - [2006/11/02 04:55:09 | 000,068,608 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\usbcir.sys -- (usbcir)
DRV - [2006/11/02 04:55:08 | 000,035,328 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\circlass.sys -- (circlass)
DRV - [2006/11/02 04:55:05 | 000,022,528 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\usbuhci.sys -- (usbuhci)
DRV - [2006/11/02 04:55:01 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\hidir.sys -- (HidIr)
DRV - [2006/11/02 04:53:56 | 000,026,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vgapnp.sys -- (vga)
DRV - [2006/11/02 04:52:52 | 000,020,608 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\wacompen.sys -- (WacomPen)
DRV - [2006/11/02 04:51:40 | 000,013,312 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sfloppy.sys -- (sfloppy)
DRV - [2006/11/02 04:51:33 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\fdc.sys -- (fdc)
DRV - [2006/11/02 04:51:32 | 000,020,480 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\flpydisk.sys -- (flpydisk)
DRV - [2006/11/02 04:51:30 | 000,083,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2006/11/02 04:51:30 | 000,079,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\parport.sys -- (Parport)
DRV - [2006/11/02 04:51:25 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\serenum.sys -- (Serenum)
DRV - [2006/11/02 04:51:23 | 000,008,704 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\parvdm.sys -- (Parvdm)
DRV - [2006/11/02 04:51:12 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\kbdhid.sys -- (kbdhid)
DRV - [2006/11/02 04:42:03 | 000,065,536 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\IPMIDrv.sys -- (IPMIDRV)
DRV - [2006/11/02 04:35:03 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\wmiacpi.sys -- (WmiAcpi)
DRV - [2006/11/02 04:30:19 | 000,039,424 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\viac7.sys -- (ViaC7)
DRV - [2006/11/02 04:30:18 | 000,040,960 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\amdk8.sys -- (AmdK8)
DRV - [2006/11/02 04:30:18 | 000,039,424 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\intelppm.sys -- (intelppm)
DRV - [2006/11/02 04:30:18 | 000,038,912 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\crusoe.sys -- (Crusoe)
DRV - [2006/11/02 04:30:18 | 000,038,912 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\amdk7.sys -- (AmdK7)
DRV - [2006/11/02 04:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\BrSerId.sys -- (Brserid)
DRV - [2006/11/02 04:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BrUsbSer.sys -- (BrUsbSer)
DRV - [2006/11/02 04:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BrFiltUp.sys -- (BrFiltUp)
DRV - [2006/11/02 04:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BrFiltLo.sys -- (BrFiltLo)
DRV - [2006/11/02 04:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\BrSerWdm.sys -- (BrSerWdm)
DRV - [2006/11/02 04:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\BrUsbMdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 03:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 03:36:49 | 000,235,520 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\HdAudio.sys -- (HdAudAddService)
DRV - [2006/11/02 03:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60)
DRV - [2006/11/02 03:10:22 | 000,002,864 | ---- | M] (Microsoft Corporation) [Adapter | On_Demand | Unknown] -- C:\Windows\System32\WINSOCK.DLL -- (Winsock)
DRV - [2006/11/02 02:37:21 | 000,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\secdrv.sys -- (secdrv)
DRV - [2006/06/19 10:26:58 | 000,012,672 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\mdmxsdk.sys -- (mdmxsdk)
DRV - [2005/12/12 13:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{11D231C8-2FE5-4B8A-B2F9-B1736520C7A2}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sea...putEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{637897BC-FCE2-4DEA-8938-5BA57BAEB440}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE8SRC&src=IE-SearchBox
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes\{759B6E70-7A7D-4FE5-82BF-EA161AA627D9}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=800236&p={searchTerms}
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/05/27 18:14:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}: C:\Program Files\Updater By SweetPacks\Firefox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/06/12 20:46:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/07/02 22:46:56 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/06/12 20:46:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/07/02 22:46:56 | 000,000,000 | ---D | M]

[2008/09/08 20:54:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Extensions
[2013/07/01 09:34:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\extensions
[2013/06/29 20:38:56 | 000,001,793 | ---- | M] () -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\searchplugins\Bing.xml
[2013/06/20 13:58:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/06/12 20:46:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/06/12 20:46:17 | 000,000,000 | ---D | M] (The Browser Highlighter) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========== Chrome ==========

CHR - default_search_provider: Bing (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.116\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll
CHR - plugin: Java Deployment Toolkit 7.0.210.11 (Enabled) = C:\Windows\system32\npDeployJava1.dll

O1 HOSTS File: ([2013/02/02 00:35:03 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (jZip Webmail plugin) - {647FD14A-C4F1-46F4-8FC3-0B40F54226F7} - C:\Program Files\jZip\WebmailPlugin.dll (Discordia Limited)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Linksys Wireless Manager] C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe (Linksys, LLC)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OEM05Mon.exe] C:\Windows\OEM05Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateReg] C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000..\Run: [B7456CF5EF0D0980D92DD0562D346087910D60E2._service_run] C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Evernote - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Download Link Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_file.htm File not found
O8 - Extra context menu item: Download List Of Files Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_list.htm File not found
O8 - Extra context menu item: Subscribe To RSS/Podcast Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_rss.htm File not found
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{36937FF7-1F22-4576-8665-B5965D4D3BCC}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BBDB5DE6-583B-4601-A391-1DC2D9542FFD}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/01/01 10:56:33 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/07/03 11:32:59 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Trudy Stewart\Desktop\JRT.exe
[2013/07/03 11:32:32 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\Desktop\downloads
[2013/07/03 10:49:27 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Trudy Stewart\Desktop\OTL.exe
[2013/07/01 20:34:13 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Local\Comodo
[2013/07/01 20:34:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
[2013/07/01 20:34:09 | 000,047,368 | ---- | C] (COMODO CA Limited) -- C:\Windows\System32\certsentry.dll
[2013/07/01 20:33:58 | 000,000,000 | ---D | C] -- C:\Program Files\Comodo
[2013/07/01 10:18:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/07/01 10:18:27 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013/07/01 10:18:27 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013/06/30 02:05:20 | 000,000,000 | ---D | C] -- C:\Windows\Microsoft Antimalware
[2013/06/28 08:03:37 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Roaming\PowerISO
[2013/06/28 01:33:09 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ace CD Burner
[2013/06/28 01:33:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ace CD Burner
[2013/06/28 01:33:08 | 001,703,936 | ---- | C] (NCT Company) -- C:\Windows\System32\NCTAudioFile.dll
[2013/06/28 01:33:08 | 000,892,928 | ---- | C] (NCT Company) -- C:\Windows\System32\NCTAudioInformation.dll
[2013/06/28 01:33:08 | 000,274,432 | ---- | C] (NCT Company) -- C:\Windows\System32\NCTAudioPlayer.dll
[2013/06/28 01:33:07 | 001,388,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00F
[2013/06/28 01:33:07 | 000,589,824 | ---- | C] (NuMedia Soft, Inc.) -- C:\Windows\System32\DVDRProX.dll
[2013/06/28 01:33:07 | 000,380,928 | ---- | C] (NUGROOVZ) -- C:\Windows\System32\CDRipperX.ocx
[2013/06/28 01:33:06 | 000,073,785 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00E
[2013/06/28 01:33:06 | 000,000,000 | ---D | C] -- C:\Program Files\Ace CD Burner
[2013/06/28 01:31:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\We-Care Reminder
[2013/06/28 01:28:04 | 000,000,000 | ---D | C] -- C:\Windows\System32\jmdp
[2013/06/28 01:28:04 | 000,000,000 | ---D | C] -- C:\Windows\System32\ARFC
[2013/06/20 13:58:36 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/06/19 21:40:33 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/06/19 21:40:09 | 000,000,000 | ---D | C] -- C:\JRT
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Local\temp
[2013/06/19 12:33:38 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/06/19 12:10:01 | 005,081,021 | R--- | C] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/18 19:09:10 | 000,000,000 | ---D | C] -- C:\FRST
[2013/06/15 21:27:20 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan
[2013/06/15 21:27:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
[2013/06/15 21:27:12 | 000,000,000 | ---D | C] -- C:\Program Files\Security Task Manager
[2013/06/13 08:35:00 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/06/13 08:34:58 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013/06/13 08:34:58 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013/06/13 08:34:57 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013/06/13 08:34:57 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013/06/13 08:34:55 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013/06/13 08:34:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013/06/13 08:34:53 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013/06/12 20:46:12 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/06/12 11:15:02 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printcom.dll
[2013/06/12 11:14:58 | 000,812,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certutil.exe
[2013/06/12 11:14:57 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certenc.dll
[2013/06/12 11:14:50 | 003,603,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013/06/12 11:14:49 | 003,551,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013/06/12 11:14:40 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cryptdlg.dll
[2012/10/28 22:15:21 | 011,881,936 | ---- | C] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Users\Trudy Stewart\gosetup.exe

========== Files - Modified Within 30 Days ==========

[2013/07/03 11:36:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/07/03 11:36:00 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/07/03 11:33:00 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Trudy Stewart\Desktop\JRT.exe
[2013/07/03 11:27:30 | 000,000,454 | ---- | M] () -- C:\Windows\tasks\RegCure Program Check.job
[2013/07/03 11:27:20 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2013/07/03 11:27:13 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/07/03 11:27:12 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/07/03 11:27:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/07/03 11:27:04 | 3219,554,304 | -HS- | M] () -- C:\hiberfil.sys
[2013/07/03 11:25:21 | 000,000,321 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013/07/03 11:18:30 | 000,650,027 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\AdwCleaner.exe
[2013/07/03 10:49:27 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Trudy Stewart\Desktop\OTL.exe
[2013/07/01 20:34:13 | 000,000,871 | ---- | M] () -- C:\Users\Public\Desktop\Comodo Dragon.lnk
[2013/07/01 20:34:09 | 000,047,368 | ---- | M] (COMODO CA Limited) -- C:\Windows\System32\certsentry.dll
[2013/07/01 10:18:28 | 000,000,868 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/07/01 10:09:32 | 000,000,571 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\rkill (1) - Shortcut.lnk
[2013/07/01 10:08:46 | 000,000,581 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\RogueKiller - Shortcut.lnk
[2013/07/01 09:59:59 | 000,000,882 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\JRT (1) - Shortcut.lnk
[2013/06/30 18:45:26 | 000,001,325 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\tdsskiller - Shortcut.lnk
[2013/06/29 20:06:56 | 000,634,834 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/06/29 20:06:56 | 000,112,596 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/06/28 01:33:09 | 000,001,687 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Ace CD Burner.lnk
[2013/06/28 01:31:58 | 000,033,958 | ---- | M] () -- C:\ProgramData\uninstaller.exe
[2013/06/27 20:58:10 | 000,770,344 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2013/06/27 20:58:10 | 000,369,584 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2013/06/27 20:58:10 | 000,175,176 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/06/27 20:58:10 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys.sum
[2013/06/27 20:58:10 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswSP.sys.sum
[2013/06/27 20:58:10 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswSnx.sys.sum
[2013/06/20 14:41:24 | 000,001,933 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/06/19 14:29:01 | 000,000,911 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/19 12:10:07 | 005,081,021 | R--- | M] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/11 18:39:35 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013/06/11 18:39:35 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

========== Files Created - No Company Name ==========

[2013/07/03 11:18:30 | 000,650,027 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\AdwCleaner.exe
[2013/07/01 20:34:13 | 000,000,871 | ---- | C] () -- C:\Users\Public\Desktop\Comodo Dragon.lnk
[2013/07/01 10:18:28 | 000,000,868 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/07/01 10:09:32 | 000,000,571 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\rkill (1) - Shortcut.lnk
[2013/07/01 10:08:46 | 000,000,581 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\RogueKiller - Shortcut.lnk
[2013/07/01 09:59:59 | 000,000,882 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\JRT (1) - Shortcut.lnk
[2013/06/30 18:44:06 | 000,001,325 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\tdsskiller - Shortcut.lnk
[2013/06/28 01:33:09 | 000,001,687 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Ace CD Burner.lnk
[2013/06/28 01:31:58 | 000,033,958 | ---- | C] () -- C:\ProgramData\uninstaller.exe
[2013/06/27 20:58:10 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys.sum
[2013/06/26 17:22:47 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswSP.sys.sum
[2013/06/26 17:22:47 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswSnx.sys.sum
[2013/06/19 14:29:01 | 000,000,911 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/18 19:26:02 | 000,000,321 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013/05/22 11:21:06 | 004,325,376 | ---- | C] () -- C:\ProgramData\ReadOnlyInstaller.msi
[2013/04/14 20:49:34 | 000,175,176 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/04/14 20:49:34 | 000,049,376 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013/02/02 00:21:01 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/02/02 00:21:01 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/02/02 00:21:01 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/02/02 00:21:01 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/02/02 00:21:01 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/05/29 13:08:18 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2012/03/31 21:41:09 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012/01/18 02:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2012/01/18 02:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2012/01/18 02:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2011/11/16 21:40:38 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2011/08/12 12:20:14 | 000,015,896 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
[2010/05/07 07:07:08 | 000,000,760 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\setup_ldm.iss
[2010/04/07 12:31:26 | 000,000,000 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\prvlcl.dat
[2009/12/09 22:32:11 | 008,892,928 | ---- | C] () -- C:\ProgramData\atscie.msi
[2009/03/24 22:26:10 | 000,000,050 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-recent-projects.properties
[2009/03/24 22:21:47 | 000,000,745 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-defaults.jap
[2008/12/28 17:31:28 | 000,031,232 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/11/16 00:46:07 | 000,000,138 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\wklnhst.dat
[2008/07/21 16:40:25 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat
[2008/05/20 03:12:40 | 000,001,356 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\d3d9caps.dat

========== ZeroAccess Check ==========

[2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 02:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 02:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2009/04/09 02:14:12 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Ambient Design
[2009/03/28 10:48:26 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Artisteer
[2010/02/26 11:39:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Canon
[2008/09/13 12:52:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/07/21 14:45:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Conceiva
[2009/03/28 22:50:52 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Darq Software
[2013/02/18 15:36:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\DeskSoft
[2012/03/22 16:15:59 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Dropbox
[2008/07/07 15:29:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Individual Software
[2013/07/01 16:37:04 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Inkscape
[2009/03/28 13:18:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Interior Designer 8.0
[2012/05/29 17:50:58 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\IrfanView
[2012/05/13 12:44:02 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Leadertech
[2012/05/29 13:24:23 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MAGIX
[2010/06/27 15:30:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MSNInstaller
[2009/03/27 18:55:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NewSoft
[2013/02/01 22:47:11 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NoteTab Light
[2012/03/31 21:23:28 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Opera
[2010/05/29 18:59:53 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoFiltre
[2010/05/29 19:02:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoScape
[2013/06/28 08:03:37 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PowerISO
[2013/04/02 15:29:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\QuickScan
[2008/05/25 20:11:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\ScanSoft
[2008/09/15 22:05:44 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Snapfish
[2013/05/01 20:37:05 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Softland
[2009/04/07 03:05:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\stickies
[2008/11/16 00:46:07 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Template
[2009/03/29 03:17:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\uTorrent

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 284 bytes -> C:\Windows\System32\´ý:@kpctlsp.log
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMPFC5A2B2
< End of report >

OTL Extras logfile created on: 7/3/2013 11:40:08 AM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Trudy Stewart\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.06 Gb Available Physical Memory | 68.84% Memory free
6.20 Gb Paging File | 5.29 Gb Available in Paging File | 85.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.49 Gb Total Space | 193.45 Gb Free Space | 67.06% Space Free | Partition Type: NTFS
Drive D: | 9.60 Gb Total Space | 1.28 Gb Free Space | 13.39% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 294.65 Gb Free Space | 98.84% Space Free | Partition Type: NTFS

Computer Name: TRUDYSTEWART-PC | User Name: Trudy Stewart | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

[HKEY_USERS\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [Browse with FastStone] -- "C:\Program Files\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 1
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2B5C102A-2F85-41AA-A0DF-4B29849F1245}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=file and printer sharing (spooler service - rpc-epmap) | 
"{2F8DB637-6B0D-47A0-9779-9D3A28000669}" = lport=138 | protocol=17 | dir=in | app=system | 
"{37D77BC9-B345-400F-963A-3AE039A87527}" = lport=137 | protocol=17 | dir=in | app=system | 
"{5857283E-65FE-433A-AA8A-84EC1C967C72}" = lport=445 | protocol=6 | dir=in | app=system | 
"{7E9AA345-DD13-4172-B2AE-AFB5A3A79C31}" = rport=138 | protocol=17 | dir=out | app=system | 
"{A6EDA168-7252-4309-93B7-C22BC789A93C}" = rport=139 | protocol=6 | dir=out | app=system | 
"{C048FD24-BF27-47A3-BF19-30FE2D3A540E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=c:\windows\system32\spoolsv.exe | 
"{DD3EDD64-4C09-4020-999F-31C2ED524F61}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E49EDD1E-78E2-4BBD-BE4D-917B73C1B873}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{E5410391-24C8-44F6-B630-1D36463A3F68}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service | 
"{EF3C7162-07F8-439B-965B-7974F7FD5F30}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{F5A7E1B9-A236-416C-BA82-DD6F662FED52}" = rport=445 | protocol=6 | dir=out | app=system | 
"{FC7DDDB3-A87C-4671-9614-6700B8024D70}" = rport=137 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{171E2811-FE90-4898-A588-A4A344BB0EF7}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{1AF0C643-52C5-4AFD-9A0E-C372A869C9D3}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{230C5A4B-8073-440C-BFC2-C1231154FFFC}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"{2C002230-3129-49C4-8EDB-16F4059AB82A}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{32309D6F-37A6-4894-9184-2A2BB65A1AC7}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{3AD88B88-0F09-4AE0-8A39-DEDAF4EDF7FA}" = protocol=58 | dir=out | name=file and printer sharing (echo request - icmpv6-out) | 
"{48E260AC-7936-4505-A4F4-16706633FA19}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{52D9830E-4EA8-4923-A9DA-4FBFB957E73D}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{53FA3C26-2526-48D6-B015-DCA1735BC32A}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"{6E3F040F-4892-431B-ADF5-5E92216256AE}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{6E8CE4C0-7EF4-4BE8-9263-D00418994111}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{77C78FA5-4509-4EA6-8064-DE6C4F371E5F}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{96BC3B3D-6A6B-4AA8-8D38-2C976D36345F}" = protocol=6 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | 
"{98005BA6-FB48-4ED9-9092-853A1A82C900}" = protocol=6 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | 
"{A019144C-6701-47F4-8B94-B2B1973F5674}" = protocol=17 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | 
"{A6435162-E89E-4887-982C-97CBB197A9B4}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{A849F0F0-629E-4BF4-8269-C3BE016C6B27}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{AB5E8326-A88B-4508-8390-8A43F93BE7A3}" = protocol=6 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe | 
"{AD5DC11A-066E-48FB-8C72-166ED69E1643}" = protocol=6 | dir=in | app=c:\program files\citrix\gotomypc\g2svc.exe | 
"{B96003ED-7A2F-4EA8-ACD8-F86672A91C8E}" = protocol=1 | dir=out | name=file and printer sharing (echo request - icmpv4-out) | 
"{BB588A75-248E-4231-884E-ED327DB03632}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{C2AB2EE1-1F83-4DC2-AAE3-C703152D49ED}" = protocol=17 | dir=in | app=c:\program files\citrix\gotomypc\g2svc.exe | 
"{C921D61F-94B3-4C9B-8DF5-15F814B5B74C}" = protocol=17 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | 
"{CA4760A8-5A45-4CE0-B434-42D8BE9E391F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{E073820C-F42B-454F-880A-45EB992DE92B}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{E13D43B0-EF0E-4B2E-9E8A-531CFE1A7EFB}" = protocol=58 | dir=in | name=file and printer sharing (echo request - icmpv6-in) | 
"{E4D8E406-9641-4595-AB6B-ECF0F569965A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{E6566B50-34F0-442F-9181-E8C5661521FE}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{E6A1E825-52EF-44A3-B50F-4637047C65EA}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{EC1E3A28-96F7-449C-B7A6-5D75B539BB40}" = protocol=17 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe | 
"{F15D811C-BBF5-4F1A-8406-BFFB34757AE2}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{F814EDF0-6FDA-4AD7-B646-4E345C8978D9}" = protocol=1 | dir=in | name=file and printer sharing (echo request - icmpv4-in) | 
"{FD3D8681-159C-4D93-9432-8566477A54DD}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"TCP Query User{12C7280E-FAD3-4684-9FFF-4A9E2643749C}C:\program files\oneeko\oneeko.exe" = protocol=6 | dir=in | app=c:\program files\oneeko\oneeko.exe | 
"TCP Query User{53D78474-D07F-4CEF-B4FF-845EB4543393}C:\program files\oneeko\oneeko.exe" = protocol=6 | dir=in | app=c:\program files\oneeko\oneeko.exe | 
"TCP Query User{CAB5F08C-B19D-471E-B475-2E69B9E8107E}C:\users\trudy stewart\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\trudy stewart\program files\dna\btdna.exe | 
"TCP Query User{E1B16E35-B279-41D4-9C13-CBE4ECFB2092}C:\users\trudy stewart\downloads\utorrent(2).exe" = protocol=6 | dir=in | app=c:\users\trudy stewart\downloads\utorrent(2).exe | 
"TCP Query User{EC751BFB-C7F3-4593-97A9-69563F5AB2E8}C:\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe | 
"UDP Query User{13817C37-6C0B-4474-8095-4D16A7B732C2}C:\program files\oneeko\oneeko.exe" = protocol=17 | dir=in | app=c:\program files\oneeko\oneeko.exe | 
"UDP Query User{3D19ED8B-5CA5-452D-B163-5057F98F636E}C:\program files\oneeko\oneeko.exe" = protocol=17 | dir=in | app=c:\program files\oneeko\oneeko.exe | 
"UDP Query User{623451B8-D177-45AD-A1D8-97536D4C3B9C}C:\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe | 
"UDP Query User{A8424EB2-1B9F-4747-BA13-24072DC732B2}C:\users\trudy stewart\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\trudy stewart\program files\dna\btdna.exe | 
"UDP Query User{BC18183C-C5E0-4C98-9424-392DF3B91D2E}C:\users\trudy stewart\downloads\utorrent(2).exe" = protocol=17 | dir=in | app=c:\users\trudy stewart\downloads\utorrent(2).exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5
"{0D025345-1033-4F35-A5CE-68CDCDE6CC03}" = Evernote
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP560_series" = Canon MP560 series MP Drivers
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX700_series" = Canon MX700 series
"{11B83AD3-7A46-4C2E-A568-9505981D4C6F}" = HP Update
"{11BB336F-0E58-4977-B866-F24FA334616B}" = HP Active Support Library
"{11E568E0-3244-4BCB-875E-F334269DFDCB}" = iTunes
"{12A76360-388E-4B27-ABEB-D5FC5378DD2A}" = HPPhotoSmartPhotobookWebPack1
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EBA6E7C-3DF6-48AE-B87B-4CAFB2C1C3F7}" = LightScribe Template Labeler
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CACFCD9-F71B-413A-8DF5-1A6419D5CDC6}" = Cards_Calendar_OrderGift_DoMorePlugout
"{4CE8DF60-5468-4E0B-98EA-9F7169DC79D0}" = Transmute v1.10
"{4F41AD68-89F2-4262-A32C-2F70B01FCE9E}" = Photo Story 3 for Windows
"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
"{5B2029A4-1854-42BC-96B6-4ACE5F5414BD}" = ArtRage 2 Starter Edition
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{64FFDCF5-740E-ECA2-DAA2-2C9E190A7D88}" = Interior Designer 8
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}_is1" = Updater By SweetPacks 2.0.0.586
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A5F34E2-37CF-4AD4-808C-2D413786E31A}" = Microsoft Visual C Runtime
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ULTIMATER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ULTIMATER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ULTIMATER_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002E-0000-0000-0000000FF1CE}" = Microsoft Office Ultimate 2007
"{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{925F1DB6-E86E-4378-9091-D1F68B0583C9}" = iCloud
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9885A11E-60E4-417C-B58B-8B31B21C0B8A}" = HP Easy Setup - Frontend
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{A0087DDE-69D0-11E2-AD57-43CA6188709B}" = Adobe AIR
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.5
"{AFAD41A9-9687-48A3-848F-693C11451433}" = HP Customer Experience Enhancements
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B2F3DBD9-A9D2-4838-B45D-C917DAB32BC3}" = ScanSoft OmniPage SE 4
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C86B0A93-6134-462A-A510-A6ED6F043982}" = Picture Painter Home and Landscape
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}" = Presto! PageManager 7.15.16
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{DB9BF6DA-8030-4A21-9FF4-8856A7556FCF}" = ASPCA Reminder by We-Care.com v4.1.22.1
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E6CFBFB5-9232-410C-B353-AF6E614B2681}" = LightScribe System Software 1.10.16.1
"{E8C2622C-9FF1-4F60-8008-A0208154F9F3}" = muvee autoProducer 6.1
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F87A8E11-02A4-4875-A3A5-5961081B0E4E}" = OpenOffice.org 2.4
"{FC467B61-F890-4E29-8585-365DAB66F13E}" = Pure Networks Platform
"{FEF07CF4-5834-4AF1-9DEA-9EE94B53C6EB}" = PhotoS
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"Ace CD Burner" = Ace CD Burner
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.0
"avast" = avast! Free Antivirus
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Chasys Draw IES" = Chasys Draw IES 3.72.01
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Soft Data Fax Modem with SmartCP
"CoffeeCup HTML Editor 2008" = CoffeeCup HTML Editor 2008
"Color Style Studio_is1" = Color Style Studio 2.4
"ColorPic" = ColorPic
"Comodo Dragon" = Comodo Dragon
"Creative OEM005" = Monitor Webcam (SP2208WFP) Driver (1.00.08.0720) 
"doPDF 7 printer_is1" = doPDF 7.3 printer
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"FastStone Image Viewer" = FastStone Image Viewer 3.5
"Google Chrome" = Google Chrome
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"Image Mender" = Image Mender 1.22
"Inkscape" = Inkscape 0.46
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"LightBox Free Image Editor" = LightBox Free Image Editor
"Linksys Wireless Manager" = Linksys Wireless Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 21.0 (x86 en-US)" = Mozilla Firefox 21.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"NoteTab Light 7_is1" = NoteTab Light 7 (Remove only)
"NVIDIA Drivers" = NVIDIA Drivers
"Opera 12.15.1748" = Opera 12.15
"OsdMaestro" = HP On-Screen Cap/Num/Scroll Lock Indicator
"Photo Effect Studio_is1" = Photo Effect Studio 5.56
"Picasa 3" = Picasa 3
"Professor Answers" = Professor Answers
"Professor Teaches Windows Vista Premium" = Professor Teaches Windows Vista Premium
"RegCure" = RegCure 1.5.0.1
"Security Task Manager" = Security Task Manager 1.8g
"ULTIMATER" = Microsoft Office Ultimate 2007
"VLC media player" = VLC media player 2.0.6
"WinPcapInst" = WinPcap 4.0.2

< End of report >


----------



## kevinf80 (Mar 21, 2006)

What issues/concerns are remaining on your system, give me update please...


----------



## Trutalley (Mar 10, 2013)

Kevin, I wasn't sure this last post went thru. I was getting a redirect & didn't know if it was your site or my computer.
The ads are gone but sweetpacks is still in the address bar when I try to use bing and of course I am still getting the notice like I did before. Adware remove a lot of sweetpack redirects but this still remains. I cannot use a double click to open shortcuts but can with the right click to open. I think that is it. Sure is doing a lot better! Thanks again, Trudy


----------



## kevinf80 (Mar 21, 2006)

Run AdwCleaner off the delete tab option and post the log,


----------



## Trutalley (Mar 10, 2013)

Kevin, I rechecked my shortcuts right before running this and they are working with the left double click.
AdwCleaner shut the computer down and then showed notepad on startup. Bing worked in Mozilla on first and second search but on third and fourth I got the following. Hope this helps! Thanks, Trudy

third search
Ref A: 8c815bd0b2e24a0cb3d0e31ff0ce38fb Ref B: 072CD079B3CEEA5DE14DF284CA9049C6 Ref C: Wed Jul 03 15:33:29 2013 PST

fourth search

Ref A: a2a1dac9d19347f8a00c4c0cd23edf9a Ref B: 578805B3586D3D6E1D091584B376D619 Ref C: Wed Jul 03 15:33:46 2013 PST

# AdwCleaner v2.304 - Logfile created 07/03/2013 at 18:27:38
# Updated 03/07/2013 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Trudy Stewart - TRUDYSTEWART-PC
# Boot Mode : Normal
# Running from : C:\Users\Trudy Stewart\Desktop\AdwCleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\Program Files\jZip

***** [Registry] *****

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16490

[OK] Registry is clean.

-\\ Mozilla Firefox v21.0 (en-US)

File : C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\yoebz5b8.default-1357333329994\prefs.js

[OK] File is clean.

-\\ Google Chrome v27.0.1453.116

File : C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

-\\ Opera v12.15.1748.0

File : C:\Users\Trudy Stewart\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [18567 octets] - [18/06/2013 18:12:16]
AdwCleaner[R2].txt - [9765 octets] - [01/07/2013 09:22:08]
AdwCleaner[R3].txt - [9829 octets] - [01/07/2013 09:32:29]
AdwCleaner[R555].txt - [9829 octets] - [01/07/2013 09:33:20]
AdwCleaner[S1].txt - [19017 octets] - [18/06/2013 19:24:54]
AdwCleaner[S2].txt - [9802 octets] - [01/07/2013 09:34:02]
AdwCleaner[S3].txt - [1844 octets] - [03/07/2013 11:24:28]
AdwCleaner[S4].txt - [1464 octets] - [03/07/2013 18:27:38]

########## EOF - C:\AdwCleaner[S4].txt - [1524 octets] ##########


----------



## kevinf80 (Mar 21, 2006)

Can you tell me about the following entry:

SRV - [2013/06/04 10:58:48 | 002,095,752 | ---- | M] () [Auto | Running] -- C:\Program Files\Comodo\Dragon\dragon_updater.exe -- (DragonUpdater)

That entry automatically runs at boot so may influence your system, are you using that application?


----------



## Trutalley (Mar 10, 2013)

Kevin, I am running the comodo browser without using their secure DNS. I installed it after all my search engines went down. It installs with yahoo search. I installed 3 to 5 days ago. Trudy


----------



## kevinf80 (Mar 21, 2006)

Re-Run







by double left click, Vista and Widows 7 users accept UAC alert.


Under the







box at the bottom, paste in the following, start with and include the colon plus OTL . *:OTL*


```
:OTL
DRV - File not found [Kernel | Disabled | Stopped] -- -- (blbdrive)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}: C:\Program Files\Updater By SweetPacks\Firefox
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jin...ndows-i586.cab (Reg Error: Key error.)
Files::
C:\Program Files\Updater By SweetPacks
ipconfig /flushdns /c
:Commands
[emptytemp]
[CREATERESTOREPOINT]
```

Then click







button at the top
Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
Please post that log in your next reply.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.
If you are asked to reboot the machine choose *Yes*. In this case, after the reboot, open Notepad (Start > All Programs > Accessories > Notepad), click File > Open, in the File Name box enter **.log* and press the Enter key, navigate to the *C:\_OTL\MovedFiles folder*, and open the newest *.log* file present, and copy/paste the contents of that document back here in your next post.

Post that log, tell me how your system responds now, any issues or concerns...

Kevin


----------



## Trutalley (Mar 10, 2013)

Kevin, Here is the log. As far as the update bing is still 'not right'. More noticeable in firefox (on the first search). internet explorer, opera (my default browser is bing but is showing google search in the address bar and does not show bing in the search results). My changing to bing in the secondary box in opera has searched in bing(it is not showing as the default in the preferences page) Hmmm?

All processes killed
========== OTL ==========
Service blbdrive stopped successfully!
Service blbdrive deleted successfully!
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}\ not found.
File C:\Program Files\Updater By SweetPacks\Firefox not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
File ptytemp] not found.
File EATERESTOREPOINT] not found.

OTL by OldTimer - Version 3.2.69.0 log created on 07042013_155948

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


----------



## kevinf80 (Mar 21, 2006)

Regarding FireFox, do you have the *Navigation Toolbar* active? If so can you hit the dropdown and amend so Bing is active like attached image...

See if the following will work for IE....

Open Internet Explorer, Select > Tools > internet options > advanced > reset. Close IE.

Open Internet Explorer again, Select > Tools > Manage add-ons > search provider > does Bing show? if so select it then set as default...
Modify message


----------



## Trutalley (Mar 10, 2013)

Keven, I went thru each browser and reset as per instructions. Bing searches via sweetpaks gives me gibberish. I simply cannot use it in any browser. I wrote down each step and all browser have the same results. I can search with google, yahoo, etc., but not bing. Someone's out to do bing in? Trudy


----------



## Trutalley (Mar 10, 2013)

Kevin, I did some research on sweetpacks. Turns out it is a redirect/browser hijacker. This is one of the links.http://lp.sweetim.com/SweetPacksBundleUninstaller/

It gives uninstall on all sim components. I don't really know where we stand in the process but I can do this but I imagine because we have done so much damage there will be stuff missing. Thought it would be good to know. Trudyhttp://answers.microsoft.com/en-us/...ks-virus/80ddc7d4-fc68-4629-8857-df29e4737d2c


----------



## kevinf80 (Mar 21, 2006)

I thought we`d removed all sweetpack entries with AdwCleaner, OTL etc etc... I guess not.

OK we try again see if we can nail this PIA.... Go to the following link and follow the instructions:

http://malwaretips.com/blogs/remove-sweetpacks-toolbar/

Next,

Please download Junkware Removal tool from this link:
http://www.bleepingcomputer.com/download/junkware-removal-tool/
Save to your desktop.


*Shut down your Security Protection software now to avoid potential conflicts*.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator. Follow prompts as they come.
The tool will open and start scanning your system. (Press any key when prompted to continue)
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post JRT.txt to your next message.

Next,

Download *OTL* from any of the following links and save to your desktop.

http://itxassociates.com/OT-Tools/OTL.com
http://oldtimer.geekstogo.com/OTL.exe
http://www.itxassociates.com/OT-Tools/OTL.scr

Double click the OTL icon to start the tool. (Note: If you are running on Vista or Windows 7 accept UAC alert)


 When the window appears, underneath *Output* at the top, make sure *Standard output* is selected.
 Select *Scan all users*
Change *Drivers* to *All*
 Under the *Extra Registry* section, check *Use SafeList*
 In the lower right corner, checkmark *"LOP Check"* and checkmark *"Purity Check".*
 Click *Run Scan* and let the program run uninterrupted.
 When the scan is complete, two text files will be created on your Desktop.
 *OTL.Txt* <- this one will be opened
 *Extras.txt* <- this one will be minimized

Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of *OTL.Txt* and the *Extras.txt* in your next reply

Let me know how you get on with link instructions, post JRT and OTL log...

Kevin,


----------



## Trutalley (Mar 10, 2013)

Kevin, I followed the link you sent and followed the instructions. I had noticed two entries in internet explorer for bing search engines but no info was given to the side of it. I went to add/remove on my computer and found the sweetpack updater. I clicked to uninstall but it said it had been removed would i like to remove it from the list. i selected yes.

In Internet Explorer, settings i checked on the bing search engines and found not two but three entries, two of these were sweetpacksearch.com, i deleted both. still does a bing search from the omnibox thought it is set to use google for the omnibox, and a google icon is showing in the omnibox. when went to the internet options, under reset the internet explorer setting i checked delete personal setting and then clicked on reset. not only did it do that, i now have a 'new internet explorer 9'.
when i try to reset my search engine default google is not there. just bing and yahoo. bummer. aol is my homepage. when i try to click on the link to search for other search engines it goes to microsoft page ( very odd looking, took forever, assumed it was a redirect. tried to install another search engine but it did not show in downloads but showed on search engine list but not able to enable it).

Mozilla was easy and worked. Clicked on 'reset firefox' button from troubleshooting under the help section in the menu bar.

Chrome had 2 bing selections under settings. they were were sweetim.com and sweetsearch.com. deleted both, i had to look under default settings under open specific pages to find these. i rechecked my search engines and both entries for bing were gone, so no bing searches.ok for now, trudy

here are the logs. sorry otl is first

OTL logfile created on: 7/5/2013 2:10:45 PM - Run 5
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Trudy Stewart\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.56 Gb Available Physical Memory | 52.18% Memory free
6.20 Gb Paging File | 4.87 Gb Available in Paging File | 78.58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.49 Gb Total Space | 193.40 Gb Free Space | 67.04% Space Free | Partition Type: NTFS
Drive D: | 9.60 Gb Total Space | 1.28 Gb Free Space | 13.39% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 294.65 Gb Free Space | 98.84% Space Free | Partition Type: NTFS

Computer Name: TRUDYSTEWART-PC | User Name: Trudy Stewart | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/07/05 14:09:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Trudy Stewart\Desktop\OTL.scr
PRC - [2013/06/04 10:58:48 | 002,095,752 | ---- | M] () -- C:\Program Files\Comodo\Dragon\dragon_updater.exe
PRC - [2013/05/09 04:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe
PRC - [2011/11/11 14:08:06 | 000,205,336 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
PRC - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
PRC - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2009/04/11 02:28:10 | 000,019,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetsrv\w3wp.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/16 05:44:55 | 001,358,384 | R--- | M] (Linksys, LLC) -- C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
PRC - [2007/10/25 09:52:08 | 004,702,208 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/05/09 01:00:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM05Mon.exe
PRC - [2007/02/04 12:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
PRC - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Modules (No Company Name) ==========

MOD - [2012/10/11 21:56:46 | 000,087,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/10/11 21:56:22 | 001,242,512 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/11/11 14:09:20 | 000,336,408 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
MOD - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
MOD - [2011/08/12 12:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
MOD - [2010/05/07 18:37:40 | 000,126,808 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll
MOD - [2010/05/07 18:37:40 | 000,027,480 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll
MOD - [2010/05/07 18:36:54 | 000,340,824 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll
MOD - [2010/05/07 18:35:56 | 007,954,776 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll
MOD - [2010/05/07 18:35:44 | 002,143,576 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll
MOD - [2009/07/13 18:37:04 | 000,152,112 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll
MOD - [2009/07/13 18:37:04 | 000,098,304 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll
MOD - [2006/10/30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
MOD - [2006/09/20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe -- (RoxLiveShare9)
SRV - [2013/06/18 10:21:21 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/06/04 10:58:48 | 002,095,752 | ---- | M] () [Auto | Running] -- C:\Program Files\Comodo\Dragon\dragon_updater.exe -- (DragonUpdater)
SRV - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2009/07/07 15:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2009/04/11 02:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/11/06 16:22:26 | 000,092,792 | ---- | M] (CACE Technologies) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2006/11/02 08:36:18 | 000,029,696 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\iprip.dll -- (iprip)

========== Driver Services (All) ==========

DRV - [2013/06/27 20:58:10 | 000,770,344 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2013/06/27 20:58:10 | 000,369,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2013/06/27 20:58:10 | 000,175,176 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswVmm.sys -- (aswVmm)
DRV - [2013/05/09 04:59:10 | 000,056,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2013/05/09 04:59:10 | 000,049,376 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswRvrt.sys -- (aswRvrt)
DRV - [2013/05/09 04:59:09 | 000,066,336 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2013/05/09 04:59:09 | 000,049,760 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2013/05/09 04:59:08 | 000,029,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2013/05/08 00:37:21 | 000,905,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tcpip.sys -- (Tcpip6)
DRV - [2013/05/08 00:37:21 | 000,905,576 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\tcpip.sys -- (Tcpip)
DRV - [2013/04/15 10:20:04 | 000,638,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dxgkrnl.sys -- (DXGKrnl)
DRV - [2013/03/03 15:07:52 | 001,082,232 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\ntfs.sys -- (Ntfs)
DRV - [2012/08/21 13:01:22 | 000,026,840 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2012/08/21 07:47:42 | 000,224,640 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\volsnap.sys -- (volsnap)
DRV - [2012/07/25 23:39:21 | 000,526,952 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\Wdf01000.sys -- (Wdf01000)
DRV - [2012/07/25 22:33:43 | 000,066,560 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WUDFPf.sys -- (WudfPf)
DRV - [2012/07/25 22:32:51 | 000,155,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WUDFRd.sys -- (WUDFRd)
DRV - [2012/06/04 11:26:04 | 000,440,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ksecdd.sys -- (KSecDD)
DRV - [2012/05/01 10:03:49 | 000,180,736 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpwd.sys -- (RDPWD)
DRV - [2012/03/20 19:28:50 | 000,053,120 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\partmgr.sys -- (partmgr)
DRV - [2012/02/29 09:32:37 | 000,012,800 | ---- | M] (Microsoft Corporation) [Recognizer | System | Unknown] -- C:\Windows\System32\drivers\fs_rec.sys -- (Fs_Rec)
DRV - [2012/01/18 02:44:52 | 004,332,960 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUVC.sys -- (LVUVC)
DRV - [2012/01/18 02:44:28 | 000,312,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2012/01/18 02:44:14 | 000,022,176 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvbusflt.sys -- (CompFilter)
DRV - [2011/07/06 11:31:47 | 000,214,016 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mrxsmb10.sys -- (mrxsmb10)
DRV - [2011/04/29 09:25:10 | 000,146,432 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\srv2.sys -- (srv2)
DRV - [2011/04/29 09:25:09 | 000,102,400 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\srvnet.sys -- (srvnet)
DRV - [2011/04/29 09:24:42 | 000,079,872 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mrxsmb20.sys -- (mrxsmb20)
DRV - [2011/04/29 09:24:40 | 000,106,496 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mrxsmb.sys -- (mrxsmb)
DRV - [2011/04/21 09:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\afd.sys -- (AFD)
DRV - [2011/04/14 10:59:03 | 000,075,264 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\System32\drivers\dfsc.sys -- (DfsC)
DRV - [2011/03/30 23:54:32 | 001,073,216 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AE1200vista.sys -- (Linksys_adapter)
DRV - [2011/02/22 09:23:55 | 000,069,632 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\bowser.sys -- (bowser)
DRV - [2011/02/18 10:03:32 | 000,305,152 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\srv.sys -- (srv)
DRV - [2010/05/07 18:43:30 | 000,025,824 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2010/02/20 16:53:34 | 000,411,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\http.sys -- (HTTP)
DRV - [2010/02/18 07:28:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tunnel.sys -- (tunnel)
DRV - [2009/12/08 13:26:18 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tcpipreg.sys -- (tcpipreg)
DRV - [2009/07/07 15:48:44 | 000,027,696 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\purendis.sys -- (purendis)
DRV - [2009/07/07 15:48:44 | 000,026,672 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pnarp.sys -- (pnarp)
DRV - [2009/04/11 02:33:03 | 000,292,840 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\volmgrx.sys -- (volmgrx)
DRV - [2009/04/11 02:32:55 | 000,149,480 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pci.sys -- (pci)
DRV - [2009/04/11 02:32:52 | 000,053,224 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\termdd.sys -- (TermDD)
DRV - [2009/04/11 02:32:49 | 000,527,848 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ndis.sys -- (NDIS)
DRV - [2009/04/11 02:32:49 | 000,014,312 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pciide.sys -- (pciide)
DRV - [2009/04/11 02:32:46 | 000,265,688 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\acpi.sys -- (ACPI)
DRV - [2009/04/11 02:32:46 | 000,245,736 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\clfs.sys -- (CLFS)
DRV - [2009/04/11 02:32:46 | 000,190,424 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\fltMgr.sys -- (FltMgr)
DRV - [2009/04/11 02:32:46 | 000,161,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\msrpc.sys -- (MsRPC)
DRV - [2009/04/11 02:32:43 | 000,141,288 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ecache.sys -- (Ecache)
DRV - [2009/04/11 02:32:31 | 000,053,736 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\disk.sys -- (disk)
DRV - [2009/04/11 02:32:31 | 000,048,104 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\mup.sys -- (Mup)
DRV - [2009/04/11 02:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\atapi.sys -- (atapi)
DRV - [2009/04/11 00:46:40 | 000,069,120 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rassstp.sys -- (RasSstp)
DRV - [2009/04/11 00:46:32 | 000,121,344 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ndiswan.sys -- (NdisWan)
DRV - [2009/04/11 00:46:30 | 000,041,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\raspppoe.sys -- (RasPppoe)
DRV - [2009/04/11 00:45:56 | 000,072,192 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\tdx.sys -- (tdx)
DRV - [2009/04/11 00:45:51 | 000,072,192 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\pacer.sys -- (PSched)
DRV - [2009/04/11 00:45:37 | 000,185,856 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\netbt.sys -- (netbt)
DRV - [2009/04/11 00:45:22 | 000,066,560 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\smb.sys -- (Smb)
DRV - [2009/04/11 00:43:28 | 000,148,480 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nwifi.sys -- (NativeWifiP)
DRV - [2009/04/11 00:43:16 | 000,196,096 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbhub.sys -- (usbhub)
DRV - [2009/04/11 00:43:04 | 000,062,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ohci1394.sys -- (ohci1394)
DRV - [2009/04/11 00:42:55 | 000,065,536 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\USBSTOR.SYS -- (USBSTOR)
DRV - [2009/04/11 00:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio)
DRV - [2009/04/11 00:42:52 | 000,039,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbehci.sys -- (usbehci)
DRV - [2009/04/11 00:42:52 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbohci.sys -- (usbohci)
DRV - [2009/04/11 00:42:48 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hidusb.sys -- (HidUsb)
DRV - [2009/04/11 00:39:17 | 000,067,072 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\cdrom.sys -- (cdrom)
DRV - [2009/04/11 00:14:40 | 000,114,688 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mrxdav.sys -- (MRxDAV)
DRV - [2009/04/11 00:14:29 | 000,225,280 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\System32\drivers\rdbss.sys -- (rdbss)
DRV - [2009/04/11 00:14:01 | 000,035,328 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\System32\drivers\npfs.sys -- (Npfs)
DRV - [2009/04/11 00:13:59 | 000,226,816 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\udfs.sys -- (udfs)
DRV - [2009/04/11 00:13:53 | 000,136,704 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\exfat.sys -- (exfat)
DRV - [2009/04/11 00:13:52 | 000,142,848 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\fastfat.sys -- (fastfat)
DRV - [2009/02/11 12:38:14 | 002,324,512 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService)
DRV - [2008/12/04 09:17:15 | 000,645,120 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WUSB54GCv3.sys -- (WUSB54GCv3)
DRV - [2008/08/01 19:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008/05/08 05:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2008/05/08 05:04:16 | 000,661,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2008/05/08 05:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)
DRV - [2008/01/19 03:42:35 | 000,181,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\msiscsi.sys -- (iScsiPrt)
DRV - [2008/01/19 03:42:31 | 000,058,936 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\fileinfo.sys -- (FileInfo)
DRV - [2008/01/19 03:42:28 | 000,057,400 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\mountmgr.sys -- (MountMgr)
DRV - [2008/01/19 03:42:18 | 000,052,792 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\volmgr.sys -- (volmgr)
DRV - [2008/01/19 03:41:52 | 000,035,384 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\kbdclass.sys -- (kbdclass)
DRV - [2008/01/19 03:41:52 | 000,034,360 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\mouclass.sys -- (mouclass)
DRV - [2008/01/19 03:41:49 | 000,031,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mssmbios.sys -- (mssmbios)
DRV - [2008/01/19 03:41:30 | 000,021,048 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\spldr.sys -- (spldr)
DRV - [2008/01/19 03:41:14 | 000,016,440 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\msisadrv.sys -- (msisadrv)
DRV - [2008/01/19 03:41:14 | 000,015,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\swenum.sys -- (swenum)
DRV - [2008/01/19 02:14:40 | 000,018,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbprint.sys -- (usbprint)
DRV - [2008/01/19 02:14:10 | 000,009,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\serscan.sys -- (StillCam)
DRV - [2008/01/19 02:14:09 | 000,035,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbscan.sys -- (usbscan)
DRV - [2008/01/19 02:01:15 | 000,023,552 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tssecsrv.sys -- (tssecsrv)
DRV - [2008/01/19 02:01:09 | 000,006,144 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\RDPENCDD.sys -- (RDPENCDD)
DRV - [2008/01/19 02:01:08 | 000,029,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tdtcp.sys -- (TDTCP)
DRV - [2008/01/19 02:01:08 | 000,006,144 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\RDPCDD.sys -- (RDPCDD)
DRV - [2008/01/19 02:01:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tdpipe.sys -- (TDPIPE)
DRV - [2008/01/19 01:57:16 | 000,031,744 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\modem.sys -- (Modem)
DRV - [2008/01/19 01:57:15 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rootmdm.sys -- (ROOTMODEM)
DRV - [2008/01/19 01:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\ws2ifsl.sys -- (ws2ifsl)
DRV - [2008/01/19 01:56:34 | 000,076,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rasl2tp.sys -- (Rasl2tp)
DRV - [2008/01/19 01:56:34 | 000,062,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\raspptp.sys -- (PptpMiniport)
DRV - [2008/01/19 01:56:31 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\wanarp.sys -- (Wanarpv6)
DRV - [2008/01/19 01:56:31 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wanarp.sys -- (Wanarp)
DRV - [2008/01/19 01:56:31 | 000,011,776 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\rasacd.sys -- (RasAcd)
DRV - [2008/01/19 01:56:29 | 000,017,408 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\asyncmac.sys -- (AsyncMac)
DRV - [2008/01/19 01:56:28 | 000,100,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ipnat.sys -- (IPNAT)
DRV - [2008/01/19 01:56:28 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ndproxy.sys -- (NDProxy)
DRV - [2008/01/19 01:56:24 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ndistapi.sys -- (NdisTapi)
DRV - [2008/01/19 01:56:23 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ipfltdrv.sys -- (IpFilterDriver)
DRV - [2008/01/19 01:56:07 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\qwavedrv.sys -- (QWAVEdrv)
DRV - [2008/01/19 01:55:50 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\nsiproxy.sys -- (nsiproxy)
DRV - [2008/01/19 01:55:45 | 000,035,840 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\System32\drivers\netbios.sys -- (NetBIOS)
DRV - [2008/01/19 01:55:41 | 000,015,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\TUNMP.SYS -- (tunmp)
DRV - [2008/01/19 01:55:40 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ndisuio.sys -- (Ndisuio)
DRV - [2008/01/19 01:55:19 | 000,013,312 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\irenum.sys -- (IRENUM)
DRV - [2008/01/19 01:55:03 | 000,060,416 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rspndr.sys -- (rspndr)
DRV - [2008/01/19 01:55:03 | 000,047,104 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lltdio.sys -- (lltdio)
DRV - [2008/01/19 01:54:46 | 000,064,000 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mpsdrv.sys -- (mpsdrv)
DRV - [2008/01/19 01:53:40 | 000,034,816 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\umbus.sys -- (umbus)
DRV - [2008/01/19 01:53:38 | 000,134,016 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbvideo.sys -- (usbvideo)
DRV - [2008/01/19 01:53:29 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbccgp.sys -- (usbccgp)
DRV - [2008/01/19 01:53:16 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\drmkaud.sys -- (drmkaud)
DRV - [2008/01/19 01:52:19 | 000,041,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\monitor.sys -- (monitor)
DRV - [2008/01/19 01:52:06 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vga.sys -- (VgaSave)
DRV - [2008/01/19 01:49:20 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mskssrv.sys -- (MSKSSRV)
DRV - [2008/01/19 01:49:19 | 000,006,016 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mstee.sys -- (MSTEE)
DRV - [2008/01/19 01:49:18 | 000,054,784 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\i8042prt.sys -- (i8042prt)
DRV - [2008/01/19 01:49:18 | 000,005,888 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mspclock.sys -- (MSPCLOCK)
DRV - [2008/01/19 01:49:18 | 000,005,504 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mspqm.sys -- (MSPQM)
DRV - [2008/01/19 01:49:16 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sermouse.sys -- (sermouse)
DRV - [2008/01/19 01:49:16 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mouhid.sys -- (mouhid)
DRV - [2008/01/19 01:49:12 | 000,004,608 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\null.sys -- (Null)
DRV - [2008/01/19 01:49:10 | 000,006,144 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\beep.sys -- (Beep)
DRV - [2008/01/19 01:30:36 | 000,084,480 | ---- | M] (Microsoft Corporation) [File_System | Auto | Running] -- C:\Windows\System32\drivers\luafv.sys -- (luafv)
DRV - [2008/01/19 01:30:23 | 000,027,648 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\filetrace.sys -- (Filetrace)
DRV - [2008/01/19 01:28:09 | 000,022,528 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\Windows\System32\drivers\msfs.sys -- (Msfs)
DRV - [2008/01/19 01:28:02 | 000,070,144 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Running] -- C:\Windows\System32\drivers\cdfs.sys -- (cdfs)
DRV - [2008/01/19 01:27:21 | 000,040,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\processr.sys -- (Processor)
DRV - [2008/01/19 00:30:49 | 000,053,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007/11/06 16:22:06 | 000,034,064 | ---- | M] (CACE Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2007/10/26 07:51:22 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007/10/18 07:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/10/12 02:00:44 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/09/07 10:36:08 | 000,156,928 | ---- | M] (ViXS Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\xcbda.sys -- (xcbdaNtsc)
DRV - [2007/08/27 14:59:00 | 007,574,976 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/07/20 01:00:00 | 000,235,616 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vid.sys -- (OEM05Vid)
DRV - [2007/06/08 01:00:02 | 000,141,376 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\OEM05Afx.sys -- (OEM05Afx)
DRV - [2007/04/11 15:33:06 | 000,079,376 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2007/04/11 15:32:58 | 000,036,112 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007/04/11 15:32:52 | 000,034,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2007/04/11 15:32:38 | 000,063,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2007/04/11 15:32:30 | 000,020,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2007/03/05 18:45:04 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM05Vfx.sys -- (OEM05Vfx)
DRV - [2007/01/18 11:24:58 | 000,026,496 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RimSerial.sys -- (RimVSerPort)
DRV - [2007/01/01 10:07:44 | 000,013,312 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sffdisk.sys -- (sffdisk)
DRV - [2007/01/01 10:07:44 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sffp_sd.sys -- (sffp_sd)
DRV - [2007/01/01 10:07:44 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sffp_mmc.sys -- (sffp_mmc)
DRV - [2006/11/02 05:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 05:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 05:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 05:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 05:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 05:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\iaStorV.sys -- (iaStorV)
DRV - [2006/11/02 05:51:12 | 000,167,528 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\pcmcia.sys -- (pcmcia)
DRV - [2006/11/02 05:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 05:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 05:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 05:50:40 | 000,106,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NV_AGP.SYS -- (nv_agp)
DRV - [2006/11/02 05:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 05:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 05:50:24 | 000,047,208 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\isapnp.sys -- (isapnp)
DRV - [2006/11/02 05:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 05:50:17 | 000,080,488 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\msdsm.sys -- (msdsm)
DRV - [2006/11/02 05:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 05:50:16 | 000,078,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\mpio.sys -- (mpio)
DRV - [2006/11/02 05:50:16 | 000,076,392 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sbp2port.sys -- (sbp2port)
DRV - [2006/11/02 05:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 05:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 05:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 05:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 05:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 05:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 05:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\HpCISSs.sys -- (HpCISSs)
DRV - [2006/11/02 05:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 05:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 05:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 05:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 05:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 05:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 05:50:04 | 000,058,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\GAGP30KX.SYS -- (gagp30kx)
DRV - [2006/11/02 05:50:04 | 000,058,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ULIAGPKX.SYS -- (uliagpkx)
DRV - [2006/11/02 05:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 05:49:59 | 000,056,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\UAGP35.SYS -- (uagp35)
DRV - [2006/11/02 05:49:59 | 000,054,888 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AMDAGP.SYS -- (amdagp)
DRV - [2006/11/02 05:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\Mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 05:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 05:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 05:49:52 | 000,054,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VIAAGP.SYS -- (viaagp)
DRV - [2006/11/02 05:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGP440.sys -- (agp440)
DRV - [2006/11/02 05:49:51 | 000,053,352 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SISAGP.SYS -- (sisagp)
DRV - [2006/11/02 05:49:49 | 000,027,752 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\i2omp.sys -- (i2omp)
DRV - [2006/11/02 05:49:44 | 000,023,144 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\msahci.sys -- (msahci)
DRV - [2006/11/02 05:49:43 | 000,022,632 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\crcdisk.sys -- (crcdisk)
DRV - [2006/11/02 05:49:38 | 000,019,560 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\wd.sys -- (Wd)
DRV - [2006/11/02 05:49:32 | 000,018,280 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\compbatt.sys -- (Compbatt)
DRV - [2006/11/02 05:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 05:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 05:49:26 | 000,015,464 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\amdide.sys -- (amdide)
DRV - [2006/11/02 05:49:24 | 000,014,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\intelide.sys -- (intelide)
DRV - [2006/11/02 05:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 05:04:35 | 000,878,080 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\PEAuth.sys -- (PEAUTH)
DRV - [2006/11/02 05:03:00 | 000,242,688 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\rdpdr.sys -- (rdpdr)
DRV - [2006/11/02 04:55:23 | 000,039,936 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\bthmodem.sys -- (BTHMODEM)
DRV - [2006/11/02 04:55:22 | 000,029,184 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\hidbth.sys -- (HidBth)
DRV - [2006/11/02 04:55:09 | 000,068,608 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\usbcir.sys -- (usbcir)
DRV - [2006/11/02 04:55:08 | 000,035,328 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\circlass.sys -- (circlass)
DRV - [2006/11/02 04:55:05 | 000,022,528 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\usbuhci.sys -- (usbuhci)
DRV - [2006/11/02 04:55:01 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\hidir.sys -- (HidIr)
DRV - [2006/11/02 04:53:56 | 000,026,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vgapnp.sys -- (vga)
DRV - [2006/11/02 04:52:52 | 000,020,608 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\wacompen.sys -- (WacomPen)
DRV - [2006/11/02 04:51:40 | 000,013,312 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sfloppy.sys -- (sfloppy)
DRV - [2006/11/02 04:51:33 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\fdc.sys -- (fdc)
DRV - [2006/11/02 04:51:32 | 000,020,480 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\flpydisk.sys -- (flpydisk)
DRV - [2006/11/02 04:51:30 | 000,083,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2006/11/02 04:51:30 | 000,079,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\parport.sys -- (Parport)
DRV - [2006/11/02 04:51:25 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\serenum.sys -- (Serenum)
DRV - [2006/11/02 04:51:23 | 000,008,704 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\parvdm.sys -- (Parvdm)
DRV - [2006/11/02 04:51:12 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\kbdhid.sys -- (kbdhid)
DRV - [2006/11/02 04:42:03 | 000,065,536 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\IPMIDrv.sys -- (IPMIDRV)
DRV - [2006/11/02 04:35:03 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\wmiacpi.sys -- (WmiAcpi)
DRV - [2006/11/02 04:30:19 | 000,039,424 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\viac7.sys -- (ViaC7)
DRV - [2006/11/02 04:30:18 | 000,040,960 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\amdk8.sys -- (AmdK8)
DRV - [2006/11/02 04:30:18 | 000,039,424 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\intelppm.sys -- (intelppm)
DRV - [2006/11/02 04:30:18 | 000,038,912 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\crusoe.sys -- (Crusoe)
DRV - [2006/11/02 04:30:18 | 000,038,912 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\amdk7.sys -- (AmdK7)
DRV - [2006/11/02 04:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\BrSerId.sys -- (Brserid)
DRV - [2006/11/02 04:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BrUsbSer.sys -- (BrUsbSer)
DRV - [2006/11/02 04:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BrFiltUp.sys -- (BrFiltUp)
DRV - [2006/11/02 04:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BrFiltLo.sys -- (BrFiltLo)
DRV - [2006/11/02 04:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\BrSerWdm.sys -- (BrSerWdm)
DRV - [2006/11/02 04:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\BrUsbMdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 03:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 03:36:49 | 000,235,520 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\HdAudio.sys -- (HdAudAddService)
DRV - [2006/11/02 03:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60)
DRV - [2006/11/02 03:10:22 | 000,002,864 | ---- | M] (Microsoft Corporation) [Adapter | On_Demand | Unknown] -- C:\Windows\System32\WINSOCK.DLL -- (Winsock)
DRV - [2006/11/02 02:37:21 | 000,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\secdrv.sys -- (secdrv)
DRV - [2006/06/19 10:26:58 | 000,012,672 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\mdmxsdk.sys -- (mdmxsdk)
DRV - [2005/12/12 13:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{11D231C8-2FE5-4B8A-B2F9-B1736520C7A2}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/05/27 18:14:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/06/12 20:46:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/07/02 22:46:56 | 000,000,000 | ---D | M]

[2008/09/08 20:54:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Extensions
[2013/06/20 13:58:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/06/12 20:46:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/06/12 20:46:17 | 000,000,000 | ---D | M] (The Browser Highlighter) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/07/05 13:37:25 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.116\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll
CHR - plugin: Java Deployment Toolkit 7.0.210.11 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - Extension: Envelopes for Google Docs = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaclkeicedlkpjgnnfkedjomkkhmgcod\2_0\
CHR - Extension: Floorplanner = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\abopacaefhbognnmeigicfpgnmpideag\13_0\
CHR - Extension: I Dream of Greenie = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\abpplimpipkdhcobigmhmmjpmmkjneod\0.2_0\
CHR - Extension: Prezi = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\acoonfmhnndodekhecidldfdjgooefpg\1.3_0\
CHR - Extension: Task Timer = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\aomfjmibjhhfdenfkpaodhnlhkolngif\3.9.1_0\
CHR - Extension: Lucidchart: Diagramming = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\apboafhkiegglekeafbckfjldecefkhn\16_0\
CHR - Extension: Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: Loupe Collage = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhaonknplhhecdgjpphnooeomecgipkc\3.0.0_0\
CHR - Extension: Print this page with CleanPrint = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\biafepndnnahkfldhobcjlclklffkibe\4.7.0_0\
CHR - Extension: YouTube = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: HelloFax: 50 Free Fax Pages = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\bocmleclimfnadgmcdgecijlblfcmfnm\1.12_0\
CHR - Extension: Facebook = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\boeajhmfdjldchidhphikilcgdacljfm\1.0.3_0\
CHR - Extension: Revision3 = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\cncldpggpcpckadjcholildoahcgbmfo\1_0\
CHR - Extension: Sumo Paint = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpgjihldbpodlmnjolekemlfbcajnmod\3.7_0\
CHR - Extension: Easy Clock = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\dplbpgapoedppajbikieafefmcceaagn\9.0.6_0\
CHR - Extension: Gravity = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\eboilkbecbgepecmaaicggbpnlbcfagj\1_0\
CHR - Extension: Facebook Disconnect = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpepffjfmamnambagiibghpglaidiec\1.3.0_0\
CHR - Extension: Stupeflix Video Maker = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkdmcfnoimoilncpjchamnenebopocem\1.5_0\
CHR - Extension: Springpad = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkmopoamfjnmppabeaphohombnjcjgla\6_0\
CHR - Extension: EasyDrop = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\flogpfmjdekjoilcnmmchanikomlidie\1.3.0_0\
CHR - Extension: DocuSign = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\goblijolcnempeilmnkmfbhohlpngemd\2.1.0.0_0\
CHR - Extension: Drive Notepad = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpgjomejfimnbmobcocilppikhncegaj\1.2_0\
CHR - Extension: Gradient Creator! = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcplneddoadgichngfbobgpllfphdfla\0.2.1.3_0\
CHR - Extension: Vector Paint = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnbpdiengicdefcjecjbnjnoifekhgdo\3.2.0.0_0\
CHR - Extension: Pixlr Editor = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmaknaampgiegkcjlimdiidlhopknpk\1.2_0\
CHR - Extension: Knok | Home exchange = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iehdddmijbgofffjjmhkodckmnombhmf\3.1_0\
CHR - Extension: Sync SugarSync, Evernote, and Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifanaabofjmgladnlbckonoiohpmchik\1.2.4.2_0\
CHR - Extension: Pixorial Video = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ilbibicalpgnmbjnganinjppjephokai\1.0.3_0\
CHR - Extension: Sync Dropbox, Evernote, and Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iobcbdgacfkninlcbphihhdlkobkehia\1.2.4.2_0\
CHR - Extension: Dropbox = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioekoebejdcmnlefjiknokhhafglcjdl\3.0.6_0\
CHR - Extension: Save this page with CleanSave = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\iplagehfoafmmjppeijnpkohihcllici\4.7.0_0\
CHR - Extension: Free Online PDF Tools = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jddfpnmfhodaljeelokfceepbeapgbdn\1.0.1.2_0\
CHR - Extension: Roomstyler 3D planner = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfnniehafojoidolddmhfnpnbiolbppi\2.5_0\
CHR - Extension: Autodesk Homestyler = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdmmkfaghgcicheaimnpffeeekheafkb\2.3_0\
CHR - Extension: eBay Extension for Google Chrome\u2122 (by eBay) = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khhckppjhonfmcpegdjdibmngahahhck\1.6.13_0\
CHR - Extension: HuffingtonPost NewsGlide = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khjialelnkjdomiblmnpcpjongleegef\0.3.2_0\
CHR - Extension: WordPress.com = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\khjnjifipfkgglficmipimgjpbmlbemd\1.1.1_0\
CHR - Extension: Magisto for Google Drive = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\kinnlbfbjboagbejldhemnifjepmkakj\1.0.4_0\
CHR - Extension: CanvasDraw = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\knfimpamngmggpbamfoomdpebdoleghe\2_0\
CHR - Extension: DriveTunes = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\labgcacinobdnkfndodfkfeabbjckbnj\3.2.4_0\
CHR - Extension: Evernote Web = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol\1.0.7_0\
CHR - Extension: Sketchpad = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkllajgbhondgjjnhmmgbjndmogapinp\1.0.0.4_0\
CHR - Extension: Spanning Backup for Google Apps\u2122 = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lniahgcddkbgipmbmlhjpoafdeephgcf\3.0.1.3_0\
CHR - Extension: Word\u00B2 = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpibnckjjeaabeepofhfmmpjmnomohee\2.5_0\
CHR - Extension: Quick Note = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\mijlebbfndhelmdpmllgcfadlkankhok\1.5.0_0\
CHR - Extension: Free Online PDF Unlocker = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkdknbehfogkgogcennnagfokmnimpab\1.0.1.1_0\
CHR - Extension: deviantART muro = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\namljbfbglehfnlonjmebceimaalofei\1.0_0\
CHR - Extension: InspirARTion = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhbmpilemgmpbdaniehhmodkkppkelec\10_0\
CHR - Extension: Pinterest Keyboard Shortcut | Ctrl+Alt+P = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\npbcjndbpajikchenclendcojmaeaphh\1.2.2_0\
CHR - Extension: Google Chrome to Phone Extension = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oadboiipflhobonjjffjbfekfjcgkhco\2.3.1_0\
CHR - Extension: Todo.ly = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhefmbclkekanpjjpkbciloojcmpkap\2_0\
CHR - Extension: Bolt Save and Share = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofmipocdiiichlijcngflajilbpkkfhj\7.2_0\
CHR - Extension: Photo Collage = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiabhgfgfhoilflkoicbmnejgjjfmhcg\1_0\
CHR - Extension: WeVideo - Video Editor = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\okgjbfikepgflmlelgfgecmgjnmnmnnb\3.1.0_0\
CHR - Extension: Picasa = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb\6.2.2_0\
CHR - Extension: Diigo Web Collector - Capture and Annotate = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\oojbgadfejifecebmdnhhkbhdjaphole\2.1.10_0\
CHR - Extension: Click&Clean App = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdabfienifkbhoihedcgeogidfmibmhp\8.0_0\
CHR - Extension: Outlook.com = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfpeapihoiogbcmdmnibeplnikfnhoge\1.0.2_0\
CHR - Extension: Evernote Web Clipper = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc\5.9.18_0\
CHR - Extension: Gmail = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Balsamiq Mockups = C:\Users\Trudy Stewart\AppData\Local\Google\Chrome\User Data\Default\Extensions\pplbmgaodhjmbklkgkgmlghaekcfhhkk\1.9_0\

O1 HOSTS File: ([2013/02/02 00:35:03 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (jZip Webmail plugin) - {647FD14A-C4F1-46F4-8FC3-0B40F54226F7} - C:\Program Files\jZip\WebmailPlugin.dll (Discordia Limited)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Linksys Wireless Manager] C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe (Linksys, LLC)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OEM05Mon.exe] C:\Windows\OEM05Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateReg] C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000..\Run: [B7456CF5EF0D0980D92DD0562D346087910D60E2._service_run] C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{36937FF7-1F22-4576-8665-B5965D4D3BCC}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BBDB5DE6-583B-4601-A391-1DC2D9542FFD}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/01/01 10:56:33 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/07/05 14:09:06 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Trudy Stewart\Desktop\OTL.scr
[2013/07/05 12:33:19 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Roaming\InstallShield
[2013/07/03 11:32:59 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Trudy Stewart\Desktop\JRT.exe
[2013/07/03 11:32:32 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\Desktop\downloads
[2013/07/03 10:49:27 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Trudy Stewart\Desktop\OTL.exe
[2013/07/01 20:34:13 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Local\Comodo
[2013/07/01 20:34:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
[2013/07/01 20:34:09 | 000,047,368 | ---- | C] (COMODO CA Limited) -- C:\Windows\System32\certsentry.dll
[2013/07/01 20:33:58 | 000,000,000 | ---D | C] -- C:\Program Files\Comodo
[2013/07/01 10:18:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/07/01 10:18:27 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013/07/01 10:18:27 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013/06/30 02:05:20 | 000,000,000 | ---D | C] -- C:\Windows\Microsoft Antimalware
[2013/06/28 08:03:37 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Roaming\PowerISO
[2013/06/28 01:33:09 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ace CD Burner
[2013/06/28 01:33:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ace CD Burner
[2013/06/28 01:33:08 | 001,703,936 | ---- | C] (NCT Company) -- C:\Windows\System32\NCTAudioFile.dll
[2013/06/28 01:33:08 | 000,892,928 | ---- | C] (NCT Company) -- C:\Windows\System32\NCTAudioInformation.dll
[2013/06/28 01:33:08 | 000,274,432 | ---- | C] (NCT Company) -- C:\Windows\System32\NCTAudioPlayer.dll
[2013/06/28 01:33:07 | 001,388,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00F
[2013/06/28 01:33:07 | 000,589,824 | ---- | C] (NuMedia Soft, Inc.) -- C:\Windows\System32\DVDRProX.dll
[2013/06/28 01:33:07 | 000,380,928 | ---- | C] (NUGROOVZ) -- C:\Windows\System32\CDRipperX.ocx
[2013/06/28 01:33:06 | 000,073,785 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00E
[2013/06/28 01:33:06 | 000,000,000 | ---D | C] -- C:\Program Files\Ace CD Burner
[2013/06/28 01:31:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\We-Care Reminder
[2013/06/28 01:28:04 | 000,000,000 | ---D | C] -- C:\Windows\System32\jmdp
[2013/06/28 01:28:04 | 000,000,000 | ---D | C] -- C:\Windows\System32\ARFC
[2013/06/20 13:58:36 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/06/19 21:40:33 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/06/19 21:40:09 | 000,000,000 | ---D | C] -- C:\JRT
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/06/19 12:34:21 | 000,000,000 | ---D | C] -- C:\Users\Trudy Stewart\AppData\Local\temp
[2013/06/19 12:33:38 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/06/19 12:10:01 | 005,081,021 | R--- | C] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/18 19:09:10 | 000,000,000 | ---D | C] -- C:\FRST
[2013/06/15 21:27:20 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan
[2013/06/15 21:27:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
[2013/06/15 21:27:12 | 000,000,000 | ---D | C] -- C:\Program Files\Security Task Manager
[2013/06/13 08:35:00 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/06/13 08:34:58 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013/06/13 08:34:58 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013/06/13 08:34:57 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013/06/13 08:34:57 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013/06/13 08:34:55 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013/06/13 08:34:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013/06/13 08:34:53 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013/06/12 20:46:12 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/06/12 11:15:02 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printcom.dll
[2013/06/12 11:14:58 | 000,812,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certutil.exe
[2013/06/12 11:14:57 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certenc.dll
[2013/06/12 11:14:50 | 003,603,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013/06/12 11:14:49 | 003,551,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013/06/12 11:14:40 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cryptdlg.dll
[2012/10/28 22:15:21 | 011,881,936 | ---- | C] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Users\Trudy Stewart\gosetup.exe

========== Files - Modified Within 30 Days ==========

[2013/07/05 14:09:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Trudy Stewart\Desktop\OTL.scr
[2013/07/05 14:01:19 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Trudy Stewart\Desktop\JRT.exe
[2013/07/05 13:37:49 | 000,000,832 | ---- | M] () -- C:\Users\Trudy Stewart\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/07/05 13:37:33 | 000,000,808 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/07/05 13:36:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/07/05 12:43:19 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/07/05 12:43:19 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/07/05 11:36:00 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/07/05 08:43:43 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2013/07/05 08:43:43 | 000,000,454 | ---- | M] () -- C:\Windows\tasks\RegCure Program Check.job
[2013/07/05 08:43:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/07/05 08:43:09 | 3219,656,704 | -HS- | M] () -- C:\hiberfil.sys
[2013/07/03 18:28:04 | 000,000,410 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013/07/03 11:18:30 | 000,650,027 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\AdwCleaner.exe
[2013/07/03 10:49:27 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Trudy Stewart\Desktop\OTL.exe
[2013/07/01 20:34:13 | 000,000,871 | ---- | M] () -- C:\Users\Public\Desktop\Comodo Dragon.lnk
[2013/07/01 20:34:09 | 000,047,368 | ---- | M] (COMODO CA Limited) -- C:\Windows\System32\certsentry.dll
[2013/07/01 10:18:28 | 000,000,868 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/07/01 10:09:32 | 000,000,571 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\rkill (1) - Shortcut.lnk
[2013/07/01 10:08:46 | 000,000,581 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\RogueKiller - Shortcut.lnk
[2013/06/30 18:45:26 | 000,001,325 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\tdsskiller - Shortcut.lnk
[2013/06/29 20:06:56 | 000,634,834 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/06/29 20:06:56 | 000,112,596 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/06/28 01:33:09 | 000,001,687 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Ace CD Burner.lnk
[2013/06/28 01:31:58 | 000,033,958 | ---- | M] () -- C:\ProgramData\uninstaller.exe
[2013/06/27 20:58:10 | 000,770,344 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2013/06/27 20:58:10 | 000,369,584 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2013/06/27 20:58:10 | 000,175,176 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/06/27 20:58:10 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys.sum
[2013/06/27 20:58:10 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswSP.sys.sum
[2013/06/27 20:58:10 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswSnx.sys.sum
[2013/06/20 14:41:24 | 000,001,933 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/06/19 14:29:01 | 000,000,911 | ---- | M] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/19 12:10:07 | 005,081,021 | R--- | M] (Swearware) -- C:\Users\Trudy Stewart\Desktop\herewego.exe
[2013/06/11 18:39:35 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013/06/11 18:39:35 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

========== Files Created - No Company Name ==========

[2013/07/03 11:18:30 | 000,650,027 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\AdwCleaner.exe
[2013/07/01 20:34:13 | 000,000,871 | ---- | C] () -- C:\Users\Public\Desktop\Comodo Dragon.lnk
[2013/07/01 10:18:28 | 000,000,868 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/07/01 10:09:32 | 000,000,571 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\rkill (1) - Shortcut.lnk
[2013/07/01 10:08:46 | 000,000,581 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\RogueKiller - Shortcut.lnk
[2013/06/30 18:44:06 | 000,001,325 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\tdsskiller - Shortcut.lnk
[2013/06/28 01:33:09 | 000,001,687 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Ace CD Burner.lnk
[2013/06/28 01:31:58 | 000,033,958 | ---- | C] () -- C:\ProgramData\uninstaller.exe
[2013/06/27 20:58:10 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys.sum
[2013/06/26 17:22:47 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswSP.sys.sum
[2013/06/26 17:22:47 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswSnx.sys.sum
[2013/06/19 14:29:01 | 000,000,911 | ---- | C] () -- C:\Users\Trudy Stewart\Desktop\Internet Explorer.lnk
[2013/06/18 19:26:02 | 000,000,410 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013/05/22 11:21:06 | 004,325,376 | ---- | C] () -- C:\ProgramData\ReadOnlyInstaller.msi
[2013/04/14 20:49:34 | 000,175,176 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/04/14 20:49:34 | 000,049,376 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013/02/02 00:21:01 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/02/02 00:21:01 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/02/02 00:21:01 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/02/02 00:21:01 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/02/02 00:21:01 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/05/29 13:08:18 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2012/03/31 21:41:09 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012/01/18 02:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2012/01/18 02:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2012/01/18 02:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2011/11/16 21:40:38 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2011/08/12 12:20:14 | 000,015,896 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
[2010/05/07 07:07:08 | 000,000,760 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\setup_ldm.iss
[2010/04/07 12:31:26 | 000,000,000 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\prvlcl.dat
[2009/12/09 22:32:11 | 008,892,928 | ---- | C] () -- C:\ProgramData\atscie.msi
[2009/03/24 22:26:10 | 000,000,050 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-recent-projects.properties
[2009/03/24 22:21:47 | 000,000,745 | ---- | C] () -- C:\Users\Trudy Stewart\.jalbum-defaults.jap
[2008/12/28 17:31:28 | 000,031,232 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/11/16 00:46:07 | 000,000,138 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Roaming\wklnhst.dat
[2008/07/21 16:40:25 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat
[2008/05/20 03:12:40 | 000,001,356 | ---- | C] () -- C:\Users\Trudy Stewart\AppData\Local\d3d9caps.dat

========== ZeroAccess Check ==========

[2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 02:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 02:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2009/04/09 02:14:12 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Ambient Design
[2009/03/28 10:48:26 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Artisteer
[2010/02/26 11:39:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Canon
[2008/09/13 12:52:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/07/21 14:45:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Conceiva
[2009/03/28 22:50:52 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Darq Software
[2013/02/18 15:36:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\DeskSoft
[2012/03/22 16:15:59 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Dropbox
[2008/07/07 15:29:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Individual Software
[2013/07/01 16:37:04 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Inkscape
[2009/03/28 13:18:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Interior Designer 8.0
[2012/05/29 17:50:58 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\IrfanView
[2012/05/13 12:44:02 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Leadertech
[2012/05/29 13:24:23 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MAGIX
[2010/06/27 15:30:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\MSNInstaller
[2009/03/27 18:55:21 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NewSoft
[2013/02/01 22:47:11 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\NoteTab Light
[2012/03/31 21:23:28 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Opera
[2010/05/29 18:59:53 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoFiltre
[2010/05/29 19:02:39 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PhotoScape
[2013/06/28 08:03:37 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\PowerISO
[2013/04/02 15:29:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\QuickScan
[2008/05/25 20:11:49 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\ScanSoft
[2008/09/15 22:05:44 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Snapfish
[2013/05/01 20:37:05 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Softland
[2009/04/07 03:05:46 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\stickies
[2008/11/16 00:46:07 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\Template
[2009/03/29 03:17:47 | 000,000,000 | ---D | M] -- C:\Users\Trudy Stewart\AppData\Roaming\uTorrent

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 284 bytes -> C:\Windows\System32\´ý:@kpctlsp.log
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMPFC5A2B2

< End of report >
OTL Extras logfile created on: 7/5/2013 2:10:45 PM - Run 5
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Trudy Stewart\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.56 Gb Available Physical Memory | 52.18% Memory free
6.20 Gb Paging File | 4.87 Gb Available in Paging File | 78.58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.49 Gb Total Space | 193.40 Gb Free Space | 67.04% Space Free | Partition Type: NTFS
Drive D: | 9.60 Gb Total Space | 1.28 Gb Free Space | 13.39% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 294.65 Gb Free Space | 98.84% Space Free | Partition Type: NTFS

Computer Name: TRUDYSTEWART-PC | User Name: Trudy Stewart | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

[HKEY_USERS\S-1-5-21-3524870626-1478210970-89139702-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [Browse with FastStone] -- "C:\Program Files\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 1
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2B5C102A-2F85-41AA-A0DF-4B29849F1245}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=file and printer sharing (spooler service - rpc-epmap) | 
"{2F8DB637-6B0D-47A0-9779-9D3A28000669}" = lport=138 | protocol=17 | dir=in | app=system | 
"{37D77BC9-B345-400F-963A-3AE039A87527}" = lport=137 | protocol=17 | dir=in | app=system | 
"{5857283E-65FE-433A-AA8A-84EC1C967C72}" = lport=445 | protocol=6 | dir=in | app=system | 
"{7E9AA345-DD13-4172-B2AE-AFB5A3A79C31}" = rport=138 | protocol=17 | dir=out | app=system | 
"{A6EDA168-7252-4309-93B7-C22BC789A93C}" = rport=139 | protocol=6 | dir=out | app=system | 
"{C048FD24-BF27-47A3-BF19-30FE2D3A540E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=c:\windows\system32\spoolsv.exe | 
"{DD3EDD64-4C09-4020-999F-31C2ED524F61}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E49EDD1E-78E2-4BBD-BE4D-917B73C1B873}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{E5410391-24C8-44F6-B630-1D36463A3F68}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service | 
"{EF3C7162-07F8-439B-965B-7974F7FD5F30}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{F5A7E1B9-A236-416C-BA82-DD6F662FED52}" = rport=445 | protocol=6 | dir=out | app=system | 
"{FC7DDDB3-A87C-4671-9614-6700B8024D70}" = rport=137 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{171E2811-FE90-4898-A588-A4A344BB0EF7}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{1AF0C643-52C5-4AFD-9A0E-C372A869C9D3}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{230C5A4B-8073-440C-BFC2-C1231154FFFC}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"{2C002230-3129-49C4-8EDB-16F4059AB82A}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{32309D6F-37A6-4894-9184-2A2BB65A1AC7}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{3AD88B88-0F09-4AE0-8A39-DEDAF4EDF7FA}" = protocol=58 | dir=out | name=file and printer sharing (echo request - icmpv6-out) | 
"{48E260AC-7936-4505-A4F4-16706633FA19}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{52D9830E-4EA8-4923-A9DA-4FBFB957E73D}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{53FA3C26-2526-48D6-B015-DCA1735BC32A}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"{6E3F040F-4892-431B-ADF5-5E92216256AE}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{6E8CE4C0-7EF4-4BE8-9263-D00418994111}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{77C78FA5-4509-4EA6-8064-DE6C4F371E5F}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{96BC3B3D-6A6B-4AA8-8D38-2C976D36345F}" = protocol=6 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | 
"{98005BA6-FB48-4ED9-9092-853A1A82C900}" = protocol=6 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | 
"{A019144C-6701-47F4-8B94-B2B1973F5674}" = protocol=17 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | 
"{A6435162-E89E-4887-982C-97CBB197A9B4}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{A849F0F0-629E-4BF4-8269-C3BE016C6B27}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{AB5E8326-A88B-4508-8390-8A43F93BE7A3}" = protocol=6 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe | 
"{AD5DC11A-066E-48FB-8C72-166ED69E1643}" = protocol=6 | dir=in | app=c:\program files\citrix\gotomypc\g2svc.exe | 
"{B96003ED-7A2F-4EA8-ACD8-F86672A91C8E}" = protocol=1 | dir=out | name=file and printer sharing (echo request - icmpv4-out) | 
"{BB588A75-248E-4231-884E-ED327DB03632}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{C2AB2EE1-1F83-4DC2-AAE3-C703152D49ED}" = protocol=17 | dir=in | app=c:\program files\citrix\gotomypc\g2svc.exe | 
"{C921D61F-94B3-4C9B-8DF5-15F814B5B74C}" = protocol=17 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | 
"{CA4760A8-5A45-4CE0-B434-42D8BE9E391F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{E073820C-F42B-454F-880A-45EB992DE92B}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{E13D43B0-EF0E-4B2E-9E8A-531CFE1A7EFB}" = protocol=58 | dir=in | name=file and printer sharing (echo request - icmpv6-in) | 
"{E4D8E406-9641-4595-AB6B-ECF0F569965A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{E6566B50-34F0-442F-9181-E8C5661521FE}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{E6A1E825-52EF-44A3-B50F-4637047C65EA}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe | 
"{EC1E3A28-96F7-449C-B7A6-5D75B539BB40}" = protocol=17 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe | 
"{F15D811C-BBF5-4F1A-8406-BFFB34757AE2}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe | 
"{F814EDF0-6FDA-4AD7-B646-4E345C8978D9}" = protocol=1 | dir=in | name=file and printer sharing (echo request - icmpv4-in) | 
"{FD3D8681-159C-4D93-9432-8566477A54DD}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"TCP Query User{12C7280E-FAD3-4684-9FFF-4A9E2643749C}C:\program files\oneeko\oneeko.exe" = protocol=6 | dir=in | app=c:\program files\oneeko\oneeko.exe | 
"TCP Query User{53D78474-D07F-4CEF-B4FF-845EB4543393}C:\program files\oneeko\oneeko.exe" = protocol=6 | dir=in | app=c:\program files\oneeko\oneeko.exe | 
"TCP Query User{CAB5F08C-B19D-471E-B475-2E69B9E8107E}C:\users\trudy stewart\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\trudy stewart\program files\dna\btdna.exe | 
"TCP Query User{E1B16E35-B279-41D4-9C13-CBE4ECFB2092}C:\users\trudy stewart\downloads\utorrent(2).exe" = protocol=6 | dir=in | app=c:\users\trudy stewart\downloads\utorrent(2).exe | 
"TCP Query User{EC751BFB-C7F3-4593-97A9-69563F5AB2E8}C:\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe | 
"UDP Query User{13817C37-6C0B-4474-8095-4D16A7B732C2}C:\program files\oneeko\oneeko.exe" = protocol=17 | dir=in | app=c:\program files\oneeko\oneeko.exe | 
"UDP Query User{3D19ED8B-5CA5-452D-B163-5057F98F636E}C:\program files\oneeko\oneeko.exe" = protocol=17 | dir=in | app=c:\program files\oneeko\oneeko.exe | 
"UDP Query User{623451B8-D177-45AD-A1D8-97536D4C3B9C}C:\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe | 
"UDP Query User{A8424EB2-1B9F-4747-BA13-24072DC732B2}C:\users\trudy stewart\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\trudy stewart\program files\dna\btdna.exe | 
"UDP Query User{BC18183C-C5E0-4C98-9424-392DF3B91D2E}C:\users\trudy stewart\downloads\utorrent(2).exe" = protocol=17 | dir=in | app=c:\users\trudy stewart\downloads\utorrent(2).exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5
"{0D025345-1033-4F35-A5CE-68CDCDE6CC03}" = Evernote
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP560_series" = Canon MP560 series MP Drivers
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX700_series" = Canon MX700 series
"{11B83AD3-7A46-4C2E-A568-9505981D4C6F}" = HP Update
"{11BB336F-0E58-4977-B866-F24FA334616B}" = HP Active Support Library
"{11E568E0-3244-4BCB-875E-F334269DFDCB}" = iTunes
"{12A76360-388E-4B27-ABEB-D5FC5378DD2A}" = HPPhotoSmartPhotobookWebPack1
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EBA6E7C-3DF6-48AE-B87B-4CAFB2C1C3F7}" = LightScribe Template Labeler
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CACFCD9-F71B-413A-8DF5-1A6419D5CDC6}" = Cards_Calendar_OrderGift_DoMorePlugout
"{4CE8DF60-5468-4E0B-98EA-9F7169DC79D0}" = Transmute v1.10
"{4F41AD68-89F2-4262-A32C-2F70B01FCE9E}" = Photo Story 3 for Windows
"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
"{5B2029A4-1854-42BC-96B6-4ACE5F5414BD}" = ArtRage 2 Starter Edition
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{64FFDCF5-740E-ECA2-DAA2-2C9E190A7D88}" = Interior Designer 8
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A5F34E2-37CF-4AD4-808C-2D413786E31A}" = Microsoft Visual C Runtime
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ULTIMATER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ULTIMATER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ULTIMATER_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002E-0000-0000-0000000FF1CE}" = Microsoft Office Ultimate 2007
"{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{925F1DB6-E86E-4378-9091-D1F68B0583C9}" = iCloud
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9885A11E-60E4-417C-B58B-8B31B21C0B8A}" = HP Easy Setup - Frontend
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{A0087DDE-69D0-11E2-AD57-43CA6188709B}" = Adobe AIR
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.5
"{AFAD41A9-9687-48A3-848F-693C11451433}" = HP Customer Experience Enhancements
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B2F3DBD9-A9D2-4838-B45D-C917DAB32BC3}" = ScanSoft OmniPage SE 4
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C86B0A93-6134-462A-A510-A6ED6F043982}" = Picture Painter Home and Landscape
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}" = Presto! PageManager 7.15.16
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{DB9BF6DA-8030-4A21-9FF4-8856A7556FCF}" = ASPCA Reminder by We-Care.com v4.1.22.1
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E6CFBFB5-9232-410C-B353-AF6E614B2681}" = LightScribe System Software 1.10.16.1
"{E8C2622C-9FF1-4F60-8008-A0208154F9F3}" = muvee autoProducer 6.1
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F87A8E11-02A4-4875-A3A5-5961081B0E4E}" = OpenOffice.org 2.4
"{FC467B61-F890-4E29-8585-365DAB66F13E}" = Pure Networks Platform
"{FEF07CF4-5834-4AF1-9DEA-9EE94B53C6EB}" = PhotoS
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"Ace CD Burner" = Ace CD Burner
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.0
"avast" = avast! Free Antivirus
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Chasys Draw IES" = Chasys Draw IES 3.72.01
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Soft Data Fax Modem with SmartCP
"CoffeeCup HTML Editor 2008" = CoffeeCup HTML Editor 2008
"Color Style Studio_is1" = Color Style Studio 2.4
"ColorPic" = ColorPic
"Comodo Dragon" = Comodo Dragon
"Creative OEM005" = Monitor Webcam (SP2208WFP) Driver (1.00.08.0720) 
"doPDF 7 printer_is1" = doPDF 7.3 printer
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"FastStone Image Viewer" = FastStone Image Viewer 3.5
"Google Chrome" = Google Chrome
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"Image Mender" = Image Mender 1.22
"Inkscape" = Inkscape 0.46
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"LightBox Free Image Editor" = LightBox Free Image Editor
"Linksys Wireless Manager" = Linksys Wireless Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 22.0 (x86 en-US)" = Mozilla Firefox 22.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"NoteTab Light 7_is1" = NoteTab Light 7 (Remove only)
"NVIDIA Drivers" = NVIDIA Drivers
"Opera 12.15.1748" = Opera 12.15
"OsdMaestro" = HP On-Screen Cap/Num/Scroll Lock Indicator
"Photo Effect Studio_is1" = Photo Effect Studio 5.56
"Picasa 3" = Picasa 3
"Professor Answers" = Professor Answers
"Professor Teaches Windows Vista Premium" = Professor Teaches Windows Vista Premium
"RegCure" = RegCure 1.5.0.1
"Security Task Manager" = Security Task Manager 1.8g
"ULTIMATER" = Microsoft Office Ultimate 2007
"VLC media player" = VLC media player 2.0.6
"WinPcapInst" = WinPcap 4.0.2

< End of report >

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Trudy Stewart on Fri 07/05/2013 at 14:03:22.26
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-3524870626-1478210970-89139702-1000\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 07/05/2013 at 14:06:25.90
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


----------



## kevinf80 (Mar 21, 2006)

Those logs look good, dont see any issues. Do you have any remaining concerns...


----------



## Trutalley (Mar 10, 2013)

Kevin, I was still having issues with chrome & after finding what I thought was the problem(setting>on start up>open specific set of pages. this showed bing and charter.net. i tried to remove, bing showed in task manager for chrome but could not be deleted. hmmmm. set open to the new tab page: closed, reopened chrome several times, still showing bing and in a different tab, charter.net same problem before we ran OTL and JRT. I gave up chrome>settings>users>remove all users.
who knew?resets chrome to default. I thought that went away with 'options' in previous chrome versions.

I made Internet Explorer my default browser.

Let me know of your suggestions and what else I need to do. Thanks again! Trudy


----------



## kevinf80 (Mar 21, 2006)

Hiya Trudy,

Apologies I missed that issue, I don`t use Chrome myself so only have limited knowledge, Do the following:

Close all instances of Chrome, Next, select > open > in the search box type *Folder Options* hit enter key > In the new window select the *View* tab.

Scroll to *Hidden files and folder* select > *Show hidden files, folders and drives* select *apply* then *OK*

Close that window, now select > start > computer > C:\ > Users > Your Username > Appdata> Local > Google > Chrome > User Data. Right click on *Default* folder and select *Rename* change name to *Default.reset* click anywhere away from rename box to close.

Reopen Chrome and you`ll find it changed back to Default settings, Is that what you wanted? Let me know if any other issues/concerns remain.

Kevin


----------



## Trutalley (Mar 10, 2013)

Kevin, Thanks for the info & all the help. THANKS AGAIN!! Trudy


----------



## kevinf80 (Mar 21, 2006)

Hiya Trudy,

what is the status of your system now, do you have any remaining issues or concerns, if none are you ready to clean up....?

Kevin..


----------



## Trutalley (Mar 10, 2013)

Kevin, Sorry to say sweetpaks is back in google chrome. went to manage browsers. Lots of selection including bing. two of the entries were sweetpacksearch.com. I deleted both. Followed your instructions but computer would not allow changes once I got into the user data file. Of course I am the administrator but that was a no go. I did get the hidden files shown. Any other suggestions? Trudy


----------



## Trutalley (Mar 10, 2013)

Kevin, I shut down the computer, it is giving me a pop up box saying scheduled tasks failed to initialize. After the shutdown I logged back on and sweetpacks was back in chrome. deleted all bing searches. shut down, logged on opened chrome, went to settings, manage search engines. all sweetpacks is gone. this is exactly what i had to do in internet explorer. that doesn't mean it isn't still dormant. Must be updating at bing search? So there ya go!


----------



## kevinf80 (Mar 21, 2006)

The only option I suggest is to totally UNinstall Chrome, go here https://support.google.com/chrome/answer/95319?hl=en-GB select the removal option for Windows, also select the "Also delete your browsing data" tick box.

When that is complete re-boot, then navigate start > computer > C:\ > User > Username > Appdata> Local > inside that folder delete *Google* folder, re-boot...

Reinstall Chrome if you need/want it...


----------



## Trutalley (Mar 10, 2013)

Kevin, I have unistalled Chrome. No need to reinstall. Everything else looks good. Thanks, ready to cleanup, Trudy


----------



## kevinf80 (Mar 21, 2006)

Ok do the following Trudy,

Remove Combofix now that we're done with it

Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")









 Please follow the prompts to uninstall Combofix.
 You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.
The above procedure will delete the following:

 ComboFix and its associated files and folders.
 VundoFix backups, if present
 The C:_OtMoveIt folder, if present
 Reset the clock settings.
 Hide file extensions, if required.
 Hide System/Hidden files, if required.
 Reset System Restore.

*It is very important that you get a successful uninstall because of the extra functions done at the same time, let me know if this does not happen.*

If Combofix /Uninstall command does not work d/l Combofix again and save to Desktop from here:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Then run the /Uninstall command again.

Next,


Download OTC by OldTimer from here http://oldtimer.geekstogo.com/OTC.exe or here http://www.itxassociates.com/OT-Tools/OTC.exe and save to your Desktop.
Double click







icon to start the program. 
If you are using Vista or Windows 7 accept UAC
Then Click the big







button.
You will get a prompt saying "_Begining Cleanup Process_". Please select *Yes*.
Restart your computer when prompted.
This will remove tools we have used and itself.

If any of the remaining tools are left on the Desktop or C:\Users\Trudy Stewart\Downloads folder delete them..

*Rkill
RogueKiller
RK_Quarantine folder
FSS
FRST*

Also Navigate start > computer > expand C:\ > delete any of the following if present:

*TDSSKiller
JRT
FRST*

Next,

Uninstall adwcleaner.exe

 Please close all open programs and internet browsers.
 Double click on adwcleaner.exe to run the tool.
 Click on *Uninstall*
 Click *Yes* at *Would you like to Uninstall Adwcleaner*

Let me know if the above complete ok, also tell me if I missed anything or you have any remaining issues or concerns...

Thank you,

Kevin....


----------



## Trutalley (Mar 10, 2013)

Kevin, Everything uninstalled, no problems. I did deletes from the search box by typing in each program name. In searching my temp file I found 'shortcut_sweetpacks0613, modified on 6/28/13, application, 7966KB. At the same time I found OTL shortcut uninstaller, application 1KB. Found lots of wmplog00-05, SQM file 2KB for each time, starting 6/24-7/5, daily. What do I do with these? Everything is going a long as it should, nice to have my computer back! Thanks sooooooo much, Trudy


----------



## kevinf80 (Mar 21, 2006)

If you find any shortcuts to OTL they should not go anywhere, click on the shortcut and see what reply you get. Or just delete it.

Regarding temporary files, maybe run a temp file cleaner to keep the rubbish down..

Download and install CCleaner from here:

http://www.piriform.com/ccleaner/builds Ensure to select Slim version so nothing extra comes bundled...

Then select the items you wish to clean up.

*In the Windows Tab*:


 * Clean all entries in the "Internet Explorer" section except Cookies if you want to keep those.*
 *Clean all the entries in the "Windows Explorer" section.*
 *Clean all entries in the "System" section.*
 *Clean all entries in the "Advanced" section.*
 *Clean any others that you choose.*
 *Make sure "Wipe free space" is unticked, this will dramatically increase scan time if selected.*

*In the Applications Tab*: 

 *Clean all except cookies in the Firefox/Mozilla section if you use it.*
 *Clean all in the Opera section if you use it.*
 *Clean Sun Java in the Internet Section.*
 *Clean any others that you choose.* 

4. Click the "*Run Cleaner*" button.
5. A pop up box will appear advising this process will permanently delete files from your system.
6. Click "*OK*" and it will scan and clean your system.
7. Click "*exit*" when done.

CCleaner is an excellent Utility and well worth keeping, bottom left hand corner of main interface is link "Online Help" use that link to get the full instructions for this very handy application.

Any other issues/concerns...


----------



## Trutalley (Mar 10, 2013)

Kevin, Ran CC Cleaner & everything looks perfect. All Good! Thanks again, Trudy


----------



## kevinf80 (Mar 21, 2006)

Good to hear Trudy, If all is ok with no issues here are some tips to reduce the potential for malware infection in the future:

*Make proper use of your antivirus and firewall*

Antivirus and Firewall programs are integral to your computer security. However, just having them installed isn't enough. The definitions of these programs are frequently updated to detect the latest malware, if you don't keep up with these updates then you'll be vulnerable to infection. Many antivirus and firewall programs have automatic update features, make use of those if you can. If your program doesn't, then get in the habit of routinely performing manual updates, because it's important.

You should keep your antivirus and firewall guard enabled at all times, *NEVER* turn them off unless there's a specific reason to do so. Also, regularly performing a full system scan with your antivirus program is a good idea to make sure you're system remains clean. Once a week should be adequate. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.

Install and use WinPatrol from here http://www.winpatrol.com/download.html This will inform you of any attempted unauthorized changes to your system.

WinPatrol features explained here http://www.winpatrol.com/features.html

Go here http://www.filehippo.com/updatechecker/ run the FileHippo Update Checker, update all applications as suggested by the Update Checker. Ignore any *Beta* updates. (Use stand alone version, not a full install)
If Java or Adobe are updated please check under Start > Control Panel > Add/Remove Programs, ensure any old versions are removed. *<--- Very important*

*Use a safer web browser*

Internet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a few good free alternatives:

FireFox http://www.mozilla.com/en-US/,

Opera http://www.opera.com/, and

Chrome http://www.google.com/chrome.

All of these are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial here http://www.bleepingcomputer.com/tutorials/tutorial102.html which will help you to make IE *MUCH* safer.

These *browser add-ons* will help to make your browser safer:

*Web of Trust* warns you about risky websites that try to scam visitors, deliver malware or send spam. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous ones:

Available for *Firefox* and *Internet Explorer*.

*Green* to go, 
*Yellow* for caution, and 
*Red* to stop.

Available for *Firefox* only. *NoScript* helps to block malicious scripts and in general gives you much better control over what types of things webpages can do to your computer while you're browsing.

These are just a couple of the most popular add-ons, if you're interested in more, take a look at this article: 
http://browsers.about.com/od/addonsplugi2/tp/browser_security_privacy.htm

Here a couple of links by two security experts that will give some excellent tips and advice.

So how did I get infected in the first place by Tony Klein from here: http://www.spywareinfoforum.com/index.php?/topic/60955-so-how-did-i-get-infected-in-the-first-place/

How to prevent Malware by Miekiemoes from here: http://users.telenet.be/bluepatchy/miekiemoes/prevention.html

Finally this link http://www.geekstogo.com/forum/topic/38-free-antivirus-and-antispyware-software will give a comprehensive upto date list of free Security programs. To include - Antivirus, Antispyware, Firewall, Antimalware, Online scanners and rescue CD`s.

Don`t forget, the best form of defense is common sense. If you don`t recognize it, don`t open it. If something looks to good to be true, then it aint.

If all ok hit the "Mark Solved" tab at the top of the thread to close out..

Take care,

Kevin


----------



## Trutalley (Mar 10, 2013)

Kevin, Sad to say this redirect is back in Mozilla. Whenever I search from the omnibox it searches with bing, again. I do not have bing enabled anywhere. I did as you suggested and ran the updater from filehippo. With the first recommended update from their site I noticed supicious behavior from my computer(blinking screen). I opened internet explorer it notified me that conduit was trying to change my default browser and my startup. I denied the changes. Internet explorer is ok. But I went thru each browser I found I could not search from the omnibox without a redirect from my google to bing. I kept getting a redirect to a captcha screen. This was the same screen as before. I think this may be in my startup since we removed everything else. I now have a lot of temporary files again. The bottom of the bing captcha screen says it is powered by conduit. There is a conduit toolbar entry in my add remove. I removed it. This did not get rid of it. This is that very odd behavior. Any suggestions, Trudy


----------



## kevinf80 (Mar 21, 2006)

You have to make sure no extra unwanted extras come bundled with any free update form all sources, it is very easy to miss a ticked box offering unwanted toolbars etc.

Run Firefox, select tools > addons > extensions > check and remove any unwanted entries. Do exactly the same from tools > addons > plugins. Also again from tools > addons > services.

When that is complete shutdown Firefox. run the following:

download Junkware Removal tool from this link:
http://www.bleepingcomputer.com/download/junkware-removal-tool/
Save to your desktop.


*Shut down your Security Protection software now to avoid potential conflicts*.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator. Follow prompts as they come.
The tool will open and start scanning your system. (Press any key when prompted to continue)
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.Next,
Post JRT.txt to your next message.

Post that log, Also re-run Firefox and see how it responds...


----------



## Trutalley (Mar 10, 2013)

Kevin, Firefox is doing ok. There was nothing to uninstall in addons or extensions. Below is the JRT log. I did check before I did the bit torrent update and saw nothing, not in the add ons or in the agreement terms?
I updated itunes also but same thing there. I'll do better but am a bit concerned about updating at this time. Perhaps the application's home site would be better than filehippo?

Thanks.....Again! Trudy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.0.0 (07.08.2013:4)
OS: Windows Vista (TM) Home Premium x86
Ran by Trudy Stewart on Mon 07/08/2013 at 18:33:45.44
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services
Failed to stop: [Service] ibupdaterservice

~~~ Registry Values

~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\im
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\iminstaller
Successfully deleted: [Registry Key] C:\Users\TRUDYS~1\AppData\Local\Temp\jrt\temp\regheur.txt

~~~ Files
Failed to delete: [File] "C:\Windows\system32\dmwu.exe"

~~~ Folders

~~~ FireFox
Successfully deleted: [File] C:\Users\Trudy Stewart\AppData\Roaming\mozilla\firefox\profiles\z6p4sma3.default-1373045683582\searchplugins\conduit.xml
Successfully deleted the following from C:\Users\Trudy Stewart\AppData\Roaming\mozilla\firefox\profiles\z6p4sma3.default-1373045683582\prefs.js
user_pref("CT3225826.smartbar.homepage", "true");
user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3225826&CUI=UN51822094029262912&UM=2&SearchSource=13&UP=SP7EB5D2EA-4BC6-44B3-ACF7-07559C312C46");
user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
user_pref("browser.search.defaultthis.engineName", "BitTorrentControl_v12 Customized Web Search");
user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3225826&CUI=UN51822094029262912&UM=2&SearchSource=3&q={searchTerms}");
user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3225826&SearchSource=2&CUI=UN51822094029262912&UM=2&q=");
user_pref("smartbar.addressBarOwnerCTID", "CT3225826");
user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3225826&CUI=UN51822094029262912&UM=2&SearchSource=13,hxxp://search.conduit.com/?ctid=CT3225826&CUI
user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3225826&SearchSource=2&CUI=UN51822094029262912&UM=2&q=");
user_pref("smartbar.defaultSearchOwnerCTID", "CT3225826");
user_pref("smartbar.homePageOwnerCTID", "CT3225826");

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 07/08/2013 at 18:36:43.46
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


----------



## Trutalley (Mar 10, 2013)

forgot to mention there is also a security task manager by neuber software in the temp folder installed 6/15.
also an ib updater service insalled 7/7. don't know about these 2 ibupdater is also in add/remove.


----------



## kevinf80 (Mar 21, 2006)

Hiya Trudy,

JRT has removed a lot of dross which is good, it does miss one entry *C:\Windows\system32\dmwu.exe* as far as I know this related to or part of Incredimail or IncrediBar adware/toolbar.

I see you mention updating BitTorrent, mmm I usually make no comments on P2P software, I just do not help with it. P2P software has the ability to transfer lots of infection over the internet, not recommended for casual use...

Maybe best to run Malwarebytes again, see if this flags anything for us, also maybe OTL for a good look again, is that ok for you, is late for me nearly 12:30 am..

Open Malwarebytes, check for updates then run Quick scan. Full instructions follow if Malwarebytes is not installed:

Download Malwarebytes from one of the following links and save it to your desktop.:

http://www.malwarebytes.org/mbam.php 
http://www.softpedia.com/get/Antivirus/Malwarebytes-Anti-Malware.shtml
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html

Double Click mbam-setup.exe to install the application.

 Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
 If an update is found, it will download and install the latest version.
 Once the program has loaded, select "Perform Quick Scan", then click Scan.
 The scan may take some time to finish,so please be patient.
 When the scan is complete, click OK, then Show Results to view the results.
 Make sure that everything is checked, and click Remove Selected.
 When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
 Please save the log to a location you will remember.
 The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
 Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Next,

Download *OTL* from any of the following links and save to your desktop.

http://itxassociates.com/OT-Tools/OTL.com
http://oldtimer.geekstogo.com/OTL.exe
http://www.itxassociates.com/OT-Tools/OTL.scr

Double click the OTL icon to start the tool. (Note: If you are running on Vista or Windows 7 accept UAC alert)


 When the window appears, underneath *Output* at the top, make sure *Standard output* is selected.
 Select *Scan all users*
Change *Drivers* to *All*
 Under the *Extra Registry* section, check *Use SafeList*
 In the lower right corner, checkmark *"LOP Check"* and checkmark *"Purity Check".*
 Click *Run Scan* and let the program run uninterrupted.
 When the scan is complete, two text files will be created on your Desktop.
 *OTL.Txt* <- this one will be opened
 *Extras.txt* <- this one will be minimized

Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of *OTL.Txt* and the *Extras.txt* in your next reply.

Kevin...


----------



## Trutalley (Mar 10, 2013)

Tomorrow is fine, I uninstalled bit torrent
I don't remember ever putting it on my computer but file hippo updater caught it as needing an update. Get some rest, Trudy


----------



## kevinf80 (Mar 21, 2006)

Yes FileHippo Update Checker does look at all software and recommend updates as required, if you have software that is not used is always best to uninstall and remove it...


----------



## Trutalley (Mar 10, 2013)

Kevin, I have tried several times to send the logs you requested but have been unable to do so? Trudy


----------



## kevinf80 (Mar 21, 2006)

Can you zip the files up and attach them?


----------



## Trutalley (Mar 10, 2013)

Kevin, Ok have zipped folders. how do i send without email? 7zip wouldn't open. missing from add/remove yet showing as my default. Downloaded b1 and have files zipped on my desktop. Do i email them? Trudy


----------



## kevinf80 (Mar 21, 2006)

Zipping is straightforward, right click on the file > select > send to > compressed (zipped) folder. That will be saved in same place as file.
Open Reply in your thread, not quick reply. Below the main reply box is "Manage attachments" tab. Select that. New window opens, select "Browse" navigate to to the zip folder, open, then upload. When complete hit "Close window" zip file will be attached to your reply. If you want to add another file or zip folder use "Browse" again before close window and repeat..

does that help..


----------



## Trutalley (Mar 10, 2013)

Kevin, Sorry I missed the manage attachments button. Ok following directions, must be doing something wrong. file is saved to desktop. zipped file is saved to desktop. 

Selecting manage attachments tab. select browse to navigate to the zip folder, select folder, click open, then click upload. Tried to do 3 at a time and one at a time. When I hit close window the zip window does not go?

aaaargh!


----------



## Trutalley (Mar 10, 2013)

Ok, There it is . I thought it would show while I was working on it. duuuuhhh Will try again


----------



## Trutalley (Mar 10, 2013)

Try again,


----------



## kevinf80 (Mar 21, 2006)

I see Malwarebytes dealt with the elusive file, ok continue as follows...

Re-Run







by double left click, Vista and Widows 7 users accept UAC alert.


Under the







box at the bottom, paste in the following, start with and include the colon plus OTL . *:OTL*


```
:OTL
[2008/09/08 20:54:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Extensions
[2013/07/07 20:36:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\z6p4sma3.default-1373045683582\extensions
[2013/07/09 13:31:58 | 000,002,100 | ---- | M] () -- C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\z6p4sma3.default-1373045683582\searchplugins\MyStart.xml
[2013/06/20 13:58:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/06/12 20:46:17 | 000,000,000 | ---D | M] (The Browser Highlighter) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2013/06/12 20:46:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
@Alternate Data Stream - 284 bytes -> C:\Windows\System32\´ý:@kpctlsp.log
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:DFC5A2B2
:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BitTorrent\bittorrent.exe"=-
:Files
ipconfig /flushdns /c
C:\Users\Trudy Stewart\AppData\Roaming\BitTorrent
C:\Program Files\Security Task Manager
C:\Windows\tasks\RegCure Program Check.job
C:\ProgramData\uninstaller.exe
:Commands
[emptytemp]
[CREATERESTOREPOINT]
```

Then click







button at the top
Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
Please post that log in your next reply.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.
If you are asked to reboot the machine choose *Yes*. In this case, after the reboot, open Notepad (Start > All Programs > Accessories > Notepad), click File > Open, in the File Name box enter **.log* and press the Enter key, navigate to the *C:\_OTL\MovedFiles folder*, and open the newest *.log* file present, and copy/paste the contents of that document back here in your next post.

Post that log, let me know if you have any remaining issues or concerns...


----------



## Trutalley (Mar 10, 2013)

Kevin, There was a file not removed, odd one?

All processes killed
========== OTL ==========
C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Extensions folder moved successfully.
C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\z6p4sma3.default-1373045683582\extensions folder moved successfully.
C:\Users\Trudy Stewart\AppData\Roaming\Mozilla\Firefox\Profiles\z6p4sma3.default-1373045683582\searchplugins\MyStart.xml moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\locale folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome\content folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\packages folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\downloads folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\components folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\upgraderLang.zh-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\upgraderLang.pl-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\upgraderLang.nl-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\upgraderLang.it-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\upgraderLang.fr-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\upgraderLang.es-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\upgraderLang.de-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\upgraderLang-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.zh-1\skype folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.zh-1\compare folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.zh-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.pl-1\skype folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.pl-1\compare folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.pl-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.nl-1\skype folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.nl-1\compare folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.nl-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.it-1\skype folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.it-1\compare folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.it-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.fr-1\skype folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.fr-1\compare folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.fr-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.es-1\skype folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.es-1\compare folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.es-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.de-1\skype folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.de-1\compare folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang.de-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang-1\skype folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang-1\compare folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\tbhLang-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\compareLang.zh-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\compareLang.pl-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\compareLang.nl-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\compareLang.it-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\compareLang.fr-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\compareLang.es-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\compareLang.de-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content\compareLang-1 folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim\content folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome\shim folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected]\chrome folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[email protected] folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions folder moved successfully.
Folder C:\Program Files\Mozilla Firefox\extensions\brow[email protected]\ not found.
C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} folder moved successfully.
C:\Program Files\Mozilla Firefox\browser\extensions folder moved successfully.
Unable to delete ADS C:\Windows\System32\待: @k pctlsp.log .
ADS C:\ProgramData\TEMPFC5A2B2 deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\BitTorrent\bittorrent.exe deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Trudy Stewart\Desktop\cmd.bat deleted successfully.
C:\Users\Trudy Stewart\Desktop\cmd.txt deleted successfully.
File\Folder C:\Users\Trudy Stewart\AppData\Roaming\BitTorrent not found.
C:\Program Files\Security Task Manager folder moved successfully.
C:\Windows\tasks\RegCure Program Check.job moved successfully.
C:\ProgramData\uninstaller.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Trudy Stewart
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 17641246 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 41834581 bytes
->Opera cache emptied: 240 bytes
->Flash cache emptied: 738 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 35031607 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 747591 bytes

Total Files Cleaned = 91.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 07102013_205044

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Hope this goes!


----------



## kevinf80 (Mar 21, 2006)

I`m not not too concerned about that ads file, run your system for 24 hours or so and see how it goes. Post back when your ready let me know if still ok or return of any issues/concerns..

Kevin


----------



## Trutalley (Mar 10, 2013)

Kevin, Wanted to touch base with an update. Everything seemed to be working just fine but I found when I tried to update any of my programs I found that the sweetpacks went active again. I checked with each download, unchecked boxes, declined all "extras" that were offered, read the entire agreement box. However with each update sweetpacks installed. I did a little search on my computer and found some interesting sweetpack alias entries. I reran the programs you had recommended. Adware could not find C://User settings. Other than that things looked cleaned. The computer seems normal so I think we are OK. Thanks again for all your help and education! Trudy


----------

