# Solved: I lose my flash player when I restart my PC



## superfrog25 (Mar 25, 2011)

I hope someone can help. I keep having issues with Adobe flash player 11.7.I have installed it and uninstalled it a number of times and each time it installs and states I have installed successfully and each time I reboot I lose it.The icon in the control panel is white and not the adobe symbol.This suggests to me it hasnt been installed correctly but I follow all the instructions to the letter. 

I always save first then wait for it to initialize before running.I have tried running as an administrator and that doesnt work I have had to reset firefox on a number of occasions too. I am running O/S windows 7 and my browsers are Firefox and IE. It seems there are 2 different versions of flash for Firefox and IE but I have checked and I am downloading the correct version.

If you do know how to resolve please reply back in simple terms and instructions as I am simple when it comes to PC's!!

Some suggest disabling Mcafee which is great but Im not sure how I do this..they never say how!!

Thanks in hope someone out there isnt as clueless as me!!

Chris


----------



## Phantom010 (Mar 9, 2009)

Uninstall it again using the *Flash Uninstaller*.

Then, download the installer (.exe) from *HERE*. Close your browser and run the installation.


----------



## Mark1956 (May 7, 2011)

It could be your security software that is causing a problem, but to tell you how to disable it I need to know what version you have, the full name and version number.

Please also run this so I can see what security software you have and if any other updates are required.

Download Security Check by screen317 from Here or Here.
Save it to your Desktop.
Double click SecurityCheck.exe (Vista or Windows 7 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.
A Notepad document should open automatically called checkup.txt; please Copy & Paste the contents of that document into your next reply.


----------



## superfrog25 (Mar 25, 2011)

Hi Phantom,

I followed your advice,unfortunately as before I have flash player until I reboot and then I lose it on restart.I also have to reset firefox as this stops responding when I try to access a site that uses flash

Thanks for trying though,anything else you can think of??

Chris


----------



## Phantom010 (Mar 9, 2009)

If you follow Mark1956's instructions, he might be on to something.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

The download went to my downloads folder and I couldnt save to the desktop.I pressed the any button (Space bar) and it completed a check, then the notepad came up eventually and stated the below ;

Results of screen317's Security Check version 0.99.64 
Windows 7 Service Pack 1 x64 (UAC is enabled) 
Internet Explorer 10 
*``````````````Antivirus/Firewall Check:``````````````* 
Windows Firewall Enabled! 
McAfee Anti-Virus and Anti-Spyware 
WMI entry may not exist for antivirus; attempting automatic update. 
*`````````Anti-malware/Other Utilities Check:`````````* 
JavaFX 2.1.1 
Java(TM) 6 Update 33 
Java 7 Update 21 
Adobe Flash Player 11.7.700.202 
Adobe Reader XI 
Mozilla Firefox (21.0) 
*````````Process Check: objlist.exe by Laurent````````* 
*`````````````````System Health check`````````````````* 
Total Fragmentation on Drive C: 0% 
*````````````````````End of Log``````````````````````*


----------



## Mark1956 (May 7, 2011)

That scan tells us the latest Flash Player is installed. One thing that needs attention is you have an outdated version of Java installed which is a security risk, please uninstall Java 6 Update 33.

Lets first look at IE, open IE and click on the Tools tab then Manage Add-ons, look for Shockwave Flash Object and click once on it, make sure it is Enabled, if not click on Enable. If it is not in the list let me know.

For Firefox click on Tools then Add-ons and select Plugins, see if Shockwave Flash is present and make sure it is Enabled.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Thanks for getting back to me.Im currently uninstalling the Java update using my Perfect uninstaller software so hopefully this will remove this completely (almost finished) I have checked both IE and Firefox and there is no Shockwave flash present in either browser add-on menu.

Chris


----------



## Phantom010 (Mar 9, 2009)

Are you always making sure your browsers are closed before installing Flash?


----------



## superfrog25 (Mar 25, 2011)

Hi Phantom,

Yes I save the file, close the browsers and then run the file either normally or as an administrator. I can get the flash to work ok but when my pc gets rebooted the pc loses the player in control panel and in the various browsers.

Chris


----------



## Phantom010 (Mar 9, 2009)

Maybe *THIS* can help?


----------



## superfrog25 (Mar 25, 2011)

Hi Phantom,

I had a go at this yesterday as I was hoping this would resolve it.I downloaded the subinACL installer and the zip file but wasnt sure how to get the zip file into the other file it isnt very clear how this is achieved!! I must admit Im not sure if it actually did what it was supposed to. I didnt check the youtube instruction out as I wasnt sure it would work without flash.

Chris


----------



## Phantom010 (Mar 9, 2009)

reset_fp11.bat.zip needs to be extracted to the SubInACL folder. Just point the extraction to the SubInACL folder.


----------



## superfrog25 (Mar 25, 2011)

Hi Phantom,

As i say I had a go at this last night and I have just tried to repeat it using the player provided as a guide and got the following ;

@echo off @setlocal enableextensions @cd /d "%~dp0" Echo ========================= Echo Repairing Flash Player HKEY_CLASSES_ROOT Registry Permissions. One moment please... Echo ========================= subinacl /subkeyreg HKEY_CLASSES_ROOT\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2} /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000} /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A} /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4} /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9} /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B} /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\.spl /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\.swf /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\.mfp /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\.sol /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\.sor /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\FlashFactory.FlashFactory /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\FlashFactory.FlashFactory.1 /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\FlashProp.FlashProp /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\FlashProp.FlashProp.1 /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.1 /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.3 /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.4 /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.5 /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.6 /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.7 /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.8 /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.9 /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.10 /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.11 /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\MacromediaFlashPaper.MacromediaFlashPaper /grant=administrators=f subinacl /subkeyreg "HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/futuresplash" /grant=administrators=f subinacl /subkeyreg "HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-shockwave-flash" /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2} /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000} /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A} /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4} /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9} /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B} /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\.spl /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\.swf /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\.mfp /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\.sol /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\.sor /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\FlashFactory.FlashFactory /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\FlashFactory.FlashFactory.1 /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\FlashProp.FlashProp /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\FlashProp.FlashProp.1 /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.1 /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.3 /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.4 /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.5 /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.6 /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.7 /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.8 /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.9 /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.10 /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.11 /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\MacromediaFlashPaper.MacromediaFlashPaper /grant=system=f subinacl /subkeyreg "HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/futuresplash" /grant=system=f subinacl /subkeyreg "HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-shockwave-flash" /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2} /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000} /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A} /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4} /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9} /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B} /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\.spl /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\.swf /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\.mfp /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\.sol /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\.sor /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\FlashFactory.FlashFactory /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\FlashFactory.FlashFactory.1 /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\FlashProp.FlashProp /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\FlashProp.FlashProp.1 /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.1 /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.3 /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.4 /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.5 /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.6 /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.7 /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.8 /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.9 /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.10 /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\ShockwaveFlash.ShockwaveFlash.11 /grant=user=r subinacl /subkeyreg HKEY_CLASSES_ROOT\MacromediaFlashPaper.MacromediaFlashPaper /grant=user=r subinacl /subkeyreg "HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/futuresplash" /grant=user=r subinacl /subkeyreg "HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-shockwave-flash" /grant=user=r Echo ========================= Echo Repairing Flash Player HKEY_LOCAL_MACHINE Registry Permissions. One moment please... Echo ========================= subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash /grant=administrators=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1 /grant=administrators=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.3 /grant=administrators=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.4 /grant=administrators=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.5 /grant=administrators=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.6 /grant=administrators=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.7 /grant=administrators=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8 /grant=administrators=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.9 /grant=administrators=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.10 /grant=administrators=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.11 /grant=administrators=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000} /grant=administrators=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash /grant=system=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1 /grant=system=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.3 /grant=system=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.4 /grant=system=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.5 /grant=system=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.6 /grant=system=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.7 /grant=system=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8 /grant=system=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.9 /grant=system=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.10 /grant=system=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.11 /grant=system=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000} /grant=system=f subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash /grant=users=r subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1 /grant=users=r subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.3 /grant=users=r subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.4 /grant=users=r subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.5 /grant=users=r subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.6 /grant=users=r subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.7 /grant=users=r subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8 /grant=users=r subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.9 /grant=users=r subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.10 /grant=users=r subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.11 /grant=users=r subinacl /subkeyreg HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000} /grant=users=r Echo ========================= Echo Repairing Flash Player File System Permissions. One moment please... Echo ========================= subinacl /subdirectories %WINDIR%\System32\Macromed /grant=administrators=f subinacl /subdirectories %WINDIR%\System32\Macromed\* /grant=administrators=f subinacl /subdirectories %WINDIR%\System32\Macromed /grant=users=r subinacl /subdirectories %WINDIR%\System32\Macromed\* /grant=users=r subinacl /subdirectories %WINDIR%\System32\Macromed /grant=system=f subinacl /subdirectories %WINDIR%\System32\Macromed\* /grant=system=f subinacl /subdirectories %WINDIR%\System32\Macromed /grant=users=r subinacl /subdirectories %WINDIR%\System32\Macromed\* /grant=users=r subinacl /subdirectories %WINDIR%\SysWow64\Macromed /grant=administrators=f subinacl /subdirectories %WINDIR%\SysWow64\Macromed\* /grant=administrators=f subinacl /subdirectories %WINDIR%\SysWow64\Macromed /grant=users=r subinacl /subdirectories %WINDIR%\SysWow64\Macromed\* /grant=users=r subinacl /subdirectories %WINDIR%\SysWow64\Macromed /grant=system=f subinacl /subdirectories %WINDIR%\SysWow64\Macromed\* /grant=system=f subinacl /subdirectories %WINDIR%\SysWow64\Macromed /grant=users=r subinacl /subdirectories %WINDIR%\SysWow64\Macromed\* /grant=users=r Echo ========================= Echo Finished. Echo ========================= pause exit

Scary!!!

Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I have uninstalled the Java update .As i said neither browser has shockwave flash in the add on menus.Do I need to install that?

Chris


----------



## Phantom010 (Mar 9, 2009)

superfrog25 said:


> Hi Phantom,
> 
> As i say I had a go at this last night and I have just tried to repeat it using the player provided as a guide and got the following ;
> 
> ...


You're not supposed to see it like that. It's opening in Notepad, but you shouldn't be seeing anything other than possibly a window flashing very fast. It's a .bat file.

How are you running it? You only need to double-click it.


----------



## superfrog25 (Mar 25, 2011)

Hi Phantom,

When I moved the zip file as instructed this is what happened Im afraid,however last night I did get the black box with data flashing quickly so it may be that I did what was asked last night.If that is the case I dont think it worked I could uninstall both the Zip file and the installer and try again from scratch??

Chris


----------



## Phantom010 (Mar 9, 2009)

Unfortunately, it is a 6-month-old fix. May not be relevant anymore.


----------



## superfrog25 (Mar 25, 2011)

Ok..Worth a try..Thanks anyway.


----------



## Mark1956 (May 7, 2011)

superfrog25 said:


> Hi Mark,
> 
> I have uninstalled the Java update .As i said neither browser has shockwave flash in the add on menus.Do I need to install that?
> 
> Chris


 No, Shockwave flash should appear in your browser add-ons when Flash Player is installed.

I think this one was sent to test us .

We can disable McAfee, but lets go in with all guns blazing and disable everything.

Follow this and then run the uninstaller for Flash Player and then do the install again. Have a look and see if the Shockwave Flash has appeared in the Browser Add-ons and reboot, look again to see if it is there, let me know the outcome.

*Selective Startup (Clean Boot)*
I would recommend you print out these instructions and follow them slowly, one line at a time, as it is very easy to get confused with this. Unfortunately this is probably the only way we can find what is causing your problem.


Click on *Start*







then type *msconfig* into the *Search* box and hit the* Enter* key.
This screen should appear with the settings as shown:











Click on the Services tab and you should see this, click on the box next to *Hide all Microsoft Services* so a check mark appears.











Now click on the General tab and check the boxes as shown:











When done click on *Apply* and then *OK*.
The window will close and you will see a notification with two choices, click on *Restart*.

Once done, go back into msconfig and change the setting back to Normal Startup, reboot and check if Shockwave Flash is still there in the Browsers.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Some progress but... I followed your instructions up to the point where you restart.I uninstalled flash from my document folder but couldnt re-install it until I went back into misconfig as I had no internet connection when I had restarted. So I reset my setting to normal restart (shockwave flash didnt show up to that point) but when I reinstalled flash player, shockwave flash appeard in the add-ons for firefox but not in IE. However and heres the problem when I tried to access a page where I know flash is required firefox wasnt responding and I had to reset.when I reset firefox I lost shockwave flash!!

Chris


----------



## Mark1956 (May 7, 2011)

Ok, I doubt this is Malware related but it may be worth running a couple of scans just to be sure the browsers and the system is clean. Apart from that I'm running out of ideas.

Please go Here and follow the instructions to run DDS, then *Copy and Paste* both the logs into your next reply. You need not run HJT or GMER.

Please run these three scans and post the logs:

*SCAN 1*
Click on this link to download : ADWCleaner and save it to your desktop.

*NOTE:* If using Internet Explorer and you get an alert that stops the program downloading click on *Tools > Smartscreen Filter > Turn off Smartscreen Filter* then click on *OK* in the box that opens. Then click on the link again.

Close your browser and click on this icon on your desktop:









You will then see the screen below, click on the *Delete* button (as indicated), accept any prompts that appear and allow it to reboot the PC. When the PC has rebooted you will be presented with the report, copy & paste it into your next post. If the log does not appear you should find it on your C: drive, using Windows Explorer, as ADWCleaner[S1].










*SCAN 2*
Download RogueKiller (by tigzy) and save direct to your Desktop.
On the web page select the 32bit or 64bit button to match the bit rate of your version of Windows.


Quit all running programs. 
Start RogueKiller.exe by double clicking on the icon. 
Wait until Prescan has finished. 
Ensure all boxes are ticked under "Report" tab. 
Click on Scan. 
Click on Report when complete. Copy/paste the contents of the report and paste into your next reply.
NOTE: *DO NOT attempt to remove anything that the scan detects.*










*SCAN 3*
Please download RKill 
There are three buttons to choose from with different names on, select the first one and save it to your desktop.


Double-click on the *Rkill* desktop icon to run the tool.
If using Vista or Windows 7, right-click on it and *Run As Administrator*.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
A log pops up at the end of the run. This log file is located at *C:\rkill.log*. *Please post this in your next reply.*
If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time.
If the tool does not run from any of the links provided, please let me know.

*DO NOT* reboot, run *Malwarebytes*, let it update and run a *full* scan. *Select everything it finds for deletion* and post the resulting log. If it finds nothing, post that log instead.

You can download Malwarebytes from here if you do not have it: Malwarebytes


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Please see below

DDS;
DDS (Ver_2012-11-20.01) - NTFS_AMD64 
Internet Explorer: 10.0.9200.16576 BrowserJavaVersion: 10.21.2
Run by Home PC at 21:41:43 on 2013-05-23
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.2013.1070 [GMT 1:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall *Enabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Users\Home PC\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe
C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
C:\Windows\system32\mfevtps.exe
C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
C:\Windows\system32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\WUDFHost.exe
C:\PROGRAM FILES (X86)\KODAK\AIO\STATUSMONITOR\EKStatusMonitor.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Users\Home PC\AppData\Roaming\Yontoo\YontooDesktop.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\mcafee.com\agent\mcagent.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Nero\Update\NASvc.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files (x86)\Nero\SyncUP\Nero.AndroidServer.exe
C:\Windows\splwow64.exe
C:\Windows\splwow64.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.co.uk/
uWindow Title = Internet Explorer, optimized for Bing and MSN
mWinlogon: Userinit = userinit.exe
BHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - LocalServer32 - <no file>
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\mcafee\SystemCore\ScriptSn.20121103121321.dll
BHO: DefaultTab Browser Helper: {7F6AFBF1-E065-4627-A2FD-810366367D01} - C:\Users\Home PC\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\siteadvisor\McIEPlg.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
BHO: Yontoo: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - 
TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\siteadvisor\McIEPlg.dll
uRun: [Yontoo Desktop] "C:\Users\Home PC\AppData\Roaming\Yontoo\YontooDesktop.exe"
mRun: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [NeroLauncher] C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe 900
mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [EKStatusMonitor] C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe
mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
mRun: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
dRunOnce: [KodakHomeCenter] "C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Kodak EasyShare software.lnk - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Microsoft Office.lnk - C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
TCP: NameServer = 192.168.0.1
TCP: Interfaces\{750A2938-91EB-4F5A-9ACE-70510B40A397} : DHCPNameServer = 192.168.0.1
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\siteadvisor\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\siteadvisor\McIEPlg.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
x64-BHO: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - <orphaned>
x64-BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\mcafee\SystemCore\ScriptSn.20121103121321.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\siteadvisor\x64\McIEPlg.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
x64-TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\siteadvisor\x64\McIEPlg.dll
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup
x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
x64-DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
x64-Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\mcsniepl64.dll
x64-Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\siteadvisor\x64\McIEPlg.dll
x64-Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\siteadvisor\x64\McIEPlg.dll
x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned>
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Home PC\AppData\Roaming\Mozilla\Firefox\Profiles\b5cj1c7m.default-1369339943653\
FF - plugin: c:\PROGRA~2\mcafee\msc\npMcSnFFPl.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\McAfee\SiteAdvisor\NPMcFFPlg32.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll
FF - ExtSQL: 2013-05-23 17:40; {4ED1F68A-5463-4931-9384-8FFF5ED91D92}; C:\Program Files (x86)\McAfee\SiteAdvisor
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\System32\drivers\mfehidk.sys [2012-11-3 771536]
R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\System32\drivers\mfewfpk.sys [2012-11-3 340216]
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2011-8-5 55856]
R2 DefaultTabUpdate;DefaultTabUpdate;C:\Users\Home PC\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe [2013-5-22 107520]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-8-5 13336]
R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [2012-10-19 395200]
R2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [2012-10-15 779200]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2012-11-3 201304]
R2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2012-11-3 201304]
R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2012-11-3 201304]
R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2012-11-3 201304]
R2 McShield;McAfee McShield;C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe [2012-11-3 241456]
R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe [2012-11-3 218760]
R2 mfevtp;McAfee Validation Trust Protection Service;C:\Windows\System32\mfevtps.exe [2011-12-6 182752]
R2 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2011-11-25 687400]
R2 NOBU;Dell DataSafe Online;C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe [2010-8-25 2823000]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2011-9-20 794272]
R2 RtNdPt60;Realtek NDIS Protocol Driver;C:\Windows\System32\drivers\RtNdPt60.sys [2011-8-5 27136]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2011-8-5 1692480]
R2 Yontoo Desktop Updater;Yontoo Desktop Updater;C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe [2013-5-22 23552]
R3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [2012-6-11 240208]
R3 cfwids;McAfee Inc. cfwids;C:\Windows\System32\drivers\cfwids.sys [2012-11-3 70112]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;C:\Windows\System32\drivers\IntcHdmi.sys [2011-8-6 138752]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\System32\drivers\mfeavfk.sys [2012-11-3 309840]
R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\System32\drivers\mfefirek.sys [2012-11-3 515968]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-8-6 236544]
S2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [2012-6-11 193616]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2012-5-3 48488]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2012-3-8 1492840]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 HipShieldK;McAfee Inc. HipShieldK;C:\Windows\System32\drivers\HipShieldK.sys [2012-11-3 196440]
S3 McAWFwk;McAfee Activation Service;C:\PROGRA~1\mcafee\msc\mcawfwk.exe [2012-11-3 225216]
S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\System32\drivers\mferkdet.sys [2012-11-3 106552]
S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
S3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);C:\Windows\System32\drivers\RtTeam60.sys [2011-8-5 43008]
S3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);C:\Windows\System32\drivers\RtVlan60.sys [2011-8-5 24064]
S3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);C:\Windows\System32\drivers\RtTeam60.sys [2011-8-5 43008]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-8-12 1255736]
S4 McOobeSv;McAfee OOBE Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2012-11-3 201304]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== File Associations ===============
.
ShellExec: EasyShare.exe: Preview="C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe"
.
=============== Created Last 30 ================

Attach;

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium 
Boot Device: \Device\HarddiskVolume2
Install Date: 10/08/2011 16:37:43
System Uptime: 23/05/2013 21:10:00 (0 hours ago)
.
Motherboard: Dell Inc. | | 018D1Y
Processor: Pentium(R) Dual-Core CPU E6700 @ 3.20GHz | CPU 1 | 3203/266mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 451 GiB total, 400.461 GiB free.
D: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP256: 20/05/2013 12:55:40 - Windows Update
RP257: 22/05/2013 09:44:07 - Removed Adobe Reader X (10.1.7) MUI.
RP258: 22/05/2013 12:04:40 - Installed Windows Resource Kit Tools - SubInAcl.exe
RP259: 22/05/2013 21:20:13 - Removed Windows Resource Kit Tools - SubInAcl.exe
RP260: 22/05/2013 21:22:10 - Installed Windows Resource Kit Tools - SubInAcl.exe
RP261: 22/05/2013 22:45:27 - Installed Windows Resource Kit Tools - SubInAcl.exe
RP262: 23/05/2013 17:44:38 - Removed Java(TM) 6 Update 33
RP263: 23/05/2013 19:00:24 - Installed Windows Resource Kit Tools - SubInAcl.exe
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 11 Plugin
Adobe Reader XI (11.0.03)
aioscnnr
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft Print Creations
ArcSoft Print Creations - Album Page
ArcSoft Print Creations - Funhouse
ArcSoft Print Creations - Greeting Card
ArcSoft Print Creations - Photo Book
ArcSoft Print Creations - Photo Calendar
ArcSoft Print Creations - Scrapbook
ArcSoft Print Creations - Slimline Card
Audacity 1.3.14 (Unicode)
Bejeweled 2 Deluxe
Bing Bar
Bing Rewards Client Installer
Blackhawk Striker 2
Bonjour
Bounce Symphony
Build-a-lot 2
C4USelfUpdater
Cake Mania
CardRd81
CCleaner
CCScore
center
Chuzzle Deluxe
Compatibility Pack for the 2007 Office system
CR2
D3DX10
DefaultTab
Dell DataSafe Local Backup
Dell DataSafe Local Backup - Support Software
Dell DataSafe Online
Dell Edoc Viewer
Dell Getting Started Guide
Dell MusicStage
Dell PhotoStage
Dell Stage
Dell VideoStage 
Diagnostic Utility
Diner Dash 2 Restaurant Rescue
DirectX 9 Runtime
Dora's World Adventure
eBay
Escape Whisper Valley (TM)
ESSBrwr
ESSCDBK
ESScore
essentials
ESSgui
ESSini
ESSPCD
ESSPDock
ESSTOOLS
essvatgt
Farm Frenzy
FATE
Final Drive Fury
Final Drive Nitro
High-Definition Video Playback
iCloud
Intel(R) Control Center
Intel(R) Graphics Media Accelerator Driver
Intel(R) Rapid Storage Technology
iTunes
Java 7 Update 21
Java Auto Updater
Java(TM) 6 Update 24 (64-bit)
JavaFX 2.1.1
Jewel Quest
Jewel Quest Solitaire 2
Junk Mail filter update
Kodak AIO Printer
KODAK AiO Software
Kodak EasyShare software
Luxor
M4P MP3 Converter 1.0
McAfee Internet Security
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Office 2010
Microsoft Office XP Professional with FrontPage
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Mozilla Firefox 21.0 (x86 en-GB)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
My Dell
Namco All-Stars PAC-MAN
Nero 10 Movie ThemePack Basic
Nero Control Center 10
Nero ControlCenter 10 Help (CHM)
Nero Core Components 10
Nero Update
netbrdg
ocr
OfotoXMI
PC Tools Registry Mechanic 11.1
Penguins!
Perfect Uninstaller v6.3.3.9
PhotoShowExpress
Plants vs. Zombies - Game of the Year
PlayReady PC Runtime x86
Poker Superstars III
Polar Bowler
Polar Golfer
PreReq
PrintProjects
QuickTime
RBVirtualFolder64Inst
Realtek High Definition Audio Driver
Roxio Activation Module
Roxio BackOnTrack
Roxio Burn
Roxio Creator Starter
Roxio Express Labeler 3
Roxio File Backup
Samantha Swift
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
SFR
SFR2
Shared C Run-time for x64
SHASTA
skin0001
SKINXSDK
Sky Broadband
Skype Toolbars
Skype™ 5.10
Sonic CinePlayer Decoder Pack
staticcr
SyncUP
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update Installer for WildTangent Games App
Virtual Villagers 4 - The Tree of Life
VPRINTOL
Wedding Dash - Ready, Aim, Love!
WildTangent Games
WildTangent Games App (Dell Games)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Resource Kit Tools - SubInAcl.exe
WIRELESS
Yahoo! Detect
Yontoo 2.053
Zinio Reader 4
Zuma Deluxe
.
==== Event Viewer Messages From Past Week ========
.
23/05/2013 21:11:20, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SftService service.
23/05/2013 20:59:12, Error: Service Control Manager [7001] - The Task Scheduler service depends on the Windows Event Log service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
23/05/2013 20:59:12, Error: Service Control Manager [7001] - The McAfee Personal Firewall Service service depends on the Windows Firewall service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
23/05/2013 12:44:04, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
23/05/2013 12:44:04, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473535.
23/05/2013 10:38:05, Error: Service Control Manager [7034] - The Kodak AiO Network Discovery Service service terminated unexpectedly. It has done this 1 time(s).
22/05/2013 10:07:04, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
22/05/2013 10:07:04, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
22/05/2013 10:07:04, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
22/05/2013 10:06:37, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
22/05/2013 09:49:38, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: An instance of the service is already running.
22/05/2013 09:49:08, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-2147218173.
22/05/2013 08:19:29, Error: Service Control Manager [7031] - The BrowserProtect service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
21/05/2013 10:47:29, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk6\DR6.
20/05/2013 09:36:55, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.
20/05/2013 08:26:50, Error: Service Control Manager [7024] - The Windows Firewall service terminated with service-specific error Access is denied..
20/05/2013 07:38:04, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
17/05/2013 21:12:12, Error: Service Control Manager [7034] - The McAfee Scanner service terminated unexpectedly. It has done this 1 time(s).
16/05/2013 19:48:59, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk5\DR5.
.
==== End Of File ===========================

ADW cleaner;

# AdwCleaner v2.301 - Logfile created 05/23/2013 at 21:48:06
# Updated 16/05/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Home PC - HOME
# Boot Mode : Normal
# Running from : C:\Users\Home PC\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

File Deleted : C:\END
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
File Deleted : C:\user.js
File Deleted : C:\Users\Public\Desktop\eBay.lnk
Folder Deleted : C:\Program Files (x86)\BrowserCompanion
Folder Deleted : C:\Program Files (x86)\Mozilla Firefox\Extensions\[email protected]
Folder Deleted : C:\Program Files (x86)\Yontoo
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Users\Home PC\AppData\Local\PackageAware
Folder Deleted : C:\Users\Home PC\AppData\Local\Smartbar
Folder Deleted : C:\Users\Home PC\AppData\Roaming\Babylon
Folder Deleted : C:\Users\Home PC\AppData\Roaming\DefaultTab
Folder Deleted : C:\Users\Home PC\AppData\Roaming\Mozilla\Firefox\Profiles\x66whzxo.default-1368960486220\extensions\[email protected]
Folder Deleted : C:\Users\Home PC\AppData\Roaming\Yontoo

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\DefaultTab
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\Default Tab
Key Deleted : HKCU\Software\DefaultTab
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\DefaultTabBHO.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Key Deleted : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowser
Key Deleted : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowser.1
Key Deleted : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveX
Key Deleted : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveX.1
Key Deleted : HKLM\Software\Classes\Installer\Features\90C64EA18BA25EE488BF80DCF07F2FFD
Key Deleted : HKLM\Software\Classes\Installer\Products\90C64EA18BA25EE488BF80DCF07F2FFD
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\Default Tab
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\clbfjfbnelcflpgpklppgplejolacbej
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Key Deleted : HKLM\SOFTWARE\Tarma Installer
Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Yontoo Desktop]

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Registry is clean.

-\\ Mozilla Firefox v21.0 (en-GB)

Roguekiller;

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Home PC [Admin rights]
Mode : Scan -- Date : 05/23/2013 21:59:35
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3500413AS +++++
--- User ---
[MBR] dea043e6dd9b9c3c0880803e84ed572a
[BSP] 65dfbe26938c06973923f63a3ba74cb6 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 15166 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 31141888 | Size: 461733 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[1]_S_05232013_02d2159.txt >>
RKreport[1]_S_05232013_02d2159.txt

RKILL;

Rkill 2.4.8 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 05/23/2013 10:04:09 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* Explorer Policy Removed: NoActiveDesktopChanges [HKLM]

Backup Registry file created at:
C:\Users\Home PC\Desktop\rkill\rkill-05-23-2013-10-04-15.reg

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Defender Disabled

[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001

Checking Windows Service Integrity:

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

* FontCache => %SystemRoot%\system32\svchost.exe -k LocalService [Incorrect ImagePath]

Searching for Missing Digital Signatures:

* C:\Windows\System32\mshtml.dll [NoSig]
+-> C:\Windows\SysWOW64\mshtml.dll : 14,323,712 : 04/05/2013 00:26 AM : 7a468bc721c1d34e60389d3f2f87bbea [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_911ec38c929b31ec\mshtml.dll : 19,230,208 : 04/18/2013 00:49 AM : 394ecd933cd66badf97ea85a183b9e1e [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_91213bba929917b7\mshtml.dll : 19,231,232 : 04/05/2013 00:50 AM : c56ef4c50a1feed0cc9b7ae068cbbbbb [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_7a4a3764ac472c8f\mshtml.dll : 19,476,480 : 04/05/2013 00:11 AM : 6d81646922700482a82f253e73989ce4 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_8c235f42afcafdda\mshtml.dll : 8,988,160 : 11/21/2010 00:24 AM : 1c8b787baa52dead1a6fec1502d652f0 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17537_none_8c10c048afd881c1\mshtml.dll : 8,995,328 : 08/06/2011 00:56 AM : 688872e9cafcc2758e7fe92a0622b4f9 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21636_none_8c995cc9c8f70834\mshtml.dll : 8,995,328 : 08/06/2011 00:56 AM : d0afd5813136f0eac80a048740553840 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16421_none_87e150ddf4cd3dc7\mshtml.dll : 17,773,056 : 08/06/2011 00:40 AM : 82682ba2df50b94cd798b8315b3f7896 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16434_none_87d981cff4d2a5bd\mshtml.dll : 17,782,272 : 07/22/2011 00:52 AM : b721efcc393d76390a319a8a30b1b654 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16437_none_87dc82adf4cff1c2\mshtml.dll : 17,781,760 : 09/01/2011 00:34 AM : 02b4e6ccca443568764281391635f5a4 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16440_none_87cab0bbf4de5c52\mshtml.dll : 17,786,368 : 11/04/2011 00:38 AM : e7bd23bec69cf23436eede9b18de186d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16441_none_87cbb105f4dd75a9\mshtml.dll : 17,790,464 : 12/14/2011 00:43 AM : e61288581ad9e647abefb1489b250b5c [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16443_none_87cdb199f4dba857\mshtml.dll : 17,790,976 : 02/28/2012 00:34 AM : d785a16a6f03f76cb862f28c9f8c9672 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16446_none_87d0b277f4d8f45c\mshtml.dll : 17,807,360 : 05/18/2012 00:47 AM : de469470d93deb4a1a81ede72b848198 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16447_none_87d1b2c1f4d80db3\mshtml.dll : 17,807,360 : 06/02/2012 01:49 PM : 89c4b3bf66d3c2f3d83f9dedf1b218d6 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16448_none_87d2b30bf4d7270a\mshtml.dll : 17,809,920 : 06/29/2012 01:55 AM : 8415f4792d7bc07be328df56fe32045a [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16450_none_87bfe0cff4e67843\mshtml.dll : 17,810,944 : 08/24/2012 01:15 AM : f244da6dd2c365abafd076222c22c2be [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16455_none_87c4e241f4e1f6f6\mshtml.dll : 17,811,968 : 10/08/2012 01:19 PM : 6d4f838e72eeeb3d6fb16a5a45632560 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16457_none_87c6e2d5f4e029a4\mshtml.dll : 17,811,968 : 11/14/2012 01:06 AM : cff3c4abdcc5356b0674743bdf0fb674 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16464_none_87b9120bf4eaf990\mshtml.dll : 17,812,992 : 01/09/2013 01:48 AM : 14deb733acb08a71cc0783ed02ff1f8d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16470_none_87aa40f7f4f6b025\mshtml.dll : 17,815,040 : 02/02/2013 01:31 AM : 460723a080d6f22e56d45bc8c1f15b2a [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16476_none_87b042b3f4f1482f\mshtml.dll : 17,817,088 : 02/22/2013 01:57 AM : 1154fefc73880a2ef44295ef0dbdc59f [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20534_none_88631e9b0df04587\mshtml.dll : 17,782,272 : 07/22/2011 01:35 AM : 79184cda49ef6a445ff152ec58c7eb5d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20537_none_88661f790ded918c\mshtml.dll : 17,781,760 : 09/01/2011 01:58 AM : 0254785c0a7715e478fe89540a992cb5 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20544_none_88584eaf0df86178\mshtml.dll : 17,786,368 : 11/04/2011 01:06 AM : 5770c4ba825c42d6efd9486029747108 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20546_none_885a4f430df69426\mshtml.dll : 17,790,464 : 12/14/2011 01:57 AM : 153963f44a26a7840acdf52c2cd1b9dc [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20548_none_885c4fd70df4c6d4\mshtml.dll : 17,790,976 : 02/28/2012 01:54 AM : 97bb8c752a400556a4ff2e1aafa0a138 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20551_none_884a7de50e033164\mshtml.dll : 17,807,360 : 05/18/2012 01:35 AM : be1e4779329040ed334651cd877c416d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20553_none_884c7e790e016412\mshtml.dll : 17,807,360 : 06/02/2012 01:45 AM : 0c26f50d6c347ce294c84347e6faeaa8 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20554_none_884d7ec30e007d69\mshtml.dll : 17,809,920 : 06/29/2012 01:39 AM : c4de0e2b31f60acb15e6b4154e26298a [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20557_none_88507fa10dfdc96e\mshtml.dll : 17,810,944 : 08/24/2012 01:40 AM : 522a528c296a9aef3f0c289ff7093315 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20562_none_8840ae430e0a66ac\mshtml.dll : 17,812,992 : 10/08/2012 01:58 AM : 1fb8062d4c3a4c7b8eca7bbd1e743000 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20565_none_8843af210e07b2b1\mshtml.dll : 17,811,968 : 11/14/2012 01:57 AM : 5024cacd183e4c0fccde6db8a38eec7b [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20573_none_8836dea10e119bf4\mshtml.dll : 17,814,528 : 01/09/2013 01:46 AM : b6c5bc6d4e1d79cb8df107112a9f37cb [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20580_none_88290dd70e1c6be0\mshtml.dll : 17,815,040 : 02/02/2013 01:04 AM : 1cd82d510d370cb04bb6bd1c660aa96f [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20586_none_882f0f930e1703ea\mshtml.dll : 17,817,600 : 02/22/2013 01:12 AM : 0e860bf2bcddd94202a6ab9a10ee95eb [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_9b736ddec6fbf3e7\mshtml.dll : 14,323,200 : 04/18/2013 01:49 AM : d017bf8d92938eeb9b3a1d1c53fda152 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_9b75e60cc6f9d9b2\mshtml.dll : 14,323,712 : 04/05/2013 01:26 AM : 7a468bc721c1d34e60389d3f2f87bbea [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_849ee1b6e0a7ee8a\mshtml.dll : 14,353,408 : 04/05/2013 01:17 AM : 92d1c395680c2878f9778c1649c00cb0 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_96780994e42bbfd5\mshtml.dll : 5,977,600 : 11/21/2010 01:25 AM : c50799f0d47dfb9774f721521b6c41d5 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17537_none_96656a9ae43943bc\mshtml.dll : 5,980,672 : 08/06/2011 01:56 AM : 1c6045d48179d15a843486d12bec0eaf [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21636_none_96ee071bfd57ca2f\mshtml.dll : 5,980,672 : 08/06/2011 01:56 AM : 1011333570e1cecae8fac34c8d9461bc [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16421_none_9235fb30292dffc2\mshtml.dll : 12,268,544 : 08/06/2011 01:40 AM : 4def8126cabaa6cdc12103cd74c6a919 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16434_none_922e2c22293367b8\mshtml.dll : 12,273,664 : 07/22/2011 01:54 AM : e6d5c7e4aac0c682169aa5021386eff3 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16437_none_92312d002930b3bd\mshtml.dll : 12,275,200 : 09/01/2011 01:36 AM : 04e0cd31a63dfc0d73725a3d1768fb5a [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16440_none_921f5b0e293f1e4d\mshtml.dll : 12,279,808 : 11/03/2011 11:02 PM : 66c0aee61d1c5c35bf1b4642a153b114 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16441_none_92205b58293e37a4\mshtml.dll : 12,282,368 : 12/14/2011 11:30 AM : 497c9c3db953a60ec4f43a097e15f75e [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16443_none_92225bec293c6a52\mshtml.dll : 12,281,856 : 02/28/2012 11:52 AM : f82bf2cb075b49e9fab5ff213c45c020 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16446_none_92255cca2939b657\mshtml.dll : 12,314,624 : 05/18/2012 11:11 AM : 9fb58f71104107d44540af1195f7a14d [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16447_none_92265d142938cfae\mshtml.dll : 12,314,624 : 06/02/2012 11:07 AM : 6820a9e91aff7cb3a510360d8ccd9bdd [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16448_none_92275d5e2937e905\mshtml.dll : 12,317,184 : 06/29/2012 11:52 AM : 5e8e869e1342308752a37a2c90cca79d [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16450_none_92148b2229473a3e\mshtml.dll : 12,319,744 : 08/24/2012 11:27 AM : bb197f54a8f69eea8356b7f70e6d3a20 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16455_none_92198c942942b8f1\mshtml.dll : 12,320,768 : 10/08/2012 11:28 AM : 8d1bb1e5a033e8817ef94a9047630165 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16457_none_921b8d282940eb9f\mshtml.dll : 12,320,256 : 11/14/2012 11:48 AM : 07f649cd36f266bbe33b814fa678aa43 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16464_none_920dbc5e294bbb8b\mshtml.dll : 12,321,280 : 01/08/2013 10:23 PM : c97434c851c4821bd92d2831fdf1ecbe [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16470_none_91feeb4a29577220\mshtml.dll : 12,321,792 : 02/02/2013 10:09 AM : 263963d93a3ca8f685efa5966f1e6581 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16476_none_9204ed0629520a2a\mshtml.dll : 12,324,352 : 02/22/2013 10:05 AM : 658ebc74bd38d16805648c4775f7fa82 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20534_none_92b7c8ed42510782\mshtml.dll : 12,273,664 : 07/22/2011 10:53 AM : f2966190d2c20c585a730f9c0b3c7373 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20537_none_92bac9cb424e5387\mshtml.dll : 12,275,200 : 09/01/2011 10:07 AM : 8c93aed0a332209434b62162d03c38c9 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20544_none_92acf90142592373\mshtml.dll : 12,279,808 : 11/03/2011 11:35 PM : a21b983e40578d0e6cfa9864ac4e1219 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20546_none_92aef99542575621\mshtml.dll : 12,282,368 : 12/14/2011 11:41 AM : a29cfd4b9f6f2bbe06c8d64b6d07f1d4 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20548_none_92b0fa29425588cf\mshtml.dll : 12,281,856 : 02/28/2012 11:21 AM : b9e083b14b1994f1255983f2df31c7df [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20551_none_929f28374263f35f\mshtml.dll : 12,314,624 : 05/17/2012 11:53 PM : 761d9111f5a2619cb5060661d36fbfff [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20553_none_92a128cb4262260d\mshtml.dll : 12,314,624 : 06/02/2012 11:48 AM : 1abf770552ea9d4fe90f654468faf4ce [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20554_none_92a2291542613f64\mshtml.dll : 12,317,184 : 06/29/2012 11:11 AM : aec51857aec2f5ce4520366240afc671 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20557_none_92a529f3425e8b69\mshtml.dll : 12,319,744 : 08/24/2012 11:43 AM : 975d1ea99a0fe8104b72440995b3c20b [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20562_none_92955895426b28a7\mshtml.dll : 12,321,280 : 10/08/2012 11:12 AM : f7b251da2fa89933771289793dcaa08b [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20565_none_92985973426874ac\mshtml.dll : 12,321,280 : 11/14/2012 11:14 AM : 8021ef27048f9ece5286ea8c8eed23b8 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20573_none_928b88f342725def\mshtml.dll : 12,322,304 : 01/08/2013 09:17 PM : b6ad225b3bcc07332fbb2c2824315534 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20580_none_927db829427d2ddb\mshtml.dll : 12,322,304 : 02/02/2013 09:15 AM : 88c27474e61271b49677f22cee76fb3e [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20586_none_9283b9e54277c5e5\mshtml.dll : 12,324,864 : 02/22/2013 09:06 AM : 474d43d76e2a33fee21c6f4bb7c4a3b7 [Pos Repl]

* C:\Windows\System32\wininet.dll [NoSig]
+-> C:\Windows\SysWOW64\wininet.dll : 1,767,424 : 04/05/2013 00:28 AM : 5abb3f36af17007f33fa275e96a2c95e [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_7fc4a46e1244c8b6\wininet.dll : 2,240,512 : 04/18/2013 09:49 AM : 753c0848ae7872a3f59663078a517293 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_7fc71c9c1242ae81\wininet.dll : 2,242,048 : 04/05/2013 09:52 AM : 27a9000c534aa9badc9ee74940f50c6d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_68f018462bf0c359\wininet.dll : 2,247,168 : 04/05/2013 09:12 AM : 61962c7a2d6e32827f089e6f0a03e533 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_7ac940242f7494a4\wininet.dll : 1,188,864 : 11/21/2010 09:23 AM : f6c5302e1f4813d552f41a0ac82455e5 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16421_none_768731bf7476d491\wininet.dll : 1,389,056 : 08/06/2011 09:40 AM : 1bf2bcc7e3c26fd4c8ef0c9efb0cc25d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16434_none_767f62b1747c3c87\wininet.dll : 1,389,056 : 07/22/2011 09:36 AM : 0732b49b250e306f7a6591029af9885b [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16437_none_7682638f7479888c\wininet.dll : 1,389,056 : 09/01/2011 09:17 AM : 271e8fb1354aa205a214f280a6766e30 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_7670919d7487f31c\wininet.dll : 1,390,080 : 11/04/2011 09:44 AM : 69151e566295e5a977fe71ffafd3b3f8 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16441_none_767191e774870c73\wininet.dll : 1,390,080 : 12/14/2011 09:04 AM : b1ac85b6adc005cf3f9eb4e28dfdcce6 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16443_none_7673927b74853f21\wininet.dll : 1,390,080 : 02/28/2012 09:49 AM : 228443ff3a1fb0b974d278f7c6403fad [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16446_none_7676935974828b26\wininet.dll : 1,392,128 : 05/18/2012 09:59 AM : 870ecfebd41c7b8f9c6777748368d51f [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16447_none_767793a37481a47d\wininet.dll : 1,392,128 : 06/02/2012 01:05 PM : 5a45fa344f4ad99d903f4b20e43b89ec [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16448_none_767893ed7480bdd4\wininet.dll : 1,392,128 : 06/29/2012 01:49 AM : 8ea68fd3780dddd5072f8cb830b3cb3d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16450_none_7665c1b174900f0d\wininet.dll : 1,392,128 : 08/24/2012 01:21 AM : 3d165c53e40236a68b7102d1a622d4e0 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16455_none_766ac323748b8dc0\wininet.dll : 1,392,128 : 10/08/2012 01:23 AM : a19db004d954bbc9c4ec125711e1d1c2 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16457_none_766cc3b77489c06e\wininet.dll : 1,392,128 : 11/14/2012 01:04 AM : 5121db613e10a46a3c5085b479026aa7 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16464_none_765ef2ed7494905a\wininet.dll : 1,392,128 : 01/09/2013 01:12 AM : 435e9c764e1ef70058580996452be6a2 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16470_none_765021d974a046ef\wininet.dll : 1,392,128 : 02/02/2013 01:47 AM : fa274190682aa41a46b285208ed46a74 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16476_none_76562395749adef9\wininet.dll : 1,392,128 : 02/22/2013 01:20 AM : a4f6142caba82fb7293ece5ff864b440 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20534_none_7708ff7c8d99dc51\wininet.dll : 1,389,056 : 07/22/2011 01:17 AM : 1a5a6898e90546b476d4e8a56626fc96 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20537_none_770c005a8d972856\wininet.dll : 1,389,056 : 09/01/2011 01:39 AM : 1b2d2d8e611de70ceb13f104d39814ba [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_76fe2f908da1f842\wininet.dll : 1,390,080 : 11/04/2011 01:19 AM : 244d45f786e33c169a93f70ba63babf8 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20546_none_770030248da02af0\wininet.dll : 1,390,080 : 12/14/2011 01:10 AM : c2fa4dbd6bb91d1afd7d155120654ab9 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20548_none_770230b88d9e5d9e\wininet.dll : 1,390,080 : 02/28/2012 01:09 AM : b70cdc073f70e6d082a62ab5880d6b07 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20551_none_76f05ec68dacc82e\wininet.dll : 1,392,128 : 05/18/2012 01:47 AM : bdc16d105bf011d4b1c3f09cf7a64314 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20553_none_76f25f5a8daafadc\wininet.dll : 1,392,128 : 06/02/2012 01:09 AM : 571e809181ebf0a04fefaa9bc9961f5b [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20554_none_76f35fa48daa1433\wininet.dll : 1,392,128 : 06/29/2012 01:51 AM : 8ba7eda2656ed7fbc93bdd5cb02b8d4e [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20557_none_76f660828da76038\wininet.dll : 1,392,128 : 08/24/2012 01:53 AM : 456d4e9006df149c250d40b813290471 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20562_none_76e68f248db3fd76\wininet.dll : 1,392,128 : 10/08/2012 01:11 AM : 789ead6f3ce42f3322818988400986e9 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20565_none_76e990028db1497b\wininet.dll : 1,392,128 : 11/14/2012 01:01 AM : 5caf48f12e8cbd96d520f4efd5b97f76 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20573_none_76dcbf828dbb32be\wininet.dll : 1,392,128 : 01/08/2013 11:55 PM : 43a6a68f1f41b13ca4d580d40dfa57ee [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20580_none_76ceeeb88dc602aa\wininet.dll : 1,392,128 : 02/02/2013 11:16 AM : 4e0669b513805a7c2a303c8ededc8e03 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20586_none_76d4f0748dc09ab4\wininet.dll : 1,392,640 : 02/22/2013 11:37 AM : e6a459c8e90c4a873c923c44f3d9510b [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_23a608ea59e75780\wininet.dll : 1,766,912 : 04/18/2013 11:49 AM : cfe0cee587f9cea4c29deec6d85fc91c [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_23a8811859e53d4b\wininet.dll : 1,767,424 : 04/05/2013 11:28 AM : 5abb3f36af17007f33fa275e96a2c95e [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_0cd17cc273935223\wininet.dll : 1,775,616 : 04/05/2013 11:19 AM : 1d48b7f4618ee77430acecca1bca88e1 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_1eaaa4a07717236e\wininet.dll : 980,992 : 11/21/2010 11:24 AM : 44214c94911c7cfb1d52cb64d5e8368d [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16421_none_1a68963bbc19635b\wininet.dll : 1,126,912 : 08/06/2011 11:40 AM : a1236375b74ea63c75657d564890c436 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16434_none_1a60c72dbc1ecb51\wininet.dll : 1,126,912 : 07/22/2011 11:48 AM : 2c7332c222d1fe1fc57d622699a8c001 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16437_none_1a63c80bbc1c1756\wininet.dll : 1,126,912 : 09/01/2011 11:28 AM : d3788d91530cfa005bd516189a4c676e [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_1a51f619bc2a81e6\wininet.dll : 1,127,424 : 11/03/2011 10:39 PM : 02f98b5c0e397ad06124d84428cf8f1a [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16441_none_1a52f663bc299b3d\wininet.dll : 1,127,424 : 12/14/2011 10:57 AM : 1d94fa7c81d2ffe494af094619ba706f [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16443_none_1a54f6f7bc27cdeb\wininet.dll : 1,127,424 : 02/28/2012 10:11 AM : 44465367256d1c72b58f5abaa19e7016 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16446_none_1a57f7d5bc2519f0\wininet.dll : 1,129,472 : 05/17/2012 11:35 PM : 1c191a4f0960f21b5d58c8a65baf5427 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16447_none_1a58f81fbc243347\wininet.dll : 1,129,472 : 06/02/2012 11:25 AM : 8e87270c4704cf2951e1e7820d6c8a2b [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16448_none_1a59f869bc234c9e\wininet.dll : 1,129,472 : 06/29/2012 11:09 AM : 75a97a2c060e72ab49e071e08c7dd2ba [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16450_none_1a47262dbc329dd7\wininet.dll : 1,129,472 : 08/24/2012 11:51 AM : 5553611e2f9ea6f613079177f1233068 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16455_none_1a4c279fbc2e1c8a\wininet.dll : 1,129,472 : 10/08/2012 11:48 AM : 9cb0d2a9a77d91d9614355ee9ff00519 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16457_none_1a4e2833bc2c4f38\wininet.dll : 1,129,472 : 11/14/2012 11:57 AM : 7fa3a810f383588d46220967de8b64ff [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16464_none_1a405769bc371f24\wininet.dll : 1,129,472 : 01/08/2013 10:03 PM : b49b56b64f57699a1a663d2cf7d0a56f [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16470_none_1a318655bc42d5b9\wininet.dll : 1,129,472 : 02/02/2013 10:30 AM : 03728c624d05c2f157bbd46f6b7f6ea0 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16476_none_1a378811bc3d6dc3\wininet.dll : 1,129,472 : 02/22/2013 10:38 AM : c5b6468422db1c8aa36c32cbb0197e5e [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20534_none_1aea63f8d53c6b1b\wininet.dll : 1,126,912 : 07/22/2011 10:48 AM : aa75f065975fce762fc9bbf5a3c08368 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20537_none_1aed64d6d539b720\wininet.dll : 1,126,912 : 09/01/2011 10:57 AM : c0fcee8d760c70db6ef858bb2262288e [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_1adf940cd544870c\wininet.dll : 1,127,424 : 11/03/2011 11:07 PM : 32569df2f9bef05dd7d56e30590edfd9 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20546_none_1ae194a0d542b9ba\wininet.dll : 1,127,424 : 12/14/2011 11:28 AM : 022a78194e2c7106f5af9f2bc6ac8774 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20548_none_1ae39534d540ec68\wininet.dll : 1,127,424 : 02/28/2012 11:58 AM : 11a34dca08eb2a586246f2d6c2a81d58 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20551_none_1ad1c342d54f56f8\wininet.dll : 1,129,472 : 05/17/2012 11:19 PM : 43bac67996d8765a5f1b3a4ea6231e21 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20553_none_1ad3c3d6d54d89a6\wininet.dll : 1,129,472 : 06/02/2012 11:16 AM : e430161a632f9a8fe512de0ca5685559 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20554_none_1ad4c420d54ca2fd\wininet.dll : 1,129,472 : 06/28/2012 11:54 PM : 54c30a4066a28f9a017e095e283b2762 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20557_none_1ad7c4fed549ef02\wininet.dll : 1,129,472 : 08/24/2012 11:12 AM : 2895e29efcfc0b1bcf8aee1a0c67913c [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20562_none_1ac7f3a0d5568c40\wininet.dll : 1,129,472 : 10/08/2012 11:37 AM : 6e3ac8a54a1881806ba2b58539483788 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20565_none_1acaf47ed553d845\wininet.dll : 1,129,472 : 11/14/2012 11:33 AM : 0635d714351f842d43ea184e75c4a3ff [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20573_none_1abe23fed55dc188\wininet.dll : 1,129,472 : 01/08/2013 08:41 PM : 16c45e6881449c6330567e51c13920fa [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20580_none_1ab05334d5689174\wininet.dll : 1,129,472 : 02/02/2013 08:36 AM : 1284d72c04b553ed5382ea14303d66db [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20586_none_1ab654f0d563297e\wininet.dll : 1,129,984 : 02/22/2013 08:35 AM : 490e24d5e427dfa55b1c1182f0db861c [Pos Repl]

Checking HOSTS File:

* No issues found.

Program finished at: 05/23/2013 10:06:50 PM
Execution time: 0 hours(s), 2 minute(s), and 40 seconds(s)

The malware scan is still scanning I will send as soon as its complete

Thanks for all your help
Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Please see below 1 x object found

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2013.05.23.11

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16576
Home PC :: HOME [administrator]

Protection: Enabled

23/05/2013 22:18:39
MBAM-log-2013-05-23 (23-27-11).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 436920
Time elapsed: 58 minute(s), 34 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Home PC\Downloads\installer_mcafee_siteadvisor_for_firefox.exe (PUP.Adbundler) -> No action taken.

(end)

I will understand if you get back to me tomorrow mate its getting late

Kind Regards
Chris


----------



## Mark1956 (May 7, 2011)

Those scans have brought a few things to light. The DDS logs show quite a few service failures and more importantly errors relating the the hard drive which we need to check.

ADWCleaner has removed a bunch of Adware, but you missed the bottom of the log so I can't see if it found anything in Firefox, I need you to run it again to be sure the other detections have completely gone so please be sure to copy the full log and post it in your next reply. Use the Delete button just as before.

RKill found two defective system files with signatures, so they are either infected or corrupt, if the hard drive is having errors that would explain how they became corrupt which is more likely than infected.

I can alse see in the DDS logs another old version of Java that needs to be uninstalled: Java(TM) 6 Update 24 (64-bit)

I also see Registry Mechanic, you should never need to use a registry optimizer, they are a waste of time and money and can damage the system, I would recommend you remove it.

The next move is to run the System File Checker which should replace the corrupt files and to do a check on the hard drive.

*Disk Check*


Click on *Start* then type *cmd* in the search box. A menu will pop up with *cmd* at the top, *right click* on it and select *Run as Administrator*. Another box will open, at the prompt type *chkdsk /r* and hit *Enter*._ *Note:* you must include a space between the *k* and the */*_
You will then see the following message:
*chkdsk* cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts?* (Y/N)*
Type *Y* for yes, and hit *Enter*. Then reboot the computer. 
*chkdsk* will start when Windows begins loading again. Let all 5 phases run and don't use or turn off the computer. (_The *chkdsk* process may take an hour or more to finish, if it appears to freeze this is normal so *do not* interrupt it. On drives above 500GB it can take several hours._)
When the Disk Check is done, it will finish loading Windows.

Then follow this guide to find the *chkdsk* log. *NOTE:* You need to do the search for *wininit* not *chkdsk*.
Windows 7 Disk Check log

Once the log is in view then click on* Copy* in the right hand pane and select *"Copy details as text".*
You can then *right click* on the message box on this forum and select *Paste* and the log will appear, add any further information asked for and then click on *Submit/Post Quick Reply* and your done.


Click on *Start* and type *cmd* in the search box. Right click on *cmd* in the popup menu and select *Run as Administrator*.
Another box will open, at the Command Prompt, type *sfc /scannow* and press Enter. (Note the gap between the c and the /) 
Let the check run to completion. *DO NOT* reboot the PC or close the *cmd* window.
Copy & Paste the following command at the Command Prompt and press Enter:

* findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >%userprofile%\Desktop\sfcdetails.txt*


This will place a file on your desktop called *sfcdetails.txt* which contains the results of the scan.
Copy and Paste the contents of the file into your next post.


----------



## Mark1956 (May 7, 2011)

Our posts just crossed over, yup I will be turning in soon, 12.50AM here.

Malwarebytes made a detection which you didn't remove as instructed, run it again and check the detection for removal.

Take your time to complete the other instructions, I'll be back in the morning.


----------



## superfrog25 (Mar 25, 2011)

Thanks Mark,

I will look at this tomorrow morning but will uninstall the java tonight.

Until then have a great nights sleep.

Cheers chris


----------



## Mark1956 (May 7, 2011)

Thank you, speak with you tomorrow.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

The full result of the ADW scan below

# AdwCleaner v2.301 - Logfile created 05/24/2013 at 06:17:41
# Updated 16/05/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Home PC - HOME
# Boot Mode : Normal
# Running from : C:\Users\Home PC\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

***** [Registry] *****

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Registry is clean.

-\\ Mozilla Firefox v21.0 (en-GB)

File : C:\Users\Home PC\AppData\Roaming\Mozilla\Firefox\Profiles\b5cj1c7m.default-1369339943653\prefs.js

[OK] File is clean.

File : C:\Users\NEW Admin\AppData\Roaming\Mozilla\Firefox\Profiles\svx8t548.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [402 octets] - [23/05/2013 21:46:54]
AdwCleaner[S2].txt - [6813 octets] - [23/05/2013 21:48:06]
AdwCleaner[S3].txt - [924 octets] - [24/05/2013 06:17:41]

########## EOF - C:\AdwCleaner[S3].txt - [983 octets] ##########

Will have a go at the remainder in a bit

chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

See below the chkdsk results

Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 24/05/2013 08:49:04
Event ID:  1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Home
Description:

Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
204288 file records processed.

File verification completed.
433 large file records processed.

0 bad file records processed.

0 EA records processed.

82 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
268196 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
204288 file SDs/SIDs processed.

Cleaning up 547 unused index entries from index $SII of file 0x9.
Cleaning up 547 unused index entries from index $SDH of file 0x9.
Cleaning up 547 unused security descriptors.
Security descriptor verification completed.
31955 data files processed.

CHKDSK is verifying Usn Journal...
36763496 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
204272 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
106088470 free clusters processed.

Free space verification is complete.
Windows has checked the file system and found no problems.

472814591 KB total disk space.
48060836 KB in 149678 files.
78048 KB in 31956 indexes.
0 KB in bad sectors.
321827 KB in use by the system.
65536 KB occupied by the log file.
424353880 KB available on disk.

4096 bytes in each allocation unit.
118203647 total allocation units on disk.
106088470 allocation units available on disk.

Internal Info:
00 1e 03 00 8d c5 02 00 2a 25 04 00 00 00 00 00 ........*%......
72 0b 00 00 52 00 00 00 00 00 00 00 00 00 00 00 r...R...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-05-24T07:49:04.000000000Z" />
<EventRecordID>84510</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Home</Computer>
<Security />
</System>
<EventData>

Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
204288 file records processed.

File verification completed.
433 large file records processed.

0 bad file records processed.

0 EA records processed.

82 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
268196 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
204288 file SDs/SIDs processed.

Cleaning up 547 unused index entries from index $SII of file 0x9.
Cleaning up 547 unused index entries from index $SDH of file 0x9.
Cleaning up 547 unused security descriptors.
Security descriptor verification completed.
31955 data files processed.

CHKDSK is verifying Usn Journal...
36763496 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
204272 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
106088470 free clusters processed.

Free space verification is complete.
Windows has checked the file system and found no problems.

472814591 KB total disk space.
48060836 KB in 149678 files.
78048 KB in 31956 indexes.
0 KB in bad sectors.
321827 KB in use by the system.
65536 KB occupied by the log file.
424353880 KB available on disk.

4096 bytes in each allocation unit.
118203647 total allocation units on disk.
106088470 allocation units available on disk.

Internal Info:
00 1e 03 00 8d c5 02 00 2a 25 04 00 00 00 00 00 ........*%......
72 0b 00 00 52 00 00 00 00 00 00 00 00 00 00 00 r...R...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

</EventData>
</Event>

Onto the last one you asked me to do now.

Chris


----------



## Mark1956 (May 7, 2011)

Scans are looking good so far, we will see what the File Checker has to report.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I completed the last scan as instructed and copied and pasted the link but the message followed 

FINDSTR: Cannot open PC\desktop\sfcdetails.txt

Followed by

C:windows\system32>

I havent come out of the command box in case you want me to type something else

Chris


----------



## superfrog25 (Mar 25, 2011)

After the scan it said the following;

Windows resource protection found corrupt files and successfully repaired them.Details are included in the CBS.log windir\logs\CBS\CBS log. For example C:\windows\logs\CBS\CBS.log

I dont know if that helps

Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Is it ok to close the command box? Do you want me to give it another go?

Chris


----------



## Mark1956 (May 7, 2011)

You can close the command box, not sure why you got that error. Anyway it could be that the bad files have been fixed, please run RKill again and post the log so we can see.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,
I have run Rkill again.Please see log below;

Rkill 2.4.8 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 05/24/2013 10:37:05 AM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Defender Disabled

[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001

Checking Windows Service Integrity:

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

* FontCache => %SystemRoot%\system32\svchost.exe -k LocalService [Incorrect ImagePath]

Searching for Missing Digital Signatures:

* C:\Windows\System32\mshtml.dll [NoSig]
+-> C:\Windows\SysWOW64\mshtml.dll : 14,323,712 : 04/05/2013 00:26 AM : 7a468bc721c1d34e60389d3f2f87bbea [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_911ec38c929b31ec\mshtml.dll : 19,230,208 : 04/18/2013 00:49 AM : 394ecd933cd66badf97ea85a183b9e1e [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_91213bba929917b7\mshtml.dll : 19,231,232 : 04/05/2013 00:50 AM : c56ef4c50a1feed0cc9b7ae068cbbbbb [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_7a4a3764ac472c8f\mshtml.dll : 19,476,480 : 04/05/2013 00:11 AM : 6d81646922700482a82f253e73989ce4 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_8c235f42afcafdda\mshtml.dll : 8,988,160 : 11/21/2010 00:24 AM : 1c8b787baa52dead1a6fec1502d652f0 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17537_none_8c10c048afd881c1\mshtml.dll : 8,995,328 : 08/06/2011 00:56 AM : 688872e9cafcc2758e7fe92a0622b4f9 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21636_none_8c995cc9c8f70834\mshtml.dll : 8,995,328 : 08/06/2011 00:56 AM : d0afd5813136f0eac80a048740553840 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16421_none_87e150ddf4cd3dc7\mshtml.dll : 17,773,056 : 08/06/2011 00:40 AM : 82682ba2df50b94cd798b8315b3f7896 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16434_none_87d981cff4d2a5bd\mshtml.dll : 17,782,272 : 07/22/2011 00:52 AM : b721efcc393d76390a319a8a30b1b654 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16437_none_87dc82adf4cff1c2\mshtml.dll : 17,781,760 : 09/01/2011 00:34 AM : 02b4e6ccca443568764281391635f5a4 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16440_none_87cab0bbf4de5c52\mshtml.dll : 17,786,368 : 11/04/2011 00:38 AM : e7bd23bec69cf23436eede9b18de186d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16441_none_87cbb105f4dd75a9\mshtml.dll : 17,790,464 : 12/14/2011 00:43 AM : e61288581ad9e647abefb1489b250b5c [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16443_none_87cdb199f4dba857\mshtml.dll : 17,790,976 : 02/28/2012 00:34 AM : d785a16a6f03f76cb862f28c9f8c9672 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16446_none_87d0b277f4d8f45c\mshtml.dll : 17,807,360 : 05/18/2012 00:47 AM : de469470d93deb4a1a81ede72b848198 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16447_none_87d1b2c1f4d80db3\mshtml.dll : 17,807,360 : 06/02/2012 01:49 PM : 89c4b3bf66d3c2f3d83f9dedf1b218d6 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16448_none_87d2b30bf4d7270a\mshtml.dll : 17,809,920 : 06/29/2012 01:55 AM : 8415f4792d7bc07be328df56fe32045a [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16450_none_87bfe0cff4e67843\mshtml.dll : 17,810,944 : 08/24/2012 01:15 AM : f244da6dd2c365abafd076222c22c2be [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16455_none_87c4e241f4e1f6f6\mshtml.dll : 17,811,968 : 10/08/2012 01:19 PM : 6d4f838e72eeeb3d6fb16a5a45632560 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16457_none_87c6e2d5f4e029a4\mshtml.dll : 17,811,968 : 11/14/2012 01:06 AM : cff3c4abdcc5356b0674743bdf0fb674 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16464_none_87b9120bf4eaf990\mshtml.dll : 17,812,992 : 01/09/2013 01:48 AM : 14deb733acb08a71cc0783ed02ff1f8d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16470_none_87aa40f7f4f6b025\mshtml.dll : 17,815,040 : 02/02/2013 01:31 AM : 460723a080d6f22e56d45bc8c1f15b2a [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16476_none_87b042b3f4f1482f\mshtml.dll : 17,817,088 : 02/22/2013 01:57 AM : 1154fefc73880a2ef44295ef0dbdc59f [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20534_none_88631e9b0df04587\mshtml.dll : 17,782,272 : 07/22/2011 01:35 AM : 79184cda49ef6a445ff152ec58c7eb5d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20537_none_88661f790ded918c\mshtml.dll : 17,781,760 : 09/01/2011 01:58 AM : 0254785c0a7715e478fe89540a992cb5 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20544_none_88584eaf0df86178\mshtml.dll : 17,786,368 : 11/04/2011 01:06 AM : 5770c4ba825c42d6efd9486029747108 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20546_none_885a4f430df69426\mshtml.dll : 17,790,464 : 12/14/2011 01:57 AM : 153963f44a26a7840acdf52c2cd1b9dc [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20548_none_885c4fd70df4c6d4\mshtml.dll : 17,790,976 : 02/28/2012 01:54 AM : 97bb8c752a400556a4ff2e1aafa0a138 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20551_none_884a7de50e033164\mshtml.dll : 17,807,360 : 05/18/2012 01:35 AM : be1e4779329040ed334651cd877c416d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20553_none_884c7e790e016412\mshtml.dll : 17,807,360 : 06/02/2012 01:45 AM : 0c26f50d6c347ce294c84347e6faeaa8 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20554_none_884d7ec30e007d69\mshtml.dll : 17,809,920 : 06/29/2012 01:39 AM : c4de0e2b31f60acb15e6b4154e26298a [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20557_none_88507fa10dfdc96e\mshtml.dll : 17,810,944 : 08/24/2012 01:40 AM : 522a528c296a9aef3f0c289ff7093315 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20562_none_8840ae430e0a66ac\mshtml.dll : 17,812,992 : 10/08/2012 01:58 AM : 1fb8062d4c3a4c7b8eca7bbd1e743000 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20565_none_8843af210e07b2b1\mshtml.dll : 17,811,968 : 11/14/2012 01:57 AM : 5024cacd183e4c0fccde6db8a38eec7b [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20573_none_8836dea10e119bf4\mshtml.dll : 17,814,528 : 01/09/2013 01:46 AM : b6c5bc6d4e1d79cb8df107112a9f37cb [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20580_none_88290dd70e1c6be0\mshtml.dll : 17,815,040 : 02/02/2013 01:04 AM : 1cd82d510d370cb04bb6bd1c660aa96f [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20586_none_882f0f930e1703ea\mshtml.dll : 17,817,600 : 02/22/2013 01:12 AM : 0e860bf2bcddd94202a6ab9a10ee95eb [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_9b736ddec6fbf3e7\mshtml.dll : 14,323,200 : 04/18/2013 01:49 AM : d017bf8d92938eeb9b3a1d1c53fda152 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_9b75e60cc6f9d9b2\mshtml.dll : 14,323,712 : 04/05/2013 01:26 AM : 7a468bc721c1d34e60389d3f2f87bbea [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_849ee1b6e0a7ee8a\mshtml.dll : 14,353,408 : 04/05/2013 01:17 AM : 92d1c395680c2878f9778c1649c00cb0 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_96780994e42bbfd5\mshtml.dll : 5,977,600 : 11/21/2010 01:25 AM : c50799f0d47dfb9774f721521b6c41d5 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17537_none_96656a9ae43943bc\mshtml.dll : 5,980,672 : 08/06/2011 01:56 AM : 1c6045d48179d15a843486d12bec0eaf [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21636_none_96ee071bfd57ca2f\mshtml.dll : 5,980,672 : 08/06/2011 01:56 AM : 1011333570e1cecae8fac34c8d9461bc [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16421_none_9235fb30292dffc2\mshtml.dll : 12,268,544 : 08/06/2011 01:40 AM : 4def8126cabaa6cdc12103cd74c6a919 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16434_none_922e2c22293367b8\mshtml.dll : 12,273,664 : 07/22/2011 01:54 AM : e6d5c7e4aac0c682169aa5021386eff3 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16437_none_92312d002930b3bd\mshtml.dll : 12,275,200 : 09/01/2011 01:36 AM : 04e0cd31a63dfc0d73725a3d1768fb5a [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16440_none_921f5b0e293f1e4d\mshtml.dll : 12,279,808 : 11/03/2011 11:02 PM : 66c0aee61d1c5c35bf1b4642a153b114 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16441_none_92205b58293e37a4\mshtml.dll : 12,282,368 : 12/14/2011 11:30 AM : 497c9c3db953a60ec4f43a097e15f75e [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16443_none_92225bec293c6a52\mshtml.dll : 12,281,856 : 02/28/2012 11:52 AM : f82bf2cb075b49e9fab5ff213c45c020 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16446_none_92255cca2939b657\mshtml.dll : 12,314,624 : 05/18/2012 11:11 AM : 9fb58f71104107d44540af1195f7a14d [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16447_none_92265d142938cfae\mshtml.dll : 12,314,624 : 06/02/2012 11:07 AM : 6820a9e91aff7cb3a510360d8ccd9bdd [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16448_none_92275d5e2937e905\mshtml.dll : 12,317,184 : 06/29/2012 11:52 AM : 5e8e869e1342308752a37a2c90cca79d [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16450_none_92148b2229473a3e\mshtml.dll : 12,319,744 : 08/24/2012 11:27 AM : bb197f54a8f69eea8356b7f70e6d3a20 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16455_none_92198c942942b8f1\mshtml.dll : 12,320,768 : 10/08/2012 11:28 AM : 8d1bb1e5a033e8817ef94a9047630165 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16457_none_921b8d282940eb9f\mshtml.dll : 12,320,256 : 11/14/2012 11:48 AM : 07f649cd36f266bbe33b814fa678aa43 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16464_none_920dbc5e294bbb8b\mshtml.dll : 12,321,280 : 01/08/2013 10:23 PM : c97434c851c4821bd92d2831fdf1ecbe [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16470_none_91feeb4a29577220\mshtml.dll : 12,321,792 : 02/02/2013 10:09 AM : 263963d93a3ca8f685efa5966f1e6581 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16476_none_9204ed0629520a2a\mshtml.dll : 12,324,352 : 02/22/2013 10:05 AM : 658ebc74bd38d16805648c4775f7fa82 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20534_none_92b7c8ed42510782\mshtml.dll : 12,273,664 : 07/22/2011 10:53 AM : f2966190d2c20c585a730f9c0b3c7373 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20537_none_92bac9cb424e5387\mshtml.dll : 12,275,200 : 09/01/2011 10:07 AM : 8c93aed0a332209434b62162d03c38c9 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20544_none_92acf90142592373\mshtml.dll : 12,279,808 : 11/03/2011 11:35 PM : a21b983e40578d0e6cfa9864ac4e1219 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20546_none_92aef99542575621\mshtml.dll : 12,282,368 : 12/14/2011 11:41 AM : a29cfd4b9f6f2bbe06c8d64b6d07f1d4 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20548_none_92b0fa29425588cf\mshtml.dll : 12,281,856 : 02/28/2012 11:21 AM : b9e083b14b1994f1255983f2df31c7df [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20551_none_929f28374263f35f\mshtml.dll : 12,314,624 : 05/17/2012 11:53 PM : 761d9111f5a2619cb5060661d36fbfff [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20553_none_92a128cb4262260d\mshtml.dll : 12,314,624 : 06/02/2012 11:48 AM : 1abf770552ea9d4fe90f654468faf4ce [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20554_none_92a2291542613f64\mshtml.dll : 12,317,184 : 06/29/2012 11:11 AM : aec51857aec2f5ce4520366240afc671 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20557_none_92a529f3425e8b69\mshtml.dll : 12,319,744 : 08/24/2012 11:43 AM : 975d1ea99a0fe8104b72440995b3c20b [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20562_none_92955895426b28a7\mshtml.dll : 12,321,280 : 10/08/2012 11:12 AM : f7b251da2fa89933771289793dcaa08b [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20565_none_92985973426874ac\mshtml.dll : 12,321,280 : 11/14/2012 11:14 AM : 8021ef27048f9ece5286ea8c8eed23b8 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20573_none_928b88f342725def\mshtml.dll : 12,322,304 : 01/08/2013 09:17 PM : b6ad225b3bcc07332fbb2c2824315534 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20580_none_927db829427d2ddb\mshtml.dll : 12,322,304 : 02/02/2013 09:15 AM : 88c27474e61271b49677f22cee76fb3e [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20586_none_9283b9e54277c5e5\mshtml.dll : 12,324,864 : 02/22/2013 09:06 AM : 474d43d76e2a33fee21c6f4bb7c4a3b7 [Pos Repl]

* C:\Windows\System32\wininet.dll [NoSig]
+-> C:\Windows\SysWOW64\wininet.dll : 1,767,424 : 04/05/2013 00:28 AM : 5abb3f36af17007f33fa275e96a2c95e [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_7fc4a46e1244c8b6\wininet.dll : 2,240,512 : 04/18/2013 09:49 AM : 753c0848ae7872a3f59663078a517293 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_7fc71c9c1242ae81\wininet.dll : 2,242,048 : 04/05/2013 09:52 AM : 27a9000c534aa9badc9ee74940f50c6d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_68f018462bf0c359\wininet.dll : 2,247,168 : 04/05/2013 09:12 AM : 61962c7a2d6e32827f089e6f0a03e533 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_7ac940242f7494a4\wininet.dll : 1,188,864 : 11/21/2010 09:23 AM : f6c5302e1f4813d552f41a0ac82455e5 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16421_none_768731bf7476d491\wininet.dll : 1,389,056 : 08/06/2011 09:40 AM : 1bf2bcc7e3c26fd4c8ef0c9efb0cc25d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16434_none_767f62b1747c3c87\wininet.dll : 1,389,056 : 07/22/2011 09:36 AM : 0732b49b250e306f7a6591029af9885b [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16437_none_7682638f7479888c\wininet.dll : 1,389,056 : 09/01/2011 09:17 AM : 271e8fb1354aa205a214f280a6766e30 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_7670919d7487f31c\wininet.dll : 1,390,080 : 11/04/2011 09:44 AM : 69151e566295e5a977fe71ffafd3b3f8 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16441_none_767191e774870c73\wininet.dll : 1,390,080 : 12/14/2011 09:04 AM : b1ac85b6adc005cf3f9eb4e28dfdcce6 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16443_none_7673927b74853f21\wininet.dll : 1,390,080 : 02/28/2012 09:49 AM : 228443ff3a1fb0b974d278f7c6403fad [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16446_none_7676935974828b26\wininet.dll : 1,392,128 : 05/18/2012 09:59 AM : 870ecfebd41c7b8f9c6777748368d51f [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16447_none_767793a37481a47d\wininet.dll : 1,392,128 : 06/02/2012 01:05 PM : 5a45fa344f4ad99d903f4b20e43b89ec [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16448_none_767893ed7480bdd4\wininet.dll : 1,392,128 : 06/29/2012 01:49 AM : 8ea68fd3780dddd5072f8cb830b3cb3d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16450_none_7665c1b174900f0d\wininet.dll : 1,392,128 : 08/24/2012 01:21 AM : 3d165c53e40236a68b7102d1a622d4e0 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16455_none_766ac323748b8dc0\wininet.dll : 1,392,128 : 10/08/2012 01:23 AM : a19db004d954bbc9c4ec125711e1d1c2 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16457_none_766cc3b77489c06e\wininet.dll : 1,392,128 : 11/14/2012 01:04 AM : 5121db613e10a46a3c5085b479026aa7 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16464_none_765ef2ed7494905a\wininet.dll : 1,392,128 : 01/09/2013 01:12 AM : 435e9c764e1ef70058580996452be6a2 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16470_none_765021d974a046ef\wininet.dll : 1,392,128 : 02/02/2013 01:47 AM : fa274190682aa41a46b285208ed46a74 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16476_none_76562395749adef9\wininet.dll : 1,392,128 : 02/22/2013 01:20 AM : a4f6142caba82fb7293ece5ff864b440 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20534_none_7708ff7c8d99dc51\wininet.dll : 1,389,056 : 07/22/2011 01:17 AM : 1a5a6898e90546b476d4e8a56626fc96 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20537_none_770c005a8d972856\wininet.dll : 1,389,056 : 09/01/2011 01:39 AM : 1b2d2d8e611de70ceb13f104d39814ba [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_76fe2f908da1f842\wininet.dll : 1,390,080 : 11/04/2011 01:19 AM : 244d45f786e33c169a93f70ba63babf8 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20546_none_770030248da02af0\wininet.dll : 1,390,080 : 12/14/2011 01:10 AM : c2fa4dbd6bb91d1afd7d155120654ab9 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20548_none_770230b88d9e5d9e\wininet.dll : 1,390,080 : 02/28/2012 01:09 AM : b70cdc073f70e6d082a62ab5880d6b07 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20551_none_76f05ec68dacc82e\wininet.dll : 1,392,128 : 05/18/2012 01:47 AM : bdc16d105bf011d4b1c3f09cf7a64314 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20553_none_76f25f5a8daafadc\wininet.dll : 1,392,128 : 06/02/2012 01:09 AM : 571e809181ebf0a04fefaa9bc9961f5b [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20554_none_76f35fa48daa1433\wininet.dll : 1,392,128 : 06/29/2012 01:51 AM : 8ba7eda2656ed7fbc93bdd5cb02b8d4e [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20557_none_76f660828da76038\wininet.dll : 1,392,128 : 08/24/2012 01:53 AM : 456d4e9006df149c250d40b813290471 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20562_none_76e68f248db3fd76\wininet.dll : 1,392,128 : 10/08/2012 01:11 AM : 789ead6f3ce42f3322818988400986e9 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20565_none_76e990028db1497b\wininet.dll : 1,392,128 : 11/14/2012 01:01 AM : 5caf48f12e8cbd96d520f4efd5b97f76 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20573_none_76dcbf828dbb32be\wininet.dll : 1,392,128 : 01/08/2013 11:55 PM : 43a6a68f1f41b13ca4d580d40dfa57ee [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20580_none_76ceeeb88dc602aa\wininet.dll : 1,392,128 : 02/02/2013 11:16 AM : 4e0669b513805a7c2a303c8ededc8e03 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20586_none_76d4f0748dc09ab4\wininet.dll : 1,392,640 : 02/22/2013 11:37 AM : e6a459c8e90c4a873c923c44f3d9510b [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_23a608ea59e75780\wininet.dll : 1,766,912 : 04/18/2013 11:49 AM : cfe0cee587f9cea4c29deec6d85fc91c [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_23a8811859e53d4b\wininet.dll : 1,767,424 : 04/05/2013 11:28 AM : 5abb3f36af17007f33fa275e96a2c95e [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_0cd17cc273935223\wininet.dll : 1,775,616 : 04/05/2013 11:19 AM : 1d48b7f4618ee77430acecca1bca88e1 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_1eaaa4a07717236e\wininet.dll : 980,992 : 11/21/2010 11:24 AM : 44214c94911c7cfb1d52cb64d5e8368d [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16421_none_1a68963bbc19635b\wininet.dll : 1,126,912 : 08/06/2011 11:40 AM : a1236375b74ea63c75657d564890c436 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16434_none_1a60c72dbc1ecb51\wininet.dll : 1,126,912 : 07/22/2011 11:48 AM : 2c7332c222d1fe1fc57d622699a8c001 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16437_none_1a63c80bbc1c1756\wininet.dll : 1,126,912 : 09/01/2011 11:28 AM : d3788d91530cfa005bd516189a4c676e [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_1a51f619bc2a81e6\wininet.dll : 1,127,424 : 11/03/2011 10:39 PM : 02f98b5c0e397ad06124d84428cf8f1a [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16441_none_1a52f663bc299b3d\wininet.dll : 1,127,424 : 12/14/2011 10:57 AM : 1d94fa7c81d2ffe494af094619ba706f [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16443_none_1a54f6f7bc27cdeb\wininet.dll : 1,127,424 : 02/28/2012 10:11 AM : 44465367256d1c72b58f5abaa19e7016 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16446_none_1a57f7d5bc2519f0\wininet.dll : 1,129,472 : 05/17/2012 11:35 PM : 1c191a4f0960f21b5d58c8a65baf5427 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16447_none_1a58f81fbc243347\wininet.dll : 1,129,472 : 06/02/2012 11:25 AM : 8e87270c4704cf2951e1e7820d6c8a2b [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16448_none_1a59f869bc234c9e\wininet.dll : 1,129,472 : 06/29/2012 11:09 AM : 75a97a2c060e72ab49e071e08c7dd2ba [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16450_none_1a47262dbc329dd7\wininet.dll : 1,129,472 : 08/24/2012 11:51 AM : 5553611e2f9ea6f613079177f1233068 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16455_none_1a4c279fbc2e1c8a\wininet.dll : 1,129,472 : 10/08/2012 11:48 AM : 9cb0d2a9a77d91d9614355ee9ff00519 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16457_none_1a4e2833bc2c4f38\wininet.dll : 1,129,472 : 11/14/2012 11:57 AM : 7fa3a810f383588d46220967de8b64ff [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16464_none_1a405769bc371f24\wininet.dll : 1,129,472 : 01/08/2013 10:03 PM : b49b56b64f57699a1a663d2cf7d0a56f [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16470_none_1a318655bc42d5b9\wininet.dll : 1,129,472 : 02/02/2013 10:30 AM : 03728c624d05c2f157bbd46f6b7f6ea0 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16476_none_1a378811bc3d6dc3\wininet.dll : 1,129,472 : 02/22/2013 10:38 AM : c5b6468422db1c8aa36c32cbb0197e5e [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20534_none_1aea63f8d53c6b1b\wininet.dll : 1,126,912 : 07/22/2011 10:48 AM : aa75f065975fce762fc9bbf5a3c08368 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20537_none_1aed64d6d539b720\wininet.dll : 1,126,912 : 09/01/2011 10:57 AM : c0fcee8d760c70db6ef858bb2262288e [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_1adf940cd544870c\wininet.dll : 1,127,424 : 11/03/2011 11:07 PM : 32569df2f9bef05dd7d56e30590edfd9 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20546_none_1ae194a0d542b9ba\wininet.dll : 1,127,424 : 12/14/2011 11:28 AM : 022a78194e2c7106f5af9f2bc6ac8774 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20548_none_1ae39534d540ec68\wininet.dll : 1,127,424 : 02/28/2012 11:58 AM : 11a34dca08eb2a586246f2d6c2a81d58 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20551_none_1ad1c342d54f56f8\wininet.dll : 1,129,472 : 05/17/2012 11:19 PM : 43bac67996d8765a5f1b3a4ea6231e21 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20553_none_1ad3c3d6d54d89a6\wininet.dll : 1,129,472 : 06/02/2012 11:16 AM : e430161a632f9a8fe512de0ca5685559 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20554_none_1ad4c420d54ca2fd\wininet.dll : 1,129,472 : 06/28/2012 11:54 PM : 54c30a4066a28f9a017e095e283b2762 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20557_none_1ad7c4fed549ef02\wininet.dll : 1,129,472 : 08/24/2012 11:12 AM : 2895e29efcfc0b1bcf8aee1a0c67913c [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20562_none_1ac7f3a0d5568c40\wininet.dll : 1,129,472 : 10/08/2012 11:37 AM : 6e3ac8a54a1881806ba2b58539483788 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20565_none_1acaf47ed553d845\wininet.dll : 1,129,472 : 11/14/2012 11:33 AM : 0635d714351f842d43ea184e75c4a3ff [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20573_none_1abe23fed55dc188\wininet.dll : 1,129,472 : 01/08/2013 08:41 PM : 16c45e6881449c6330567e51c13920fa [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20580_none_1ab05334d5689174\wininet.dll : 1,129,472 : 02/02/2013 08:36 AM : 1284d72c04b553ed5382ea14303d66db [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20586_none_1ab654f0d563297e\wininet.dll : 1,129,984 : 02/22/2013 08:35 AM : 490e24d5e427dfa55b1c1182f0db861c [Pos Repl]

Checking HOSTS File:

* No issues found.

Program finished at: 05/24/2013 10:37:35 AM
Execution time: 0 hours(s), 0 minute(s), and 30 seconds(s)

Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Do I try installing flash again now?

Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Guess you are at work or busy mate.Will check my account for updates later.

Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Just in case you dont have a chance to get back to me tonight.I am on holiday tomorrow for a week so if I dont get a chance to respond I will take a look when I return.

Thanks for all your help and guidance so far its really appreciated

Hopefully we can resolve the flash issue soon

Regards
Chris


----------



## Mark1956 (May 7, 2011)

Hope you have a great holiday and I will leave you with these instructions for when you return.

After you have run OTM post the log and then do another run with the System File Checker and see if the log can be produced, if so post it, if not run Rkill again and post the new log.

Please download *OTM by OldTimer*. Save it to your desktop.

Double click *OTM.exe* to start the tool.


*Copy* the text in the code box below to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose *Copy*):


```
:Processes
explorer.exe

:Files
C:\Windows\System32\mshtml.dll |  C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_911ec38c929b31ec\mshtml.dll /replace
C:\Windows\System32\wininet.dll | C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_7fc4a46e1244c8b6\wininet.dll /replace
:Commands
[createrestorepoint]
[emptyflash]
[emptytemp]
[resethosts]
[reboot]
```

 Return to OTM, right click in the *"Paste Instructions for Items to be Moved"* window (under the yellow bar) and choose *Paste*.
Click the red *Moveit!* button.
All your desktop icons will disappear as the scan begins. It should complete within a few minutes.
Once complete you may see a box appear asking you to Restart the system to complete the file removal, accept it and it will reboot.
Even if that box does not appear the system should reboot as the command is included in the script.
When the system has come back to the desktop a Notepad document will open, please copy and paste that into your next post.

-- Note: The logs are saved here: C:\_OTM\MovedFiles


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Thanks,I had a nice holiday and followed your instructions today. They came up on notepad so I have copied the information from there.Please see below and thanks for your continued support.

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
Unable to replace file: C:\Windows\System32\mshtml.dll with C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_911ec38c929b31ec\mshtml.dll without a reboot.
Unable to replace file: C:\Windows\System32\wininet.dll with C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_7fc4a46e1244c8b6\wininet.dll without a reboot.
========== COMMANDS ==========
Restore point Set: OTM Restore Point

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 56466 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Emily

User: Home PC
->Flash cache emptied: 56994 bytes

User: louise
->Flash cache emptied: 2834 bytes

User: NEW Admin
->Flash cache emptied: 57171 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 101433 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Emily

User: Home PC
->Temp folder emptied: 24118349 bytes
->Temporary Internet Files folder emptied: 114664601 bytes
->Java cache emptied: 3232488 bytes
->FireFox cache emptied: 183131420 bytes
->Flash cache emptied: 0 bytes

User: louise
->Temp folder emptied: 115309 bytes
->Temporary Internet Files folder emptied: 10146581 bytes
->Flash cache emptied: 0 bytes

User: NEW Admin
->Temp folder emptied: 145671 bytes
->Temporary Internet Files folder emptied: 1847785 bytes
->FireFox cache emptied: 21964343 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 44140 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 13264317 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 753 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42287446 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 743 bytes
RecycleBin emptied: 1278283 bytes

Total Files Cleaned = 397.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTM by OldTimer - Version 3.1.21.0 log created on 06022013_100428

Files moved on Reboot...
File C:\Users\Home PC\AppData\Local\Temp\etilqs_WVvV2bvYh5OfoT6 not found!
C:\Users\Home PC\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Home PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
C:\Users\Home PC\AppData\Local\Mozilla\Firefox\Profiles\b5cj1c7m.default-1369339943653\startupCache\startupCache.4.little moved successfully.
C:\Users\Home PC\AppData\Local\Mozilla\Firefox\Profiles\b5cj1c7m.default-1369339943653\Cache\_CACHE_001_ moved successfully.
C:\Users\Home PC\AppData\Local\Mozilla\Firefox\Profiles\b5cj1c7m.default-1369339943653\Cache\_CACHE_002_ moved successfully.
C:\Users\Home PC\AppData\Local\Mozilla\Firefox\Profiles\b5cj1c7m.default-1369339943653\Cache\_CACHE_003_ moved successfully.
C:\Users\Home PC\AppData\Local\Mozilla\Firefox\Profiles\b5cj1c7m.default-1369339943653\Cache\_CACHE_MAP_ moved successfully.
C:\Users\Home PC\AppData\Local\Mozilla\Firefox\Profiles\b5cj1c7m.default-1369339943653\_CACHE_CLEAN_ moved successfully.
C:\Windows\SysWow64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

Registry entries deleted on Reboot...

Regards
Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Which system file checker did you mean.I am not sure which program you want me to run?

Chris


----------



## Mark1956 (May 7, 2011)

Looks like that scan has done the fix, please now run another scan with RKill and post the log.

There is a new version of RKill available so before you run it delete the icon and then download a fresh copy.


----------



## Mark1956 (May 7, 2011)

superfrog25 said:


> Hi Mark,
> 
> Which system file checker did you mean.I am not sure which program you want me to run?
> 
> Chris


 Our posts crossed over so I had not seen this one when I made my last post.

Instructions for SFC are in post 25.


----------



## superfrog25 (Mar 25, 2011)

Ran Rkill as advised and the results are below

Rkill 2.5.2 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 06/02/2013 10:46:16 AM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Defender Disabled

[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001

Checking Windows Service Integrity:

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

Searching for Missing Digital Signatures:

* C:\Windows\System32\mshtml.dll [NoSig]
+-> C:\Windows\SysWOW64\mshtml.dll : 14,323,712 : 04/05/2013 00:26 AM : 7a468bc721c1d34e60389d3f2f87bbea [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_911ec38c929b31ec\mshtml.dll : 19,230,208 : 04/18/2013 00:49 AM : 394ecd933cd66badf97ea85a183b9e1e [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_91213bba929917b7\mshtml.dll : 19,231,232 : 04/05/2013 00:50 AM : c56ef4c50a1feed0cc9b7ae068cbbbbb [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_7a4a3764ac472c8f\mshtml.dll : 19,476,480 : 04/05/2013 00:11 AM : 6d81646922700482a82f253e73989ce4 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_8c235f42afcafdda\mshtml.dll : 8,988,160 : 11/21/2010 00:24 AM : 1c8b787baa52dead1a6fec1502d652f0 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17537_none_8c10c048afd881c1\mshtml.dll : 8,995,328 : 08/06/2011 00:56 AM : 688872e9cafcc2758e7fe92a0622b4f9 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21636_none_8c995cc9c8f70834\mshtml.dll : 8,995,328 : 08/06/2011 00:56 AM : d0afd5813136f0eac80a048740553840 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16421_none_87e150ddf4cd3dc7\mshtml.dll : 17,773,056 : 08/06/2011 00:40 AM : 82682ba2df50b94cd798b8315b3f7896 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16434_none_87d981cff4d2a5bd\mshtml.dll : 17,782,272 : 07/22/2011 00:52 AM : b721efcc393d76390a319a8a30b1b654 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16437_none_87dc82adf4cff1c2\mshtml.dll : 17,781,760 : 09/01/2011 00:34 AM : 02b4e6ccca443568764281391635f5a4 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16440_none_87cab0bbf4de5c52\mshtml.dll : 17,786,368 : 11/04/2011 00:38 AM : e7bd23bec69cf23436eede9b18de186d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16441_none_87cbb105f4dd75a9\mshtml.dll : 17,790,464 : 12/14/2011 00:43 AM : e61288581ad9e647abefb1489b250b5c [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16443_none_87cdb199f4dba857\mshtml.dll : 17,790,976 : 02/28/2012 00:34 AM : d785a16a6f03f76cb862f28c9f8c9672 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16446_none_87d0b277f4d8f45c\mshtml.dll : 17,807,360 : 05/18/2012 00:47 AM : de469470d93deb4a1a81ede72b848198 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16447_none_87d1b2c1f4d80db3\mshtml.dll : 17,807,360 : 06/02/2012 01:49 PM : 89c4b3bf66d3c2f3d83f9dedf1b218d6 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16448_none_87d2b30bf4d7270a\mshtml.dll : 17,809,920 : 06/29/2012 01:55 AM : 8415f4792d7bc07be328df56fe32045a [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16450_none_87bfe0cff4e67843\mshtml.dll : 17,810,944 : 08/24/2012 01:15 AM : f244da6dd2c365abafd076222c22c2be [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16455_none_87c4e241f4e1f6f6\mshtml.dll : 17,811,968 : 10/08/2012 01:19 PM : 6d4f838e72eeeb3d6fb16a5a45632560 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16457_none_87c6e2d5f4e029a4\mshtml.dll : 17,811,968 : 11/14/2012 01:06 AM : cff3c4abdcc5356b0674743bdf0fb674 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16464_none_87b9120bf4eaf990\mshtml.dll : 17,812,992 : 01/09/2013 01:48 AM : 14deb733acb08a71cc0783ed02ff1f8d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16470_none_87aa40f7f4f6b025\mshtml.dll : 17,815,040 : 02/02/2013 01:31 AM : 460723a080d6f22e56d45bc8c1f15b2a [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16476_none_87b042b3f4f1482f\mshtml.dll : 17,817,088 : 02/22/2013 01:57 AM : 1154fefc73880a2ef44295ef0dbdc59f [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20534_none_88631e9b0df04587\mshtml.dll : 17,782,272 : 07/22/2011 01:35 AM : 79184cda49ef6a445ff152ec58c7eb5d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20537_none_88661f790ded918c\mshtml.dll : 17,781,760 : 09/01/2011 01:58 AM : 0254785c0a7715e478fe89540a992cb5 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20544_none_88584eaf0df86178\mshtml.dll : 17,786,368 : 11/04/2011 01:06 AM : 5770c4ba825c42d6efd9486029747108 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20546_none_885a4f430df69426\mshtml.dll : 17,790,464 : 12/14/2011 01:57 AM : 153963f44a26a7840acdf52c2cd1b9dc [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20548_none_885c4fd70df4c6d4\mshtml.dll : 17,790,976 : 02/28/2012 01:54 AM : 97bb8c752a400556a4ff2e1aafa0a138 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20551_none_884a7de50e033164\mshtml.dll : 17,807,360 : 05/18/2012 01:35 AM : be1e4779329040ed334651cd877c416d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20553_none_884c7e790e016412\mshtml.dll : 17,807,360 : 06/02/2012 01:45 AM : 0c26f50d6c347ce294c84347e6faeaa8 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20554_none_884d7ec30e007d69\mshtml.dll : 17,809,920 : 06/29/2012 01:39 AM : c4de0e2b31f60acb15e6b4154e26298a [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20557_none_88507fa10dfdc96e\mshtml.dll : 17,810,944 : 08/24/2012 01:40 AM : 522a528c296a9aef3f0c289ff7093315 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20562_none_8840ae430e0a66ac\mshtml.dll : 17,812,992 : 10/08/2012 01:58 AM : 1fb8062d4c3a4c7b8eca7bbd1e743000 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20565_none_8843af210e07b2b1\mshtml.dll : 17,811,968 : 11/14/2012 01:57 AM : 5024cacd183e4c0fccde6db8a38eec7b [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20573_none_8836dea10e119bf4\mshtml.dll : 17,814,528 : 01/09/2013 01:46 AM : b6c5bc6d4e1d79cb8df107112a9f37cb [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20580_none_88290dd70e1c6be0\mshtml.dll : 17,815,040 : 02/02/2013 01:04 AM : 1cd82d510d370cb04bb6bd1c660aa96f [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20586_none_882f0f930e1703ea\mshtml.dll : 17,817,600 : 02/22/2013 01:12 AM : 0e860bf2bcddd94202a6ab9a10ee95eb [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_9b736ddec6fbf3e7\mshtml.dll : 14,323,200 : 04/18/2013 01:49 AM : d017bf8d92938eeb9b3a1d1c53fda152 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_9b75e60cc6f9d9b2\mshtml.dll : 14,323,712 : 04/05/2013 01:26 AM : 7a468bc721c1d34e60389d3f2f87bbea [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_849ee1b6e0a7ee8a\mshtml.dll : 14,353,408 : 04/05/2013 01:17 AM : 92d1c395680c2878f9778c1649c00cb0 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_96780994e42bbfd5\mshtml.dll : 5,977,600 : 11/21/2010 01:25 AM : c50799f0d47dfb9774f721521b6c41d5 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17537_none_96656a9ae43943bc\mshtml.dll : 5,980,672 : 08/06/2011 01:56 AM : 1c6045d48179d15a843486d12bec0eaf [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21636_none_96ee071bfd57ca2f\mshtml.dll : 5,980,672 : 08/06/2011 01:56 AM : 1011333570e1cecae8fac34c8d9461bc [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16421_none_9235fb30292dffc2\mshtml.dll : 12,268,544 : 08/06/2011 01:40 AM : 4def8126cabaa6cdc12103cd74c6a919 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16434_none_922e2c22293367b8\mshtml.dll : 12,273,664 : 07/22/2011 01:54 AM : e6d5c7e4aac0c682169aa5021386eff3 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16437_none_92312d002930b3bd\mshtml.dll : 12,275,200 : 09/01/2011 01:36 AM : 04e0cd31a63dfc0d73725a3d1768fb5a [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16440_none_921f5b0e293f1e4d\mshtml.dll : 12,279,808 : 11/03/2011 11:02 PM : 66c0aee61d1c5c35bf1b4642a153b114 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16441_none_92205b58293e37a4\mshtml.dll : 12,282,368 : 12/14/2011 11:30 AM : 497c9c3db953a60ec4f43a097e15f75e [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16443_none_92225bec293c6a52\mshtml.dll : 12,281,856 : 02/28/2012 11:52 AM : f82bf2cb075b49e9fab5ff213c45c020 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16446_none_92255cca2939b657\mshtml.dll : 12,314,624 : 05/18/2012 11:11 AM : 9fb58f71104107d44540af1195f7a14d [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16447_none_92265d142938cfae\mshtml.dll : 12,314,624 : 06/02/2012 11:07 AM : 6820a9e91aff7cb3a510360d8ccd9bdd [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16448_none_92275d5e2937e905\mshtml.dll : 12,317,184 : 06/29/2012 11:52 AM : 5e8e869e1342308752a37a2c90cca79d [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16450_none_92148b2229473a3e\mshtml.dll : 12,319,744 : 08/24/2012 11:27 AM : bb197f54a8f69eea8356b7f70e6d3a20 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16455_none_92198c942942b8f1\mshtml.dll : 12,320,768 : 10/08/2012 11:28 AM : 8d1bb1e5a033e8817ef94a9047630165 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16457_none_921b8d282940eb9f\mshtml.dll : 12,320,256 : 11/14/2012 11:48 AM : 07f649cd36f266bbe33b814fa678aa43 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16464_none_920dbc5e294bbb8b\mshtml.dll : 12,321,280 : 01/08/2013 10:23 PM : c97434c851c4821bd92d2831fdf1ecbe [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16470_none_91feeb4a29577220\mshtml.dll : 12,321,792 : 02/02/2013 10:09 AM : 263963d93a3ca8f685efa5966f1e6581 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16476_none_9204ed0629520a2a\mshtml.dll : 12,324,352 : 02/22/2013 10:05 AM : 658ebc74bd38d16805648c4775f7fa82 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20534_none_92b7c8ed42510782\mshtml.dll : 12,273,664 : 07/22/2011 10:53 AM : f2966190d2c20c585a730f9c0b3c7373 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20537_none_92bac9cb424e5387\mshtml.dll : 12,275,200 : 09/01/2011 10:07 AM : 8c93aed0a332209434b62162d03c38c9 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20544_none_92acf90142592373\mshtml.dll : 12,279,808 : 11/03/2011 11:35 PM : a21b983e40578d0e6cfa9864ac4e1219 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20546_none_92aef99542575621\mshtml.dll : 12,282,368 : 12/14/2011 11:41 AM : a29cfd4b9f6f2bbe06c8d64b6d07f1d4 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20548_none_92b0fa29425588cf\mshtml.dll : 12,281,856 : 02/28/2012 11:21 AM : b9e083b14b1994f1255983f2df31c7df [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20551_none_929f28374263f35f\mshtml.dll : 12,314,624 : 05/17/2012 11:53 PM : 761d9111f5a2619cb5060661d36fbfff [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20553_none_92a128cb4262260d\mshtml.dll : 12,314,624 : 06/02/2012 11:48 AM : 1abf770552ea9d4fe90f654468faf4ce [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20554_none_92a2291542613f64\mshtml.dll : 12,317,184 : 06/29/2012 11:11 AM : aec51857aec2f5ce4520366240afc671 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20557_none_92a529f3425e8b69\mshtml.dll : 12,319,744 : 08/24/2012 11:43 AM : 975d1ea99a0fe8104b72440995b3c20b [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20562_none_92955895426b28a7\mshtml.dll : 12,321,280 : 10/08/2012 11:12 AM : f7b251da2fa89933771289793dcaa08b [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20565_none_92985973426874ac\mshtml.dll : 12,321,280 : 11/14/2012 11:14 AM : 8021ef27048f9ece5286ea8c8eed23b8 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20573_none_928b88f342725def\mshtml.dll : 12,322,304 : 01/08/2013 09:17 PM : b6ad225b3bcc07332fbb2c2824315534 [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20580_none_927db829427d2ddb\mshtml.dll : 12,322,304 : 02/02/2013 09:15 AM : 88c27474e61271b49677f22cee76fb3e [Pos Repl]
+-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20586_none_9283b9e54277c5e5\mshtml.dll : 12,324,864 : 02/22/2013 09:06 AM : 474d43d76e2a33fee21c6f4bb7c4a3b7 [Pos Repl]

* C:\Windows\System32\wininet.dll [NoSig]
+-> C:\Windows\SysWOW64\wininet.dll : 1,767,424 : 04/05/2013 00:28 AM : 5abb3f36af17007f33fa275e96a2c95e [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_7fc4a46e1244c8b6\wininet.dll : 2,240,512 : 04/18/2013 09:49 AM : 753c0848ae7872a3f59663078a517293 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_7fc71c9c1242ae81\wininet.dll : 2,242,048 : 04/05/2013 09:52 AM : 27a9000c534aa9badc9ee74940f50c6d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_68f018462bf0c359\wininet.dll : 2,247,168 : 04/05/2013 09:12 AM : 61962c7a2d6e32827f089e6f0a03e533 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_7ac940242f7494a4\wininet.dll : 1,188,864 : 11/21/2010 09:23 AM : f6c5302e1f4813d552f41a0ac82455e5 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16421_none_768731bf7476d491\wininet.dll : 1,389,056 : 08/06/2011 09:40 AM : 1bf2bcc7e3c26fd4c8ef0c9efb0cc25d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16434_none_767f62b1747c3c87\wininet.dll : 1,389,056 : 07/22/2011 09:36 AM : 0732b49b250e306f7a6591029af9885b [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16437_none_7682638f7479888c\wininet.dll : 1,389,056 : 09/01/2011 09:17 AM : 271e8fb1354aa205a214f280a6766e30 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_7670919d7487f31c\wininet.dll : 1,390,080 : 11/04/2011 09:44 AM : 69151e566295e5a977fe71ffafd3b3f8 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16441_none_767191e774870c73\wininet.dll : 1,390,080 : 12/14/2011 09:04 AM : b1ac85b6adc005cf3f9eb4e28dfdcce6 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16443_none_7673927b74853f21\wininet.dll : 1,390,080 : 02/28/2012 09:49 AM : 228443ff3a1fb0b974d278f7c6403fad [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16446_none_7676935974828b26\wininet.dll : 1,392,128 : 05/18/2012 09:59 AM : 870ecfebd41c7b8f9c6777748368d51f [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16447_none_767793a37481a47d\wininet.dll : 1,392,128 : 06/02/2012 01:05 PM : 5a45fa344f4ad99d903f4b20e43b89ec [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16448_none_767893ed7480bdd4\wininet.dll : 1,392,128 : 06/29/2012 01:49 AM : 8ea68fd3780dddd5072f8cb830b3cb3d [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16450_none_7665c1b174900f0d\wininet.dll : 1,392,128 : 08/24/2012 01:21 AM : 3d165c53e40236a68b7102d1a622d4e0 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16455_none_766ac323748b8dc0\wininet.dll : 1,392,128 : 10/08/2012 01:23 AM : a19db004d954bbc9c4ec125711e1d1c2 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16457_none_766cc3b77489c06e\wininet.dll : 1,392,128 : 11/14/2012 01:04 AM : 5121db613e10a46a3c5085b479026aa7 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16464_none_765ef2ed7494905a\wininet.dll : 1,392,128 : 01/09/2013 01:12 AM : 435e9c764e1ef70058580996452be6a2 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16470_none_765021d974a046ef\wininet.dll : 1,392,128 : 02/02/2013 01:47 AM : fa274190682aa41a46b285208ed46a74 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16476_none_76562395749adef9\wininet.dll : 1,392,128 : 02/22/2013 01:20 AM : a4f6142caba82fb7293ece5ff864b440 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20534_none_7708ff7c8d99dc51\wininet.dll : 1,389,056 : 07/22/2011 01:17 AM : 1a5a6898e90546b476d4e8a56626fc96 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20537_none_770c005a8d972856\wininet.dll : 1,389,056 : 09/01/2011 01:39 AM : 1b2d2d8e611de70ceb13f104d39814ba [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_76fe2f908da1f842\wininet.dll : 1,390,080 : 11/04/2011 01:19 AM : 244d45f786e33c169a93f70ba63babf8 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20546_none_770030248da02af0\wininet.dll : 1,390,080 : 12/14/2011 01:10 AM : c2fa4dbd6bb91d1afd7d155120654ab9 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20548_none_770230b88d9e5d9e\wininet.dll : 1,390,080 : 02/28/2012 01:09 AM : b70cdc073f70e6d082a62ab5880d6b07 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20551_none_76f05ec68dacc82e\wininet.dll : 1,392,128 : 05/18/2012 01:47 AM : bdc16d105bf011d4b1c3f09cf7a64314 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20553_none_76f25f5a8daafadc\wininet.dll : 1,392,128 : 06/02/2012 01:09 AM : 571e809181ebf0a04fefaa9bc9961f5b [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20554_none_76f35fa48daa1433\wininet.dll : 1,392,128 : 06/29/2012 01:51 AM : 8ba7eda2656ed7fbc93bdd5cb02b8d4e [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20557_none_76f660828da76038\wininet.dll : 1,392,128 : 08/24/2012 01:53 AM : 456d4e9006df149c250d40b813290471 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20562_none_76e68f248db3fd76\wininet.dll : 1,392,128 : 10/08/2012 01:11 AM : 789ead6f3ce42f3322818988400986e9 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20565_none_76e990028db1497b\wininet.dll : 1,392,128 : 11/14/2012 01:01 AM : 5caf48f12e8cbd96d520f4efd5b97f76 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20573_none_76dcbf828dbb32be\wininet.dll : 1,392,128 : 01/08/2013 11:55 PM : 43a6a68f1f41b13ca4d580d40dfa57ee [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20580_none_76ceeeb88dc602aa\wininet.dll : 1,392,128 : 02/02/2013 11:16 AM : 4e0669b513805a7c2a303c8ededc8e03 [Pos Repl]
+-> C:\Windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20586_none_76d4f0748dc09ab4\wininet.dll : 1,392,640 : 02/22/2013 11:37 AM : e6a459c8e90c4a873c923c44f3d9510b [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_23a608ea59e75780\wininet.dll : 1,766,912 : 04/18/2013 11:49 AM : cfe0cee587f9cea4c29deec6d85fc91c [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_23a8811859e53d4b\wininet.dll : 1,767,424 : 04/05/2013 11:28 AM : 5abb3f36af17007f33fa275e96a2c95e [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_0cd17cc273935223\wininet.dll : 1,775,616 : 04/05/2013 11:19 AM : 1d48b7f4618ee77430acecca1bca88e1 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_1eaaa4a07717236e\wininet.dll : 980,992 : 11/21/2010 11:24 AM : 44214c94911c7cfb1d52cb64d5e8368d [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16421_none_1a68963bbc19635b\wininet.dll : 1,126,912 : 08/06/2011 11:40 AM : a1236375b74ea63c75657d564890c436 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16434_none_1a60c72dbc1ecb51\wininet.dll : 1,126,912 : 07/22/2011 11:48 AM : 2c7332c222d1fe1fc57d622699a8c001 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16437_none_1a63c80bbc1c1756\wininet.dll : 1,126,912 : 09/01/2011 11:28 AM : d3788d91530cfa005bd516189a4c676e [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_1a51f619bc2a81e6\wininet.dll : 1,127,424 : 11/03/2011 10:39 PM : 02f98b5c0e397ad06124d84428cf8f1a [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16441_none_1a52f663bc299b3d\wininet.dll : 1,127,424 : 12/14/2011 10:57 AM : 1d94fa7c81d2ffe494af094619ba706f [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16443_none_1a54f6f7bc27cdeb\wininet.dll : 1,127,424 : 02/28/2012 10:11 AM : 44465367256d1c72b58f5abaa19e7016 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16446_none_1a57f7d5bc2519f0\wininet.dll : 1,129,472 : 05/17/2012 11:35 PM : 1c191a4f0960f21b5d58c8a65baf5427 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16447_none_1a58f81fbc243347\wininet.dll : 1,129,472 : 06/02/2012 11:25 AM : 8e87270c4704cf2951e1e7820d6c8a2b [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16448_none_1a59f869bc234c9e\wininet.dll : 1,129,472 : 06/29/2012 11:09 AM : 75a97a2c060e72ab49e071e08c7dd2ba [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16450_none_1a47262dbc329dd7\wininet.dll : 1,129,472 : 08/24/2012 11:51 AM : 5553611e2f9ea6f613079177f1233068 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16455_none_1a4c279fbc2e1c8a\wininet.dll : 1,129,472 : 10/08/2012 11:48 AM : 9cb0d2a9a77d91d9614355ee9ff00519 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16457_none_1a4e2833bc2c4f38\wininet.dll : 1,129,472 : 11/14/2012 11:57 AM : 7fa3a810f383588d46220967de8b64ff [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16464_none_1a405769bc371f24\wininet.dll : 1,129,472 : 01/08/2013 10:03 PM : b49b56b64f57699a1a663d2cf7d0a56f [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16470_none_1a318655bc42d5b9\wininet.dll : 1,129,472 : 02/02/2013 10:30 AM : 03728c624d05c2f157bbd46f6b7f6ea0 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16476_none_1a378811bc3d6dc3\wininet.dll : 1,129,472 : 02/22/2013 10:38 AM : c5b6468422db1c8aa36c32cbb0197e5e [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20534_none_1aea63f8d53c6b1b\wininet.dll : 1,126,912 : 07/22/2011 10:48 AM : aa75f065975fce762fc9bbf5a3c08368 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20537_none_1aed64d6d539b720\wininet.dll : 1,126,912 : 09/01/2011 10:57 AM : c0fcee8d760c70db6ef858bb2262288e [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_1adf940cd544870c\wininet.dll : 1,127,424 : 11/03/2011 11:07 PM : 32569df2f9bef05dd7d56e30590edfd9 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20546_none_1ae194a0d542b9ba\wininet.dll : 1,127,424 : 12/14/2011 11:28 AM : 022a78194e2c7106f5af9f2bc6ac8774 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20548_none_1ae39534d540ec68\wininet.dll : 1,127,424 : 02/28/2012 11:58 AM : 11a34dca08eb2a586246f2d6c2a81d58 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20551_none_1ad1c342d54f56f8\wininet.dll : 1,129,472 : 05/17/2012 11:19 PM : 43bac67996d8765a5f1b3a4ea6231e21 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20553_none_1ad3c3d6d54d89a6\wininet.dll : 1,129,472 : 06/02/2012 11:16 AM : e430161a632f9a8fe512de0ca5685559 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20554_none_1ad4c420d54ca2fd\wininet.dll : 1,129,472 : 06/28/2012 11:54 PM : 54c30a4066a28f9a017e095e283b2762 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20557_none_1ad7c4fed549ef02\wininet.dll : 1,129,472 : 08/24/2012 11:12 AM : 2895e29efcfc0b1bcf8aee1a0c67913c [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20562_none_1ac7f3a0d5568c40\wininet.dll : 1,129,472 : 10/08/2012 11:37 AM : 6e3ac8a54a1881806ba2b58539483788 [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20565_none_1acaf47ed553d845\wininet.dll : 1,129,472 : 11/14/2012 11:33 AM : 0635d714351f842d43ea184e75c4a3ff [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20573_none_1abe23fed55dc188\wininet.dll : 1,129,472 : 01/08/2013 08:41 PM : 16c45e6881449c6330567e51c13920fa [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20580_none_1ab05334d5689174\wininet.dll : 1,129,472 : 02/02/2013 08:36 AM : 1284d72c04b553ed5382ea14303d66db [Pos Repl]
+-> C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20586_none_1ab654f0d563297e\wininet.dll : 1,129,984 : 02/22/2013 08:35 AM : 490e24d5e427dfa55b1c1182f0db861c [Pos Repl]

Checking HOSTS File:

* HOSTS file entries found:

ÿþ1 2 7 . 0 . 0 . 1 l o c a l h o s t

: : 1 l o c a l h o s t

Program finished at: 06/02/2013 10:46:53 AM
Execution time: 0 hours(s), 0 minute(s), and 36 seconds(s)

Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

This was the one I had a problem with the last time.For some reason it doesnt provide a report on my desktop. I have saved it on powerpoint but cant see a way to attach it if you want to see it? I copied the link in the instruction on post 25 but it says cannot open on the cmd box. Can I shut this down and is there a way to attach the powerpoint file.Sorry I took so long I thought you wanted me to complete a chkdsk first.

Chris


----------



## superfrog25 (Mar 25, 2011)

Mark

Managed to get it to scan now.I will let you know if it creates the result report on my dektop.It is scanning now.

Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

It states

C:windows\system32.sfc / scannow

Beginning system scan. This process will take some time

Beginning verification phase of system scan.
Verification 100% complete

Windows Resource Protection did not find any violations

C:\windows\system32.findstr / c:"[SR]" %windir%\logs\cbs\cbs.log . userprofile%\desktop\sfcdetails.txt
FINDSTR: Cannot open PC\desktop\sfcdetails.txt

C:Windows\system32>

I have had to type it as it wouldnt save to my desktop. Can I close the CMD window now?

Chris


----------



## Mark1956 (May 7, 2011)

Rkill showed the same files again with the missing signatures, but now the System File Checker is showing no violations were found.

I still can't figure out why the command being used is not creating the log file.

I think to be on the safe side we need to run another couple of scans.

*STEP 1*
*NOTE:* If you have already used Combofix please delete the icon from your desktop.


Please download DeFogger and save it to your desktop.
Once downloaded, double-click on the *DeFogger* icon to start the tool.
The application window will appear.
You should now click on the *Disable* button to disable your CD Emulation drivers.
When it prompts you whether or not you want to continue, please click on the *Yes* button to continue.
When the program has completed you will see a *Finished!* message. Click on the *OK* button to exit the program.
If CD Emulation programs are present and have been disabled, *DeFogger* will now ask you to reboot the machine. Please allow it to do so by clicking on the *OK* button.

*STEP 2*
Please download *ComboFix*







from one of the locations below and *save it to your Desktop. <-Important!!!*


Download Mirror #1
Download Mirror #2

Be sure to print out and follow these instructions: *A guide and tutorial on using ComboFix*

*Vista*/*Windows 7* users can skip the Recovery Console instructions and use the Windows DVD to boot into the Vista Recovery Environment or Windows 7 System Recovery Options if something goes awry. If you do not have a Windows 7 DVD then please create a Windows 7 Repair Disc. *XP* users need to install the Recovery Console first, just follow the prompts when you run it.


Temporarily *disable* your *anti-virus*, script blocking and any *anti-malware* real-time protection _*before*_ performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause _"unpredictable results"_. Click this link to see a list of such programs and how to disable them.
If ComboFix detects an older version of itself, you will be asked to update the program.
ComboFix will begin by showing a Disclaimer. Read it and click *I Agree* if you want to continue.
Follow the prompts and click on *Yes* to continue scanning for malware.
If using Windows 7 or Vista and you receive a UAC prompt asking if you want to continue running the program, you should press the *Continue* button.
When finished, please copy and paste the contents of C:\*ComboFix.txt* (_which will open after reboot_) in your next reply.
Be sure to *re-enable* your anti-virus and other security programs.

_-- Do not touch your mouse/keyboard until the ComboFix scan has completed, as this may cause the process to stall or the computer to lock.
-- ComboFix will temporarily disable your desktop, and if interrupted may leave it disabled. If this occurs, please reboot to restore it.
-- ComboFix disables autorun of all CD, floppy and USB devices to assist with malware removal and increase security._

If you no longer have access to your Internet connection after running ComboFix, please reboot to restore it. If that does not restore the connection, then follow the instructions for Manually restoring the Internet connection provided in the "_How to Guide_" you printed out earlier. Those instructions only apply to XP, for Vista and Windows 7 go here: Internet connection repair

*NOTE:* if you see a message like this when you attempt to open anything after the reboot *"Illegal Operation attempted on a registry key that has been marked for deletion"* please reboot the system again and the warning should not return.



> *Do NOT use ComboFix* unless you have been instructed to do so by a Malware Removal Expert. It is a powerful tool intended by its creator to be used under the guidance and supervision of an expert, *NOT for general public or personal use*. *Using this tool incorrectly could lead to serious problems with your operating system such as preventing it from ever starting again.* This site, sUBs and myself *will not* be responsible for any damage caused to your machine by misusing or running ComboFix on your own. Please read *ComboFix's Disclaimer*.


==================================================================

*Eset online scan instructions.*
*IMPORTANT --->* Please make sure you follow the instruction to *uncheck* the box next to *Remove found threats*. Eset will detect anything that looks even remotely suspicious, this can include legitimate program files. If you do not uncheck the box, as instructed, Eset will automatically remove all suspect files which could leave some of your software inoperative. If you make a mistake these files can be restored from quarantine, but it would be preferable not to add any extra work to the clean up of your system.


Disable your existing Anti Virus following these instructions.
Please go here to use the Eset Online Scanner.
When the web page opens click on this button








If you are not using *Internet Explorer* you will see a message box open asking you to to download the *ESET Smart Installer*, click on the link and allow it to download and then run it. Accept the *Terms of use* and click on *Start*. The required components will download.
If using Internet Explorer the *Terms of use* box will open immediately, accept it and click on *Start*.
After the download is complete the *Computer scan settings* window will open, *IMPORTANT ---->* *uncheck* the box next to *Remove found threats* and click on *Start*. The virus signature database will then download which may take some time depending on the speed of your internet connection. The scan will automatically start when the download is complete.
This is a very thorough scan and may take several hours to complete depending on how much data you have on your hard drive. *Do not* interrupt it, be patient and let it finish.
A Scan Results window will appear at the end of the scan. If it lists any number of Infected Files click on List of found threats. Click on Copy to clipboard, come back to this thread and right click on the message box. Select *Paste* and the report will appear, add any comments you have and post the reply.
Back on the *Eset* window, click the *Back* button and then click on *Finish*.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

OMG scary!! I have completed step 1 Defogger. Can I just check I have turned my firewall off in Mcafee and when I checked the windows firewall it stated that These settings are being managed by vendor application Mcafee personal firewall. As I have shut this down I presume I can continue once I have stopped the anti - malware.I have a trial version you asked me to download while you have been helping me.Shall I uninstall it? I have been getting a message saying it expires in 4 days anyway?

Chris


----------



## Mark1956 (May 7, 2011)

I don't see any post where I suggested you installed a trial version of McAfee. I always recommend Microsoft Security Essentials when there is no Anti Virus installed.

Please download MSE from the link above and save it to your desktop. Then download this tool McAfee Removal Tool and also save that to your desktop.

Disconnect from the Internet and uninstall McAfee, then run the Removal Tool. Reboot the system and disconnected from the internet again. Then install MSE, reconnect to the Internet, run MSE and let it update, run a Full system scan with it and remove anything it finds and report back with a list of any detections.

Then proceed with running Combofix and post the log produced. When done re-enable MSE and then run Eset.

To disable MSE:

Click on the icon in the Taskbar, then click on *Open* which should appear.
Click on the *Settings* tab and select *Real-time protection* in the list on the left.
Click on the check box to clear it next to *Turn on real-time protection (recommended).*
Click on *Save Changes* and close the window.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Step 2 complete,

Please see below;

ComboFix 13-06-02.02 - Home PC 02/06/2013 19:27:17.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.2013.685 [GMT 1:00]
Running from: c:\users\Home PC\Downloads\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
FW: McAfee Firewall *Disabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\6261\AddOnDownloaded\1b0b3c38-2b97-4f8d-954b-06296209b73d.dll
c:\programdata\PCDr\6261\AddOnDownloaded\1e512ef2-01fb-49fb-b09b-71de0eac4612.dll
c:\programdata\PCDr\6261\AddOnDownloaded\27ada864-54d8-46c9-a6e3-8334fa39b525.dll
c:\programdata\PCDr\6261\AddOnDownloaded\2eccd5d6-e118-4f76-97b6-ba56fb6c597a.dll
c:\programdata\PCDr\6261\AddOnDownloaded\3e0b29b2-9809-4050-abfc-ef8aff73ceab.dll
c:\programdata\PCDr\6261\AddOnDownloaded\5f2ce3e8-3c56-40bb-86d6-a1a41867000b.dll
c:\programdata\PCDr\6261\AddOnDownloaded\7b6e388f-35d0-44f8-aa2c-20538273473f.dll
c:\programdata\PCDr\6261\AddOnDownloaded\97cd9b9c-9747-469a-acfa-cfbf8aed528a.dll
c:\programdata\PCDr\6261\AddOnDownloaded\b69d9551-76e9-4872-95f8-075916f82d74.dll
c:\programdata\PCDr\6261\AddOnDownloaded\bea3f575-677a-4c92-89ca-7be8480c11a9.dll
c:\programdata\ZeoBIT
.
.
((((((((((((((((((((((((( Files Created from 2013-05-02 to 2013-06-02 )))))))))))))))))))))))))))))))
.
.
2013-06-02 09:04 . 2013-06-02 09:04 -------- d-----w- C:\_OTM
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-06-01 16:01 . 2013-06-01 16:01 -------- d-----w- c:\program files (x86)\QuickTime
2013-06-01 15:58 . 2013-06-01 15:58 -------- d-----w- c:\program files\iPod
2013-06-01 15:58 . 2013-06-01 15:59 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-01 15:58 . 2013-06-01 15:59 -------- d-----w- c:\program files\iTunes
2013-06-01 15:58 . 2013-06-01 15:59 -------- d-----w- c:\program files (x86)\iTunes
2013-05-23 21:17 . 2013-05-23 21:17 -------- d-----w- c:\users\Home PC\AppData\Roaming\Malwarebytes
2013-05-23 21:17 . 2013-05-23 21:17 -------- d-----w- c:\programdata\Malwarebytes
2013-05-23 18:00 . 2013-05-23 18:00 -------- d-----w- c:\program files (x86)\Windows Resource Kits
2013-05-23 10:03 . 2013-05-23 10:13 -------- d-----w- c:\users\NEW Admin
2013-05-22 11:06 . 2013-05-22 11:06 262552 ----a-w- c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
2013-05-22 08:08 . 2013-05-22 08:08 -------- d-----w- c:\programdata\PC-Doctor for Windows
2013-05-22 08:07 . 2013-05-22 08:08 -------- d-----w- c:\program files\My Dell
2013-05-20 07:36 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-20 07:36 . 2013-04-10 06:01 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-20 07:36 . 2011-02-03 11:25 144384 ----a-w- c:\windows\system32\cdd.dll
2013-05-20 07:36 . 2013-02-27 05:52 14172672 ----a-w- c:\windows\system32\shell32.dll
2013-05-20 07:35 . 2013-02-27 05:48 1930752 ----a-w- c:\windows\system32\authui.dll
2013-05-20 07:35 . 2013-02-27 05:52 197120 ----a-w- c:\windows\system32\shdocvw.dll
2013-05-20 07:35 . 2013-02-27 06:02 111448 ----a-w- c:\windows\system32\consent.exe
2013-05-20 07:35 . 2013-02-27 05:47 70144 ----a-w- c:\windows\system32\appinfo.dll
2013-05-20 07:35 . 2013-02-27 04:49 1796096 ----a-w- c:\windows\SysWow64\authui.dll
2013-05-20 07:35 . 2013-03-19 05:53 48640 ----a-w- c:\windows\system32\wwanprotdim.dll
2013-05-20 07:35 . 2013-03-19 05:53 230400 ----a-w- c:\windows\system32\wwansvc.dll
2013-05-20 07:33 . 2013-04-10 03:30 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-05-20 06:33 . 2013-05-20 07:25 -------- d-----w- c:\program files (x86)\Solid Savings
2013-05-17 17:57 . 2013-05-20 07:26 -------- d-----w- c:\users\louise
2013-05-16 19:27 . 2013-05-17 16:18 -------- d-----w- c:\program files (x86)\Google
2013-05-16 19:27 . 2013-05-17 16:18 -------- d-----w- c:\users\Home PC\AppData\Local\Google
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-20 12:00 . 2011-08-13 08:38 75016696 ----a-w- c:\windows\system32\MRT.exe
2013-05-20 08:37 . 2010-06-24 10:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-01 02:59 . 2013-05-01 02:59 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2013-05-01 02:59 . 2013-05-01 02:59 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2013-04-18 07:49 . 2013-04-18 07:49 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-04-18 07:49 . 2013-04-18 07:49 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-04-18 07:49 . 2013-04-18 07:49 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-04-18 07:49 . 2013-04-18 07:49 81408 ----a-w- c:\windows\system32\icardie.dll
2013-04-18 07:49 . 2013-04-18 07:49 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-04-18 07:49 . 2013-04-18 07:49 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-04-18 07:49 . 2013-04-18 07:49 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-18 07:49 . 2013-04-18 07:49 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-04-18 07:49 . 2013-04-18 07:49 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-04-18 07:49 . 2013-04-18 07:49 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-04-18 07:49 . 2013-04-18 07:49 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-04-18 07:49 . 2013-04-18 07:49 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-04-18 07:49 . 2013-04-18 07:49 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-04-18 07:49 . 2013-04-18 07:49 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-04-18 07:49 . 2013-04-18 07:49 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-04-18 07:49 . 2013-04-18 07:49 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-04-18 07:49 . 2013-04-18 07:49 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-04-18 07:49 . 2013-04-18 07:49 441856 ----a-w- c:\windows\system32\html.iec
2013-04-18 07:49 . 2013-04-18 07:49 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-04-18 07:49 . 2013-04-18 07:49 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-04-18 07:49 . 2013-04-18 07:49 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-04-18 07:49 . 2013-04-18 07:49 27648  ----a-w- c:\windows\system32\licmgr10.dll
2013-04-18 07:49 . 2013-04-18 07:49 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-04-18 07:49 . 2013-04-18 07:49 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-04-18 07:49 . 2013-04-18 07:49 235008 ----a-w- c:\windows\system32\url.dll
2013-04-18 07:49 . 2013-04-18 07:49 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-04-18 07:49 . 2013-04-18 07:49 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-04-18 07:49 . 2013-04-18 07:49 216064 ----a-w- c:\windows\system32\msls31.dll
2013-04-18 07:49 . 2013-04-18 07:49 197120 ----a-w- c:\windows\system32\msrating.dll
2013-04-18 07:49 . 2013-04-18 07:49 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-04-18 07:49 . 2013-04-18 07:49 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-18 07:49 . 2013-04-18 07:49 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-04-18 07:49 . 2013-04-18 07:49 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-04-18 07:49 . 2013-04-18 07:49 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-04-18 07:49 . 2013-04-18 07:49 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-04-18 07:49 . 2013-04-18 07:49 149504 ----a-w- c:\windows\system32\occache.dll
2013-04-18 07:49 . 2013-04-18 07:49 144896 ----a-w- c:\windows\system32\wextract.exe
2013-04-18 07:49 . 2013-04-18 07:49 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-04-18 07:49 . 2013-04-18 07:49 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-04-18 07:49 . 2013-04-18 07:49 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-04-18 07:49 . 2013-04-18 07:49 13824 ----a-w- c:\windows\system32\mshta.exe
2013-04-18 07:49 . 2013-04-18 07:49 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-04-18 07:49 . 2013-04-18 07:49 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-04-18 07:49 . 2013-04-18 07:49 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-04-18 07:49 . 2013-04-18 07:49 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-04-18 07:49 . 2013-04-18 07:49 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-04-18 07:49 . 2013-04-18 07:49 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-04-18 07:49 . 2013-04-18 07:49 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-18 07:49 . 2013-04-18 07:49 102912 ----a-w- c:\windows\system32\inseng.dll
2013-04-13 05:49 . 2013-05-20 07:36 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-20 07:36 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-20 07:36 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-20 07:36 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-20 07:36 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-20 07:36 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 12:46 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-03-19 06:04 . 2013-04-10 08:25 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 08:25 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 08:25 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 08:25 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 08:25 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 08:25 112640 ----a-w- c:\windows\system32\smss.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2013-04-18 . 394ECD933CD66BADF97EA85A183B9E1E . 19230208 . . [10.00.9200.16521] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_911ec38c929b31ec\mshtml.dll
[-] 2013-04-05 . C56EF4C50A1FEED0CC9B7AE068CBBBBB . 19231232 . . [10.00.9200.16521] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_91213bba929917b7\mshtml.dll
[-] 2013-04-05 . 6D81646922700482A82F253E73989CE4 . 19476480 . . [10.00.9200.16521] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_7a4a3764ac472c8f\mshtml.dll
[7] 2013-02-22 . 0E860BF2BCDDD94202A6AB9A10EE95EB . 17817600 . . [9.00.8112.20586] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20586_none_882f0f930e1703ea\mshtml.dll
[7] 2013-02-22 . 1154FEFC73880A2EF44295EF0DBDC59F . 17817088 . . [9.00.8112.16476] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16476_none_87b042b3f4f1482f\mshtml.dll
[7] 2013-02-02 . 1CD82D510D370CB04BB6BD1C660AA96F . 17815040 . . [9.00.8112.20580] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20580_none_88290dd70e1c6be0\mshtml.dll
[7] 2013-02-02 . 460723A080D6F22E56D45BC8C1F15B2A . 17815040 . . [9.00.8112.16470] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16470_none_87aa40f7f4f6b025\mshtml.dll
[7] 2013-01-09 . 14DEB733ACB08A71CC0783ED02FF1F8D . 17812992 . . [9.00.8112.16464] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16464_none_87b9120bf4eaf990\mshtml.dll
[7] 2013-01-09 . B6C5BC6D4E1D79CB8DF107112A9F37CB . 17814528 . . [9.00.8112.20573] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20573_none_8836dea10e119bf4\mshtml.dll
[7] 2012-11-14 . CFF3C4ABDCC5356B0674743BDF0FB674 . 17811968 . . [9.00.8112.16457] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16457_none_87c6e2d5f4e029a4\mshtml.dll
[7] 2012-11-14 . 5024CACD183E4C0FCCDE6DB8A38EEC7B . 17811968 . . [9.00.8112.20565] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20565_none_8843af210e07b2b1\mshtml.dll
[7] 2012-10-08 . 6D4F838E72EEEB3D6FB16A5A45632560 . 17811968 . . [9.00.8112.16455] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16455_none_87c4e241f4e1f6f6\mshtml.dll
[7] 2012-10-08 . 1FB8062D4C3A4C7B8ECA7BBD1E743000 . 17812992 . . [9.00.8112.20562] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20562_none_8840ae430e0a66ac\mshtml.dll
[7] 2012-08-24 . F244DA6DD2C365ABAFD076222C22C2BE . 17810944 . . [9.00.8112.16450] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16450_none_87bfe0cff4e67843\mshtml.dll
[7] 2012-08-24 . 522A528C296A9AEF3F0C289FF7093315 . 17810944 . . [9.00.8112.20557] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20557_none_88507fa10dfdc96e\mshtml.dll
[7] 2012-06-29 . 8415F4792D7BC07BE328DF56FE32045A . 17809920 . . [9.00.8112.16448] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16448_none_87d2b30bf4d7270a\mshtml.dll
[7] 2012-06-29 . C4DE0E2B31F60ACB15E6B4154E26298A . 17809920 . . [9.00.8112.20554] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20554_none_884d7ec30e007d69\mshtml.dll
[7] 2012-06-02 . 89C4B3BF66D3C2F3D83F9DEDF1B218D6 . 17807360 . . [9.00.8112.16447] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16447_none_87d1b2c1f4d80db3\mshtml.dll
[-] 2013-04-05 . C56EF4C50A1FEED0CC9B7AE068CBBBBB . 19231232 . . [10.00.9200.16521] .. c:\windows\system32\mshtml.dll
.
[-] 2013-04-05 . 27A9000C534AA9BADC9EE74940F50C6D . 2242048 . . [10.00.9200.16521] .. c:\windows\system32\wininet.dll
.
[7] 2013-04-18 . D017BF8D92938EEB9B3A1D1C53FDA152 . 14323200 . . [10.00.9200.16521] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_9b736ddec6fbf3e7\mshtml.dll
[-] 2013-04-05 . 7A468BC721C1D34E60389D3F2F87BBEA . 14323712 . . [10.00.9200.16521] .. c:\windows\SysWOW64\mshtml.dll
[-] 2013-04-05 . 7A468BC721C1D34E60389D3F2F87BBEA . 14323712 . . [10.00.9200.16521] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_9b75e60cc6f9d9b2\mshtml.dll
[-] 2013-04-05 . 92D1C395680C2878F9778C1649C00CB0 . 14353408 . . [10.00.9200.16521] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_849ee1b6e0a7ee8a\mshtml.dll
[7] 2013-02-22 . 474D43D76E2A33FEE21C6F4BB7C4A3B7 . 12324864 . . [9.00.8112.20586] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20586_none_9283b9e54277c5e5\mshtml.dll
[7] 2013-02-22 . 658EBC74BD38D16805648C4775F7FA82 . 12324352 . . [9.00.8112.16476] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16476_none_9204ed0629520a2a\mshtml.dll
.
[7] 2013-04-18 . CFE0CEE587F9CEA4C29DEEC6D85FC91C . 1766912 . . [10.00.9200.16521] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_23a608ea59e75780\wininet.dll
[-] 2013-04-05 . 5ABB3F36AF17007F33FA275E96A2C95E . 1767424 . . [10.00.9200.16521] .. c:\windows\SysWOW64\wininet.dll
[-] 2013-04-05 . 5ABB3F36AF17007F33FA275E96A2C95E . 1767424 . . [10.00.9200.16521] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_23a8811859e53d4b\wininet.dll
[-] 2013-04-05 . 1D48B7F4618EE77430ACECCA1BCA88E1 . 1775616 . . [10.00.9200.16521] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_0cd17cc273935223\wininet.dll
[7] 2013-02-22 . C5B6468422DB1C8AA36C32CBB0197E5E . 1129472 . . [9.00.8112.16476] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16476_none_1a378811bc3d6dc3\wininet.dll
[7] 2013-02-22 . 490E24D5E427DFA55B1C1182F0DB861C . 1129984 . . [9.00.8112.20586] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20586_none_1ab654f0d563297e\wininet.dll
[7] 2013-02-02 . 1284D72C04B553ED5382EA14303D66DB . 1129472 . . [9.00.8112.20580] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20580_none_1ab05334d5689174\wininet.dll
[7] 2013-02-02 . 03728C624D05C2F157BBD46F6B7F6EA0 . 1129472 . . [9.00.8112.16470] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16470_none_1a318655bc42d5b9\wininet.dll
[7] 2013-01-08 . B49B56B64F57699A1A663D2CF7D0A56F . 1129472 . . [9.00.8112.16464] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16464_none_1a405769bc371f24\wininet.dll
[7] 2013-01-08 . 16C45E6881449C6330567E51C13920FA . 1129472 . . [9.00.8112.20573] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20573_none_1abe23fed55dc188\wininet.dll
[7] 2012-11-14 . 7FA3A810F383588D46220967DE8B64FF . 1129472 . . [9.00.8112.16457] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16457_none_1a4e2833bc2c4f38\wininet.dll
[7] 2012-11-14 . 0635D714351F842D43EA184E75C4A3FF . 1129472 . . [9.00.8112.20565] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20565_none_1acaf47ed553d845\wininet.dll
[7] 2012-10-08 . 9CB0D2A9A77D91D9614355EE9FF00519 . 1129472 . . [9.00.8112.16455] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16455_none_1a4c279fbc2e1c8a\wininet.dll
[7] 2012-10-08 . 6E3AC8A54A1881806BA2B58539483788 . 1129472 . . [9.00.8112.20562] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20562_none_1ac7f3a0d5568c40\wininet.dll
[7] 2012-08-24 . 2895E29EFCFC0B1BCF8AEE1A0C67913C . 1129472 . . [9.00.8112.20557] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20557_none_1ad7c4fed549ef02\wininet.dll
[7] 2012-08-24 . 5553611E2F9EA6F613079177F1233068 . 1129472 . . [9.00.8112.16450] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16450_none_1a47262dbc329dd7\wininet.dll
[7] 2012-06-29 . 75A97A2C060E72AB49E071E08C7DD2BA . 1129472 . . [9.00.8112.16448] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16448_none_1a59f869bc234c9e\wininet.dll
[7] 2012-06-28 . 54C30A4066A28F9A017E095E283B2762 . 1129472 . . [9.00.8112.20554] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20554_none_1ad4c420d54ca2fd\wininet.dll
[7] 2012-06-02 . 8E87270C4704CF2951E1E7820D6C8A2B . 1129472 . . [9.00.8112.16447] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16447_none_1a58f81fbc243347\wininet.dll
[7] 2012-06-02 . E430161A632F9A8FE512DE0CA5685559 . 1129472 . . [9.00.8112.20553] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20553_none_1ad3c3d6d54d89a6\wininet.dll
[7] 2012-05-17 . 1C191A4F0960F21B5D58C8A65BAF5427 . 1129472 . . [9.00.8112.16446] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16446_none_1a57f7d5bc2519f0\wininet.dll
[7] 2012-05-17 . 43BAC67996D8765A5F1B3A4EA6231E21 . 1129472 . . [9.00.8112.20551] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20551_none_1ad1c342d54f56f8\wininet.dll
[7] 2012-02-28 . 44465367256D1C72B58F5ABAA19E7016 . 1127424 . . [9.00.8112.16443] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16443_none_1a54f6f7bc27cdeb\wininet.dll
[7] 2012-02-28 . 11A34DCA08EB2A586246F2D6C2A81D58 . 1127424 . . [9.00.8112.20548] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20548_none_1ae39534d540ec68\wininet.dll
[7] 2011-12-14 . 1D94FA7C81D2FFE494AF094619BA706F . 1127424 . . [9.00.8112.16441] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16441_none_1a52f663bc299b3d\wininet.dll
[7] 2011-12-14 . 022A78194E2C7106F5AF9F2BC6AC8774 . 1127424 . . [9.00.8112.20546] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20546_none_1ae194a0d542b9ba\wininet.dll
[7] 2011-11-03 . 32569DF2F9BEF05DD7D56E30590EDFD9 . 1127424 . . [9.00.8112.20544] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_1adf940cd544870c\wininet.dll
[7] 2011-11-03 . 02F98B5C0E397AD06124D84428CF8F1A . 1127424 . . [9.00.8112.16440] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_1a51f619bc2a81e6\wininet.dll
[7] 2011-09-01 . D3788D91530CFA005BD516189A4C676E . 1126912 . . [9.00.8112.16437] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16437_none_1a63c80bbc1c1756\wininet.dll
[7] 2011-09-01 . C0FCEE8D760C70DB6EF858BB2262288E . 1126912 . . [9.00.8112.20537] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20537_none_1aed64d6d539b720\wininet.dll
[7] 2011-08-06 . A1236375B74EA63C75657D564890C436 . 1126912 . . [9.00.8112.16421] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16421_none_1a68963bbc19635b\wininet.dll
[7] 2011-07-22 . 2C7332C222D1FE1FC57D622699A8C001 . 1126912 . . [9.00.8112.16434] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16434_none_1a60c72dbc1ecb51\wininet.dll
[7] 2011-07-22 . AA75F065975FCE762FC9BBF5A3C08368 . 1126912 . . [9.00.8112.20534] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20534_none_1aea63f8d53c6b1b\wininet.dll
[7] 2010-11-21 . 44214C94911C7CFB1D52CB64D5E8368D . 980992 . . [8.00.7601.17514] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_1eaaa4a07717236e\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SSDMonitor"="c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2012-08-21 105120]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"NeroLauncher"="c:\program files (x86)\Nero\SyncUP\NeroLauncher.exe" [2012-02-06 66872]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2013-03-13 1532992]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-03 284696]
"EKStatusMonitor"="c:\program files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe" [2012-10-15 2844608]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]
"Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-25 1117528]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-15 152392]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KodakHomeCenter"="c:\program files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe" [2012-10-19 2235840]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2011-2-23 323584]
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe [2012-06-11 240208]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 HipShieldK;McAfee Inc. HipShieldK;c:\windows\system32\drivers\HipShieldK.sys [2012-04-20 196440]
R3 McAWFwk;McAfee Activation Service;c:\progra~1\mcafee\msc\mcawfwk.exe [2011-01-28 225216]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2013-02-19 106552]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2008-10-24 43008]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [2007-12-03 24064]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2008-10-24 43008]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-12 1255736]
R4 McOobeSv;McAfee OOBE Service;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2012-08-31 201304]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2013-02-19 340216]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
S2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe [2012-06-11 193616]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-03 13336]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [2012-10-19 395200]
S2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;c:\program files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [2012-10-15 779200]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2012-08-31 201304]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2013-02-19 218760]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2013-02-19 182752]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-11-25 687400]
S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2012-08-21 794272]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2009-07-20 27136]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2013-02-19 70112]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-26 138752]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2013-02-19 515968]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-07-31 236544]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
*Deregistered* - mfeavfk01
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-02 c:\windows\Tasks\RMAutoUpdate.job
- c:\program files (x86)\Registry Mechanic\SULauncher.exe [2013-04-18 13:44]
.
2013-05-23 c:\windows\Tasks\RMSchedule.job
- c:\program files (x86)\Registry Mechanic\RegMech.exe [2011-09-20 13:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-21 8306208]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-07-12 365592]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-07-12 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-07-12 387608]
"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Home PC\AppData\Roaming\Mozilla\Firefox\Profiles\b5cj1c7m.default-1369339943653\
FF - ExtSQL: 2013-05-23 17:40; {4ED1F68A-5463-4931-9384-8FFF5ED91D92}; c:\program files (x86)\McAfee\SiteAdvisor
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-Conime - c:\windows\system32\conime.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-WT089446 - c:\program files (x86)\WildTangent\Dell Games\Wedding Dash - Ready
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\rundll32.exe
c:\program files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
c:\program files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
.
**************************************************************************
.
Completion time: 2013-06-02 19:44:45 - machine was rebooted
ComboFix-quarantined-files.txt 2013-06-02 18:44
.
Pre-Run: 431,767,343,104 bytes free
Post-Run: 431,476,056,064 bytes free
.
- - End Of File - - 155062E07411062A1CCC465C659707C8

Regards
Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Crossed wires I think my friend. I meant the malaware tool, Malwarebytes Anti-malware I had downloaded earlier. My system was already using Mcafee. I unistalled the malware program prior to my scan and disabled Mcafee.

Chris

Regards


----------



## superfrog25 (Mar 25, 2011)

Hi Mark

Going onto stage 3 now so might not be back on again tonight as this one apparently can take a while to complete. Thanks again and if we dont get a chance to speak again today. Hopefully we can tomorrow.Im at work but will be home in the evening.

Kind Regards
Chris


----------



## Mark1956 (May 7, 2011)

Our posts just crossed over, please read post 51 and follow what I have suggested to remove the trial version of McAfee and install MSE, run the scan with it and report on anything found then run Eset.

Combofix found the same bad files so when you have the results of the MSE and Eset scans post them and we will run a fix using Combofix.

Combofix has found and removed entries relating to PC Doctor which is not desirable software.

It also shows some entries for Registry Mechanic, please confirm that you uninstalled RM as I suggested earlier in the thread.


----------



## Mark1956 (May 7, 2011)

We just crossed posts again. I now understand what you were talking about, your post made it sound like you were talking about McAfee not Malwarebytes which you didn't mention.

Yup, the Eset scan can take several hours depending on the amount of data on your system as it scans everything.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I havent got a trial version of Mcafee it is my current internet security firewall etc. I have run ESET as you advised and it found below "threat / infection"

C:\Users\Home PC\Downloads\Express_Installer.exe a variant of Win32/Adware.iBryte.G application

I hadnt initially uninstalled registry mechanic but have now. I would be grateful for any advice after this problem has been resolved in how to keep the pc running smoothly and at optimum performance as I was using this tool to do this.I thought up until now it had been doing a good job to be honest.

Regards
Chris


----------



## superfrog25 (Mar 25, 2011)

Your right about our posts they do keep crossing!! Sorry for the misunderstanding earlier about the malwarebytes program


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Off to bed now.Will pick up anything you advise about re-running Combofix etc tomorrow evening when I get in from work.

Thanks
Chris


----------



## Mark1956 (May 7, 2011)

We are now going to run ComboFix a different way so that we can replace the bad files.

I shall give some closing advice when we are done and I can assure you a registry cleaner is not required to keep your system running smoothly, if it were there would be one built in to Windows.

As with the first Combofix scan, disconnect from the internet and disable script blocking and all your security software.

Open Notepad by clicking







and in the search box type: *Notepad.exe* and hit *Enter*
Then copy and paste everything in the *code box* below into it.
-- Note: Make sure Word Wrap is unchecked in Notepad by clicking on *Format* in the top menu.


```
FCopy::
c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_911ec38c929b31ec\mshtml.dll | c:\windows\system32\mshtml.dll
c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_9b736ddec6fbf3e7\mshtml.dll | c:\windows\SysWOW64\mshtml.dll
c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_23a608ea59e757 80\wininet.dll | c:\windows\system32\wininet.dll
c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_23a608ea59e757 80\wininet.dll | c:\windows\SysWOW64\wininet.dll

File::
c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_9b75e60cc6f9d9b2\mshtml.dll
c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_849ee1b6e0a7ee8a\mshtml.dll
c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_91213bba929917b7\mshtml.dll
c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_7a4a3764ac472c8f\mshtml.dll
c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_23a8811859e53d 4b\wininet.dll
c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_0cd17cc2739352 23\wininet.dll
C:\Users\Home PC\Downloads\Express_Installer.exe

Reboot::
```

Save the file as *CFScript.txt* by choosing Save As... in the File Menu, and save it to your Desktop where the ComboFix icon is also located.
Close your browser and *disconnect* from the Internet.
Now use your mouse to *drag*, then *drop* the CFScript.txt file on top of ComboFix.exe as seen in the image below.









This will start ComboFix again and launch the script.
ComboFix may reboot your system when it finishes. This is normal.
A log with be created just as before and saved to C:\ComboFix.txt. Please copy and paste the contents of *ComboFix.txt* in your next reply.
Be sure to *re-enable* your anti-virus and other security programs *after* the scan is complete.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Scan completed as advised and results below

ComboFix 13-06-02.02 - Home PC 03/06/2013 19:54:44.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.2013.775 [GMT 1:00]
Running from: c:\users\Home PC\Downloads\ComboFix.exe
Command switches used :: c:\users\Home PC\Desktop\CFScript.txt
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
FW: McAfee Firewall *Disabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Home PC\Downloads\Express_Installer.exe"
"c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_91213bba929917b7\mshtml.dll"
"c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_7a4a3764ac472c8f\mshtml.dll"
"c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_9b75e60cc6f9d9b2\mshtml.dll"
"c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_849ee1b6e0a7ee8a\mshtml.dll"
"c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_23a8811859e53d 4b\wininet.dll"
"c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_0cd17cc2739352 23\wininet.dll"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Home PC\Downloads\Express_Installer.exe
c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_91213bba929917b7\mshtml.dll
c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_7a4a3764ac472c8f\mshtml.dll
c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_9b75e60cc6f9d9b2\mshtml.dll
c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20681_none_849ee1b6e0a7ee8a\mshtml.dll
.
.
--------------- FCopy ---------------
.
c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_911ec38c929b31ec\mshtml.dll --> c:\windows\system32\mshtml.dll
c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_9b736ddec6fbf3e7\mshtml.dll --> c:\windows\SysWOW64\mshtml.dll
.
((((((((((((((((((((((((( Files Created from 2013-05-03 to 2013-06-03 )))))))))))))))))))))))))))))))
.
.
2013-06-03 19:06 . 2013-06-03 19:06 -------- d-----w- c:\users\Emily\AppData\Local\temp
2013-06-03 19:06 . 2013-06-03 19:06 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-06-02 19:09 . 2013-06-02 19:09 -------- d-----w- c:\program files (x86)\ESET
2013-06-02 09:04 . 2013-06-02 09:04 -------- d-----w- C:\_OTM
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-06-01 16:01 . 2013-06-01 16:01 -------- d-----w- c:\program files (x86)\QuickTime
2013-06-01 15:58 . 2013-06-01 15:58 -------- d-----w- c:\program files\iPod
2013-06-01 15:58 . 2013-06-01 15:59 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-01 15:58 . 2013-06-01 15:59 -------- d-----w- c:\program files\iTunes
2013-06-01 15:58 . 2013-06-01 15:59 -------- d-----w- c:\program files (x86)\iTunes
2013-05-23 21:17 . 2013-05-23 21:17 -------- d-----w- c:\users\Home PC\AppData\Roaming\Malwarebytes
2013-05-23 21:17 . 2013-05-23 21:17 -------- d-----w- c:\programdata\Malwarebytes
2013-05-23 18:00 . 2013-05-23 18:00 -------- d-----w- c:\program files (x86)\Windows Resource Kits
2013-05-23 10:03 . 2013-05-23 10:13 -------- d-----w- c:\users\NEW Admin
2013-05-22 11:06 . 2013-05-22 11:06 262552 ----a-w- c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
2013-05-22 08:08 . 2013-05-22 08:08 -------- d-----w- c:\programdata\PC-Doctor for Windows
2013-05-22 08:07 . 2013-05-22 08:08 -------- d-----w- c:\program files\My Dell
2013-05-20 07:36 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-20 07:36 . 2013-04-10 06:01 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-20 07:36 . 2011-02-03 11:25 144384 ----a-w- c:\windows\system32\cdd.dll
2013-05-20 07:36 . 2013-02-27 05:52 14172672 ----a-w- c:\windows\system32\shell32.dll
2013-05-20 07:35 . 2013-02-27 05:48 1930752 ----a-w- c:\windows\system32\authui.dll
2013-05-20 07:35 . 2013-02-27 05:52 197120 ----a-w- c:\windows\system32\shdocvw.dll
2013-05-20 07:35 . 2013-02-27 06:02 111448 ----a-w- c:\windows\system32\consent.exe
2013-05-20 07:35 . 2013-02-27 05:47 70144 ----a-w- c:\windows\system32\appinfo.dll
2013-05-20 07:35 . 2013-02-27 04:49 1796096 ----a-w- c:\windows\SysWow64\authui.dll
2013-05-20 07:35 . 2013-03-19 05:53 48640 ----a-w- c:\windows\system32\wwanprotdim.dll
2013-05-20 07:35 . 2013-03-19 05:53 230400 ----a-w- c:\windows\system32\wwansvc.dll
2013-05-20 07:33 . 2013-04-10 03:30 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-05-20 06:33 . 2013-05-20 07:25 -------- d-----w- c:\program files (x86)\Solid Savings
2013-05-17 17:57 . 2013-05-20 07:26 -------- d-----w- c:\users\louise
2013-05-16 19:27 . 2013-05-17 16:18 -------- d-----w- c:\program files (x86)\Google
2013-05-16 19:27 . 2013-05-17 16:18 -------- d-----w- c:\users\Home PC\AppData\Local\Google
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-20 12:00 . 2011-08-13 08:38 75016696 ----a-w- c:\windows\system32\MRT.exe
2013-05-20 08:37 . 2010-06-24 10:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-01 02:59 . 2013-05-01 02:59 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2013-05-01 02:59 . 2013-05-01 02:59 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2013-04-18 07:49 . 2013-04-18 07:49 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-04-18 07:49 . 2013-04-18 07:49 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-04-18 07:49 . 2013-04-18 07:49 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-04-18 07:49 . 2013-04-18 07:49 81408 ----a-w- c:\windows\system32\icardie.dll
2013-04-18 07:49 . 2013-04-18 07:49 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-04-18 07:49 . 2013-04-18 07:49 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-04-18 07:49 . 2013-04-18 07:49 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-18 07:49 . 2013-04-18 07:49 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-04-18 07:49 . 2013-04-18 07:49 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-04-18 07:49 . 2013-04-18 07:49 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-04-18 07:49 . 2013-04-18 07:49 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-04-18 07:49 . 2013-04-18 07:49 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-04-18 07:49 . 2013-04-18 07:49 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-04-18 07:49 . 2013-04-18 07:49 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-04-18 07:49 . 2013-04-18 07:49 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-04-18 07:49 . 2013-04-18 07:49 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-04-18 07:49 . 2013-04-18 07:49 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-04-18 07:49 . 2013-04-18 07:49 441856 ----a-w- c:\windows\system32\html.iec
2013-04-18 07:49 . 2013-04-18 07:49 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-04-18 07:49 . 2013-04-18 07:49 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-04-18 07:49 . 2013-04-18 07:49 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-04-18 07:49 . 2013-04-18 07:49 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-04-18 07:49 . 2013-04-18 07:49 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-04-18 07:49 . 2013-04-18 07:49 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-04-18 07:49 . 2013-04-18 07:49 235008 ----a-w- c:\windows\system32\url.dll
2013-04-18 07:49 . 2013-04-18 07:49 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-04-18 07:49 . 2013-04-18 07:49 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-04-18 07:49 . 2013-04-18 07:49 216064 ----a-w- c:\windows\system32\msls31.dll
2013-04-18 07:49 . 2013-04-18 07:49 197120 ----a-w- c:\windows\system32\msrating.dll
2013-04-18 07:49 . 2013-04-18 07:49 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-04-18 07:49 . 2013-04-18 07:49 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-18 07:49 . 2013-04-18 07:49 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-04-18 07:49 . 2013-04-18 07:49 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-04-18 07:49 . 2013-04-18 07:49 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-04-18 07:49 . 2013-04-18 07:49 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-04-18 07:49 . 2013-04-18 07:49 149504 ----a-w- c:\windows\system32\occache.dll
2013-04-18 07:49 . 2013-04-18 07:49 144896 ----a-w- c:\windows\system32\wextract.exe
2013-04-18 07:49 . 2013-04-18 07:49 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-04-18 07:49 . 2013-04-18 07:49 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-04-18 07:49 . 2013-04-18 07:49 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-04-18 07:49 . 2013-04-18 07:49 13824 ----a-w- c:\windows\system32\mshta.exe
2013-04-18 07:49 . 2013-04-18 07:49 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-04-18 07:49 . 2013-04-18 07:49 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-04-18 07:49 . 2013-04-18 07:49 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-04-18 07:49 . 2013-04-18 07:49 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-04-18 07:49 . 2013-04-18 07:49 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-04-18 07:49 . 2013-04-18 07:49 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-04-18 07:49 . 2013-04-18 07:49 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-18 07:49 . 2013-04-18 07:49 102912 ----a-w- c:\windows\system32\inseng.dll
2013-04-13 05:49 . 2013-05-20 07:36 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-20 07:36 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-20 07:36 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-20 07:36 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-20 07:36 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-20 07:36 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 12:46 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-03-19 06:04 . 2013-04-10 08:25 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 08:25 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 08:25 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 08:25 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 08:25 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 08:25 112640 ----a-w- c:\windows\system32\smss.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2013-04-18 . 394ECD933CD66BADF97EA85A183B9E1E . 19230208 . . [10.00.9200.16521] .. c:\windows\erdnt\cache86\mshtml.dll
[7] 2013-04-18 . 394ECD933CD66BADF97EA85A183B9E1E . 19230208 . . [10.00.9200.16521] .. c:\windows\SysWOW64\mshtml.dll
[7] 2013-04-18 . 394ECD933CD66BADF97EA85A183B9E1E . 19230208 . . [10.00.9200.16521] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16540_none_911ec38c929b31ec\mshtml.dll
[7] 2013-02-22 . 0E860BF2BCDDD94202A6AB9A10EE95EB . 17817600 . . [9.00.8112.20586] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20586_none_882f0f930e1703ea\mshtml.dll
[7] 2013-02-22 . 1154FEFC73880A2EF44295EF0DBDC59F . 17817088 . . [9.00.8112.16476] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16476_none_87b042b3f4f1482f\mshtml.dll
[7] 2013-02-02 . 1CD82D510D370CB04BB6BD1C660AA96F . 17815040 . . [9.00.8112.20580] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20580_none_88290dd70e1c6be0\mshtml.dll
[7] 2013-02-02 . 460723A080D6F22E56D45BC8C1F15B2A . 17815040 . . [9.00.8112.16470] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16470_none_87aa40f7f4f6b025\mshtml.dll
[7] 2013-01-09 . 14DEB733ACB08A71CC0783ED02FF1F8D . 17812992 . . [9.00.8112.16464] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16464_none_87b9120bf4eaf990\mshtml.dll
[7] 2013-01-09 . B6C5BC6D4E1D79CB8DF107112A9F37CB . 17814528 . . [9.00.8112.20573] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20573_none_8836dea10e119bf4\mshtml.dll
[7] 2012-11-14 . CFF3C4ABDCC5356B0674743BDF0FB674 . 17811968 . . [9.00.8112.16457] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16457_none_87c6e2d5f4e029a4\mshtml.dll
[7] 2012-11-14 . 5024CACD183E4C0FCCDE6DB8A38EEC7B . 17811968 . . [9.00.8112.20565] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20565_none_8843af210e07b2b1\mshtml.dll
[7] 2012-10-08 . 6D4F838E72EEEB3D6FB16A5A45632560 . 17811968 . . [9.00.8112.16455] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16455_none_87c4e241f4e1f6f6\mshtml.dll
[7] 2012-10-08 . 1FB8062D4C3A4C7B8ECA7BBD1E743000 . 17812992 . . [9.00.8112.20562] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20562_none_8840ae430e0a66ac\mshtml.dll
[7] 2012-08-24 . F244DA6DD2C365ABAFD076222C22C2BE . 17810944 . . [9.00.8112.16450] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16450_none_87bfe0cff4e67843\mshtml.dll
[7] 2012-08-24 . 522A528C296A9AEF3F0C289FF7093315 . 17810944 . . [9.00.8112.20557] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20557_none_88507fa10dfdc96e\mshtml.dll
[7] 2012-06-29 . 8415F4792D7BC07BE328DF56FE32045A . 17809920 . . [9.00.8112.16448] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16448_none_87d2b30bf4d7270a\mshtml.dll
[7] 2012-06-29 . C4DE0E2B31F60ACB15E6B4154E26298A . 17809920 . . [9.00.8112.20554] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20554_none_884d7ec30e007d69\mshtml.dll
[7] 2012-06-02 . 89C4B3BF66D3C2F3D83F9DEDF1B218D6 . 17807360 . . [9.00.8112.16447] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16447_none_87d1b2c1f4d80db3\mshtml.dll
[7] 2012-06-02 . 0C26F50D6C347CE294C84347E6FAEAA8 . 17807360 . . [9.00.8112.20553] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20553_none_884c7e790e016412\mshtml.dll
[7] 2012-05-18 . DE469470D93DEB4A1A81EDE72B848198 . 17807360 . . [9.00.8112.16446] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16446_none_87d0b277f4d8f45c\mshtml.dll
[7] 2012-05-18 . BE1E4779329040ED334651CD877C416D . 17807360 . . [9.00.8112.20551] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20551_none_884a7de50e033164\mshtml.dll
[7] 2012-02-28 . D785A16A6F03F76CB862F28C9F8C9672 . 17790976 . . [9.00.8112.16443] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16443_none_87cdb199f4dba857\mshtml.dll
[7] 2012-02-28 . 97BB8C752A400556A4FF2E1AAFA0A138 . 17790976 . . [9.00.8112.20548] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20548_none_885c4fd70df4c6d4\mshtml.dll
[7] 2011-12-14 . E61288581AD9E647ABEFB1489B250B5C . 17790464 . . [9.00.8112.16441] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16441_none_87cbb105f4dd75a9\mshtml.dll
[7] 2011-12-14 . 153963F44A26A7840ACDF52C2CD1B9DC . 17790464 . . [9.00.8112.20546] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20546_none_885a4f430df69426\mshtml.dll
[7] 2011-11-04 . 5770C4BA825C42D6EFD9486029747108 . 17786368 . . [9.00.8112.20544] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20544_none_88584eaf0df86178\mshtml.dll
[7] 2011-11-04 . E7BD23BEC69CF23436EEDE9B18DE186D . 17786368 . . [9.00.8112.16440] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16440_none_87cab0bbf4de5c52\mshtml.dll
[-] 2013-04-05 . C56EF4C50A1FEED0CC9B7AE068CBBBBB . 19231232 . . [10.00.9200.16521] .. c:\windows\system32\mshtml.dll
.
[7] 2013-04-18 . 753C0848AE7872A3F59663078A517293 . 2240512 . . [10.00.9200.16521] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_7fc4a46e1244c8b6\wininet.dll
[-] 2013-04-05 . 27A9000C534AA9BADC9EE74940F50C6D . 2242048 . . [10.00.9200.16521] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_7fc71c9c1242ae81\wininet.dll
[-] 2013-04-05 . 61962C7A2D6E32827F089E6F0A03E533 . 2247168 . . [10.00.9200.16521] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_68f018462bf0c359\wininet.dll
[7] 2013-02-22 . E6A459C8E90C4A873C923C44F3D9510B . 1392640 . . [9.00.8112.20586] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20586_none_76d4f0748dc09ab4\wininet.dll
[7] 2013-02-22 . A4F6142CABA82FB7293ECE5FF864B440 . 1392128 . . [9.00.8112.16476] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16476_none_76562395749adef9\wininet.dll
[7] 2013-02-02 . 4E0669B513805A7C2A303C8EDEDC8E03 . 1392128 . . [9.00.8112.20580] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20580_none_76ceeeb88dc602aa\wininet.dll
[7] 2013-02-02 . FA274190682AA41A46B285208ED46A74 . 1392128 . . [9.00.8112.16470] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16470_none_765021d974a046ef\wininet.dll
[7] 2013-01-09 . 435E9C764E1EF70058580996452BE6A2 . 1392128 . . [9.00.8112.16464] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16464_none_765ef2ed7494905a\wininet.dll
[7] 2013-01-08 . 43A6A68F1F41B13CA4D580D40DFA57EE . 1392128 . . [9.00.8112.20573] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20573_none_76dcbf828dbb32be\wininet.dll
[7] 2012-11-14 . 5121DB613E10A46A3C5085B479026AA7 . 1392128 . . [9.00.8112.16457] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16457_none_766cc3b77489c06e\wininet.dll
[7] 2012-11-14 . 5CAF48F12E8CBD96D520F4EFD5B97F76 . 1392128 . . [9.00.8112.20565] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20565_none_76e990028db1497b\wininet.dll
[7] 2012-10-08 . A19DB004D954BBC9C4EC125711E1D1C2 . 1392128 . . [9.00.8112.16455] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16455_none_766ac323748b8dc0\wininet.dll
[7] 2012-10-08 . 789EAD6F3CE42F3322818988400986E9 . 1392128 . . [9.00.8112.20562] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20562_none_76e68f248db3fd76\wininet.dll
[7] 2012-08-24 . 3D165C53E40236A68B7102D1A622D4E0 . 1392128 . . [9.00.8112.16450] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16450_none_7665c1b174900f0d\wininet.dll
[7] 2012-08-24 . 456D4E9006DF149C250D40B813290471 . 1392128 . . [9.00.8112.20557] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20557_none_76f660828da76038\wininet.dll
[7] 2012-06-29 . 8EA68FD3780DDDD5072F8CB830B3CB3D . 1392128 . . [9.00.8112.16448] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16448_none_767893ed7480bdd4\wininet.dll
[7] 2012-06-29 . 8BA7EDA2656ED7FBC93BDD5CB02B8D4E . 1392128 . . [9.00.8112.20554] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20554_none_76f35fa48daa1433\wininet.dll
[7] 2012-06-02 . 5A45FA344F4AD99D903F4B20E43B89EC . 1392128 . . [9.00.8112.16447] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16447_none_767793a37481a47d\wininet.dll
[7] 2012-06-02 . 571E809181EBF0A04FEFAA9BC9961F5B . 1392128 . . [9.00.8112.20553] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20553_none_76f25f5a8daafadc\wininet.dll
[7] 2012-05-18 . 870ECFEBD41C7B8F9C6777748368D51F . 1392128 . . [9.00.8112.16446] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16446_none_7676935974828b26\wininet.dll
[7] 2012-05-18 . BDC16D105BF011D4B1C3F09CF7A64314 . 1392128 . . [9.00.8112.20551] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20551_none_76f05ec68dacc82e\wininet.dll
[7] 2012-02-28 . 228443FF3A1FB0B974D278F7C6403FAD . 1390080 . . [9.00.8112.16443] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16443_none_7673927b74853f21\wininet.dll
[7] 2012-02-28 . B70CDC073F70E6D082A62AB5880D6B07 . 1390080 . . [9.00.8112.20548] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20548_none_770230b88d9e5d9e\wininet.dll
[7] 2011-12-14 . B1AC85B6ADC005CF3F9EB4E28DFDCCE6 . 1390080 . . [9.00.8112.16441] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16441_none_767191e774870c73\wininet.dll
[7] 2011-12-14 . C2FA4DBD6BB91D1AFD7D155120654AB9 . 1390080 . . [9.00.8112.20546] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20546_none_770030248da02af0\wininet.dll
[7] 2011-11-04 . 244D45F786E33C169A93F70BA63BABF8 . 1390080 . . [9.00.8112.20544] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_76fe2f908da1f842\wininet.dll
[7] 2011-11-04 . 69151E566295E5A977FE71FFAFD3B3F8 . 1390080 . . [9.00.8112.16440] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_7670919d7487f31c\wininet.dll
[7] 2011-09-01 . 271E8FB1354AA205A214F280A6766E30 . 1389056 . . [9.00.8112.16437] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16437_none_7682638f7479888c\wininet.dll
[7] 2011-09-01 . 1B2D2D8E611DE70CEB13F104D39814BA . 1389056 . . [9.00.8112.20537] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20537_none_770c005a8d972856\wininet.dll
[7] 2011-08-06 . 1BF2BCC7E3C26FD4C8EF0C9EFB0CC25D . 1389056 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16421_none_768731bf7476d491\wininet.dll
[7] 2011-07-22 . 0732B49B250E306F7A6591029AF9885B . 1389056 . . [9.00.8112.16434] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16434_none_767f62b1747c3c87\wininet.dll
[7] 2011-07-22 . 1A5A6898E90546B476D4E8A56626FC96 . 1389056 . . [9.00.8112.20534] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20534_none_7708ff7c8d99dc51\wininet.dll
[7] 2010-11-21 . F6C5302E1F4813D552F41A0AC82455E5 . 1188864 . . [8.00.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_7ac940242f7494a4\wininet.dll
[-] 2013-04-05 . 27A9000C534AA9BADC9EE74940F50C6D . 2242048 . . [10.00.9200.16521] .. c:\windows\system32\wininet.dll
.
[7] 2013-04-18 . CFE0CEE587F9CEA4C29DEEC6D85FC91C . 1766912 . . [10.00.9200.16521] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_23a608ea59e75780\wininet.dll
[-] 2013-04-05 . 5ABB3F36AF17007F33FA275E96A2C95E . 1767424 . . [10.00.9200.16521] .. c:\windows\SysWOW64\wininet.dll
[-] 2013-04-05 . 5ABB3F36AF17007F33FA275E96A2C95E . 1767424 . . [10.00.9200.16521] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_23a8811859e53d4b\wininet.dll
[-] 2013-04-05 . 1D48B7F4618EE77430ACECCA1BCA88E1 . 1775616 . . [10.00.9200.16521] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_0cd17cc273935223\wininet.dll
[7] 2013-02-22 . C5B6468422DB1C8AA36C32CBB0197E5E . 1129472 . . [9.00.8112.16476] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16476_none_1a378811bc3d6dc3\wininet.dll
[7] 2013-02-22 . 490E24D5E427DFA55B1C1182F0DB861C . 1129984 . . [9.00.8112.20586] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20586_none_1ab654f0d563297e\wininet.dll
[7] 2013-02-02 . 1284D72C04B553ED5382EA14303D66DB . 1129472 . . [9.00.8112.20580] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20580_none_1ab05334d5689174\wininet.dll
[7] 2013-02-02 . 03728C624D05C2F157BBD46F6B7F6EA0 . 1129472 . . [9.00.8112.16470] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16470_none_1a318655bc42d5b9\wininet.dll
[7] 2013-01-08 . B49B56B64F57699A1A663D2CF7D0A56F . 1129472 . . [9.00.8112.16464] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16464_none_1a405769bc371f24\wininet.dll
[7] 2013-01-08 . 16C45E6881449C6330567E51C13920FA . 1129472 . . [9.00.8112.20573] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20573_none_1abe23fed55dc188\wininet.dll
[7] 2012-11-14 . 7FA3A810F383588D46220967DE8B64FF . 1129472 . . [9.00.8112.16457] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16457_none_1a4e2833bc2c4f38\wininet.dll
[7] 2012-11-14 . 0635D714351F842D43EA184E75C4A3FF . 1129472 . . [9.00.8112.20565] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20565_none_1acaf47ed553d845\wininet.dll
[7] 2012-10-08 . 9CB0D2A9A77D91D9614355EE9FF00519 . 1129472 . . [9.00.8112.16455] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16455_none_1a4c279fbc2e1c8a\wininet.dll
[7] 2012-10-08 . 6E3AC8A54A1881806BA2B58539483788 . 1129472 . . [9.00.8112.20562] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20562_none_1ac7f3a0d5568c40\wininet.dll
[7] 2012-08-24 . 2895E29EFCFC0B1BCF8AEE1A0C67913C . 1129472 . . [9.00.8112.20557] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20557_none_1ad7c4fed549ef02\wininet.dll
[7] 2012-08-24 . 5553611E2F9EA6F613079177F1233068 . 1129472 . . [9.00.8112.16450] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16450_none_1a47262dbc329dd7\wininet.dll
[7] 2012-06-29 . 75A97A2C060E72AB49E071E08C7DD2BA . 1129472 . . [9.00.8112.16448] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16448_none_1a59f869bc234c9e\wininet.dll
[7] 2012-06-28 . 54C30A4066A28F9A017E095E283B2762 . 1129472 . . [9.00.8112.20554] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20554_none_1ad4c420d54ca2fd\wininet.dll
[7] 2012-06-02 . 8E87270C4704CF2951E1E7820D6C8A2B . 1129472 . . [9.00.8112.16447] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16447_none_1a58f81fbc243347\wininet.dll
[7] 2012-06-02 . E430161A632F9A8FE512DE0CA5685559 . 1129472 . . [9.00.8112.20553] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20553_none_1ad3c3d6d54d89a6\wininet.dll
[7] 2012-05-17 . 1C191A4F0960F21B5D58C8A65BAF5427 . 1129472 . . [9.00.8112.16446] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16446_none_1a57f7d5bc2519f0\wininet.dll
[7] 2012-05-17 . 43BAC67996D8765A5F1B3A4EA6231E21 . 1129472 . . [9.00.8112.20551] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20551_none_1ad1c342d54f56f8\wininet.dll
[7] 2012-02-28 . 44465367256D1C72B58F5ABAA19E7016 . 1127424 . . [9.00.8112.16443] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16443_none_1a54f6f7bc27cdeb\wininet.dll
[7] 2012-02-28 . 11A34DCA08EB2A586246F2D6C2A81D58 . 1127424 . . [9.00.8112.20548] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20548_none_1ae39534d540ec68\wininet.dll
[7] 2011-12-14 . 1D94FA7C81D2FFE494AF094619BA706F . 1127424 . . [9.00.8112.16441] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16441_none_1a52f663bc299b3d\wininet.dll
[7] 2011-12-14 . 022A78194E2C7106F5AF9F2BC6AC8774 . 1127424 . . [9.00.8112.20546] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20546_none_1ae194a0d542b9ba\wininet.dll
[7] 2011-11-03 . 32569DF2F9BEF05DD7D56E30590EDFD9 . 1127424 . . [9.00.8112.20544] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_1adf940cd544870c\wininet.dll
[7] 2011-11-03 . 02F98B5C0E397AD06124D84428CF8F1A . 1127424 . . [9.00.8112.16440] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_1a51f619bc2a81e6\wininet.dll
[7] 2011-09-01 . D3788D91530CFA005BD516189A4C676E . 1126912 . . [9.00.8112.16437] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16437_none_1a63c80bbc1c1756\wininet.dll
[7] 2011-09-01 . C0FCEE8D760C70DB6EF858BB2262288E . 1126912 . . [9.00.8112.20537] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20537_none_1aed64d6d539b720\wininet.dll
[7] 2011-08-06 . A1236375B74EA63C75657D564890C436 . 1126912 . . [9.00.8112.16421] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16421_none_1a68963bbc19635b\wininet.dll
[7] 2011-07-22 . 2C7332C222D1FE1FC57D622699A8C001 . 1126912 . . [9.00.8112.16434] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16434_none_1a60c72dbc1ecb51\wininet.dll
[7] 2011-07-22 . AA75F065975FCE762FC9BBF5A3C08368 . 1126912 . . [9.00.8112.20534] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20534_none_1aea63f8d53c6b1b\wininet.dll
[7] 2010-11-21 . 44214C94911C7CFB1D52CB64D5E8368D . 980992 . . [8.00.7601.17514] .. c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_1eaaa4a07717236e\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"NeroLauncher"="c:\program files (x86)\Nero\SyncUP\NeroLauncher.exe" [2012-02-06 66872]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2013-03-13 1532992]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-03 284696]
"EKStatusMonitor"="c:\program files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe" [2012-10-15 2844608]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]
"Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-25 1117528]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-15 152392]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KodakHomeCenter"="c:\program files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe" [2012-10-19 2235840]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2011-2-23 323584]
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe [2012-06-11 193616]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 HipShieldK;McAfee Inc. HipShieldK;c:\windows\system32\drivers\HipShieldK.sys [2012-04-20 196440]
R3 McAWFwk;McAfee Activation Service;c:\progra~1\mcafee\msc\mcawfwk.exe [2011-01-28 225216]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2013-02-19 106552]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2008-10-24 43008]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [2007-12-03 24064]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2008-10-24 43008]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-12 1255736]
R4 McOobeSv;McAfee OOBE Service;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2012-08-31 201304]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2013-02-19 340216]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-03 13336]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [2012-10-19 395200]
S2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;c:\program files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [2012-10-15 779200]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2012-08-31 201304]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2013-02-19 218760]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2013-02-19 182752]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-11-25 687400]
S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2009-07-20 27136]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480]
S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe [2012-06-11 240208]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2013-02-19 70112]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-26 138752]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2013-02-19 515968]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-07-31 236544]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-21 8306208]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-07-12 365592]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-07-12 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-07-12 387608]
"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Home PC\AppData\Roaming\Mozilla\Firefox\Profiles\b5cj1c7m.default-1369339943653\
FF - ExtSQL: 2013-05-23 17:40; {4ED1F68A-5463-4931-9384-8FFF5ED91D92}; c:\program files (x86)\McAfee\SiteAdvisor
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
AddRemove-WT089446 - c:\program files (x86)\WildTangent\Dell Games\Wedding Dash - Ready
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\rundll32.exe
c:\program files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
c:\program files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
.
**************************************************************************
.
Completion time: 2013-06-03 20:33:37 - machine was rebooted
ComboFix-quarantined-files.txt 2013-06-03 19:33
ComboFix2.txt 2013-06-02 18:44
.
Pre-Run: 431,286,370,304 bytes free
Post-Run: 430,930,546,688 bytes free
.
- - End Of File - - 6F1014352545681301D0DCC31B505585

Thanks and I will be grateful for the advice at the end for keeping my PC running smoothly.

Chris


----------



## superfrog25 (Mar 25, 2011)

As per last night Mark I will check the thread for further instruction when I get home from work tomorrow.

Thanks again
Chris


----------



## Mark1956 (May 7, 2011)

We need to run the Combofix script again. Only one of the three files up for replacement worked ok, a small formatting problem with the script created a space where thee should be one so it didn't work.

Please run this again.

We are now going to run ComboFix a different way so that we can replace them.

As with the first Combofix scan, disconnect from the internet and disable script blocking and all your security software.

Open Notepad by clicking







and in the search box type: *Notepad.exe* and hit *Enter*
Then copy and paste everything in the *code box* below into it.
-- Note: Make sure Word Wrap is unchecked in Notepad by clicking on *Format* in the top menu.


```
FCopy::
c:\windows\erdnt\cache86\mshtml.dll | c:\windows\system32\mshtml.dll

c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_7fc4a46e1244c8b6\wininet.dll | c:\windows\system32\wininet.dll

c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_23a608ea59e75780\wininet.dll | c:\windows\SysWOW64\wininet.dll

File::
c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_7fc71c9c1242ae81\wininet.dll
c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_68f018462bf0c359\wininet.dll
c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_23a8811859e53d4b\wininet.dll
c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_0cd17cc273935223\wininet.dll

Reboot::
```

Save the file as *CFScript.txt* by choosing Save As... in the File Menu, and save it to your Desktop where the ComboFix icon is also located.
Close your browser and *disconnect* from the Internet.
Now use your mouse to *drag*, then *drop* the CFScript.txt file on top of ComboFix.exe as seen in the image below.









This will start ComboFix again and launch the script.
ComboFix may reboot your system when it finishes. This is normal.
A log with be created just as before and saved to C:\ComboFix.txt. Please copy and paste the contents of *ComboFix.txt* in your next reply.
Be sure to *re-enable* your anti-virus and other security programs *after* the scan is complete.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I have done the last combi scan you have advised.Please see below for results;

ComboFix 13-06-02.02 - Home PC 04/06/2013 19:05:09.3.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.2013.866 [GMT 1:00]
Running from: c:\users\Home PC\Downloads\ComboFix.exe
Command switches used :: c:\users\Home PC\Desktop\CFScript.txt
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
FW: McAfee Firewall *Disabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_7fc71c9c1242ae81\wininet.dll"
"c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_68f018462bf0c359\wininet.dll"
"c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_23a8811859e53d4b\wininet.dll"
"c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_0cd17cc273935223\wininet.dll"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_7fc71c9c1242ae81\wininet.dll
c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_68f018462bf0c359\wininet.dll
c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16576_none_23a8811859e53d4b\wininet.dll
c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.20681_none_0cd17cc273935223\wininet.dll
.
.
--------------- FCopy ---------------
.
c:\windows\erdnt\cache86\mshtml.dll --> c:\windows\system32\mshtml.dll
c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_7fc4a46e1244c8b6\wininet.dll --> c:\windows\system32\wininet.dll
c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_23a608ea59e75780\wininet.dll --> c:\windows\SysWOW64\wininet.dll
.
((((((((((((((((((((((((( Files Created from 2013-05-04 to 2013-06-04 )))))))))))))))))))))))))))))))
.
.
2013-06-04 18:17 . 2013-06-04 18:17 -------- d-----w- c:\users\Emily\AppData\Local\temp
2013-06-04 18:17 . 2013-06-04 18:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-06-02 19:09 . 2013-06-02 19:09 -------- d-----w- c:\program files (x86)\ESET
2013-06-02 09:04 . 2013-06-02 09:04 -------- d-----w- C:\_OTM
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-06-01 16:01 . 2013-06-01 16:01 -------- d-----w- c:\program files (x86)\QuickTime
2013-06-01 15:58 . 2013-06-01 15:58 -------- d-----w- c:\program files\iPod
2013-06-01 15:58 . 2013-06-01 15:59 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-01 15:58 . 2013-06-01 15:59 -------- d-----w- c:\program files\iTunes
2013-06-01 15:58 . 2013-06-01 15:59 -------- d-----w- c:\program files (x86)\iTunes
2013-05-23 21:17 . 2013-05-23 21:17 -------- d-----w- c:\users\Home PC\AppData\Roaming\Malwarebytes
2013-05-23 21:17 . 2013-05-23 21:17 -------- d-----w- c:\programdata\Malwarebytes
2013-05-23 18:00 . 2013-05-23 18:00 -------- d-----w- c:\program files (x86)\Windows Resource Kits
2013-05-23 10:03 . 2013-05-23 10:13 -------- d-----w- c:\users\NEW Admin
2013-05-22 11:06 . 2013-05-22 11:06 262552 ----a-w- c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
2013-05-22 08:08 . 2013-05-22 08:08 -------- d-----w- c:\programdata\PC-Doctor for Windows
2013-05-22 08:07 . 2013-05-22 08:08 -------- d-----w- c:\program files\My Dell
2013-05-20 07:36 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-20 07:36 . 2013-04-10 06:01 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-20 07:36 . 2011-02-03 11:25 144384 ----a-w- c:\windows\system32\cdd.dll
2013-05-20 07:36 . 2013-02-27 05:52 14172672 ----a-w- c:\windows\system32\shell32.dll
2013-05-20 07:35 . 2013-02-27 05:48 1930752 ----a-w- c:\windows\system32\authui.dll
2013-05-20 07:35 . 2013-02-27 05:52 197120 ----a-w- c:\windows\system32\shdocvw.dll
2013-05-20 07:35 . 2013-02-27 06:02 111448 ----a-w- c:\windows\system32\consent.exe
2013-05-20 07:35 . 2013-02-27 05:47 70144 ----a-w- c:\windows\system32\appinfo.dll
2013-05-20 07:35 . 2013-02-27 04:49 1796096 ----a-w- c:\windows\SysWow64\authui.dll
2013-05-20 07:35 . 2013-03-19 05:53 48640 ----a-w- c:\windows\system32\wwanprotdim.dll
2013-05-20 07:35 . 2013-03-19 05:53 230400 ----a-w- c:\windows\system32\wwansvc.dll
2013-05-20 07:33 . 2013-04-10 03:30 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-05-20 06:33 . 2013-05-20 07:25 -------- d-----w- c:\program files (x86)\Solid Savings
2013-05-17 17:57 . 2013-05-20 07:26 -------- d-----w- c:\users\louise
2013-05-16 19:27 . 2013-05-17 16:18 -------- d-----w- c:\program files (x86)\Google
2013-05-16 19:27 . 2013-05-17 16:18 -------- d-----w- c:\users\Home PC\AppData\Local\Google
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-20 12:00 . 2011-08-13 08:38 75016696 ----a-w- c:\windows\system32\MRT.exe
2013-05-20 08:37 . 2010-06-24 10:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-01 02:59 . 2013-05-01 02:59 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2013-05-01 02:59 . 2013-05-01 02:59 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2013-04-18 07:49 . 2013-04-18 07:49 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-04-18 07:49 . 2013-04-18 07:49 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-04-18 07:49 . 2013-04-18 07:49 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-04-18 07:49 . 2013-04-18 07:49 81408 ----a-w- c:\windows\system32\icardie.dll
2013-04-18 07:49 . 2013-04-18 07:49 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-04-18 07:49 . 2013-04-18 07:49 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-04-18 07:49 . 2013-04-18 07:49 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-18 07:49 . 2013-04-18 07:49 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-04-18 07:49 . 2013-04-18 07:49 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-04-18 07:49 . 2013-04-18 07:49 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-04-18 07:49 . 2013-04-18 07:49 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-04-18 07:49 . 2013-04-18 07:49 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-04-18 07:49 . 2013-04-18 07:49 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-04-18 07:49 . 2013-04-18 07:49 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-04-18 07:49 . 2013-04-18 07:49 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-04-18 07:49 . 2013-04-18 07:49 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-04-18 07:49 . 2013-04-18 07:49 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-04-18 07:49 . 2013-04-18 07:49 441856 ----a-w- c:\windows\system32\html.iec
2013-04-18 07:49 . 2013-04-18 07:49 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-04-18 07:49 . 2013-04-18 07:49 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-04-18 07:49 . 2013-04-18 07:49 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-04-18 07:49 . 2013-04-18 07:49 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-04-18 07:49 . 2013-04-18 07:49 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-04-18 07:49 . 2013-04-18 07:49 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-04-18 07:49 . 2013-04-18 07:49 235008 ----a-w- c:\windows\system32\url.dll
2013-04-18 07:49 . 2013-04-18 07:49 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-04-18 07:49 . 2013-04-18 07:49 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-04-18 07:49 . 2013-04-18 07:49 216064 ----a-w- c:\windows\system32\msls31.dll
2013-04-18 07:49 . 2013-04-18 07:49 197120 ----a-w- c:\windows\system32\msrating.dll
2013-04-18 07:49 . 2013-04-18 07:49 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-04-18 07:49 . 2013-04-18 07:49 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-18 07:49 . 2013-04-18 07:49 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-04-18 07:49 . 2013-04-18 07:49 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-04-18 07:49 . 2013-04-18 07:49 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-04-18 07:49 . 2013-04-18 07:49 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-04-18 07:49 . 2013-04-18 07:49 149504 ----a-w- c:\windows\system32\occache.dll
2013-04-18 07:49 . 2013-04-18 07:49 144896 ----a-w- c:\windows\system32\wextract.exe
2013-04-18 07:49 . 2013-04-18 07:49 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-04-18 07:49 . 2013-04-18 07:49 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-04-18 07:49 . 2013-04-18 07:49 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-04-18 07:49 . 2013-04-18 07:49 13824 ----a-w- c:\windows\system32\mshta.exe
2013-04-18 07:49 . 2013-04-18 07:49 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-04-18 07:49 . 2013-04-18 07:49 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-04-18 07:49 . 2013-04-18 07:49 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-04-18 07:49 . 2013-04-18 07:49 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-04-18 07:49 . 2013-04-18 07:49 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-04-18 07:49 . 2013-04-18 07:49 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-04-18 07:49 . 2013-04-18 07:49 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-18 07:49 . 2013-04-18 07:49 102912 ----a-w- c:\windows\system32\inseng.dll
2013-04-13 05:49 . 2013-05-20 07:36 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-20 07:36 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-20 07:36 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-20 07:36 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-20 07:36 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-20 07:36 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 12:46 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-03-19 06:04 . 2013-04-10 08:25 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 08:25 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 08:25 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 08:25 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 08:25 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 08:25 112640 ----a-w- c:\windows\system32\smss.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2013-04-18 . 753C0848AE7872A3F59663078A517293 . 2240512 . . [10.00.9200.16521] .. c:\windows\erdnt\cache86\wininet.dll
[7] 2013-04-18 . 753C0848AE7872A3F59663078A517293 . 2240512 . . [10.00.9200.16521] .. c:\windows\SysWOW64\wininet.dll
[7] 2013-04-18 . 753C0848AE7872A3F59663078A517293 . 2240512 . . [10.00.9200.16521] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_10.2.9200.16540_none_7fc4a46e1244c8b6\wininet.dll
[7] 2013-02-22 . E6A459C8E90C4A873C923C44F3D9510B . 1392640 . . [9.00.8112.20586] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20586_none_76d4f0748dc09ab4\wininet.dll
[7] 2013-02-22 . A4F6142CABA82FB7293ECE5FF864B440 . 1392128 . . [9.00.8112.16476] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16476_none_76562395749adef9\wininet.dll
[7] 2013-02-02 . 4E0669B513805A7C2A303C8EDEDC8E03 . 1392128 . . [9.00.8112.20580] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20580_none_76ceeeb88dc602aa\wininet.dll
[7] 2013-02-02 . FA274190682AA41A46B285208ED46A74 . 1392128 . . [9.00.8112.16470] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16470_none_765021d974a046ef\wininet.dll
[7] 2013-01-09 . 435E9C764E1EF70058580996452BE6A2 . 1392128 . . [9.00.8112.16464] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16464_none_765ef2ed7494905a\wininet.dll
[7] 2013-01-08 . 43A6A68F1F41B13CA4D580D40DFA57EE . 1392128 . . [9.00.8112.20573] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20573_none_76dcbf828dbb32be\wininet.dll
[7] 2012-11-14 . 5121DB613E10A46A3C5085B479026AA7 . 1392128 . . [9.00.8112.16457] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16457_none_766cc3b77489c06e\wininet.dll
[7] 2012-11-14 . 5CAF48F12E8CBD96D520F4EFD5B97F76 . 1392128 . . [9.00.8112.20565] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20565_none_76e990028db1497b\wininet.dll
[7] 2012-10-08 . A19DB004D954BBC9C4EC125711E1D1C2 . 1392128 . . [9.00.8112.16455] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16455_none_766ac323748b8dc0\wininet.dll
[7] 2012-10-08 . 789EAD6F3CE42F3322818988400986E9 . 1392128 . . [9.00.8112.20562] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20562_none_76e68f248db3fd76\wininet.dll
[7] 2012-08-24 . 3D165C53E40236A68B7102D1A622D4E0 . 1392128 . . [9.00.8112.16450] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16450_none_7665c1b174900f0d\wininet.dll
[7] 2012-08-24 . 456D4E9006DF149C250D40B813290471 . 1392128 . . [9.00.8112.20557] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20557_none_76f660828da76038\wininet.dll
[7] 2012-06-29 . 8EA68FD3780DDDD5072F8CB830B3CB3D . 1392128 . . [9.00.8112.16448] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16448_none_767893ed7480bdd4\wininet.dll
[7] 2012-06-29 . 8BA7EDA2656ED7FBC93BDD5CB02B8D4E . 1392128 . . [9.00.8112.20554] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20554_none_76f35fa48daa1433\wininet.dll
[7] 2012-06-02 . 5A45FA344F4AD99D903F4B20E43B89EC . 1392128 . . [9.00.8112.16447] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16447_none_767793a37481a47d\wininet.dll
[7] 2012-06-02 . 571E809181EBF0A04FEFAA9BC9961F5B . 1392128 . . [9.00.8112.20553] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20553_none_76f25f5a8daafadc\wininet.dll
[7] 2012-05-18 . 870ECFEBD41C7B8F9C6777748368D51F . 1392128 . . [9.00.8112.16446] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16446_none_7676935974828b26\wininet.dll
[7] 2012-05-18 . BDC16D105BF011D4B1C3F09CF7A64314 . 1392128 . . [9.00.8112.20551] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20551_none_76f05ec68dacc82e\wininet.dll
[7] 2012-02-28 . 228443FF3A1FB0B974D278F7C6403FAD . 1390080 . . [9.00.8112.16443] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16443_none_7673927b74853f21\wininet.dll
[7] 2012-02-28 . B70CDC073F70E6D082A62AB5880D6B07 . 1390080 . . [9.00.8112.20548] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20548_none_770230b88d9e5d9e\wininet.dll
[7] 2011-12-14 . B1AC85B6ADC005CF3F9EB4E28DFDCCE6 . 1390080 . . [9.00.8112.16441] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16441_none_767191e774870c73\wininet.dll
[7] 2011-12-14 . C2FA4DBD6BB91D1AFD7D155120654AB9 . 1390080 . . [9.00.8112.20546] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20546_none_770030248da02af0\wininet.dll
[7] 2011-11-04 . 244D45F786E33C169A93F70BA63BABF8 . 1390080 . . [9.00.8112.20544] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_76fe2f908da1f842\wininet.dll
[7] 2011-11-04 . 69151E566295E5A977FE71FFAFD3B3F8 . 1390080 . . [9.00.8112.16440] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_7670919d7487f31c\wininet.dll
[7] 2011-09-01 . 271E8FB1354AA205A214F280A6766E30 . 1389056 . . [9.00.8112.16437] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16437_none_7682638f7479888c\wininet.dll
[7] 2011-09-01 . 1B2D2D8E611DE70CEB13F104D39814BA . 1389056 . . [9.00.8112.20537] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20537_none_770c005a8d972856\wininet.dll
[7] 2011-08-06 . 1BF2BCC7E3C26FD4C8EF0C9EFB0CC25D . 1389056 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16421_none_768731bf7476d491\wininet.dll
[7] 2011-07-22 . 0732B49B250E306F7A6591029AF9885B . 1389056 . . [9.00.8112.16434] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16434_none_767f62b1747c3c87\wininet.dll
[7] 2011-07-22 . 1A5A6898E90546B476D4E8A56626FC96 . 1389056 . . [9.00.8112.20534] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20534_none_7708ff7c8d99dc51\wininet.dll
[7] 2010-11-21 . F6C5302E1F4813D552F41A0AC82455E5 . 1188864 . . [8.00.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_7ac940242f7494a4\wininet.dll
[-] 2013-04-05 . 27A9000C534AA9BADC9EE74940F50C6D . 2242048 . . [10.00.9200.16521] .. c:\windows\system32\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"NeroLauncher"="c:\program files (x86)\Nero\SyncUP\NeroLauncher.exe" [2012-02-06 66872]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2013-03-13 1532992]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-03 284696]
"EKStatusMonitor"="c:\program files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe" [2012-10-15 2844608]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]
"Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-25 1117528]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-15 152392]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KodakHomeCenter"="c:\program files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe" [2012-10-19 2235840]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2011-2-23 323584]
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe [2012-06-11 193616]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe [2012-06-11 240208]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 HipShieldK;McAfee Inc. HipShieldK;c:\windows\system32\drivers\HipShieldK.sys [2012-04-20 196440]
R3 McAWFwk;McAfee Activation Service;c:\progra~1\mcafee\msc\mcawfwk.exe [2011-01-28 225216]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2013-02-19 106552]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2008-10-24 43008]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [2007-12-03 24064]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2008-10-24 43008]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-12 1255736]
R4 McOobeSv;McAfee OOBE Service;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2012-08-31 201304]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2013-02-19 340216]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-03 13336]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [2012-10-19 395200]
S2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;c:\program files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [2012-10-15 779200]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2012-08-31 201304]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2013-02-19 218760]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2013-02-19 182752]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-11-25 687400]
S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2009-07-20 27136]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2013-02-19 70112]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-26 138752]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2013-02-19 515968]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-07-31 236544]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-21 8306208]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-07-12 365592]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-07-12 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-07-12 387608]
"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Home PC\AppData\Roaming\Mozilla\Firefox\Profiles\b5cj1c7m.default-1369339943653\
FF - ExtSQL: 2013-05-23 17:40; {4ED1F68A-5463-4931-9384-8FFF5ED91D92}; c:\program files (x86)\McAfee\SiteAdvisor
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
AddRemove-WT089446 - c:\program files (x86)\WildTangent\Dell Games\Wedding Dash - Ready
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\windows\SysWOW64\rundll32.exe
c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
c:\program files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
c:\windows\SysWOW64\DllHost.exe
.
**************************************************************************
.
Completion time: 2013-06-04 19:48:25 - machine was rebooted
ComboFix-quarantined-files.txt 2013-06-04 18:48
ComboFix2.txt 2013-06-03 19:33
ComboFix3.txt 2013-06-02 18:44
.
Pre-Run: 430,938,836,992 bytes free
Post-Run: 430,468,792,320 bytes free
.
- - End Of File - - 770A7FA1A83C87CFDD374497219E3F3D

Regards
Chris


----------



## Mark1956 (May 7, 2011)

We are nearly there, just one more file that still hasn't replaced correctly.

We are now going to run ComboFix a different way so that we can replace them.

As with the first Combofix scan, disconnect from the internet and disable script blocking and all your security software.

Open Notepad by clicking







> *Run...* and in the open box type: *Notepad.exe*
Press Ok, then copy and paste everything in the *code box* below into it.
-- Note: Make sure Word Wrap is unchecked in Notepad by clicking on *Format* in the top menu.


```
FCopy::
c:\windows\erdnt\cache86\wininet.dll | c:\windows\system32\wininet.dll


Reboot::
```

Save the file as *CFScript.txt* by choosing Save As... in the File Menu, and save it to your Desktop where the ComboFix icon is also located.
Close your browser and *disconnect* from the Internet.
Now use your mouse to *drag*, then *drop* the CFScript.txt file on top of ComboFix.exe as seen in the image below.









This will start ComboFix again and launch the script.
ComboFix may reboot your system when it finishes. This is normal.
A log with be created just as before and saved to C:\ComboFix.txt. Please copy and paste the contents of *ComboFix.txt* in your next reply.
Be sure to *re-enable* your anti-virus and other security programs *after* the scan is complete.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Please see latest scan results below

ComboFix 13-06-02.02 - Home PC 05/06/2013 9:34.4.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.2013.982 [GMT 1:00]
Running from: c:\users\Home PC\Downloads\ComboFix.exe
Command switches used :: c:\users\Home PC\Desktop\CFScript.txt
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
FW: McAfee Firewall *Disabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\erdnt\cache86\wininet.dll --> c:\windows\system32\wininet.dll
.
((((((((((((((((((((((((( Files Created from 2013-05-05 to 2013-06-05 )))))))))))))))))))))))))))))))
.
.
2013-06-05 08:44 . 2013-06-05 08:44 -------- d-----w- c:\users\Emily\AppData\Local\temp
2013-06-05 08:44 . 2013-06-05 08:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-06-02 19:09 . 2013-06-02 19:09 -------- d-----w- c:\program files (x86)\ESET
2013-06-02 09:04 . 2013-06-02 09:04 -------- d-----w- C:\_OTM
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-06-01 16:01 . 2013-06-01 16:01 -------- d-----w- c:\program files (x86)\QuickTime
2013-06-01 15:58 . 2013-06-01 15:58 -------- d-----w- c:\program files\iPod
2013-06-01 15:58 . 2013-06-01 15:59 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-01 15:58 . 2013-06-01 15:59 -------- d-----w- c:\program files\iTunes
2013-06-01 15:58 . 2013-06-01 15:59 -------- d-----w- c:\program files (x86)\iTunes
2013-05-23 21:17 . 2013-05-23 21:17 -------- d-----w- c:\users\Home PC\AppData\Roaming\Malwarebytes
2013-05-23 21:17 . 2013-05-23 21:17 -------- d-----w- c:\programdata\Malwarebytes
2013-05-23 18:00 . 2013-05-23 18:00 -------- d-----w- c:\program files (x86)\Windows Resource Kits
2013-05-23 10:03 . 2013-05-23 10:13 -------- d-----w- c:\users\NEW Admin
2013-05-22 11:06 . 2013-05-22 11:06 262552 ----a-w- c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
2013-05-22 08:08 . 2013-05-22 08:08 -------- d-----w- c:\programdata\PC-Doctor for Windows
2013-05-22 08:07 . 2013-05-22 08:08 -------- d-----w- c:\program files\My Dell
2013-05-20 07:36 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-20 07:36 . 2013-04-10 06:01 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-20 07:36 . 2011-02-03 11:25 144384 ----a-w- c:\windows\system32\cdd.dll
2013-05-20 07:36 . 2013-02-27 05:52 14172672 ----a-w- c:\windows\system32\shell32.dll
2013-05-20 07:35 . 2013-02-27 05:48 1930752 ----a-w- c:\windows\system32\authui.dll
2013-05-20 07:35 . 2013-02-27 05:52 197120 ----a-w- c:\windows\system32\shdocvw.dll
2013-05-20 07:35 . 2013-02-27 06:02 111448 ----a-w- c:\windows\system32\consent.exe
2013-05-20 07:35 . 2013-02-27 05:47 70144 ----a-w- c:\windows\system32\appinfo.dll
2013-05-20 07:35 . 2013-02-27 04:49 1796096 ----a-w- c:\windows\SysWow64\authui.dll
2013-05-20 07:35 . 2013-03-19 05:53 48640 ----a-w- c:\windows\system32\wwanprotdim.dll
2013-05-20 07:35 . 2013-03-19 05:53 230400 ----a-w- c:\windows\system32\wwansvc.dll
2013-05-20 07:33 . 2013-04-10 03:30 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-05-20 06:33 . 2013-05-20 07:25 -------- d-----w- c:\program files (x86)\Solid Savings
2013-05-17 17:57 . 2013-05-20 07:26 -------- d-----w- c:\users\louise
2013-05-16 19:27 . 2013-05-17 16:18 -------- d-----w- c:\program files (x86)\Google
2013-05-16 19:27 . 2013-05-17 16:18 -------- d-----w- c:\users\Home PC\AppData\Local\Google
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-20 12:00 . 2011-08-13 08:38 75016696 ----a-w- c:\windows\system32\MRT.exe
2013-05-20 08:37 . 2010-06-24 10:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-01 02:59 . 2013-05-01 02:59 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2013-05-01 02:59 . 2013-05-01 02:59 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2013-04-18 07:49 . 2013-04-18 07:49 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-04-18 07:49 . 2013-04-18 07:49 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-04-18 07:49 . 2013-04-18 07:49 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-04-18 07:49 . 2013-04-18 07:49 81408 ----a-w- c:\windows\system32\icardie.dll
2013-04-18 07:49 . 2013-04-18 07:49 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-04-18 07:49 . 2013-04-18 07:49 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-04-18 07:49 . 2013-04-18 07:49 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-18 07:49 . 2013-04-18 07:49 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-04-18 07:49 . 2013-04-18 07:49 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-04-18 07:49 . 2013-04-18 07:49 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-04-18 07:49 . 2013-04-18 07:49 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-04-18 07:49 . 2013-04-18 07:49 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-04-18 07:49 . 2013-04-18 07:49 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-04-18 07:49 . 2013-04-18 07:49 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-04-18 07:49 . 2013-04-18 07:49 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-04-18 07:49 . 2013-04-18 07:49 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-04-18 07:49 . 2013-04-18 07:49 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-04-18 07:49 . 2013-04-18 07:49 441856 ----a-w- c:\windows\system32\html.iec
2013-04-18 07:49 . 2013-04-18 07:49 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-04-18 07:49 . 2013-04-18 07:49 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-04-18 07:49 . 2013-04-18 07:49 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-04-18 07:49 . 2013-04-18 07:49 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-04-18 07:49 . 2013-04-18 07:49 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-04-18 07:49 . 2013-04-18 07:49 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-04-18 07:49 . 2013-04-18 07:49 235008 ----a-w- c:\windows\system32\url.dll
2013-04-18 07:49 . 2013-04-18 07:49 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-04-18 07:49 . 2013-04-18 07:49 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-04-18 07:49 . 2013-04-18 07:49 216064 ----a-w- c:\windows\system32\msls31.dll
2013-04-18 07:49 . 2013-04-18 07:49 197120 ----a-w- c:\windows\system32\msrating.dll
2013-04-18 07:49 . 2013-04-18 07:49 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-04-18 07:49 . 2013-04-18 07:49 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-18 07:49 . 2013-04-18 07:49 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-04-18 07:49 . 2013-04-18 07:49 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-04-18 07:49 . 2013-04-18 07:49 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-04-18 07:49 . 2013-04-18 07:49 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-04-18 07:49 . 2013-04-18 07:49 149504 ----a-w- c:\windows\system32\occache.dll
2013-04-18 07:49 . 2013-04-18 07:49 144896 ----a-w- c:\windows\system32\wextract.exe
2013-04-18 07:49 . 2013-04-18 07:49 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-04-18 07:49 . 2013-04-18 07:49 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-04-18 07:49 . 2013-04-18 07:49 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-04-18 07:49 . 2013-04-18 07:49 13824 ----a-w- c:\windows\system32\mshta.exe
2013-04-18 07:49 . 2013-04-18 07:49 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-04-18 07:49 . 2013-04-18 07:49 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-04-18 07:49 . 2013-04-18 07:49 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-04-18 07:49 . 2013-04-18 07:49 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-04-18 07:49 . 2013-04-18 07:49 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-04-18 07:49 . 2013-04-18 07:49 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-04-18 07:49 . 2013-04-18 07:49 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-18 07:49 . 2013-04-18 07:49 102912 ----a-w- c:\windows\system32\inseng.dll
2013-04-13 05:49 . 2013-05-20 07:36 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-20 07:36 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-20 07:36 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-20 07:36 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-20 07:36 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-20 07:36 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 12:46 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-03-19 06:04 . 2013-04-10 08:25 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 08:25 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 08:25 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 08:25 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 08:25 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 08:25 112640 ----a-w- c:\windows\system32\smss.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"NeroLauncher"="c:\program files (x86)\Nero\SyncUP\NeroLauncher.exe" [2012-02-06 66872]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2013-03-13 1532992]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-03 284696]
"EKStatusMonitor"="c:\program files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe" [2012-10-15 2844608]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]
"Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-25 1117528]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-15 152392]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"Conime"="c:\windows\system32\conime.exe" [BU]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KodakHomeCenter"="c:\program files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe" [2012-10-19 2235840]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2011-2-23 323584]
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe [2012-06-11 193616]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe [2012-06-11 240208]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 HipShieldK;McAfee Inc. HipShieldK;c:\windows\system32\drivers\HipShieldK.sys [2012-04-20 196440]
R3 McAWFwk;McAfee Activation Service;c:\progra~1\mcafee\msc\mcawfwk.exe [2011-01-28 225216]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2013-02-19 106552]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2008-10-24 43008]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [2007-12-03 24064]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2008-10-24 43008]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-12 1255736]
R4 McOobeSv;McAfee OOBE Service;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2012-08-31 201304]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2013-02-19 340216]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-03 13336]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [2012-10-19 395200]
S2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;c:\program files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [2012-10-15 779200]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2012-08-31 201304]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2013-02-19 218760]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2013-02-19 182752]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-11-25 687400]
S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2009-07-20 27136]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2013-02-19 70112]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-26 138752]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2013-02-19 515968]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-07-31 236544]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-21 8306208]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-07-12 365592]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-07-12 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-07-12 387608]
"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Home PC\AppData\Roaming\Mozilla\Firefox\Profiles\b5cj1c7m.default-1369339943653\
FF - ExtSQL: 2013-05-23 17:40; {4ED1F68A-5463-4931-9384-8FFF5ED91D92}; c:\program files (x86)\McAfee\SiteAdvisor
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
AddRemove-WT089446 - c:\program files (x86)\WildTangent\Dell Games\Wedding Dash - Ready
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\windows\SysWOW64\rundll32.exe
c:\windows\SysWOW64\DllHost.exe
.
**************************************************************************
.
Completion time: 2013-06-05 10:03:42 - machine was rebooted
ComboFix-quarantined-files.txt 2013-06-05 09:03
ComboFix2.txt 2013-06-04 18:48
ComboFix3.txt 2013-06-03 19:33
ComboFix4.txt 2013-06-02 18:44
.
Pre-Run: 430,028,701,696 bytes free
Post-Run: 429,964,271,616 bytes free
.
- - End Of File - - 406A9BC7AC917DD0AE656F1BEC027EAB

Also when I start my PC up now I get several application errors

They state as below;

stage_primary.exe - Application Error
then a red cross message The application was unable to start correctly (0xc000007b) Click OK to close the application

ACDaemon.exe - Application Error
then a red cross message The application was unable to start correctly (0xc000007b) Click OK to close the application

RoxWatchTray120EM.exe - Application Error
then a red cross message The application was unable to start correctly (0xc000007b) Click OK to close the application

accuweather.exe - Application Error
then a red cross message The application was unable to start correctly (0xc000007b) Click OK to close the application

I had a similar message for NERO but that didnt come up when I rebooted this time.

I was aware of the Dell stage application which isnt loading now and the accuweather application which also isnt loading but not sure about the others.

Regards
Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

More info on the Nero error message it stated as below;

This program requires the file advrcntr5.dll,which was not found on the system

Regards
Chris


----------



## superfrog25 (Mar 25, 2011)

Mark

I forgot to mention when my girlfriend was checking her email she tried to open an attachment but was unable to until she tried to access it via the web.The attachment wouldnt open normally.

Chris


----------



## Mark1956 (May 7, 2011)

There certainly are some strange things going on. The work we have done with Combofix was purely related to two system files, which has now been successful, and could not have caused a problem with any of your software, so something unknown is causing file corruption.

There was also a problem using the Command Prompt to get the System File Checker log produced and the files we have just repaired had been damaged along with several of the back up copies.

First go back to the system config, click on Start and type *msconfig* into the box and hit Enter.
Check it is set back to Normal Startup and click on Apply, then reboot.

All the faulty software will have to be reinstalled to fix the errors, but first I would now suggest running a Repair Install. If this also fails to rectify the problems I can then only suggest a full format and reinstall of the OS.

There is an infection which could cause the problems being seen which destroys files, but there has been no sign of it in the scans and it is not a common infection these days.

Before I give the instruction to run the Repair Install I think a full test of the hard drive would be wise just in case it is that which is causing the problem.

Open Internet Explorer and click on this: Seatools

Save the download to your desktop.

In Windows 7 right click the ISO file, select *Open With*, then select* Windows Disc Image Burning Tool* then follow the prompts.
For all other versions of windows (if you do not have an ISO burner) download this free software. ImgBurn Install the program and start the application. Select the top left hand option to *Write image file to disc* and then on the next window click on the small yellow folder icon and browse to the ISO file on your desktop. Then click on the two grey discs with the arrow in between (bottom left) and leave it to complete the operation.

You will need a blank recordable CD or a re-recordable CD. You cannot use this software on a USB flash drive.

When the CD has been burned boot the PC into the Bios setup and set the CD/DVD drive to 1st in the boot sequence. Insert the disk in the drive then reboot and the disc will load into DOS. Click on Basic Tests and select the Long Test.

A full set of instructions can be found here: Seatools instructions

When the test completes it will show a Pass or Fail


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I have checked msconfig and it was set for normal start up.I unchecked the box and re-checked it and applied as said so this is definitely set up for normal start up now.

I was unable to open Internet explorer for Seatools, can I use Ffrefox as this appears to be working still?

Chris


----------



## Mark1956 (May 7, 2011)

Yup, using Firefox will be fine.


----------



## superfrog25 (Mar 25, 2011)

Mark,

It will not let me download seatools as it states blocked by your security zone policy - seagate.com -

Regards
Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark

It gave me an option to run but wouldnt let me save? What would you advise I do next?

Chris


----------



## Mark1956 (May 7, 2011)

I'm assuming the warning came from Firefox and not your Anti Virus. If it was the Anti Virus, disable it.

In Firefox click on the Tools tab and select Options.

Under the Security tab click on the top 'Exceptions' and add this web address to the list.

http://www.seagate.com/staticfiles/support/seatools/SeaToolsDOS223ALL.ISO

If that still won't work you could try in Safe Mode with Networking or you will have to use another PC.


----------



## superfrog25 (Mar 25, 2011)

Sorry to be a pain Mark but it still wont work.I have disabled mcafee and typed the link in exceptions in Firefox and it keeps stating blocked by your security zone policy - seagate.com -

How do I complete using safe mode or another PC?

Chris


----------



## Mark1956 (May 7, 2011)

As you boot the PC start tapping the F8 key as soon as you switch on and then use the arrow keys to highlight 'Safe Mode with Networking' and hit the Enter key. You can then follow the same instructions.

You can use any PC to follow the instructions to create the CD, then boot the faulty machine with it.


----------



## superfrog25 (Mar 25, 2011)

Ok Mark I have downloaded seatools on another pc it has saved in downloads and I have created a shortcut on the desktop.Im a little confused what to do next.It comes up with a disk creator but Im not sure what I have to do in there?


----------



## superfrog25 (Mar 25, 2011)

It is asking for a blank disc in the right hand side pane of the application


----------



## superfrog25 (Mar 25, 2011)

I wasnt sure if I needed to do something before I put in a disc though


----------



## superfrog25 (Mar 25, 2011)

There is a seatools icon in the left hand pane which says seatoolsDOS223ALL. In the right hand pane it says DVDRW Drive D

Please insert a blank disc into the drive

Selected image file C:\users\emily\downloads\seatoolssDOS223ALLISO

Then a list of recordable discs which can be used

Chris


----------



## superfrog25 (Mar 25, 2011)

hold fire mark..I think I have burned it now


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,


Just to let you know (via my daughters PC) my PC is now doing the Long test you advised.I got there in the end!! Will let you know once complete.

Thanks
Chris


----------



## Mark1956 (May 7, 2011)

Well done, I'll wait to here from you.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

The test has now completed and it has stated Test Progress Idle and Test result Passed

Chris


----------



## Mark1956 (May 7, 2011)

Ok, I think we should now try a Repair Install. Make sure before you do this that you back up any important data, just in case anything goes wrong.

Do you have a retail copy of Windows 7, if not please go here: Windows 7 ISO downloads and download the version of Windows 7 that matches what you have on your PC.

You can deal with that in exactly the same way you dealt with the Seatools ISO. You must use a blank DVD as a CD will not be big enough. It is a big download so may take a few hours depending on the speed of your internet connection.

When done follow this guide Windows 7 Repair Install


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I havent got a retail copy of windows 7 so I am downloading a copy onto my daughters desktop through the ISO method you have explained. Do I take the disk out of my PC from the seatools check and reboot my pc or do I just swop disks then reboot? It might take a while as you say its currently saying about 8 hours!!

Regards
Chris


----------



## Mark1956 (May 7, 2011)

Yes you will need to remove the Seatools CD. The follow the instruction in the guide.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

My only worry is the download states 3.1 GB and I am not sure this Pc has that capacity as its a laptop.I dont want to cause her Pc problems?

Chris


----------



## Mark1956 (May 7, 2011)

The DDS log shows you have over 400GB of free space so no need for concern.


----------



## superfrog25 (Mar 25, 2011)

on her laptop?


----------



## superfrog25 (Mar 25, 2011)

Mark

I will let it run through the night as its going to take a while. Its a relief I am not doing her PC any harm!!

Can I just say thanks for your patience and perseverance. Its appreciated

Regards
Chris


----------



## Mark1956 (May 7, 2011)

superfrog25 said:


> on her laptop?


 my mistake, that is your PC.

Hopefully there will be enough room, if there isn't then that PC needs a bigger hard drive , much less than several GB's of space can cause performance issues.

Back with you in the morning


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I checked her disc space and she had plenty (218GB I think it said.So I downloaded the 64 bit information (X17-24209.ISO) and I am currently burning to disc. I presume I am just keeping this in case everything doesnt go according to plan or do you need me to put it into the CD drive on MY PC and boot it up or do anything similar to what I did with Seatools I.E some sort of test?

If I am required not to actually do anything I will go onto the next stage after you confirm which is the 
Windows 7 repair install

I will wait for you to confirm before I proceed



Chris


----------



## superfrog25 (Mar 25, 2011)

OMG I have just printed off the instructions for the repair!! Whe it states download windows 7 with ISO file here and create a bootable DVD or USB flash drive am I to presume that is what I have just done?

Do I now insert the disc and follow the instructions?

I am concerned though as I have had a look through the instructions and it states enter Windows 7 product key.The PC came without a disc and windows 7 was already loaded onto it.How can I obtain the product key?

Regards Chris


----------



## Mark1956 (May 7, 2011)

If you follow the instruction it will tell you when to insert the Windows 7 DVD which is what you have just created.

You system should have a small sticker on it that has the Product key, if you don't have that let me know and don't proceed with the Repair Install. The product key contains a mixture of 25 numbers and letters in this form xxxxx-xxxxx-xxxxx-xxxxx-xxxxx.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I can confirm I have NO product key.As I said the system came with windows 7 already installed and didnt come with a disc. I thought it might come to haunt me one day!! I have checked all over the PC unit and there are no sticker with anything resembling a product key.Im glad I waited and checked with you first

Chris


----------



## Mark1956 (May 7, 2011)

Ok, we need to check your Windows Licence to be sure it is genuine then there is a tool you can run that will tell you the full Product Key.

Run this first and post the log for checking.

We need to check your Windows licence, please follow these instructions.


To run the tool, click on this link: MGADiag
In the File Download - Security Warning dialog box, click Run.
In the Internet Explorer - Security Warning dialog box, click Run.
In the Microsoft Genuine Advantage Diagnostic Tool dialog box, click *Continue*.
When the MGADIAG tool finishes, ensure it is displaying the information under the *Windows* tab and click* Copy*.
Come back to this thread and right click on the message box and select *Paste* from the pop up menu and the results will appear, then submit the message.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Unfortunately everything I now try to download or open as an attachment comes up with the message Blocked by your security zone policy-microsoft.com this time.Can I do this via another PC?

regards


----------



## superfrog25 (Mar 25, 2011)

Im guessing in one of the combi fix scans I have lost the ability to download or open an attachment?


----------



## superfrog25 (Mar 25, 2011)

If it helps I bought the PC direct from Dell over the phone


----------



## superfrog25 (Mar 25, 2011)

When I was going through the boot procedure on Seatools I noticed an option to repair windows 7 in there.I presume that will not do what is necessary?

I didnt press it but thought I would mention it


----------



## Mark1956 (May 7, 2011)

I am very surprised your PC has no License sticker as it should be on all systems supplied from a legitimate manufacturer, we can find the key but need to check out this download problem and run MGADiag first. I doubt very much if Combofix caused this issue as it does not change security settings, what can happen on a 'non-genuine' system is it might remove the validation patch.

Let's see if we can reset your security zone. The setting in IE has a side effect on all browsers so that is where we need to look.

Open IE and click on Tools.
Select Internet Options and then click on the Security tab.
The setting should be on Medium, change it if it is on high and let me know what you have found.
If you changed the setting try downloading again.


----------



## superfrog25 (Mar 25, 2011)

Th only other things I can try Mark is completely uninstall mcafee to download the program.Rather than just disabling it?

Alternatively my girlfriend thinks we have some restore to 3 system recovery discs if required?


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I cannot access IE only Firefox. I have checked my settings through the control panel though by going into the security tab and my setting is on medium

The error messages Im getting on the downloads appear to be mcafee based as they have a red circle and white cross inbside like when mcafee doesnt want to do something.However I have made sure this has been disabled prior to attempting download?

Very frustrating!!

Chris


----------



## superfrog25 (Mar 25, 2011)

Just going to pick the kids up...back in a bit


----------



## Mark1956 (May 7, 2011)

Ok, it may be better to remove McAfee as you suggested and replace it with a more user friendly Anti Virus which is far easier to disable if it needs to be.

First download these two items, if you can't, uninstall McAfee first.

Microsoft Security Essentials
McAfee Removal Tool

Save them both to your desktop, then disconnect from the internet, uninstall McAfee (if not done) and run the Removal Tool. Then install MSE and reconnect to the internet, let it update and run a quick scan, delete anything it finds and post the results of the scan.

Then try the MGADiag download again.

If you need to disable MSE, this is how it is done.

Click on the icon in the Taskbar, then click on *Open* which should appear.
Click on the *Settings* tab and select *Real-time protection* in the list on the left.
Click on the check box to clear it next to *Turn on real-time protection (recommended).*
Click on *Save Changes* and close the window.


----------



## superfrog25 (Mar 25, 2011)

I have unistalled Mcafee and rebooted.Unfortunately I am still unable to download any files to the computer now.It will not let me download either the Mcafee removal tool or the Microsoft Essential program. I am still getting the same error as before


----------



## Mark1956 (May 7, 2011)

Do you have a Flash Drive that you can use, if you download the programs on another PC and then use the Flash Drive to transfer them that may help things move on as we are a bit stuck at the moment.


----------



## superfrog25 (Mar 25, 2011)

Yes I have I will give it a go


----------



## superfrog25 (Mar 25, 2011)

Progress!! I am currently removing Mcafee and have downloaded the other files on the flash so will work my way through your instruction


----------



## Mark1956 (May 7, 2011)

:up:


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

The scan has stated that No threats were detected on your PC during this scan.

Is it ok to complete MGADiag?

Chris


----------



## superfrog25 (Mar 25, 2011)

Mark,

It will not run on my PC but would have run on Emily's so the download is ok but it will not run on my PC.States error as below

Red circle with white cross..then this message; The application was unable to start correctly (0x00000b). Click OK to close the application.

This message is similar to the messages Im getting on start up with Dell stage, Accuweather ROXWatchTray120OEM.exe.All state the same error and the same numbers in brackets

Chris


----------



## superfrog25 (Mar 25, 2011)

Sorry that should read (0xc000007b)


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I was just chatting to my girlfriend while I waited for you to get back to me and she said before all this started she said she experienced Administrator issues like the system didnt think she was the administrator.Which of course she is/we are. She has a home group set up on here.It might be nothing but I thought I would let you know

Chris


----------



## superfrog25 (Mar 25, 2011)

Mark,

I have searched the net and found below.Do you think I should try this out on my application problem? See below

0xc000007b error 
Download and install the following to fix 0xc000007b error.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=a7b7a05e-6de6-4d3a-a423-37bf0912db84

I have downloaded it onto the flash drive if you want me to try

Chris


----------



## Mark1956 (May 7, 2011)

Ok, you can try that if you want to, but I can't guarantee it will fix the problem.

You system seems to be going into reduced functionality, are you seeing any warnings about validation?


----------



## superfrog25 (Mar 25, 2011)

I will give it a go.No warnings about validation as yet


----------



## superfrog25 (Mar 25, 2011)

It failed Mark.It would not even let me download it.This time it stated Red circle with white cross..then this message; Set up-EXE The application was unable to start correctly (0x00000b). Click OK to close the application. It would appear I cant now download from a flash drive either


----------



## superfrog25 (Mar 25, 2011)

(0xc000007b) not (0x00000b)


----------



## Mark1956 (May 7, 2011)

I think at this point running System Restore may help, if we can at least get the system back to where it will download programs or be able to transfer programs from the Flash Drive we might get somewhere. Unless we can do this we are unlikely to be able to run the program that will find your Product Key.

Just before we take the plunge see if you can get this program onto the system, if it won't transfer from the Flash Drive try it in Safe Mode: Speccy System Information Tool

If you do get that tool to run don't post the log as it will display your full Product Key which you do not want to make public.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

It allowed me to run this and after checking under the Operating system tab I have found a serial number which looks like a product key.It doesnt sy product key but it has 5 numbers or letter with a dash in between and has 25 in all.

Chris


----------



## superfrog25 (Mar 25, 2011)

As a footnote when I was looking up information on the (0xc000007b0 error Im getting the general concencus was that it was the system thinking it was the wrong bit I.E 32 instead of 64.It was all a bit over my head to be honest.


----------



## Mark1956 (May 7, 2011)

Not sure why Speccy lists the Product Key as a Serial Number, but that is the number you need, take a *very careful* note of it and keep it somewhere safe, without it your copy of Windows 7 will be useless, one digit incorrectly copied and it will fail to validate.

You can now try and start the Repair Install process, fingers crossed this will cure the problem, if not a clean install will be required which you should be able to do from your Recovery Partition or you can use the Windows 7 DVD that you burned.

Make sure you have all your important data backed up. A Repair Install should preserve all your software and data, but as your PC is not behaving well and there is always a small risk that something may go wrong it is always best to preserve your data on an external drive or DVD's. The only things you needn't back up are the things you would not mind loosing.


----------



## Mark1956 (May 7, 2011)

superfrog25 said:


> As a footnote when I was looking up information on the (0xc000007b0 error Im getting the general concencus was that it was the system thinking it was the wrong bit I.E 32 instead of 64.It was all a bit over my head to be honest.


 Just to pass comment on this, the 64bit and 32bit versions of IE are both on your PC and either should run without a problem as you have a 64bit version of Windows 7.


----------



## superfrog25 (Mar 25, 2011)

Ok Mark I will give the repair instruction a go when I have picked the kids up as I dont want to rush it.I presume as I havent got window 7 disc I will be using the disc I created on the DVD.Windows 7 ISO download and then follow the instructions.I have printed them off so i can follow step by step.My only worry is that if the repair doesnt work I will lose the O/S altogether

Thanks Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Just to let you know (Im on my daughters PC) I have started the repair disc. It was a bit of pain as it wouldnt load from autoplay and I had to go in via the computer and set up on the disc but got there in the end.it may take a while but as soon s I know anything will post it.

Chris


----------



## Mark1956 (May 7, 2011)

Ok, I'll keep my fingers crossed for you.



> I presume as I havent got window 7 disc I will be using the disc I created on the DVD


FYI. The disc you created is a Windows 7 disc. It is an identical copy of an original retail disc.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark

YIPPPEEEE!! I have completed the instruction and it has restored all my programs including IE. I no longer have any error messages pop up on start up. Dell stage and Accuweather are loading at start up as well. I have completed the entire instruction including the disc clean up.The only thing I have to do at some point is to re-install I-Tunes as this didnt come through properly but I did get a message to that effect during the process.

I have not tried to download anything as I wanted to post this first

Thanks and Regards
Chris


----------



## superfrog25 (Mar 25, 2011)

When you get time (If you are not already) Please advise what to do next.

I noticed on my daughters PC that in her control panel under programs her flash player has an active X icon and a plug in icon.When we were trying to download flash player and use it we had NO active x icon.Maybe thats why it wouldnt open again after reboot. However I havent tried to install this until you are ready for me to try again


----------



## Mark1956 (May 7, 2011)

That is sounding good. Please tell me if any of the tools we have used are still present especially Combofix as that requires specific instructions to uninstall it correctly.

Please run this scan so we can see if anything important needs to be updated. This will tell us about Flash Player.

Download Security Check by screen317 from Here or Here.
Save it to your Desktop.
Double click SecurityCheck.exe (Vista or Windows 7 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.
A Notepad document should open automatically called checkup.txt; please Copy & Paste the contents of that document into your next reply.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I have done the security scan as recommended and the results are below. I have tested my applications this morning and most are working fine.I have old versions of Word.Power Point and Excel which havent been restored but unless you see an issue with it I can re-install them if necessary.

Also one of the Kodak applications will not open as it states the usual red circle with a white cross and the following message.."Windows cannot access the specified device path or file you may not have appropriate permissions to access the item"

The only other problem I have encountered is the Nero error message is still appearing despite me re-installing Nero that message states " This program requires the file ADVRCNTR5.DLL which was not found on the system.

All that said the PC seem to be in a better state now

All the items you asked me to download including Combifix are still on my computer See below list.

Roguekiller
OTM
Defogger
ADWcleaner
Combifix
Speccy

Results of screen317's Security Check version 0.99.64 
Windows 7 Service Pack 1 x64 (UAC is enabled) 
*``````````````Antivirus/Firewall Check:``````````````* 
Windows Firewall Enabled! 
Microsoft Security Essentials 
Antivirus up to date! 
*`````````Anti-malware/Other Utilities Check:`````````* 
JavaFX 2.1.1 
Java 7 Update 21 
Adobe Reader XI 
Mozilla Firefox (21.0) 
*````````Process Check: objlist.exe by Laurent````````* 
Microsoft Security Essentials MSMpEng.exe 
Microsoft Security Essentials msseces.exe 
*`````````````````System Health check`````````````````* 
Total Fragmentation on Drive C: 2% 
*````````````````````End of Log``````````````````````*

Regards
Chris


----------



## Mark1956 (May 7, 2011)

The security check is fine, please go ahead and install the Flash Player, follow my guide for the installation.

I have also posted below the instructions to remove Combofix and the other tools used.

To re-enable your CD Emulation drivers if you disabled them, double click *DeFogger.exe* to run the tool again.


The application window will appear.
Click the *Re-enable* button to re-enable your CD Emulation drivers.
Click *Yes* to continue.
A *'Finished!*' message will appear.
Click *OK*.
DeFogger will now ask to reboot the machine...click *OK*.

To uninstall ComboFix, press the *WINKEY + R* keys on your keyboard or click on Start







and type *Run* into the search box and hit *Enter*.
In the *Run* box type: *ComboFix /Uninstall* (Be sure to leave a space before the forward slash).











Click on *OK*.
If you encounter any problems using the switch from the Run dialog box, just rename ComboFix.exe to *Uninstall.exe*, then double-click on it to remove.
This will delete ComboFix's related folders/files, reset the clock settings, hide file extensions/system files, clear the System Restore cache to prevent possible reinfection and *create a new Restore point.*
When it has finished you will see a dialog box stating that _"ComboFix has been uninstalled". _
After that, you can delete the ComboFix.exe program from your computer (Desktop).

*Next*


Download *OTC* by OldTimer and save it to your *desktop.*
Double click







icon to start the program. 
If you are using Vista or Windows 7, please right-click and choose *Run as Administrator*
Then Click the big







button.
You will get a prompt saying "_Begin Cleanup Process_". Please select *Yes*.
Restart your computer when prompted.

-- Doing this will *remove* any specialized tools downloaded and used. If OTC does not delete itself, then delete the file manually when done.
-- Any leftover folders/files related to ComboFix or other tools which OTC did not remove can be deleted manually (right-click on it and choose delete).

*Please post back when this is complete and let me know if you have had any problems.*

==================================================================

Go to this link Adobe Downloads and select the latest version to download and install. You will see this page below, click on the appropriate button for the Adobe product you require.










You will now see a page similar to this one:










All four Adobe products, Reader, Flash Player, Air and Shockwave Player are set by default to download the version for *Windows* Operating Systems and for *Internet Explorer* in *English*. If you are using a Macintosh, or you want to use the Adobe product with a different Browser or language you must click on the line (as indicated in the above image) to make further selections to meet your requirements.

As you will see in the above image the Adobe Reader is set for Windows 7, please click (as indicated) if you are using a different version of *Windows* to make further selections. All the other Adobe products are universal and you will only need to change the selection for different Browsers, Languages or for Macintosh.
NOTE: In all the downloads look out for any Add-ons like Google Toolbar, McAfee products, etc. and uncheck the box to exclude them. The above image shows the Google Toolbar being offered but this will change from time to time for other products.

Some additional instructions may appear for XP installations. In all cases save the download to your desktop, then close your browser and double click on the Adobe icon on your desktop to install it. If you have any problems installing, disconnect from the internet and disable your Anti Virus and any other security software, instructions for most AV's, etc. can be found here: How to disable security software.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I have completed Defogger as instructed but when I try to remove combofix it states Windows cannot find "ComboFix" Make sure you typed the name correctly and try again.

Chris


----------



## superfrog25 (Mar 25, 2011)

Do you want me to continue with the rest of the instruction?


----------



## superfrog25 (Mar 25, 2011)

When you are in the run box there is NO message underneath saying this task will be created with administrative priveleges


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I tried to uninstall combifix using the other method of renaming the download file Uninstall.exe and double clicking as instructed but it appeared to run a scan?? Details below

ComboFix 13-06-02.02 - Home PC 08/06/2013 12:16:44.5.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.2013.699 [GMT 1:00]
Running from: c:\users\Home PC\Downloads\Uninstall.exe.exe
AV: Microsoft Security Essentials *Enabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Enabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\6261\AddOnDownloaded\1b0b3c38-2b97-4f8d-954b-06296209b73d.dll
c:\programdata\PCDr\6261\AddOnDownloaded\1e512ef2-01fb-49fb-b09b-71de0eac4612.dll
c:\programdata\PCDr\6261\AddOnDownloaded\27ada864-54d8-46c9-a6e3-8334fa39b525.dll
c:\programdata\PCDr\6261\AddOnDownloaded\2eccd5d6-e118-4f76-97b6-ba56fb6c597a.dll
c:\programdata\PCDr\6261\AddOnDownloaded\3e0b29b2-9809-4050-abfc-ef8aff73ceab.dll
c:\programdata\PCDr\6261\AddOnDownloaded\5f2ce3e8-3c56-40bb-86d6-a1a41867000b.dll
c:\programdata\PCDr\6261\AddOnDownloaded\7b6e388f-35d0-44f8-aa2c-20538273473f.dll
c:\programdata\PCDr\6261\AddOnDownloaded\97cd9b9c-9747-469a-acfa-cfbf8aed528a.dll
c:\programdata\PCDr\6261\AddOnDownloaded\b69d9551-76e9-4872-95f8-075916f82d74.dll
c:\programdata\PCDr\6261\AddOnDownloaded\bea3f575-677a-4c92-89ca-7be8480c11a9.dll
.
.
((((((((((((((((((((((((( Files Created from 2013-05-08 to 2013-06-08 )))))))))))))))))))))))))))))))
.
.
2013-06-08 11:26 . 2013-06-08 11:26 -------- d-----w- c:\users\Emily\AppData\Local\temp
2013-06-08 11:26 . 2013-06-08 11:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-06-08 01:14 . 2013-06-07 17:01 -------- d-----w- c:\windows\Panther
2013-06-08 01:02 . 2013-06-07 16:48 -------- d-----w- C:\$WINDOWS.~Q
2013-06-08 00:57 . 2013-06-08 01:00 -------- d-----w- C:\$INPLACE.~TR
2013-06-07 20:06 . 2013-06-07 20:06 -------- d-----w- c:\program files (x86)\Common Files\LightScribe
2013-06-07 20:05 . 2013-06-07 20:05 -------- d-----w- c:\programdata\Ahead
2013-06-07 20:01 . 2013-06-07 20:04 -------- d-----w- c:\program files (x86)\Common Files\Ahead
2013-06-07 19:07 . 2013-05-12 22:37 9460464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B75FE17C-E2C7-4597-89D8-936B1E30F4C2}\mpengine.dll
2013-06-07 17:10 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2013-06-07 17:10 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2013-06-07 17:10 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2013-06-07 17:10 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2013-06-07 17:03 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2013-06-07 17:03 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2013-06-07 17:03 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2013-06-07 17:03 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2013-06-07 17:02 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2013-06-07 17:02 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2013-06-07 17:02 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2013-06-07 17:02 . 2012-06-02 14:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2013-06-07 17:02 . 2012-06-02 14:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2013-06-07 17:01 . 2013-06-07 17:01 -------- d-----w- C:\Recovery
2013-06-07 16:43 . 2013-06-08 10:18 -------- d-----w- c:\users\Default\AppData\Local\SoftThinks
2013-06-07 16:43 . 2013-06-07 16:43 -------- d-----w- c:\users\Default\AppData\Roaming\KODAK AiO Home Center93006868
2013-06-07 16:43 . 2013-06-07 16:43 -------- d-----w- c:\users\Default\AppData\Roaming\KODAK AiO Home Center391347320
2013-06-07 16:43 . 2013-06-07 16:43 -------- d-----w- c:\users\Default\AppData\Local\Eastman_Kodak_Company
2013-06-07 16:20 . 2013-06-08 10:17 -------- d-----w- c:\users\Home PC
2013-06-07 16:20 . 2013-06-07 16:41 -------- d-----w- c:\users\NEW Admin
2013-06-07 16:18 . 2013-06-08 10:18 -------- d-----w- c:\programdata\Kodak
2013-06-07 16:18 . 2013-06-07 16:18 -------- d-----w- c:\windows\system32\kodak
2013-06-07 16:17 . 2013-06-07 16:17 -------- d-----w- c:\program files\Realtek
2013-06-07 16:17 . 2013-06-07 16:17 -------- d-----w- c:\windows\SysWow64\RTCOM
2013-06-07 11:17 . 2013-06-07 16:22 -------- d-----w- c:\program files\Speccy
2013-06-06 18:44 . 2013-06-06 18:44 964552 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E7D8AD44-81F5-450D-BC82-CA2AD5222169}\gapaengine.dll
2013-06-06 18:41 . 2013-06-07 16:25 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2013-06-06 18:41 . 2013-06-07 16:22 -------- d-----w- c:\program files\Microsoft Security Client
2013-06-05 08:32 . 2013-06-08 11:15 -------- d-----w- C:\ComboFix
2013-06-02 19:09 . 2013-06-07 16:24 -------- d-----w- c:\program files (x86)\ESET
2013-06-02 09:04 . 2013-06-02 09:04 -------- d-----w- C:\_OTM
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-06-01 16:01 . 2013-06-01 16:01 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-06-01 16:01 . 2013-06-07 16:25 -------- d-----w- c:\program files (x86)\QuickTime
2013-06-01 15:58 . 2013-06-07 17:17 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-05-23 21:17 . 2013-06-07 16:30 -------- d-----w- c:\programdata\Malwarebytes
2013-05-23 18:00 . 2013-06-07 16:30 -------- d-----w- c:\program files (x86)\Windows Resource Kits
2013-05-22 11:06 . 2013-05-22 11:06 262552 ----a-w- c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
2013-05-22 08:08 . 2013-06-07 16:30 -------- d-----w- c:\programdata\PC-Doctor for Windows
2013-05-22 08:07 . 2013-06-07 16:22 -------- d-----w- c:\program files\My Dell
2013-05-20 11:56 . 2013-04-05 06:50 3958784 ------w- c:\windows\system32\jscript9.dll
2013-05-20 11:56 . 2013-04-05 05:26 2877440 ------w- c:\windows\SysWow64\jscript9.dll
2013-05-20 06:33 . 2013-06-07 16:27 -------- d-----w- c:\program files (x86)\Solid Savings
2013-05-17 17:57 . 2013-06-07 16:31 -------- d-----w- c:\users\louise
2013-05-16 19:27 . 2013-06-07 16:24 -------- d-----w- c:\program files (x86)\Google
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-01 02:59 . 2013-05-01 02:59 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2013-05-01 02:59 . 2013-05-01 02:59 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2013-04-18 07:49 . 2013-04-18 07:49 905728 ------w- c:\windows\system32\mshtmlmedia.dll
2013-04-18 07:49 . 2013-04-18 07:49 719360 ------w- c:\windows\SysWow64\mshtmlmedia.dll
2013-04-18 07:49 . 2013-04-18 07:49 226304 ------w- c:\windows\system32\elshyph.dll
2013-04-18 07:49 . 2013-04-18 07:49 185344 ------w- c:\windows\SysWow64\elshyph.dll
2013-04-18 07:49 . 2013-04-18 07:49 135680 ------w- c:\windows\system32\IEAdvpack.dll
2013-04-18 07:49 . 2013-04-18 07:49 110592 ------w- c:\windows\SysWow64\IEAdvpack.dll
2013-04-18 07:49 . 2013-04-18 07:49 1054720 ------w- c:\windows\system32\MsSpellCheckingFacility.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"Conime"="c:\windows\system32\conime.exe" [BU]
"Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-25 1117528]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]
"EKStatusMonitor"="c:\program files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe" [2012-10-15 2844608]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-03 284696]
"NeroLauncher"="c:\program files (x86)\Nero\SyncUP\NeroLauncher.exe" [2012-02-06 66872]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2011-2-23 323584]
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe [2012-06-11 193616]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2008-10-24 43008]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [2007-12-03 24064]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2008-10-24 43008]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-12 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-03 13336]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [2012-10-19 395200]
S2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;c:\program files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [2012-10-15 779200]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-11-25 687400]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2009-07-20 27136]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480]
S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe [2012-06-11 240208]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-26 138752]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-07-31 236544]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 09:14 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-07-12 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-07-12 387608]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-07-12 365592]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-21 8306208]
"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.co.uk/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Home PC\AppData\Roaming\Mozilla\Firefox\Profiles\w2ccactm.default-1370515613247\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/webhp?rls=ig
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-WT089446 - c:\program files (x86)\WildTangent\Dell Games\Wedding Dash - Ready
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-06-08 12:38:34
ComboFix-quarantined-files.txt 2013-06-08 11:38
ComboFix2.txt 2013-06-05 09:03
ComboFix3.txt 2013-06-04 18:48
ComboFix4.txt 2013-06-03 19:33
ComboFix5.txt 2013-06-08 11:15
.
Pre-Run: 429,495,123,968 bytes free
Post-Run: 428,991,238,144 bytes free
.
- - End Of File - - 79D07A15B1C3F32416103B12F07D7242

Im stuck now as I have tried both options and neither seemed to remove it yet when I type it in the run box it didnt seem to find the program??

Do I still continue with the remainder of the instruction??


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

It worked this time and I have uninstalled Combofix.Im going to continue with the instruction

Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I have downloaded shockwave player ok but flash player still will not download properly. In firefox (after I have chosen the firefox option in Adobe downloads prior to downloading) the program downloads but then firefox doesnt respond after reboot as before. I then tried to download on IE after uninstalling on firefox and using that download option.I go through all 3 stages and it looks like it has extracted the files but it is not showing in my downloads file and it is not showing in my control panel as on the system. I even tried changing IE as the default browser. Unfortunately the same problem as I initially posted with still exists.

Chris
Chris


----------



## Mark1956 (May 7, 2011)

The problem you had with Combofix was a touch self inflicted, it clearly states in the original instructions to download and run it:

*save it to your Desktop. <-Important!!!*

You saved it to your downloads folder so when the uninstaller was run it couldn't find it as it was in the wrong place. Glad you managed to figure it out in the end.

=========================================================


> When you are in the run box there is NO message underneath saying this task will be created with administrative priveleges


That is also the case on my Windows 7 system, the screenshot in the canned response may have been taken from a Vista PC, either way it is of no concern

==========================================================

Sorry to hear Flash player is still an issue, there is so much information on the internet about similar issues with many different solutions it is difficult to know what to suggest.

One thing you could try is to uninstall all/any Adobe products, then run the Flash Player Uninstaller

Then we can do a search of the system and the registry to see if there might just be some remnants left behind that could be causing the problem, don't try and re-install Flash until I give the all clear.

Please download *SystemLook* from the following link below and save it to your Desktop.


*SystemLook (64-bit)*


Double-click *SystemLook.exe* to run it.
_*Vista*/*Windows 7* users right-click and select Run As Administrator_.
Copy and paste everything in the codebox below into the main textfield:


```
:filefind
*flash*
*adobe*
:folderfind
*flash*
*adobe*
:regfind
flash
adobe
```

Click the Look button to start the scan.
When finished, a Notepad window will open SystemLook.txt with the results of the search and save a copy on your Desktop.
Please copy and paste the contents of that log in your next reply.


----------



## superfrog25 (Mar 25, 2011)

Just ot let you know Mark. I have managed to uninstall Adobe Air through my Perfect Uninstaller program.It takes a bit longer than normal uninstall but has done the job.Although why the system doesnt think I am the administrator I dont know.


----------



## Mark1956 (May 7, 2011)

I just want to check with you that you did that and the uninstall of any other Adobe products and also ran the Flash Uninstaller before you did the SystemLook scan as there are a lot of remnants showing.

If you didn't complete all those steps before the scan please do so and then run the System Look scan again. That being the case you can click on the *Edit* button on all of the three posts above with the logs in and re-post the new log. There should be a Delete option when you use Edit so you can just wipe the posts out and start again.


----------



## superfrog25 (Mar 25, 2011)

When I go into the link you provided for the flash player uninstall I dont seem to be able to find the right download.There are so many on the page for toolbars and the like. I hovered over one and it said uninstall adobe flash player but when you click it the actual download was codec.I am trying to complete it but finding this link difficult to use.Phantom sent me a adobe uninstaller link earlier which I have been using up until now and I still have that available if you want me to use that one?


----------



## superfrog25 (Mar 25, 2011)

P.S removed the posts for the System look log as requested


----------



## Mark1956 (May 7, 2011)

I can see the confusion, the correct button to use is the blue button just below the big green one near the top of the page. Please use the link Phantom supplied as that comes directly from the Adobe site, I shall change the link I supplied earlier in my records. This will take you there if you need to download it again: Flash Player Uninstaller


----------



## superfrog25 (Mar 25, 2011)

Thanks Mark. Im just uninstalling a toolbar that the original link installed on my PC and I will use your new link to remove flash player and send you another copy of System look


----------



## superfrog25 (Mar 25, 2011)

SystemLook 30.07.11 by jpshortstuff
Log created at 18:05 on 08/06/2013 by Home PC
Administrator - Elevation successful

========== filefind ==========

Searching for "*flash*"
C:\$WINDOWS.~Q\DATA\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\Kodak Flash Drive.lnk --a---- 1215 bytes [07:20 26/10/2012] [07:20 26/10/2012] CFCBDDD3D0A03AA11E7E71C8D8A71A24
C:\Program Files\My Dell\updater\flash.icon1.ico --a---- 2550 bytes [08:08 22/05/2013] [06:21 03/05/2013] 5B6D410767B3F51805B65BD53047DDFF
C:\Program Files\My Dell\updater\flash.icon2.ico --a---- 2550 bytes [08:08 22/05/2013] [06:21 03/05/2013] 6995FC85569B51656600BAFE2D328769
C:\Program Files (x86)\Common Files\Ahead\NAS\nas\presets\Flash.nvp --a---- 14160 bytes [12:01 17/01/2001] [12:01 17/01/2001] D50B818FBD73E024E31EF3A39D1A30D6
C:\Program Files (x86)\Kodak\AiO\Firmware\3000\flash.dll --a---- 32768 bytes [08:21 05/09/2012] [08:21 05/09/2012] F3FD70D5D2775F9B4C66668BC4C4A4D5
C:\Program Files (x86)\Kodak\AiO\Firmware\3200\flash.dll --a---- 32768 bytes [08:21 05/09/2012] [08:21 05/09/2012] 61C0F5A4EC06C53E291CF9E661FE3DF3
C:\Program Files (x86)\Kodak\AiO\Firmware\5\flash.dll --a---- 32768 bytes [08:21 05/09/2012] [08:21 05/09/2012] CB2434A294727A4719F94E9299B00D67
C:\Program Files (x86)\Kodak\AiO\Firmware\5000\flash.dll --a---- 32768 bytes [08:20 05/09/2012] [08:20 05/09/2012] 49CF0423DDB89B59F50B726682700C57
C:\Program Files (x86)\Kodak\AiO\Firmware\5200\flash.dll --a---- 32768 bytes [08:20 05/09/2012] [08:20 05/09/2012] 61C0F5A4EC06C53E291CF9E661FE3DF3
C:\Program Files (x86)\Kodak\AiO\Firmware\79\flash.dll --a---- 32768 bytes [08:21 05/09/2012] [08:21 05/09/2012] 88AE0BC144B2A37D47B6BBA96FA8FF98
C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\apps\foxsports\7.1.391\js\FSJavaScriptFlashGateway.js --a---- 15250 bytes [19:21 22/03/2012] [19:21 22/03/2012] 77AC12A1753A98210DA0F0C56C426680
C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\apps\movies\7.1.391\js\jquery.flash.js --a---- 8805 bytes [14:04 12/10/2011] [14:04 12/10/2011] 0BE0BDABD8D81A5678E68257854BDC9B
C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\apps\news\7.1.391\js\jquery.flash.js --a---- 8805 bytes [14:04 12/10/2011] [14:04 12/10/2011] 0BE0BDABD8D81A5678E68257854BDC9B
C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\apps\slacker\7.1.391\images\no_flash.jpg --a---- 41053 bytes [20:10 21/11/2011] [20:10 21/11/2011] A359D6E62772A6B11C7C90B135F363B9
C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\apps\weather\7.1.391\js\jquery.flash.js --a---- 8805 bytes [14:04 12/10/2011] [14:04 12/10/2011] 0BE0BDABD8D81A5678E68257854BDC9B
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_de\images\Flash-Loader.jpg --a---- 7604 bytes [16:51 25/04/2008] [16:51 25/04/2008] C909D5C9879B24C9092F86700777130D
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_de\images\Flash-Loader_.jpg --a---- 7963 bytes [16:51 25/04/2008] [16:51 25/04/2008] 3D1F7F63AC9072ADD82DF1F4178FAC79
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_default\images\Flash-Loader.jpg --a---- 7604 bytes [01:08 08/04/2004] [01:08 08/04/2004] C909D5C9879B24C9092F86700777130D
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_default\images\Flash-Loader_.jpg --a---- 7963 bytes [01:13 08/04/2004] [01:13 08/04/2004] 3D1F7F63AC9072ADD82DF1F4178FAC79
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_es\images\Flash-Loader.jpg --a---- 7604 bytes [16:51 25/04/2008] [16:51 25/04/2008] C909D5C9879B24C9092F86700777130D
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_es\images\Flash-Loader_.jpg --a---- 7963 bytes [16:51 25/04/2008] [16:51 25/04/2008] 3D1F7F63AC9072ADD82DF1F4178FAC79
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_fr\images\Flash-Loader.jpg --a---- 7604 bytes [16:51 25/04/2008] [16:51 25/04/2008] C909D5C9879B24C9092F86700777130D
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_fr\images\Flash-Loader_.jpg --a---- 7963 bytes [16:51 25/04/2008] [16:51 25/04/2008] 3D1F7F63AC9072ADD82DF1F4178FAC79
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_it\images\Flash-Loader.jpg --a---- 7604 bytes [16:51 25/04/2008] [16:51 25/04/2008] C909D5C9879B24C9092F86700777130D
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_it\images\Flash-Loader_.jpg --a---- 7963 bytes [16:51 25/04/2008] [16:51 25/04/2008] 3D1F7F63AC9072ADD82DF1F4178FAC79
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_ko\images\Flash-Loader.jpg --a---- 7604 bytes [04:07 28/10/2005] [04:07 28/10/2005] C909D5C9879B24C9092F86700777130D
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_ko\images\Flash-Loader_.jpg --a---- 7963 bytes [04:07 28/10/2005] [04:07 28/10/2005] 3D1F7F63AC9072ADD82DF1F4178FAC79
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_zh-cn\images\Flash-Loader.jpg --a---- 7604 bytes [18:50 12/05/2008] [18:50 12/05/2008] C909D5C9879B24C9092F86700777130D
C:\Program Files (x86)\WildTangent\Dell Games\Bejeweled 2 Deluxe\wtmui_zh-cn\images\Flash-Loader_.jpg --a---- 7963 bytes [18:50 12/05/2008] [18:50 12/05/2008] 3D1F7F63AC9072ADD82DF1F4178FAC79
C:\ProgramData\Kodak\Installer\AxInterop.ShockwaveFlashObjects.dll --a---- 28672 bytes [15:51 27/12/2011] [09:54 06/09/2012] (Unable to calculate MD5)
C:\ProgramData\Kodak\Installer\Interop.FlashAccessibility.dll --a---- 4096 bytes [15:51 27/12/2011] [09:54 06/09/2012] (Unable to calculate MD5)
C:\ProgramData\Kodak\Installer\Interop.ShockwaveFlashObjects.dll --a---- 32768 bytes [15:51 27/12/2011] [09:54 06/09/2012] (Unable to calculate MD5)
C:\ProgramData\Kodak\Temp\Interop.FlashAccessibility.dll --a---- 4096 bytes [09:54 06/09/2012] [09:54 06/09/2012] (Unable to calculate MD5)
C:\ProgramData\Kodak\Temp\Interop.ShockwaveFlashObjects.dll --a---- 32768 bytes [09:54 06/09/2012] [09:54 06/09/2012] (Unable to calculate MD5)
C:\Users\All Users\Kodak\Installer\AxInterop.ShockwaveFlashObjects.dll --a---- 28672 bytes [15:51 27/12/2011] [09:54 06/09/2012] (Unable to calculate MD5)
C:\Users\All Users\Kodak\Installer\Interop.FlashAccessibility.dll --a---- 4096 bytes [15:51 27/12/2011] [09:54 06/09/2012] (Unable to calculate MD5)
C:\Users\All Users\Kodak\Installer\Interop.ShockwaveFlashObjects.dll --a---- 32768 bytes [15:51 27/12/2011] [09:54 06/09/2012] (Unable to calculate MD5)
C:\Users\All Users\Kodak\Temp\Interop.FlashAccessibility.dll --a---- 4096 bytes [09:54 06/09/2012] [09:54 06/09/2012] (Unable to calculate MD5)
C:\Users\All Users\Kodak\Temp\Interop.ShockwaveFlashObjects.dll --a---- 32768 bytes [09:54 06/09/2012] [09:54 06/09/2012] (Unable to calculate MD5)
C:\Users\Home PC\AppData\Local\Microsoft\BingBar\Apps\MSN_3dcb31cc91b34a9183ee9e38d43dd6ca\7.1.398\js\jquery.flash.js --a---- 8805 bytes [12:21 17/11/2012] [15:04 12/10/2011] 0BE0BDABD8D81A5678E68257854BDC9B
C:\Users\Home PC\AppData\Local\Microsoft\BingBar\Apps\News_8c172f78520647fbab760cbf38f51e67\7.1.400\js\jquery.flash.js --a---- 8805 bytes [12:21 17/11/2012] [15:04 12/10/2011] 0BE0BDABD8D81A5678E68257854BDC9B
C:\Users\Home PC\AppData\Local\Microsoft\BingBar\Apps\Weather_63630244a02f4e4cb6cb9b09b2f886f3\7.1.391\js\jquery.flash.js --a---- 8805 bytes [12:21 17/11/2012] [14:04 12/10/2011] 0BE0BDABD8D81A5678E68257854BDC9B
C:\Users\Home PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF5N26BV\uninstall_flash_player[1].exe --a---- 813448 bytes [12:59 08/06/2013] [12:59 08/06/2013] C22A15E534EDA7E5470EEA1F5F14E21A
C:\Users\Home PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NV23VF7Y\1099494-i-lose-my-flash-player-10[1].html --a---- 113543 bytes [14:06 08/06/2013] [14:06 08/06/2013] 8BA6212E1CF2B8C317BA9798537A4F15
C:\Users\Home PC\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1].exe --a---- 1035984 bytes [12:31 08/06/2013] [12:31 08/06/2013] 9E4850E1C9D62D95C00C2982B5B1F9A1
C:\Users\Home PC\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_1.exe --a---- 1035952 bytes [12:38 08/06/2013] [12:38 08/06/2013] 8B8A9FE99B63D18047E9D7B221B53BA0
C:\Users\Home PC\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_2.exe --a---- 1035952 bytes [12:41 08/06/2013] [12:41 08/06/2013] 8B8A9FE99B63D18047E9D7B221B53BA0
C:\Users\Home PC\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_3.exe --a---- 1035984 bytes [12:44 08/06/2013] [12:44 08/06/2013] 9E4850E1C9D62D95C00C2982B5B1F9A1
C:\Users\Home PC\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_4.exe --a---- 1035984 bytes [12:46 08/06/2013] [12:46 08/06/2013] 9E4850E1C9D62D95C00C2982B5B1F9A1
C:\Users\Home PC\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_5.exe --a---- 1035984 bytes [12:51 08/06/2013] [12:51 08/06/2013] 9E4850E1C9D62D95C00C2982B5B1F9A1
C:\Users\Home PC\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_6.exe --a---- 1035984 bytes [13:01 08/06/2013] [13:01 08/06/2013] 9E4850E1C9D62D95C00C2982B5B1F9A1
C:\Users\Home PC\AppData\Roaming\Microsoft\Windows\Network Shortcuts\Kodak Flash Drive.lnk --a---- 1215 bytes [15:50 27/12/2011] [15:50 27/12/2011] CFCBDDD3D0A03AA11E7E71C8D8A71A24
C:\Users\Home PC\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2117560a-4ede-4bc8-a56f-95d911efdeb3-flash1.dmp --a---- 77152 bytes [17:48 22/04/2013] [17:48 22/04/2013] DDDD697ABB99704B0B69FE5FE86FA324
C:\Users\Home PC\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2117560a-4ede-4bc8-a56f-95d911efdeb3-flash2.dmp --a---- 79324 bytes [17:48 22/04/2013] [17:48 22/04/2013] 5BA49AE5764FA4ACB7431420094905C6
C:\Users\Home PC\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7813e4df-2f6f-45be-a62f-80263a754813-flash1.dmp --a---- 42211 bytes [09:43 09/03/2013] [09:43 09/03/2013] F9D6E80AB39DFEF293A63E20436C53A8
C:\Users\Home PC\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7813e4df-2f6f-45be-a62f-80263a754813-flash2.dmp --a---- 69396 bytes [09:43 09/03/2013] [09:43 09/03/2013] 5DD9641B0074EFE8FD2A6065840DF885
C:\Users\Home PC\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a34f8c9f-181a-4e1a-924f-3e288b5dff2a-flash1.dmp --a---- 33335 bytes [15:37 05/04/2013] [15:37 05/04/2013] 2FEBA90B4E685D3A85CDA9BEB0079A19
C:\Users\Home PC\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a34f8c9f-181a-4e1a-924f-3e288b5dff2a-flash2.dmp --a---- 51627 bytes [15:37 05/04/2013] [15:37 05/04/2013] 0B21AA57D2F9A8630F81A37AAC241C18
C:\Users\Home PC\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d4631d90-1ffe-41d8-be6f-f235ee721bdf-flash1.dmp --a---- 39443 bytes [18:19 28/03/2013] [18:19 28/03/2013] EEEFF3EC71A099F69A146CA9114AF0CD
C:\Users\Home PC\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d4631d90-1ffe-41d8-be6f-f235ee721bdf-flash2.dmp --a---- 65052 bytes [18:19 28/03/2013] [18:19 28/03/2013] EF50D7805195FA96F5E729B95C192B10
C:\Users\Home PC\Downloads\install_flashplayer11x32_gdrd_aaa_aih(1).exe --a---- 1034440 bytes [14:08 08/06/2013] [14:08 08/06/2013] 57769DB160C123FF2553DFA19B424C90
C:\Users\Home PC\Downloads\install_flashplayer11x32_gdrd_aaa_aih.exe --a---- 1034440 bytes [13:22 08/06/2013] [13:22 08/06/2013] 57769DB160C123FF2553DFA19B424C90
C:\Users\Home PC\Downloads\uninstall_flash_player(1).exe --a---- 813448 bytes [17:04 08/06/2013] [17:04 08/06/2013] C22A15E534EDA7E5470EEA1F5F14E21A
C:\Users\Home PC\Downloads\uninstall_flash_player.exe --a---- 813448 bytes [15:11 23/05/2013] [15:11 23/05/2013] C22A15E534EDA7E5470EEA1F5F14E21A
C:\Users\Home PC\Music\iTunes\iTunes Media\Music\Compilations\Let's Hear It For The Girls\02 Flashdance... What A Feeling.m4a --a---- 3789666 bytes [12:36 29/10/2007] [12:36 29/10/2007] 08552CE1C2A2E49B4BCABF541353AC4E
C:\Windows\Downloaded Program Files\swflash64.inf --a---- 218 bytes [11:17 30/04/2013] [11:17 30/04/2013] 60C0B6143A14467A24E31E887954763F
C:\Windows\schemas\WCN\FlashConfig.xsd --a---- 4942 bytes [20:40 10/06/2009] [20:40 10/06/2009] 8DDE3AF7436B0B3CCC2FCD6F8DA8D87B
C:\Windows\schemas\WCN\FlashConfigDevice.xsd --a---- 14231 bytes [22:02 13/07/2009] [20:40 10/06/2009] 80148EBBA9591C8042797A2440CFF876
C:\Windows\System32\Macromed\Flash\FlashInstall.log --a---- 234952 bytes [13:28 12/01/2012] [17:04 08/06/2013] DACA9A52743E6BD6281F88E22AD9A475
C:\Windows\SysWOW64\Macromed\Flash\FlashInstall.log --a---- 102374 bytes [22:05 05/08/2011] [08:44 20/05/2013] (Unable to calculate MD5)
C:\Windows\winsxs\amd64_microsoft-windows-w..etwork-setup-wizard_31bf3856ad364e35_6.1.7600.16385_none_f0d21d0b5e184994\FlashConfig.xsd --a---- 4942 bytes [20:40 10/06/2009] [20:40 10/06/2009] 8DDE3AF7436B0B3CCC2FCD6F8DA8D87B
C:\Windows\winsxs\amd64_microsoft-windows-w..etwork-setup-wizard_31bf3856ad364e35_6.1.7600.16385_none_f0d21d0b5e184994\FlashConfigDevice.xsd --a---- 14231 bytes [22:02 13/07/2009] [20:40 10/06/2009] 80148EBBA9591C8042797A2440CFF876

Searching for "*adobe*"
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe --a---- 353912 bytes [12:51 27/07/2012] [21:06 04/04/2013] (Unable to calculate MD5)
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\ColorSync.resources\Profiles\AdobeRGB1998.icc --a---- 560 bytes [12:41 26/05/2011] [12:41 26/05/2011] (Unable to calculate MD5)
C:\Program Files (x86)\Nero\Nero 7\Adobe\NeroDigitalPluginAdobePremiere_Eng.pdf --a---- 189121 bytes [17:53 21/02/2007] [17:53 21/02/2007] 104E3F3C7907FB7CB1AB8A62B93D929F
C:\ProgramData\Adobe\ARM\Reader_10.1.1\AdobeARM.bin --a---- 317444 bytes [13:32 11/01/2012] [10:04 12/01/2012] (Unable to calculate MD5)
C:\ProgramData\Adobe\ARM\Reader_10.1.1\2683\AdobeARM.exe --a---- 843712 bytes [07:37 03/01/2012] [07:37 03/01/2012] (Unable to calculate MD5)
C:\ProgramData\Adobe\ARM\Reader_10.1.1\2683\AdobeARMHelper.exe --a---- 320456 bytes [07:37 03/01/2012] [07:37 03/01/2012] (Unable to calculate MD5)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero 7 Essentials\Manuals\Nero Adobe Premiere Plug-In [English].lnk --a---- 2278 bytes [20:06 07/06/2013] [20:06 07/06/2013] 9038C61E1734A7D1A3620146158792AE
C:\Users\All Users\Adobe\ARM\Reader_10.1.1\AdobeARM.bin --a---- 317444 bytes [13:32 11/01/2012] [10:04 12/01/2012] (Unable to calculate MD5)
C:\Users\All Users\Adobe\ARM\Reader_10.1.1\2683\AdobeARM.exe --a---- 843712 bytes [07:37 03/01/2012] [07:37 03/01/2012] (Unable to calculate MD5)
C:\Users\All Users\Adobe\ARM\Reader_10.1.1\2683\AdobeARMHelper.exe --a---- 320456 bytes [07:37 03/01/2012] [07:37 03/01/2012] (Unable to calculate MD5)
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Nero 7 Essentials\Manuals\Nero Adobe Premiere Plug-In [English].lnk --a---- 2278 bytes [20:06 07/06/2013] [20:06 07/06/2013] 9038C61E1734A7D1A3620146158792AE
C:\Users\Home PC\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst --a---- 35116 bytes [15:06 18/08/2011] [08:31 12/04/2013] 3C4F2742089BBBA853EC6BF22EAE567C
C:\Users\Home PC\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst --a---- 108603 bytes [15:06 18/08/2011] [16:46 16/11/2012] E3E94B763A62C49551A1E5E8BCD3AB84
C:\Users\Home PC\AppData\Local\Adobe\Acrobat\11.0\AdobeCMapFnt11.lst --a---- 1011 bytes [09:01 22/05/2013] [09:01 22/05/2013] FE222671BAD81AAB8C7B8766E826558D
C:\Users\Home PC\AppData\Local\Adobe\Acrobat\11.0\AdobeSysFnt11.lst --a---- 108706 bytes [09:01 22/05/2013] [09:01 22/05/2013] EA2AFFBF3BF3E196762170577416A4F7
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\10.0\ServicesRdr\com_2E_adobe_2E_acrobat_2E_services_2E_cfg_5F_10_2E_1_2E_5_2E_2.cfg --a---- 586012 bytes [17:38 25/02/2013] [17:38 25/02/2013] 5C2441FBA01CDD0DD989BBFCBDDE5DA0
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\10.0\ServicesRdr\com_2E_adobe_2E_acrobat_2E_services_2E_DEXShare_5F_10_2E_1_2E_1_2E_2.spi --a---- 1191519 bytes [14:56 31/10/2011] [14:56 31/10/2011] 94288E8ECECD837B4A6AD5460FE54224
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\10.0\ServicesRdr\com_2E_adobe_2E_acrobat_2E_services_2E_DEXShare_5F_10_2E_1_2E_5_2E_2.spi --a---- 1346203 bytes [17:38 25/02/2013] [17:38 25/02/2013] A7625AA96BAB6E3DDDEBD5E370B41412
C:\Users\louise\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\F402B3IA\get2.adobe[1].xml --a---- 13 bytes [18:00 17/05/2013] [18:01 17/05/2013] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5

========== folderfind ==========

Searching for "*flash*"
C:\Program Files (x86)\Adobe\Flash Player d------ [22:42 05/08/2011]
C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\apps\foxsports\7.1.391\flash d------ [16:13 18/09/2012]
C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\apps\slacker\7.1.391\flash d------ [16:14 18/09/2012]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_124650d0599ae8722fadaaee1eefd2f530f38ab3_16f24f38 d----c- [12:41 08/06/2013]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_5df07a3d1446b3b128eb08c393b82156dc96ca9_03eaf3d0 d----c- [12:38 08/06/2013]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_7f4844d65cc34d74523bbcbc5d1683a6252a79cc_02b057ef d----c- [13:01 08/06/2013]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_846b451cf04c2027b31e7c84f9a8aa6fda04670_0e3cf131 d----c- [12:44 08/06/2013]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_8614db19a620bd328185178fe1160b893af2f6_11d8d28a d----c- [12:31 08/06/2013]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_bfeb5cd633687d474955ed63a6f5b58a3b25b0b2_0d1aeadb d----c- [12:46 08/06/2013]
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_de11c541ca2876ec07a6f586cb946f5cb8cf431_0e1b8f82 d----c- [12:51 08/06/2013]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_124650d0599ae8722fadaaee1eefd2f530f38ab3_16f24f38 d----c- [12:41 08/06/2013]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_5df07a3d1446b3b128eb08c393b82156dc96ca9_03eaf3d0 d----c- [12:38 08/06/2013]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_7f4844d65cc34d74523bbcbc5d1683a6252a79cc_02b057ef d----c- [13:01 08/06/2013]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_846b451cf04c2027b31e7c84f9a8aa6fda04670_0e3cf131 d----c- [12:44 08/06/2013]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_8614db19a620bd328185178fe1160b893af2f6_11d8d28a d----c- [12:31 08/06/2013]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_bfeb5cd633687d474955ed63a6f5b58a3b25b0b2_0d1aeadb d----c- [12:46 08/06/2013]
C:\Users\All Users\Microsoft\Windows\WER\ReportArchive\AppCrash_install_flashpla_de11c541ca2876ec07a6f586cb946f5cb8cf431_0e1b8f82 d----c- [12:51 08/06/2013]
C:\Users\Default\AppData\Roaming\Macromedia\Flash Player d------ [16:43 07/06/2013]
C:\Users\Home PC\AppData\Local\Macromedia\Flash Player d------ [11:18 10/06/2012]
C:\Users\Home PC\AppData\Local\VirtualStore\Program Files (x86)\Kodak\KODAK Software Updater\7288971\Users\Default\Data\GenFlash d------ [11:22 14/08/2011]
C:\Users\Home PC\AppData\Roaming\Adobe\Flash Player d------ [15:43 10/08/2011]
C:\Users\Home PC\AppData\Roaming\Macromedia\Flash Player d------ [15:37 10/08/2011]
C:\Users\Home PC\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer d------ [12:25 08/06/2013]
C:\Users\louise\AppData\Roaming\Adobe\Flash Player d------ [17:57 17/05/2013]
C:\Users\louise\AppData\Roaming\Macromedia\Flash Player d------ [17:57 17/05/2013]
C:\Windows\System32\Macromed\Flash d------ [13:28 12/01/2012]
C:\Windows\SysWOW64\Macromed\Flash d------ [22:05 05/08/2011]

Searching for "*adobe*"
C:\$WINDOWS.~Q\DATA\Program Files (x86)\Adobe d------ [22:36 05/08/2011]
C:\$WINDOWS.~Q\DATA\ProgramData\Adobe d------ [22:36 05/08/2011]
C:\Program Files (x86)\Adobe d------ [22:36 05/08/2011]
C:\Program Files (x86)\Common Files\Adobe d------ [22:36 05/08/2011]
C:\Program Files (x86)\Common Files\Adobe AIR d------ [22:42 05/08/2011]
C:\Program Files (x86)\Nero\Nero 7\Adobe d------ [20:01 07/06/2013]
C:\ProgramData\Adobe d------ [22:36 05/08/2011]
C:\Users\All Users\Adobe d------ [22:36 05/08/2011]
C:\Users\Home PC\AppData\Local\Adobe d------ [15:05 18/08/2011]
C:\Users\Home PC\AppData\LocalLow\Adobe d------ [15:05 18/08/2011]
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary d------ [10:13 03/05/2012]
C:\Users\Home PC\AppData\Roaming\Adobe d------ [15:43 10/08/2011]
C:\Users\louise\AppData\Roaming\Adobe d------ [17:57 17/05/2013]

========== regfind ==========

Searching for "flash"
[HKEY_CURRENT_USER\Software\delta LTD\delta\ffxstrg]
"last_widget_url"="forums.techguy.org%2Fwindows-7%2F1099494-i-lose-my-flash-player-10.html"
[HKEY_CURRENT_USER\Software\Macromedia\FlashPlayer]
[HKEY_CURRENT_USER\Software\Macromedia\FlashPlayerUpdate]
[HKEY_CURRENT_USER\Software\Macromedia\FlashPlayerUpdate]
"description"="<XML><update version="11,7,700,169"><description>mshtml:

An update to your Adobe Flash Player is available

This update includes improvements in usability, online security and stability, as well as new features which help content developers deliver rich and engaging experiences.

Did you know...
The top 10 Facebook games use the Flash Player. To see more, visit: www.adobe.com/games.
Most of the top video sites on the web use Flash Player
Flash Player is installed on over 1.3 billion connected PCs
</description></update>message "This update includes improvements in usability, online security and stability, as well as new features which help content developers deliver rich and engaging experiences.

Did you know...

The top 10 Face
[HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication]
"Name"="InstallFlashPlayer.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Macromedia\FlashPlayer]
[HKEY_CURRENT_USER\Software\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}]
@="IFlashObject"
[HKEY_CURRENT_USER\Software\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}]
@="IShockwaveFlash"
[HKEY_CURRENT_USER\Software\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}]
@="_IShockwaveFlashEvents"
[HKEY_CURRENT_USER\Software\Classes\TypeLib\{5E1D2576-5230-462C-8F7A-09EC150B770A}\1.0]
@="Shockwave Flash"
[HKEY_CURRENT_USER\Software\Classes\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}]
@="_IShockwaveFlashEvents"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.swf]
@="ShockwaveFlash.ShockwaveFlash"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.swf]
"Content Type"="application/x-shockwave-flash"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|ProgramData|Kodak|Temp|AxInterop.ShockwaveFlashObjects.dll]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|ProgramData|Kodak|Temp|AxInterop.ShockwaveFlashObjects.dll]
"AxInterop.ShockwaveFlashObjects,Version="1.0.0.0",PublicKeyToken="5CC7AD8ABD921325",Culture="neutral",FileVersion="1.0.0.0",ProcessorArchitecture="MSIL""="}[email protected]}_}(Qt`[I(>@YGi.1(RQ9RD3JNr858r"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|ProgramData|Kodak|Temp|Interop.FlashAccessibility.dll]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|ProgramData|Kodak|Temp|Interop.FlashAccessibility.dll]
"Interop.FlashAccessibility,Version="1.1.0.0",PublicKeyToken="5CC7AD8ABD921325",Culture="neutral",FileVersion="1.1.0.0",ProcessorArchitecture="MSIL""="}[email protected]}_}(Qt`[I(>.{n&Z?c01?UJUM?_6Mxz"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|ProgramData|Kodak|Temp|Interop.ShockwaveFlashObjects.dll]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|ProgramData|Kodak|Temp|Interop.ShockwaveFlashObjects.dll]
"Interop.ShockwaveFlashObjects,Version="1.0.0.0",PublicKeyToken="5CC7AD8ABD921325",Culture="neutral",FileVersion="1.0.0.0",ProcessorArchitecture="MSIL""="}[email protected]}_}(Qt`[I(>[`m,xA]8]9r5SjzH%EYU"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}]
@="IFlashAccessibility"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}]
@="IFlashObject"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}]
@="IShockwaveFlash"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}]
@="_IShockwaveFlashEvents"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-shockwave-flash]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Nero.SyncUP.10.flv.2]
@="Flash Video"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif]
"PreviewDetails"="prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jfif]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.P
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe]
"PreviewDetails"="prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpe]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.Pr
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg]
"PreviewDetails"="prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.P
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg]
"PreviewDetails"="prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpg]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.Pr
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif]
"PreviewDetails"="prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.Pr
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff]
"PreviewDetails"="prop:System.Photo.DateTaken;System.Keywords;*System.Photo.PeopleNames;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.SharedWith"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;*System.Photo.PeopleNames;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.P
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp]
"PreviewDetails"="prop:System.Photo.DateTaken;System.Keywords;System.Rating;*System.Image.Dimensions;*System.Size;System.Title;System.Author;System.Comment;*System.OfflineAvailability;*System.OfflineStatus;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Subject;*System.Photo.FNumber;*System.Photo.ExposureTime;*System.Photo.ISOSpeed;*System.Photo.ExposureBias;*System.Photo.FocalLength;*System.Photo.MaxAperture;*System.Photo.MeteringMode;*System.Photo.SubjectDistance;*System.Photo.Flash;*System.Photo.FlashEnergy;*System.Photo.FocalLengthInFilm;*System.DateCreated;*System.DateModified;*System.DateAccessed;*System.SharedWith"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wdp]
"FullDetails"="prop:System.PropGroup.Description;System.Title;System.Subject;System.Rating;System.Keywords;System.Comment;System.PropGroup.Origin;System.Author;System.Photo.DateTaken;System.ApplicationName;System.DateAcquired;System.Copyright;System.PropGroup.Image;System.Image.ImageID;System.Image.Dimensions;System.Image.HorizontalSize;System.Image.VerticalSize;System.Image.HorizontalResolution;System.Image.VerticalResolution;System.Image.BitDepth;System.Image.Compression;System.Image.ResolutionUnit;System.Image.ColorSpace;System.Image.CompressedBitsPerPixel;System.PropGroup.Camera;System.Photo.CameraManufacturer;System.Photo.CameraModel;System.Photo.FNumber;System.Photo.ExposureTime;System.Photo.ISOSpeed;System.Photo.ExposureBias;System.Photo.FocalLength;System.Photo.MaxAperture;System.Photo.MeteringMode;System.Photo.SubjectDistance;System.Photo.Flash;System.Photo.FlashEnergy;System.Photo.FocalLengthInFilm;System.PropGroup.PhotoAdvanced;Syst
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1]
@="FlashAccessibility"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1\0\win64]
@="C:\Windows\system32\Macromed\Flash\Flash64_11_7_700_202.ocx\2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1\HELPDIR]
@="C:\Windows\system32\Macromed\Flash"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WCN.AutoPlayHandler\shell\open\command]
@="%systemroot%\system32\rundll32.exe %systemroot%\system32\wzcdlg.dll,ImportFlashProfile %L"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}]
@="IFlashAccessibility"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}]
@="IFlashObject"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}]
@="IShockwaveFlash"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}]
@="_IShockwaveFlashEvents"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1]
@="FlashAccessibility"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1\0\win64]
@="C:\Windows\system32\Macromed\Flash\Flash64_11_7_700_202.ocx\2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1\HELPDIR]
@="C:\Windows\system32\Macromed\Flash"
[HKEY_LOCAL_MACHINE\SOFTWARE\Macromedia\FlashPlayer]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FlashConfig]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\FlashPlayerPlugin_11_3_300_257.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\FlashPlayerPlugin_11_3_300_262.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\FlashPlayerPlugin_11_3_300_265.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\FlashPlayerPlugin_11_3_300_268.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\FlashPlayerPlugin_11_3_300_270.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\FlashPlayerPlugin_11_3_300_271.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\FlashPlayerPlugin_11_4_402_265.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\FlashPlayerPlugin_11_4_402_287.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\FlashPlayerPlugin_11_6_602_180.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WDM]
"USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1_0-{05901221-D566-11d1-B2F0-00A0C9062910}"="LowDateTime:803713417,HighDateTime:0***Binary mof compiled successfully"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WDM\DREDGE]
"USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1_0-{05901221-D566-11d1-B2F0-00A0C9062910}"="LowDateTime:803713417,HighDateTime:0***Binary mof compiled successfully"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\DeviceGroups\CFStorage]
"Label"="CompactFlash Reader/Writer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Adobe\Flash Player\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Adobe\Flash Player\AddIns\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BFDB5BB95F32B0844A5AFE841916EEEF]
"A3C14B8429A918B46B359CF7BE589C01"="C?\ProgramData\Kodak\Temp\Interop.FlashAccessibility.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E8AD826FA7070434FA9DB6EF9B1B1DD8]
"A3C14B8429A918B46B359CF7BE589C01"="C?\ProgramData\Kodak\Temp\Interop.ShockwaveFlashObjects.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1AE4942A89BBD24D8EFB7773B72FD3E]
"A3C14B8429A918B46B359CF7BE589C01"="C?\ProgramData\Kodak\Temp\AxInterop.ShockwaveFlashObjects.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_USBSTOR#Disk&Ven_Generic&Prod_Flash_Disk&Rev_8.07#D7563CFC&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_1694327071]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-09D6]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-10C8]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-1176]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-26CD]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-2845]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-329E]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-3971]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-45C2]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-61F3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-6DD4]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-75FA]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-85C3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-A2E4]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-A421]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-ADD5]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-B76D]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-C4FD]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-D0C9]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-ECFE]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-F29F]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Portable Devices\Devices\WPDBUSENUMROOT#UMB#2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC&PROD_FLASH_DISK&REV_8.07#D7563CFC&0#]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Portable Devices\Devices\WPDBUSENUMROOT#UMB#2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Kodak\Kodak EasyShare software\Transfer\PtsSources\Kcf]
"DEVICEKEY"="*SCSI\EUSB____COMPACT_FLASH*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Kodak\Kodak EasyShare software\Transfer\PtsSources\Kcf]
"MEDEVICEKEY"="*SCSI\EUSB____COMPACT_FLASH*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Kodak\Kodak EasyShare software\Transfer\PtsSources\Kcf]
"W2KDEVICEKEY"="*USBSTOR\DISK&VEN_EUSB&PROD_COMPACT_FLASH*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Macromedia\FlashPlayer]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\FlashConfig]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FlashPlayerPlugin_11_7_700_202_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FlashPlayerPlugin_11_7_700_202_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_1_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_1_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_2_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_2_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_3_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_3_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_4_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_4_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_5_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_5_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_6_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_6_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1]_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32_gdrd_aaa_aih(2)_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32_gdrd_aaa_aih(2)_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32_gdrd_aaa_aih_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\install_flashplayer11x32_gdrd_aaa_aih_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\AutoplayHandlers\DeviceGroups\CFStorage]
"Label"="CompactFlash Reader/Writer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-09D6]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-10C8]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-1176]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-26CD]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-2845]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-329E]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-3971]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-45C2]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-61F3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-6DD4]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-75FA]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-85C3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-A2E4]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-A421]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-ADD5]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-B76D]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-C4FD]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-D0C9]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-ECFE]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\PerHwIdStorage\PCMCIA#M-Systems-M-SYS_Flash_Memory_Card-F29F]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}]
@="IFlashAccessibility"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}]
@="IFlashObject"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}]
@="IShockwaveFlash"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}]
@="_IShockwaveFlashEvents"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1]
@="FlashAccessibility"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1\0\win64]
@="C:\Windows\system32\Macromed\Flash\Flash64_11_7_700_202.ocx\2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1\HELPDIR]
@="C:\Windows\system32\Macromed\Flash"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CriticalDeviceDatabase\PCMCIA#CL_ATA_FLASH_CARD_LEXAR__-HURRIC_-172F]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CriticalDeviceDatabase\PCMCIA#CL_ATA_FLASH_CARD_LEXAR__-TIDALWV-0E97]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CriticalDeviceDatabase\PCMCIA#CL_ATA_FLASH_CARD_LEXAR__-TIDALWV-FD21]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CriticalDeviceDatabase\PCMCIA#CL_ATA_FLASH_CARD_LEXAR__-TORNADO-29EC]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CriticalDeviceDatabase\PCMCIA#LEXARMEDIA_ATA_FLASH_CARD-HUR_HP_-0623]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CriticalDeviceDatabase\PCMCIA#____CL_ATA_FLASH_CARD_LEXAR__-HURRIC_-DC37]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{10497b1b-ba51-44e5-8318-a65c837b6661}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{10497b1b-ba51-44e5-8318-a65c837b6661}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{10497b1b-ba51-44e5-8318-a65c837b6661}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{10497b1b-ba51-44e5-8318-a65c837b6661}]
"DeviceInstance"="WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{10497b1b-ba51-44e5-8318-a65c837b6661}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{10497b1b-ba51-44e5-8318-a65c837b6661}\#]
"SymbolicLink"="\\?\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{10497b1b-ba51-44e5-8318-a65c837b6661}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\##?#USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\##?#USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
"DeviceInstance"="USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\##?#USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\#]
"SymbolicLink"="\\?\USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#Volume#_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#Volume#_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
"DeviceInstance"="STORAGE\Volume\_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#Volume#_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\#]
"SymbolicLink"="\\?\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6ac27878-a6fa-4155-ba85-f98f491d4f33}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6ac27878-a6fa-4155-ba85-f98f491d4f33}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}]
"DeviceInstance"="WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{6ac27878-a6fa-4155-ba85-f98f491d4f33}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}\#]
"SymbolicLink"="\\?\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}]
"DeviceInstance"="WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}\#]
"SymbolicLink"="\\?\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\STORAGE\Volume\_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1]
"HardwareID"="USBSTOR\DiskGeneric-Compact_Flash___1.01 USBSTOR\DiskGeneric-Compact_Flash___ USBSTOR\DiskGeneric- USBSTOR\Generic-Compact_Flash___1 Generic-Compact_Flash___1 USBSTOR\GenDisk GenDisk"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1]
"FriendlyName"="Generic- Compact Flash USB Device"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#]
"DeviceDesc"="Compact Flash "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum]
"3"="USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fvevol\Enum]
"6"="STORAGE\Volume\_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\partmgr\Enum]
"4"="USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdyboost\Enum]
"6"="STORAGE\Volume\_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\volsnap\Enum]
"6"="STORAGE\Volume\_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WUDFRd\Enum]
"0"="WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\CriticalDeviceDatabase\PCMCIA#CL_ATA_FLASH_CARD_LEXAR__-HURRIC_-172F]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\CriticalDeviceDatabase\PCMCIA#CL_ATA_FLASH_CARD_LEXAR__-TIDALWV-0E97]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\CriticalDeviceDatabase\PCMCIA#CL_ATA_FLASH_CARD_LEXAR__-TIDALWV-FD21]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\CriticalDeviceDatabase\PCMCIA#CL_ATA_FLASH_CARD_LEXAR__-TORNADO-29EC]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\CriticalDeviceDatabase\PCMCIA#LEXARMEDIA_ATA_FLASH_CARD-HUR_HP_-0623]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\CriticalDeviceDatabase\PCMCIA#____CL_ATA_FLASH_CARD_LEXAR__-HURRIC_-DC37]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{10497b1b-ba51-44e5-8318-a65c837b6661}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{10497b1b-ba51-44e5-8318-a65c837b6661}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{10497b1b-ba51-44e5-8318-a65c837b6661}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{10497b1b-ba51-44e5-8318-a65c837b6661}]
"DeviceInstance"="WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{10497b1b-ba51-44e5-8318-a65c837b6661}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{10497b1b-ba51-44e5-8318-a65c837b6661}\#]
"SymbolicLink"="\\?\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{10497b1b-ba51-44e5-8318-a65c837b6661}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\##?#USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\##?#USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
"DeviceInstance"="USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\##?#USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\#]
"SymbolicLink"="\\?\USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#Volume#_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#Volume#_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
"DeviceInstance"="STORAGE\Volume\_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#Volume#_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\#]
"SymbolicLink"="\\?\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{6ac27878-a6fa-4155-ba85-f98f491d4f33}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{6ac27878-a6fa-4155-ba85-f98f491d4f33}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}]
"DeviceInstance"="WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{6ac27878-a6fa-4155-ba85-f98f491d4f33}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}\#]
"SymbolicLink"="\\?\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}]
"DeviceInstance"="WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}\#]
"SymbolicLink"="\\?\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\STORAGE\Volume\_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1]
"HardwareID"="USBSTOR\DiskGeneric-Compact_Flash___1.01 USBSTOR\DiskGeneric-Compact_Flash___ USBSTOR\DiskGeneric- USBSTOR\Generic-Compact_Flash___1 Generic-Compact_Flash___1 USBSTOR\GenDisk GenDisk"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1]
"FriendlyName"="Generic- Compact Flash USB Device"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#]
"DeviceDesc"="Compact Flash "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AdobeFlashPlayerUpdateSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AdobeFlashPlayerUpdateSvc]
"ImagePath"="C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AdobeFlashPlayerUpdateSvc]
"DisplayName"="Adobe Flash Player Update Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AdobeFlashPlayerUpdateSvc]
"Description"="This service keeps your Adobe Flash Player installation up to date with the latest enhancements and security fixes."
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\PCMCIA#CL_ATA_FLASH_CARD_LEXAR__-HURRIC_-172F]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\PCMCIA#CL_ATA_FLASH_CARD_LEXAR__-TIDALWV-0E97]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\PCMCIA#CL_ATA_FLASH_CARD_LEXAR__-TIDALWV-FD21]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\PCMCIA#CL_ATA_FLASH_CARD_LEXAR__-TORNADO-29EC]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\PCMCIA#LEXARMEDIA_ATA_FLASH_CARD-HUR_HP_-0623]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\PCMCIA#____CL_ATA_FLASH_CARD_LEXAR__-HURRIC_-DC37]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{10497b1b-ba51-44e5-8318-a65c837b6661}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{10497b1b-ba51-44e5-8318-a65c837b6661}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{10497b1b-ba51-44e5-8318-a65c837b6661}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{10497b1b-ba51-44e5-8318-a65c837b6661}]
"DeviceInstance"="WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{10497b1b-ba51-44e5-8318-a65c837b6661}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{10497b1b-ba51-44e5-8318-a65c837b6661}\#]
"SymbolicLink"="\\?\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{10497b1b-ba51-44e5-8318-a65c837b6661}"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\##?#USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\##?#USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
"DeviceInstance"="USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\##?#USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\#]
"SymbolicLink"="\\?\USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#Volume#_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#Volume#_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
"DeviceInstance"="STORAGE\Volume\_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\##?#STORAGE#Volume#_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\#]
"SymbolicLink"="\\?\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{6ac27878-a6fa-4155-ba85-f98f491d4f33}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{6ac27878-a6fa-4155-ba85-f98f491d4f33}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}]
"DeviceInstance"="WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{6ac27878-a6fa-4155-ba85-f98f491d4f33}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}\#]
"SymbolicLink"="\\?\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}]
"DeviceInstance"="WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}\##?#WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}\#]
"SymbolicLink"="\\?\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\STORAGE\Volume\_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1]
"HardwareID"="USBSTOR\DiskGeneric-Compact_Flash___1.01 USBSTOR\DiskGeneric-Compact_Flash___ USBSTOR\DiskGeneric- USBSTOR\Generic-Compact_Flash___1 Generic-Compact_Flash___1 USBSTOR\GenDisk GenDisk"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1]
"FriendlyName"="Generic- Compact Flash USB Device"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#]
"DeviceDesc"="Compact Flash "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Disk\Enum]
"3"="USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\fvevol\Enum]
"6"="STORAGE\Volume\_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\partmgr\Enum]
"4"="USBSTOR\Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01\058F63626420&1"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\rdyboost\Enum]
"6"="STORAGE\Volume\_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\volsnap\Enum]
"6"="STORAGE\Volume\_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.01#058F63626420&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WUDFRd\Enum]
"0"="WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.01#058F63626420&1#"
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\delta LTD\delta\ffxstrg]
"last_widget_url"="forums.techguy.org%2Fwindows-7%2F1099494-i-lose-my-flash-player-10.html"
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Macromedia\FlashPlayer]
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Macromedia\FlashPlayerUpdate]
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Macromedia\FlashPlayerUpdate]
"description"="<XML><update version="11,7,700,169"><description>mshtml:

An update to your Adobe Flash Player is available

This update includes improvements in usability, online security and stability, as well as new features which help content developers deliver rich and engaging experiences.

Did you know...
The top 10 Facebook games use the Flash Player. To see more, visit: www.adobe.com/games.
Most of the top video sites on the web use Flash Player
Flash Player is installed on over 1.3 billion connected PCs
</description></update>message "This update includes improvements in usability, online security and stability, as well as new features which help content developers deliver rich and engaging experiences.

Did 
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Microsoft\Direct3D\MostRecentApplication]
"Name"="InstallFlashPlayer.exe"
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Macromedia\FlashPlayer]
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}]
@="IFlashObject"
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}]
@="IShockwaveFlash"
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}]
@="_IShockwaveFlashEvents"
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Classes\TypeLib\{5E1D2576-5230-462C-8F7A-09EC150B770A}\1.0]
@="Shockwave Flash"
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Classes\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}]
@="_IShockwaveFlashEvents"
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000_Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}]
@="IFlashObject"
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000_Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}]
@="IShockwaveFlash"
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000_Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}]
@="_IShockwaveFlashEvents"
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000_Classes\TypeLib\{5E1D2576-5230-462C-8F7A-09EC150B770A}\1.0]
@="Shockwave Flash"
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000_Classes\Wow6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}]
@="_IShockwaveFlashEvents"

Searching for "adobe"
[HKEY_CURRENT_USER\Software\Adobe]
[HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat]
[HKEY_CURRENT_USER\Software\Adobe\Adobe ARM]
[HKEY_CURRENT_USER\Software\Adobe\Adobe Synchronizer]
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Adobe]
[HKEY_CURRENT_USER\Software\Macromedia\FlashPlayerUpdate]
"description"="<XML><update version="11,7,700,169"><description>mshtml:

An update to your Adobe Flash Player is available

This update includes improvements in usability, online security and stability, as well as new features which help content developers deliver rich and engaging experiences.

Did you know...
The top 10 Facebook games use the Flash Player. To see more, visit: www.adobe.com/games.
Most of the top video sites on the web use Flash Player
Flash Player is installed on over 1.3 billion connected PCs
</description></update>message "This update includes improvements in usability, online security and stability, as well as new features which help content developers deliver rich and engaging experiences.

Did you know...
The top 10 Face
[HKEY_LOCAL_MACHINE\SOFTWARE\Adobe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.air]
"Content Type"="application/vnd.adobe.air-application-installer-package+zip"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AcroExch.Document\Shell\Open\Command]
@=""C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe" "%1""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereA2000001"="SharedMultimediaComponents59AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereHelp_PDF335AF6C9"="AdobePremiereA2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"Include_PremiereHelp_defaultA3F9FF8D"="AdobePremiereHelp_PDF335AF6C9"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereHelp_PDF_ENG147A8CC4"="Include_PremiereHelp_defaultA3F9FF8D"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereA2000001AD57D9A2000001"="SaeMlieiCmoents59AEDBECCB7CF359AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AoermeeHelp_PDF335AF6C9C94ED9335AF6C9"="AdobePremiereA2000001AD57D9A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereA2000001765653A2000001"="SaeMlieiCmoents59AEDBEC55897B59AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AoermeeHelp_PDF335AF6C9D03BC9335AF6C9"="AdobePremiereA2000001765653A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereA20000012D61B7A2000001"="SaeMlieiCmoents59AEDBEC30B92D59AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AoermeeHelp_PDF335AF6C9965517335AF6C9"="AdobePremiereA20000012D61B7A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereA2000001409406A2000001"="SaeMlieiCmoents59AEDBEC10B30B59AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AoermeeHelp_PDF335AF6C9249CEC335AF6C9"="AdobePremiereA2000001409406A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereA20000016B0598A2000001"="SaeMlieiCmoents59AEDBECC29C0D59AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AoermeeHelp_PDF335AF6C9464CD9335AF6C9"="AdobePremiereA20000016B0598A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereA200000117649EA2000001"="SaeMlieiCmoents59AEDBECF8036759AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AoermeeHelp_PDF335AF6C9D9BF9B335AF6C9"="AdobePremiereA200000117649EA2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereA20000019252A7A2000001"="SaeMlieiCmoents59AEDBEC194E1459AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AoermeeHelp_PDF335AF6C91E960E335AF6C9"="AdobePremiereA20000019252A7A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereA2000001C77FB0A2000001"="SaeMlieiCmoents59AEDBEC38059E59AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AoermeeHelp_PDF335AF6C9575E7B335AF6C9"="AdobePremiereA2000001C77FB0A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereA2000001F4535CA2000001"="SaeMlieiCmoents59AEDBECCDB29359AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AoermeeHelp_PDF335AF6C91174F6335AF6C9"="AdobePremiereA2000001F4535CA2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereHelp_PDF_DEUDA08457F"="Include_PremiereHelp_defaultA3F9FF8D"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereHelp_PDF_ITA6E1A80CE"="Include_PremiereHelp_defaultA3F9FF8D"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereHelp_PDF_JPN901C6A14"="Include_PremiereHelp_defaultA3F9FF8D"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereHelp_PDF_ESPBFB1D100"="Include_PremiereHelp_defaultA3F9FF8D"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\A16AB0BD59281124587F81F42C950133]
"AdobePremiereHelp_PDF_FRA3E5904D6"="Include_PremiereHelp_defaultA3F9FF8D"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\080E7FFA4791FB54390101EDA1F1E50D]
"ProductName"="Adobe AIR"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7C43C21609E58D74B9C5F017D78D7262\SourceList]
"LastUsedSource"="n;1;C:\Windows\SysWOW64\Adobe\Shockwave 12\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7C43C21609E58D74B9C5F017D78D7262\SourceList\Net]
"1"="C:\Windows\SysWOW64\Adobe\Shockwave 12\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{014BE14D-FFF9-4BF4-826F-323BBFB3D975}\1.0\0\win32]
@="C:\Windows\SysWOW64\Adobe\Director\SwDnld.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{014BE14D-FFF9-4BF4-826F-323BBFB3D975}\1.0\HELPDIR]
@="C:\Windows\SysWOW64\Adobe\Director"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6EF568F4-D437-4466-AA63-A3645136D93E}\1.0\0\win32]
@="C:\Windows\SysWOW64\Adobe\Shockwave 12\SwHelper_1202122.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6EF568F4-D437-4466-AA63-A3645136D93E}\1.0\HELPDIR]
@="C:\Windows\SysWOW64\Adobe\Shockwave 12"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0103A448-2934-4B3D-A54E-FED761D472E0}\LocalServer32]
@=""C:\Windows\SysWOW64\Adobe\Shockwave 12\SwHelper_1202122.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F3CB77D-D339-49e0-B8E4-FECD6D6F8CB8}\LocalServer32]
@=""C:\Windows\SysWOW64\Adobe\Shockwave 12\SwHelper_1202122.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28310B1B-B757-4b87-9AFA-8E5FAF126156}\LocalServer32]
@=""C:\Windows\SysWOW64\Adobe\Director\SwDnld.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D21ED08F-6B88-45EC-A71C-6BD453B561D0}\LocalServer32]
@=""C:\Windows\SysWOW64\Adobe\Director\SwDnld.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{014BE14D-FFF9-4BF4-826F-323BBFB3D975}\1.0\0\win32]
@="C:\Windows\SysWOW64\Adobe\Director\SwDnld.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{014BE14D-FFF9-4BF4-826F-323BBFB3D975}\1.0\HELPDIR]
@="C:\Windows\SysWOW64\Adobe\Director"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{6EF568F4-D437-4466-AA63-A3645136D93E}\1.0\0\win32]
@="C:\Windows\SysWOW64\Adobe\Shockwave 12\SwHelper_1202122.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{6EF568F4-D437-4466-AA63-A3645136D93E}\1.0\HELPDIR]
@="C:\Windows\SysWOW64\Adobe\Shockwave 12"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{4becf16c-74f0-429b-8d3e-4fba507ac661}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 7.0\reader"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{95a4104c-1c49-4c2a-9830-1be0f47e926c}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 7.0\Acrobat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{9da1d2cb-796d-4bec-bbaa-0aa9ccd80e15}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 7.0\Acrobat Elements"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{f1804479-982b-479f-95eb-c6972fb8c767}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 6.0\reader"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08f24d68-9087-4b24-81ad-7b34af3e3ed5}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 6.0\Acrobat Elements"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4becf16c-74f0-429b-8d3e-4fba507ac661}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 7.0\reader"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{95a4104c-1c49-4c2a-9830-1be0f47e926c}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 7.0\Acrobat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9da1d2cb-796d-4bec-bbaa-0aa9ccd80e15}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 7.0\Acrobat Elements"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e5f90a07-7db7-4dcb-bd6d-d3fecd376ca3}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 6.0\reader"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fb9e068b-c612-4fa8-bdb9-d728a716a420}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 6.0\Acrobat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Adobe\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Adobe\Flash Player\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Adobe\Flash Player\AddIns\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Adobe AIR\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Adobe\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Adobe\ARM\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Adobe\Reader\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Adobe\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Adobe\Acrobat\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Nero\Nero 7\Adobe\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\01B115A1CF11BAC4C9848646F190FC00]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\167CAD19A40D4044CB796E926375E603]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR.vch"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\25E1F06034CBD4D4D9DA91E700CD5D9C]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\AdobeCP.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\32A0BC59DE462384C8C2E8611776E88A]
"080E7FFA4791FB54390101EDA1F1E50D"="02:\Software\Adobe\Adobe AIR\FileTypeRegistration\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\36C55021C8CF0CC4185A830E75309920]
"080E7FFA4791FB54390101EDA1F1E50D"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\UninstallString"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3FFCCE6F709B1EFDE22EDFF38EC2E7D5]
"A16AB0BD59281124587F81F42C950133"="C?\Program Files (x86)\Nero\Nero 7\Adobe\encwiz.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\63CF2C67468BA7E4C9699F8BC0EDA931]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe Root Certificate.cer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\658C16E8DF1093B4D981092B622C10C3]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\template.msi"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6BDFE1B5AAC28594EBB3049B262D504B]
"A16AB0BD59281124587F81F42C950133"="C?\Program Files (x86)\Nero\Nero 7\Adobe\NeroDigitalPluginAdobePremiere_Eng.pdf"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C3C47CD8BAC94C4EB81B5D1DCD091E7]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\sentinel"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\75DE182506DA53243AD47F75E182CFC4]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\WebKit.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\90A2D107EB418F542933C10EDE00329A]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\95390DA4DCE6CBE4B982CACBB0207BC7]
"B6B00BF73486CE79EE6D87DBD65373A0"="02:\SOFTWARE\Adobe\Adobe AIR\AppRefcount"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98D0EE5F5CB32574E9BB35B330E68A90]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9AD3C0E43DF8A78429BEDD2EDC7CEEAA]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\adobecp.vch"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B0937E432408B64EA6D93BBF32B8CEF]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\AdobeCP15.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9EB9F2B71F1DD4E4A90FDA80F570B333]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\airappinstaller.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B132847F062053E4FB8BF7CADFEC7111]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\template.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DC6266E534349FF4D80BFC6B423730E7]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Thawte Root Certificate.cer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E34B755689BCFB04CB88A61F2E5C4003]
"277C90D53BCEB244C96C4B43C187DF2C"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\ColorSync.resources\Profiles\AdobeRGB1998.icc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FC8775A70DB513942842346B032C2437]
"080E7FFA4791FB54390101EDA1F1E50D"="C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\NPSWF32.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\080E7FFA4791FB54390101EDA1F1E50D\InstallProperties]
"DisplayName"="Adobe AIR"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\080E7FFA4791FB54390101EDA1F1E50D\InstallProperties]
"InstallLocation"="C:\Program Files (x86)\Common Files\Adobe AIR\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\080E7FFA4791FB54390101EDA1F1E50D\InstallProperties]
"Publisher"="Adobe Systems Incorporated"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7C43C21609E58D74B9C5F017D78D7262\InstallProperties]
"Comments"="Adobe Shockwave Player Merge Module"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7C43C21609E58D74B9C5F017D78D7262\InstallProperties]
"Contact"="http://www.adobe.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7C43C21609E58D74B9C5F017D78D7262\InstallProperties]
"HelpLink"="http://www.adobe.com/support"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7C43C21609E58D74B9C5F017D78D7262\InstallProperties]
"InstallSource"="C:\Windows\SysWOW64\Adobe\Shockwave 12\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7C43C21609E58D74B9C5F017D78D7262\InstallProperties]
"Publisher"="Adobe Systems, Inc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7C43C21609E58D74B9C5F017D78D7262\InstallProperties]
"URLInfoAbout"="http://www.adobe.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7C43C21609E58D74B9C5F017D78D7262\InstallProperties]
"URLUpdateInfo"="http://www.adobe.com/support/shockwave/"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereA2000001"="{.fFxU,5zpwY3X8oF-'FSharedMultimediaComponents59AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereHelp_PDF335AF6C9"="AdobePremiereA2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"Include_PremiereHelp_defaultA3F9FF8D"="AdobePremiereHelp_PDF335AF6C9"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereHelp_PDF_ENG147A8CC4"="[email protected]?r9qUdmt$rbInclude_PremiereHelp_defaultA3F9FF8D"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereA2000001AD57D9A2000001"="{.fFxU,5zpwY3X8oF-'FSaeMlieiCmoents59AEDBECCB7CF359AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AoermeeHelp_PDF335AF6C9C94ED9335AF6C9"="AdobePremiereA2000001AD57D9A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereA2000001765653A2000001"="{.fFxU,5zpwY3X8oF-'FSaeMlieiCmoents59AEDBEC55897B59AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AoermeeHelp_PDF335AF6C9D03BC9335AF6C9"="AdobePremiereA2000001765653A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereA20000012D61B7A2000001"="{.fFxU,5zpwY3X8oF-'FSaeMlieiCmoents59AEDBEC30B92D59AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AoermeeHelp_PDF335AF6C9965517335AF6C9"="AdobePremiereA20000012D61B7A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereA2000001409406A2000001"="{.fFxU,5zpwY3X8oF-'FSaeMlieiCmoents59AEDBEC10B30B59AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AoermeeHelp_PDF335AF6C9249CEC335AF6C9"="AdobePremiereA2000001409406A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereA20000016B0598A2000001"="{.fFxU,5zpwY3X8oF-'FSaeMlieiCmoents59AEDBECC29C0D59AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AoermeeHelp_PDF335AF6C9464CD9335AF6C9"="AdobePremiereA20000016B0598A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereA200000117649EA2000001"="{.fFxU,5zpwY3X8oF-'FSaeMlieiCmoents59AEDBECF8036759AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AoermeeHelp_PDF335AF6C9D9BF9B335AF6C9"="AdobePremiereA200000117649EA2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereA20000019252A7A2000001"="{.fFxU,5zpwY3X8oF-'FSaeMlieiCmoents59AEDBEC194E1459AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AoermeeHelp_PDF335AF6C91E960E335AF6C9"="AdobePremiereA20000019252A7A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereA2000001C77FB0A2000001"="{.fFxU,5zpwY3X8oF-'FSaeMlieiCmoents59AEDBEC38059E59AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AoermeeHelp_PDF335AF6C9575E7B335AF6C9"="AdobePremiereA2000001C77FB0A2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereA2000001F4535CA2000001"="{.fFxU,5zpwY3X8oF-'FSaeMlieiCmoents59AEDBECCDB29359AEDBEC"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AoermeeHelp_PDF335AF6C91174F6335AF6C9"="AdobePremiereA2000001F4535CA2000001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereHelp_PDF_DEUDA08457F"="-ZZg(J'yq9IJt?,h1X=yInclude_PremiereHelp_defaultA3F9FF8D"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereHelp_PDF_ITA6E1A80CE"="}mhsv1$Up9GRq-lc88&lInclude_PremiereHelp_defaultA3F9FF8D"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereHelp_PDF_JPN901C6A14"="`cl42wvsk=HdpQs+1l~3Include_PremiereHelp_defaultA3F9FF8D"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereHelp_PDF_ESPBFB1D100"="yL'lf7i?c=2%dMM&X~w_Include_PremiereHelp_defaultA3F9FF8D"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A16AB0BD59281124587F81F42C950133\Features]
"AdobePremiereHelp_PDF_FRA3E5904D6"="K!I*],[[email protected]{_R0Include_PremiereHelp_defaultA3F9FF8D"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Font Drivers]
"Adobe Type Manager"="atmfd.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Adobe AIR]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Adobe ARM]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereA2000001F4535CA2000001"="2#3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereA20000019252A7A2000001"="2#3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereHelp_PDF_JPN901C6A14"="2#2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereHelp_PDF_FRA3E5904D6"="2#2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereA20000016B0598A2000001"="2#3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereA2000001765653A2000001"="2#3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereA2000001AD57D9A2000001"="2#3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereHelp_PDF_ESPBFB1D100"="2#2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereHelp_PDF_ENG147A8CC4"="2#3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereA2000001"="2#3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereHelp_PDF_DEUDA08457F"="2#2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereHelp_PDF335AF6C9"="2#3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereA20000012D61B7A2000001"="2#3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereA200000117649EA2000001"="2#3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereHelp_PDF_ITA6E1A80CE"="2#2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereA2000001409406A2000001"="2#3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Ahead\Installation\Families\Nero 7\FeatureStates]
"AdobePremiereA2000001C77FB0A2000001"="2#3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AppDataLow\Software\Adobe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{4becf16c-74f0-429b-8d3e-4fba507ac661}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 7.0\reader"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{95a4104c-1c49-4c2a-9830-1be0f47e926c}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 7.0\Acrobat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{9da1d2cb-796d-4bec-bbaa-0aa9ccd80e15}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 7.0\Acrobat Elements"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{f1804479-982b-479f-95eb-c6972fb8c767}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 6.0\reader"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08f24d68-9087-4b24-81ad-7b34af3e3ed5}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 6.0\Acrobat Elements"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4becf16c-74f0-429b-8d3e-4fba507ac661}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 7.0\reader"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{95a4104c-1c49-4c2a-9830-1be0f47e926c}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 7.0\Acrobat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9da1d2cb-796d-4bec-bbaa-0aa9ccd80e15}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 7.0\Acrobat Elements"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e5f90a07-7db7-4dcb-bd6d-d3fecd376ca3}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 6.0\reader"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fb9e068b-c612-4fa8-bdb9-d728a716a420}]
"AppPath"="C:\Program Files (x86)\adobe\acrobat 6.0\Acrobat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{612C34C7-5E90-47D8-9B5C-0F717DD82726}]
"Comments"="Adobe Shockwave Player Merge Module"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{612C34C7-5E90-47D8-9B5C-0F717DD82726}]
"Contact"="http://www.adobe.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{612C34C7-5E90-47D8-9B5C-0F717DD82726}]
"HelpLink"="http://www.adobe.com/support"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{612C34C7-5E90-47D8-9B5C-0F717DD82726}]
"InstallSource"="C:\Windows\SysWOW64\Adobe\Shockwave 12\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{612C34C7-5E90-47D8-9B5C-0F717DD82726}]
"Publisher"="Adobe Systems, Inc"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{612C34C7-5E90-47D8-9B5C-0F717DD82726}]
"URLInfoAbout"="http://www.adobe.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{612C34C7-5E90-47D8-9B5C-0F717DD82726}]
"URLUpdateInfo"="http://www.adobe.com/support/shockwave/"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Font Drivers]
"Adobe Type Manager"="atmfd.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\NPInstaller\DeclineCount\adobe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{0103A448-2934-4B3D-A54E-FED761D472E0}\LocalServer32]
@=""C:\Windows\SysWOW64\Adobe\Shockwave 12\SwHelper_1202122.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{1F3CB77D-D339-49e0-B8E4-FECD6D6F8CB8}\LocalServer32]
@=""C:\Windows\SysWOW64\Adobe\Shockwave 12\SwHelper_1202122.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{28310B1B-B757-4b87-9AFA-8E5FAF126156}\LocalServer32]
@=""C:\Windows\SysWOW64\Adobe\Director\SwDnld.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D21ED08F-6B88-45EC-A71C-6BD453B561D0}\LocalServer32]
@=""C:\Windows\SysWOW64\Adobe\Director\SwDnld.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{014BE14D-FFF9-4BF4-826F-323BBFB3D975}\1.0\0\win32]
@="C:\Windows\SysWOW64\Adobe\Director\SwDnld.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{014BE14D-FFF9-4BF4-826F-323BBFB3D975}\1.0\HELPDIR]
@="C:\Windows\SysWOW64\Adobe\Director"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{6EF568F4-D437-4466-AA63-A3645136D93E}\1.0\0\win32]
@="C:\Windows\SysWOW64\Adobe\Shockwave 12\SwHelper_1202122.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{6EF568F4-D437-4466-AA63-A3645136D93E}\1.0\HELPDIR]
@="C:\Windows\SysWOW64\Adobe\Shockwave 12"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AdobeFlashPlayerUpdateSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AdobeFlashPlayerUpdateSvc]
"DisplayName"="Adobe Flash Player Update Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AdobeFlashPlayerUpdateSvc]
"Description"="This service keeps your Adobe Flash Player installation up to date with the latest enhancements and security fixes."
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Adobe]
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Adobe\Adobe Acrobat]
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Adobe\Adobe ARM]
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Adobe\Adobe Synchronizer]
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\AppDataLow\Software\Adobe]
[HKEY_USERS\S-1-5-21-2018018256-1060675942-4261822662-1000\Software\Macromedia\FlashPlayerUpdate]
"description"="<XML><update version="11,7,700,169"><description>mshtml:

An update to your Adobe Flash Player is available

This update includes improvements in usability, online security and stability, as well as new features which help content developers deliver rich and engaging experiences.

Did you know...
The top 10 Facebook games use the Flash Player. To see more, visit: www.adobe.com/games.
Most of the top video sites on the web use Flash Player
Flash Player is installed on over 1.3 billion connected PCs
</description></update>message "This update includes improvements in usability, online security and stability, as well as new features which help content developers deliver rich and engaging experiences.

Did

-= EOF =-


----------



## superfrog25 (Mar 25, 2011)

Mark As you can see I have sent you the log after I had used your link to uninstall flash.It looks as big as the last one to be honest but I have managed to get this one to post!!


----------



## Mark1956 (May 7, 2011)

Well done, I shall work my way through it as time allows, may not be back until tomorrow.


----------



## superfrog25 (Mar 25, 2011)

Ok Thanks for that.

Im back at work tomorrow so will check the thread in the evening.

Thanks for sticking with me on this

Chris


----------



## Mark1956 (May 7, 2011)

Ok, I have sifted through all the files and folders found, we can start by removing all of them and then see if the install will work before I go through all the registry entries as that may save a lot of time.

You will need to download a fresh copy as this will remove the old ones.

First run this to remove all the Temp file entries:

Download Temporary file cleaner and save it to the desktop.
Double click on the icon to run it (it appears as a dark grey dustbin). For Windows 7 and Vista right click the icon and select *Run as Administrator*.
When the window opens click on* Start*. It will close all running programs and clear the desktop icons.
When complete you may be asked to reboot, if so accept the request and your PC will reboot automatically.

Please download *OTM by OldTimer*. Save it to your desktop.

Double click *OTM.exe* to start the tool.


*Copy* the text in the code box below to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose *Copy*):


```
:Processes
explorer.exe
:Files
C:\Users\Home PC\Downloads\install_flashplayer11x32_gdrd_aaa_aih(1).exe
C:\Users\Home PC\Downloads\install_flashplayer11x32_gdrd_aaa_aih.exe
C:\Users\Home PC\Downloads\uninstall_flash_player(1).exe
C:\Users\Home PC\Downloads\uninstall_flash_player.exe
C:\Windows\Downloaded Program Files\swflash64.inf
C:\Windows\System32\Macromed
C:\Windows\SysWOW64\Macromed
C:\Program Files (x86)\Common Files\Adobe
C:\ProgramData\Adobe
C:\Users\All Users\Adobe
C:\Users\Home PC\AppData\Local\Adobe
C:\Users\Home PC\AppData\Roaming\Adobe
C:\Users\louise\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\F402B3IA\get2.adobe[1].xml
C:\Program Files (x86)\Adobe
C:\Users\Default\AppData\Roaming\Macromedia
C:\Users\Home PC\AppData\Local\Macromedia
C:\Users\Home PC\AppData\Roaming\Adobe
C:\Users\Home PC\AppData\Roaming\Macromedia
C:\Users\louise\AppData\Roaming\Adobe
C:\Users\louise\AppData\Roaming\Macromedia
C:\$WINDOWS.~Q\DATA\Program Files (x86)\Adobe
C:\$WINDOWS.~Q\DATA\ProgramData\Adobe
C:\Program Files (x86)\Adobe
C:\Program Files (x86)\Common Files\Adobe
C:\Program Files (x86)\Common Files\Adobe AIR
C:\ProgramData\Adobe
C:\Users\All Users\Adobe
C:\Users\Home PC\AppData\Local\Adobe
C:\Users\Home PC\AppData\LocalLow\Adobe
C:\Users\Home PC\AppData\Roaming\Adobe
C:\Users\louise\AppData\Roaming\Adobe
:Commands
[createrestorepoint]
[emptyflash]
[emptytemp]
[resethosts]
[reboot]
```

 Return to OTM, right click in the *"Paste Instructions for Items to be Moved"* window (under the yellow bar) and choose *Paste*.
Click the red *Moveit!* button.
All your desktop icons will disappear as the scan begins. It should complete within a few minutes.
Once complete you may see a box appear asking you to Restart the system to complete the file removal, accept it and it will reboot.
Even if that box does not appear the system should reboot as the command is included in the script.
When the system has come back to the desktop a Notepad document will open, please copy and paste that into your next post.

-- Note: The logs are saved here: C:\_OTM\MovedFiles


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Here is the OTM log

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
C:\Users\Home PC\Downloads\install_flashplayer11x32_gdrd_aaa_aih(1).exe moved successfully.
C:\Users\Home PC\Downloads\install_flashplayer11x32_gdrd_aaa_aih.exe moved successfully.
C:\Users\Home PC\Downloads\uninstall_flash_player(1).exe moved successfully.
C:\Users\Home PC\Downloads\uninstall_flash_player.exe moved successfully.
C:\Windows\Downloaded Program Files\swflash64.inf moved successfully.
C:\Windows\System32\Macromed\Flash folder moved successfully.
C:\Windows\System32\Macromed folder moved successfully.
File/Folder C:\Windows\SysWOW64\Macromed not found.
Folder move failed. C:\Program Files (x86)\Common Files\Adobe\Reader scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Adobe\HelpCfg scheduled to be moved on reboot.
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0 folder moved successfully.
C:\Program Files (x86)\Common Files\Adobe\ARM folder moved successfully.
Folder move failed. C:\Program Files (x86)\Common Files\Adobe scheduled to be moved on reboot.
C:\ProgramData\Adobe\Setup folder moved successfully.
C:\ProgramData\Adobe\ARM\Reader_10.1.7 folder moved successfully.
C:\ProgramData\Adobe\ARM\Reader_10.1.6 folder moved successfully.
C:\ProgramData\Adobe\ARM\Reader_10.1.5 folder moved successfully.
C:\ProgramData\Adobe\ARM\Reader_10.1.4 folder moved successfully.
C:\ProgramData\Adobe\ARM\Reader_10.1.3 folder moved successfully.
C:\ProgramData\Adobe\ARM\Reader_10.1.2 folder moved successfully.
C:\ProgramData\Adobe\ARM\Reader_10.1.1\2683 folder moved successfully.
Folder move failed. C:\ProgramData\Adobe\ARM\Reader_10.1.1 scheduled to be moved on reboot.
C:\ProgramData\Adobe\ARM\Reader_10.1.0 folder moved successfully.
C:\ProgramData\Adobe\ARM folder moved successfully.
C:\ProgramData\Adobe\AIH.9bbac519b1dc63d90f6a831a326042419b5bd0f1 folder moved successfully.
Folder move failed. C:\ProgramData\Adobe\Acrobat scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Adobe scheduled to be moved on reboot.
Folder move failed. C:\Users\All Users\Adobe\Acrobat scheduled to be moved on reboot.
Folder move failed. C:\Users\All Users\Adobe scheduled to be moved on reboot.
C:\Users\Home PC\AppData\Local\Adobe\Color\Profiles folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\Color folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\AIR\logs folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\AIR folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\AIH.e0aafb65b2eda7b729150d4c98fba5c687f858bc folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\AIH.cf478b64883a436ada0a2faf602aa8a088df5f86 folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\AIH.c3182eb45a43fd4cb284d90e06141ed16b29040b folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\AIH.a906b083d5b67253d3d62bb7506188160cb5fc98 folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\AIH.6b6bd047cfdbbe67b2fe5866ef0d526cc232b602 folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\AIH.438ba9f328295b04f42182f0b45fec5132195027 folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\AIH.31cc6d6b1c0670c6f1b771d347e55bb231bdf07d folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\Acrobat\11.0\Cache folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\Acrobat\11.0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\Acrobat\10.0\Cache folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\Acrobat\10.0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe\Acrobat folder moved successfully.
C:\Users\Home PC\AppData\Local\Adobe folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\LogTransport2 folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Linguistics\Dictionaries folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Linguistics folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Headlights folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Flash Player\NativeCache folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Flash Player\Icon Cache folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Flash Player\AssetCache\A76KNT6M folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Flash Player\AssetCache folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Flash Player\APSPrivateData2 folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Flash Player folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\AIR\Updater folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\AIR\ELS\ZinioReader4 folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\AIR\ELS folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\AIR folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\11.0\Security\CRLCache folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\11.0\Security folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\11.0\JSCache folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\11.0\Forms folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\11.0\Collab folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\11.0 folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\10.0\ServicesRdr folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\10.0\Security folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\10.0\JSCache folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\10.0\JavaScripts folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\10.0\Forms folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\10.0\Collab folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat\10.0 folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe\Acrobat folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Adobe folder moved successfully.
C:\Users\louise\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\F402B3IA\get2.adobe[1].xml moved successfully.
C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller folder moved successfully.
C:\Program Files (x86)\Adobe\Flash Player\AddIns folder moved successfully.
C:\Program Files (x86)\Adobe\Flash Player folder moved successfully.
C:\Program Files (x86)\Adobe folder moved successfully.
C:\Users\Default\AppData\Roaming\Macromedia\Flash Player folder moved successfully.
C:\Users\Default\AppData\Roaming\Macromedia folder moved successfully.
C:\Users\Home PC\AppData\Local\Macromedia\Flash Player folder moved successfully.
C:\Users\Home PC\AppData\Local\Macromedia folder moved successfully.
File/Folder C:\Users\Home PC\AppData\Roaming\Adobe not found.
C:\Users\Home PC\AppData\Roaming\Macromedia\Flash Player folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Macromedia folder moved successfully.
C:\Users\louise\AppData\Roaming\Adobe\Flash Player\NativeCache folder moved successfully.
C:\Users\louise\AppData\Roaming\Adobe\Flash Player\AssetCache\BYHHFG87 folder moved successfully.
C:\Users\louise\AppData\Roaming\Adobe\Flash Player\AssetCache folder moved successfully.
C:\Users\louise\AppData\Roaming\Adobe\Flash Player folder moved successfully.
C:\Users\louise\AppData\Roaming\Adobe folder moved successfully.
C:\Users\louise\AppData\Roaming\Macromedia\Flash Player folder moved successfully.
C:\Users\louise\AppData\Roaming\Macromedia folder moved successfully.
C:\$WINDOWS.~Q\DATA\Program Files (x86)\Adobe\Reader 11.0\Reader\Legal\ENU folder moved successfully.
C:\$WINDOWS.~Q\DATA\Program Files (x86)\Adobe\Reader 11.0\Reader\Legal folder moved successfully.
C:\$WINDOWS.~Q\DATA\Program Files (x86)\Adobe\Reader 11.0\Reader folder moved successfully.
C:\$WINDOWS.~Q\DATA\Program Files (x86)\Adobe\Reader 11.0 folder moved successfully.
C:\$WINDOWS.~Q\DATA\Program Files (x86)\Adobe folder moved successfully.
C:\$WINDOWS.~Q\DATA\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001} folder moved successfully.
C:\$WINDOWS.~Q\DATA\ProgramData\Adobe\Setup folder moved successfully.
C:\$WINDOWS.~Q\DATA\ProgramData\Adobe folder moved successfully.
File/Folder C:\Program Files (x86)\Adobe not found.
Folder move failed. C:\Program Files (x86)\Common Files\Adobe\Reader scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Adobe\HelpCfg scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Adobe scheduled to be moved on reboot.
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources folder moved successfully.
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0 folder moved successfully.
C:\Program Files (x86)\Common Files\Adobe AIR\Versions folder moved successfully.
C:\Program Files (x86)\Common Files\Adobe AIR folder moved successfully.
Folder move failed. C:\ProgramData\Adobe\Acrobat scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Adobe scheduled to be moved on reboot.
Folder move failed. C:\Users\All Users\Adobe\Acrobat scheduled to be moved on reboot.
Folder move failed. C:\Users\All Users\Adobe scheduled to be moved on reboot.
File/Folder C:\Users\Home PC\AppData\Local\Adobe not found.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\tur folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\swd folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\spn folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\slv folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\slo folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\sgr folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\rus folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\rum folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\prt folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\pol folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\nyn folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\nrw folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\lit folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\lav folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\itl folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\hun folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\hrv folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\heb folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\grm folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\gre folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\frn folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\fin folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\est folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\dut folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\dan folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\cze folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\ctl folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\cfr folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\bul folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brz folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\ara folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics\Dictionaries folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Linguistics folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Acrobat\11.0\assets folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Acrobat\11.0 folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Acrobat\10.0\assets folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Acrobat\10.0 folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe\Acrobat folder moved successfully.
C:\Users\Home PC\AppData\LocalLow\Adobe folder moved successfully.
File/Folder C:\Users\Home PC\AppData\Roaming\Adobe not found.
File/Folder C:\Users\louise\AppData\Roaming\Adobe not found.
========== COMMANDS ==========
Restore point Set: OTM Restore Point

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Emily

User: Home PC

User: louise

User: Public

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Emily
->Temp folder emptied: 0 bytes

User: Home PC
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 14562790 bytes

User: louise
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 826 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 14.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTM by OldTimer - Version 3.1.21.0 log created on 06092013_194259

Files moved on Reboot...
Folder move failed. C:\Program Files (x86)\Common Files\Adobe\Reader scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Adobe\HelpCfg scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Adobe\Reader scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Adobe\HelpCfg scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Adobe scheduled to be moved on reboot.
File C:\ProgramData\Adobe\ARM\Reader_10.1.1 not found!
Folder move failed. C:\ProgramData\Adobe\Acrobat scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Adobe\Acrobat scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Adobe scheduled to be moved on reboot.
Folder move failed. C:\Users\All Users\Adobe\Acrobat scheduled to be moved on reboot.
Folder move failed. C:\Users\All Users\Adobe\Acrobat scheduled to be moved on reboot.
Folder move failed. C:\Users\All Users\Adobe scheduled to be moved on reboot.
C:\Users\Home PC\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Chris


----------



## superfrog25 (Mar 25, 2011)

Do you want me to attempt install of flash player Mark?


----------



## Mark1956 (May 7, 2011)

Yup, give it a go.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

You are PC superstar...a legend. Flash player now works. I downloaded flash player first followed by shockwave player and then Reader. I havent downloded Air yet.Im not sure I use this. 

The only issue now is the Nero error message which pops up on start up and when the PC is in use at random times which is as below

NERO

Red circle and White cross: This program requires the file ADVRCNTR5.DLL,which was not found on the system. 
Along with this I have a pop up box with various programs asking which one I would like to open it with.

I would like to get rid of it completely if possible and also NERO which I re-installed in the hope that would solve it but it hasnt.

Thanks very much for resolving the flash issue and any advice you can give as to how to keep my PC running smoothly would be appreciated too!!

Kind Regards
Chris


----------



## Mark1956 (May 7, 2011)

That is great news with Flash, saved me a lot of work sorting out all the registry keys to delete and I know what to do next time when faced with a similar issue.

ADVRCNTR5.DLL belongs to Nero so I am surprised re-installing Nero didn't fix the problem.

Go ahead and uninstall Nero, check to see if the problem still exists, as it probably will then we need to search for the Run key.

Run SystemLook again and use this script.


```
:regfind
ADVRCNTR5
```


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I tried to use my perfect uninstaller program to remove Nero but Im not convinced it removed it properly.It isnt showing in my programs but I still had the box pop up asking me to select a program to run with it so I have completed system look as advised and the results are below

SystemLook 30.07.11 by jpshortstuff
Log created at 21:15 on 10/06/2013 by Home PC
Administrator - Elevation successful

========== regfind ==========

Searching for "ADVRCNTR5"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{12DC3627-F1BA-4CB7-A08C-463319E06E01}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F835F57-158A-47A6-A556-DABC464DF56D}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49D6E057-1AB0-43C2-A7BD-B5E0AFDF0408}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4B15FA87-67E8-4D4D-A21A-35FF8A3C7F7F}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{54151D14-D64D-4AE6-81D6-91415F757278}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{89113117-091E-4B69-AE7F-2047471B5803}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABF70F17-DC2C-4535-943C-B268D2D50BA2}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B10507E4-DB11-4A10-82BA-D46C17AAF29D}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA12CA4F-BD94-4C35-B011-9E40CB34545F}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC877C2B-439F-4C88-A796-69AFD1BC7B22}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF875B2E-8417-453D-94A3-F04027EB719A}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3174FC6-BDCD-4124-9104-2CA61481FD7B}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBB92678-3DD0-4603-B740-471100FE293F}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1922753C2B0D3E64B97E4FB3050B745E]
"8A2F6342E7B4C6B4EAE406C448AAA6F4"="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\Nfx.Chameleon.Plus.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1BC2B00FC0C39CF4A85E3F9B75FD3810]
"8A2F6342E7B4C6B4EAE406C448AAA6F4"="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_en-US.rtf"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AC1FC7DAEE339374D97C240E85CBDC42]
"8A2F6342E7B4C6B4EAE406C448AAA6F4"="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AC1FC7DAEE339374D97C240E85CBDC42\8A2F6342E7B4C6B4EAE406C448AAA6F4]
"File"="advrcntr5.dll.D39B4B65_3692_4292_833F_2C81D15845EB"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B06B8F9E36DE8FC428AE074BC95D886B]
"8A2F6342E7B4C6B4EAE406C448AAA6F4"="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\Nfx.Chameleon.Sharp.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C7EC681679EA5384C9A88C5B97ABDDAE]
"8A2F6342E7B4C6B4EAE406C448AAA6F4"="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\NeroPatentActivation.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{12DC3627-F1BA-4CB7-A08C-463319E06E01}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{3F835F57-158A-47A6-A556-DABC464DF56D}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{49D6E057-1AB0-43C2-A7BD-B5E0AFDF0408}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{4B15FA87-67E8-4D4D-A21A-35FF8A3C7F7F}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{54151D14-D64D-4AE6-81D6-91415F757278}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{89113117-091E-4B69-AE7F-2047471B5803}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{ABF70F17-DC2C-4535-943C-B268D2D50BA2}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{B10507E4-DB11-4A10-82BA-D46C17AAF29D}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{BA12CA4F-BD94-4C35-B011-9E40CB34545F}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{BC877C2B-439F-4C88-A796-69AFD1BC7B22}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{BF875B2E-8417-453D-94A3-F04027EB719A}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D3174FC6-BDCD-4124-9104-2CA61481FD7B}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{DBB92678-3DD0-4603-B740-471100FE293F}\InprocServer32]
@="C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll"

-= EOF =-

Chris


----------



## superfrog25 (Mar 25, 2011)

Mark,

I wlll leave it with you and check tomorrow for any updates

Thanks 

Chris


----------



## Mark1956 (May 7, 2011)

I'm a bit short of time today so will get back on this early evening, GMT+1.


----------



## Mark1956 (May 7, 2011)

Sorry for the delay.

Let me know how it is after running this:

Please download *OTM by OldTimer*. Save it to your desktop.

Double click *OTM.exe* to start the tool.


*Copy* the text in the code box below to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose *Copy*):


```
:Processes
explorer.exe
:Files
C:\Program Files (x86)\Common Files\Nero
:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{12DC3627-F1BA-4CB7-A08C-463319E06E01}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F835F57-158A-47A6-A556-DABC464DF56D}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49D6E057-1AB0-43C2-A7BD-B5E0AFDF0408}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4B15FA87-67E8-4D4D-A21A-35FF8A3C7F7F}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{54151D14-D64D-4AE6-81D6-91415F757278}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{89113117-091E-4B69-AE7F-2047471B5803}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABF70F17-DC2C-4535-943C-B268D2D50BA2}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B10507E4-DB11-4A10-82BA-D46C17AAF29D}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA12CA4F-BD94-4C35-B011-9E40CB34545F}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC877C2B-439F-4C88-A796-69AFD1BC7B22}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF875B2E-8417-453D-94A3-F04027EB719A}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3174FC6-BDCD-4124-9104-2CA61481FD7B}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBB92678-3DD0-4603-B740-471100FE293F}\InprocServer32]
@=
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Nero\AdvrCntr5\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\1922753C2B0D3E64B97E4FB3050B745E]
"8A2F6342E7B4C6B4EAE406C448AAA6F4"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\1BC2B00FC0C39CF4A85E3F9B75FD3810]
"8A2F6342E7B4C6B4EAE406C448AAA6F4"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\AC1FC7DAEE339374D97C240E85CBDC42]
"8A2F6342E7B4C6B4EAE406C448AAA6F4"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\AC1FC7DAEE339374D97C240E85CBDC42\8A2F6342E7B4C6B4EAE406C448AAA6F4]
"File"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\B06B8F9E36DE8FC428AE074BC95D886B]
"8A2F6342E7B4C6B4EAE406C448AAA6F4"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\C7EC681679EA5384C9A88C5B97ABDDAE]
"8A2F6342E7B4C6B4EAE406C448AAA6F4"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{12DC3627-F1BA-4CB7-A08C-463319E06E01}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{3F835F57-158A-47A6-A556-DABC464DF56D}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{49D6E057-1AB0-43C2-A7BD-B5E0AFDF0408}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{4B15FA87-67E8-4D4D-A21A-35FF8A3C7F7F}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{54151D14-D64D-4AE6-81D6-91415F757278}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{89113117-091E-4B69-AE7F-2047471B5803}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{ABF70F17-DC2C-4535-943C-B268D2D50BA2}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{B10507E4-DB11-4A10-82BA-D46C17AAF29D}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{BA12CA4F-BD94-4C35-B011-9E40CB34545F}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{BC877C2B-439F-4C88-A796-69AFD1BC7B22}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{BF875B2E-8417-453D-94A3-F04027EB719A}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D3174FC6-BDCD-4124-9104-2CA61481FD7B}\InprocServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{DBB92678-3DD0-4603-B740-471100FE293F}\InprocServer32]
@=-
:Commands
[createrestorepoint]
[emptyflash]
[emptytemp]
[resethosts]
[reboot]
```

 Return to OTM, right click in the *"Paste Instructions for Items to be Moved"* window (under the yellow bar) and choose *Paste*.
Click the red *Moveit!* button.
All your desktop icons will disappear as the scan begins. It should complete within a few minutes.
Once complete you may see a box appear asking you to Restart the system to complete the file removal, accept it and it will reboot.
Even if that box does not appear the system should reboot as the command is included in the script.
When the system has come back to the desktop a Notepad document will open, please copy and paste that into your next post.

-- Note: The logs are saved here: C:\_OTM\MovedFiles


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I have ran OTM as advised and the results are below.

Im not sure if it was supposed to do anything but on reboot the box came up asking which program I would like to open the file. As yet no sign of the pop error message will let you know if it comes up.
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
C:\Program Files (x86)\Common Files\Nero\Nero 10\OnlineServices folder moved successfully.
C:\Program Files (x86)\Common Files\Nero\Nero 10 folder moved successfully.
C:\Program Files (x86)\Common Files\Nero\BDCore\lib\zi\Asia folder moved successfully.
C:\Program Files (x86)\Common Files\Nero\BDCore\lib\zi\America folder moved successfully.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore\lib\zi scheduled to be moved on reboot.
C:\Program Files (x86)\Common Files\Nero\BDCore\lib\security folder moved successfully.
C:\Program Files (x86)\Common Files\Nero\BDCore\lib\image folder moved successfully.
C:\Program Files (x86)\Common Files\Nero\BDCore\lib\ext folder moved successfully.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore\lib scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore scheduled to be moved on reboot.
C:\Program Files (x86)\Common Files\Nero\AdvrCntr6 folder moved successfully.
C:\Program Files (x86)\Common Files\Nero\AdvrCntr5 folder moved successfully.
Folder move failed. C:\Program Files (x86)\Common Files\Nero scheduled to be moved on reboot.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{12DC3627-F1BA-4CB7-A08C-463319E06E01}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F835F57-158A-47A6-A556-DABC464DF56D}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49D6E057-1AB0-43C2-A7BD-B5E0AFDF0408}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4B15FA87-67E8-4D4D-A21A-35FF8A3C7F7F}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{54151D14-D64D-4AE6-81D6-91415F757278}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{89113117-091E-4B69-AE7F-2047471B5803}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABF70F17-DC2C-4535-943C-B268D2D50BA2}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B10507E4-DB11-4A10-82BA-D46C17AAF29D}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BA12CA4F-BD94-4C35-B011-9E40CB34545F}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC877C2B-439F-4C88-A796-69AFD1BC7B22}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF875B2E-8417-453D-94A3-F04027EB719A}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3174FC6-BDCD-4124-9104-2CA61481FD7B}\InprocServer32\\@ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBB92678-3DD0-4603-B740-471100FE293F}\InprocServer32\\@| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\1922753C2B0D3E64B97E4FB3050B745E not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\1BC2B00FC0C39CF4A85E3F9B75FD3810 not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\AC1FC7DAEE339374D97C240E85CBDC42 not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\AC1FC7DAEE339374D97C240E85CBDC42\8A2F6342E7B4C6B4EAE406C448AAA6F4 not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\B06B8F9E36DE8FC428AE074BC95D886B not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\C7EC681679EA5384C9A88C5B97ABDDAE not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{12DC3627-F1BA-4CB7-A08C-463319E06E01}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{3F835F57-158A-47A6-A556-DABC464DF56D}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{49D6E057-1AB0-43C2-A7BD-B5E0AFDF0408}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{4B15FA87-67E8-4D4D-A21A-35FF8A3C7F7F}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{54151D14-D64D-4AE6-81D6-91415F757278}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{89113117-091E-4B69-AE7F-2047471B5803}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{ABF70F17-DC2C-4535-943C-B268D2D50BA2}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{B10507E4-DB11-4A10-82BA-D46C17AAF29D}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{BA12CA4F-BD94-4C35-B011-9E40CB34545F}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{BC877C2B-439F-4C88-A796-69AFD1BC7B22}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{BF875B2E-8417-453D-94A3-F04027EB719A}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D3174FC6-BDCD-4124-9104-2CA61481FD7B}\InprocServer32\\@ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{DBB92678-3DD0-4603-B740-471100FE293F}\InprocServer32\\@ deleted successfully.
========== COMMANDS ==========
Restore point Set: OTM Restore Point

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Emily

User: Home PC
->Flash cache emptied: 3353 bytes

User: louise

User: Public

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Emily
->Temp folder emptied: 0 bytes

User: Home PC
->Temp folder emptied: 11533680 bytes
->Temporary Internet Files folder emptied: 5876349 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 124094682 bytes
->Flash cache emptied: 0 bytes

User: louise
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1098146 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes
RecycleBin emptied: 16108336 bytes

Total Files Cleaned = 151.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTM by OldTimer - Version 3.1.21.0 log created on 06122013_185326

Files moved on Reboot...
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore\lib\zi scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore\lib\zi scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore\lib scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore\lib\zi scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore\lib scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore\lib\zi scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore\lib scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero scheduled to be moved on reboot.
C:\Users\Home PC\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File C:\Windows\temp\TMP0000000BDB48073ABD470679 not found!
C:\Windows\SysWow64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV190I5Z\desktop.ini moved successfully.
C:\Windows\SysWow64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PDJ7T8GD\desktop.ini moved successfully.
C:\Windows\SysWow64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P70D9LH3\desktop.ini moved successfully.
C:\Windows\SysWow64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FX9ZB6H1\desktop.ini moved successfully.
File C:\Windows\SysWow64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini not found!

Registry entries deleted on Reboot...

Regards
Chris


----------



## Mark1956 (May 7, 2011)

> Im not sure if it was supposed to do anything but on reboot the box came up asking which program I would like to open the file. As yet no sign of the pop error message will let you know if it comes up.


Sounds encouraging, but what file was the pop up box asking about? Has it appeared again after further reboots?


----------



## superfrog25 (Mar 25, 2011)

I think it is trying to access the error message file.The Nero file I sent you in an earlier log.It just popped up again...As below


NERO

Red circle and White cross: This program requires the file ADVRCNTR5.DLL,which was not found on the system. 
Along with this I have a pop up box with various programs asking which one I would like to open it with


----------



## huggie54 (Feb 17, 2008)

look in here for any nero leftovers
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\ Windows\CurrentVersion\SharedDLLs.


----------



## superfrog25 (Mar 25, 2011)

Thanks Huggie,

What would you advise to do Mark?


----------



## Mark1956 (May 7, 2011)

Try what Huggie suggested.

We can also do another search with System Look as there is clearly still some remnants.

Run System Look again and use this script.


```
:filefind
*Nero*
*ADVRCNTR5*
:folderfind
*Nero*
*ADVRCNTR5*
```


----------



## superfrog25 (Mar 25, 2011)

Ok Mark I will run System look.I just wasnt sure what huggie was advising


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Please see results of System Look

SystemLook 30.07.11 by jpshortstuff
Log created at 20:17 on 12/06/2013 by Home PC
Administrator - Elevation successful

========== filefind ==========

Searching for "*Nero*"
C:\Program Files (x86)\Nero\Help\NeroControlCenter_cs-CZ.chm --a---- 114732 bytes [14:05 04/03/2011] [14:05 04/03/2011] 391EA0C627C881472500B238AB52EC96
C:\Program Files (x86)\Nero\Help\NeroControlCenter_da-DK.chm -ra---- 113694 bytes [07:38 23/02/2011] [07:38 23/02/2011] 0D085EC220E66779200AFA108557F852
C:\Program Files (x86)\Nero\Help\NeroControlCenter_de-DE.chm --a---- 123420 bytes [14:05 04/03/2011] [14:05 04/03/2011] 98564BE46C3FE59C63F2E777D6FF659A
C:\Program Files (x86)\Nero\Help\NeroControlCenter_el-GR.chm -ra---- 116716 bytes [07:38 23/02/2011] [07:38 23/02/2011] 468FCE4A869CFD484EAFF0031B763E3C
C:\Program Files (x86)\Nero\Help\NeroControlCenter_en-GB.chm -ra---- 112684 bytes [07:38 23/02/2011] [07:38 23/02/2011] 5105FEAD1F2B2F327B7739BE465E516F
C:\Program Files (x86)\Nero\Help\NeroControlCenter_en-US.chm --a---- 113388 bytes [14:05 04/03/2011] [14:05 04/03/2011] 6A1CEFEE25C91EF31BEEE672F5F20ED6
C:\Program Files (x86)\Nero\Help\NeroControlCenter_es-ES.chm --a---- 114516 bytes [14:05 04/03/2011] [14:05 04/03/2011] E2FA8274B5C5199BE337D7B540195678
C:\Program Files (x86)\Nero\Help\NeroControlCenter_fi-FI.chm -ra---- 114454 bytes [07:38 23/02/2011] [07:38 23/02/2011] BF33D0E9285B18C8E5CB920699678CAD
C:\Program Files (x86)\Nero\Help\NeroControlCenter_fr-FR.chm --a---- 114938 bytes [14:05 04/03/2011] [14:05 04/03/2011] F619A09678E994DD67F9D0B129F7B776
C:\Program Files (x86)\Nero\Help\NeroControlCenter_hu-HU.chm -ra---- 115092 bytes [07:38 23/02/2011] [07:38 23/02/2011] C37BA4F43F707AF29E47BA246A8701F8
C:\Program Files (x86)\Nero\Help\NeroControlCenter_it-IT.chm --a---- 113954 bytes [14:05 04/03/2011] [14:05 04/03/2011] B0C8E9567E3ADCB7F19E014C7C461ED9
C:\Program Files (x86)\Nero\Help\NeroControlCenter_ja-JP.chm --a---- 117164 bytes [14:05 04/03/2011] [14:05 04/03/2011] 651C049AA99FC3080CFD950BD7A9D6C4
C:\Program Files (x86)\Nero\Help\NeroControlCenter_ko-KR.chm --a---- 114162 bytes [14:05 04/03/2011] [14:05 04/03/2011] 499958BE4716F7C59A4DE83EC5C95F8F
C:\Program Files (x86)\Nero\Help\NeroControlCenter_nb-NO.chm -ra---- 113834 bytes [07:38 23/02/2011] [07:38 23/02/2011] B64843A34B327E15511BD1E3BA345540
C:\Program Files (x86)\Nero\Help\NeroControlCenter_nl-NL.chm --a---- 113994 bytes [14:05 04/03/2011] [14:05 04/03/2011] 8DCC61A16ED6905C3410BBC53B148814
C:\Program Files (x86)\Nero\Help\NeroControlCenter_pl-PL.chm --a---- 115978 bytes [14:05 04/03/2011] [14:05 04/03/2011] A8A16B05167F1CE293B18174AB2637EB
C:\Program Files (x86)\Nero\Help\NeroControlCenter_pt-BR.chm --a---- 114780 bytes [14:05 04/03/2011] [14:05 04/03/2011] CE9E4B51E606B4608F2299CBC3D2CB3B
C:\Program Files (x86)\Nero\Help\NeroControlCenter_pt-PT.chm -ra---- 114168 bytes [07:40 23/02/2011] [07:40 23/02/2011] 777542DCBFB30C58115BAE71D24F2DD8
C:\Program Files (x86)\Nero\Help\NeroControlCenter_ru-RU.chm --a---- 116266 bytes [14:05 04/03/2011] [14:05 04/03/2011] 6C11992DF779393D26CDF331639D4B15
C:\Program Files (x86)\Nero\Help\NeroControlCenter_sv-SE.chm --a---- 112838 bytes [14:05 04/03/2011] [14:05 04/03/2011] EE6D83FCFE03909F411AE3EABA262A17
C:\Program Files (x86)\Nero\Help\NeroControlCenter_th-TH.chm -ra---- 115636 bytes [07:38 23/02/2011] [07:38 23/02/2011] 5040727159C2441F7226454A905ED7C4
C:\Program Files (x86)\Nero\Help\NeroControlCenter_tr-TR.chm -ra---- 114760 bytes [07:38 23/02/2011] [07:38 23/02/2011] CF3EF7FFAFD017CEF58801CEAB773DEF
C:\Program Files (x86)\Nero\Help\NeroControlCenter_zh-CN.chm --a---- 113610 bytes [14:05 04/03/2011] [14:05 04/03/2011] 35EB5AF6C908A35FD9DC2351C3AE53E4
C:\Program Files (x86)\Nero\Help\NeroControlCenter_zh-TW.chm --a---- 113472 bytes [14:05 04/03/2011] [14:05 04/03/2011] 7F754AE009B3493F2DF998562CB68C01
C:\Program Files (x86)\Nero\Help\NeroHelpLang.dll --a---- 15120 bytes [12:22 01/03/2011] [12:22 01/03/2011] 0B66243CCDE2ED65076B5DCF398C1622
C:\Program Files (x86)\Nero\Help\cs-CZ\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] 854DD823242F84ED03813E2832077654
C:\Program Files (x86)\Nero\Help\da-DK\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] B0712ED08D2807997FF29D23EC7BD9E7
C:\Program Files (x86)\Nero\Help\de\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] 658C93A8E1941B6E617F29CD610324F2
C:\Program Files (x86)\Nero\Help\de-DE\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] E2781B680B1365BA6B9FEB9753818262
C:\Program Files (x86)\Nero\Help\el-GR\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] E185CDDD16ED1390FF583CB4FCB39137
C:\Program Files (x86)\Nero\Help\en-GB\nerohelplang.dll.mui --a---- 7952 bytes [12:22 01/03/2011] [12:22 01/03/2011] 9442895BEFC6A15735EDAC1C164BC01F
C:\Program Files (x86)\Nero\Help\en-US\nerohelplang.dll.mui --a---- 7952 bytes [12:22 01/03/2011] [12:22 01/03/2011] C9691B73AB66A9F3254632E33731EA22
C:\Program Files (x86)\Nero\Help\es\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] D9C1ACAA0AC2EE60991FF34FCF95730B
C:\Program Files (x86)\Nero\Help\es-ES\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] B862F568D36D06C277A869BE83294057
C:\Program Files (x86)\Nero\Help\fi-FI\nerohelplang.dll.mui --a---- 7952 bytes [12:22 01/03/2011] [12:22 01/03/2011] 0521C37A84C728BE45520770B87D9CA2
C:\Program Files (x86)\Nero\Help\fr\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] 9FC5C3AD76C9DB1C77CBCFF7445766EB
C:\Program Files (x86)\Nero\Help\fr-FR\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] C88E889DA3BD031C9E6A31D19C68772E
C:\Program Files (x86)\Nero\Help\hu-HU\nerohelplang.dll.mui --a---- 7952 bytes [12:22 01/03/2011] [12:22 01/03/2011] 23368A5DBDCBA7AACB1FD71374493A91
C:\Program Files (x86)\Nero\Help\it\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] 1E833574E6B66CD6375E15E294E846A7
C:\Program Files (x86)\Nero\Help\it-IT\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] D3769A1160D1EFCC7D4F0CEA59DA42CC
C:\Program Files (x86)\Nero\Help\ja-JP\nerohelplang.dll.mui --a---- 7952 bytes [12:22 01/03/2011] [12:22 01/03/2011] B13E7DFE8851B7F2FC2E59B2BAFEE158
C:\Program Files (x86)\Nero\Help\ko-KR\nerohelplang.dll.mui --a---- 7952 bytes [12:22 01/03/2011] [12:22 01/03/2011] 0A6FAF74DF4B5B442A41A7FC5BFFF723
C:\Program Files (x86)\Nero\Help\nb-NO\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] 1FAA8E4722DA13F6589C48DA9ED06E10
C:\Program Files (x86)\Nero\Help\nl\nerohelplang.dll.mui --a---- 7952 bytes [12:22 01/03/2011] [12:22 01/03/2011] 758807FF5705AC9F68198342A7BCFF57
C:\Program Files (x86)\Nero\Help\nl-NL\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] DA0F1CE009C4B1D7FB79E260B0B0FAB3
C:\Program Files (x86)\Nero\Help\pl-PL\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] E2C3522676C077F253666F642E3E9A39
C:\Program Files (x86)\Nero\Help\pt\nerohelplang.dll.mui --a---- 8464 bytes [12:22 01/03/2011] [12:22 01/03/2011] 23CB7D0CD2CE1D1E5B1B8DB786B9D67E
C:\Program Files (x86)\Nero\Help\pt-BR\nerohelplang.dll.mui --a---- 8464 bytes [12:23 01/03/2011] [12:23 01/03/2011] 610524FF684E8822195ABB02DA9F05A8
C:\Program Files (x86)\Nero\Help\pt-PT\nerohelplang.dll.mui --a---- 8464 bytes [12:23 01/03/2011] [12:23 01/03/2011] FB2EEA295BDF3CA4D3A0D7420D067674
C:\Program Files (x86)\Nero\Help\ru-RU\nerohelplang.dll.mui --a---- 8464 bytes [12:23 01/03/2011] [12:23 01/03/2011] 88CABE8EFDD9439978C9E1A39220E953
C:\Program Files (x86)\Nero\Help\sv-SE\nerohelplang.dll.mui --a---- 8464 bytes [12:23 01/03/2011] [12:23 01/03/2011] 00231A28BB5E4AB5A050D06D0D0DA9B5
C:\Program Files (x86)\Nero\Help\th-TH\nerohelplang.dll.mui --a---- 8464 bytes [12:23 01/03/2011] [12:23 01/03/2011] 41D958D10910220C37F609608434ABC9
C:\Program Files (x86)\Nero\Help\tr-TR\nerohelplang.dll.mui --a---- 8464 bytes [12:23 01/03/2011] [12:23 01/03/2011] 0870E01734D6FCA7E441DE3626D79DE4
C:\Program Files (x86)\Nero\Help\zh\nerohelplang.dll.mui --a---- 7440 bytes [12:23 01/03/2011] [12:23 01/03/2011] 1FCBA892A35D6C5A776A7A6C0A067857
C:\Program Files (x86)\Nero\Help\zh-CN\nerohelplang.dll.mui --a---- 7440 bytes [12:23 01/03/2011] [12:23 01/03/2011] 17EE05A9CFCA98AAE363C3E71BB031A3
C:\Program Files (x86)\Nero\Help\zh-HK\nerohelplang.dll.mui --a---- 7952 bytes [12:23 01/03/2011] [12:23 01/03/2011] E54D1F0D9908A20ACEEF1D185893F6CA
C:\Program Files (x86)\Nero\Help\zh-TW\nerohelplang.dll.mui --a---- 7952 bytes [12:23 01/03/2011] [12:23 01/03/2011] C245AB08AE885D45740344D2F05733EE
C:\Program Files (x86)\Nero\NeroContent\NeroContentLicenseCheck.dll --a---- 79144 bytes [17:19 07/01/2011] [17:19 07/01/2011] 93026492F217D4B839633A63E29F9E5D
C:\Program Files (x86)\Nero\SyncUP\Nero.AndroidServer.exe --a---- 150312 bytes [15:10 29/04/2011] [15:10 29/04/2011] 851DB553220B73AAE2A0BD9B0BADE4EC
C:\Program Files (x86)\Nero\SyncUP\Nerops.exe --a---- 25384 bytes [17:22 06/02/2012] [17:22 06/02/2012] 10ABD7C5B878544259CAA0BD6980700B
C:\Program Files (x86)\Nero\SyncUP\Nerops.exe.config --a---- 206 bytes [15:10 29/04/2011] [15:10 29/04/2011] 7279919D334BB8A1B0EB30C90F5A14BA
C:\Program Files (x86)\Nero\SyncUP\NeroAccessoryServer.exe --a---- 79144 bytes [17:21 06/02/2012] [17:21 06/02/2012] D2021EE52EA5C988A21C5B8987B198DE
C:\Program Files (x86)\Nero\SyncUP\NeroBRServer.exe --a---- 35624 bytes [18:48 10/11/2010] [18:48 10/11/2010] A037068FD0F11E7BBA7CC3AF66093CD8
C:\Program Files (x86)\Nero\SyncUP\NeroBRServer.exe.manifest --a---- 1499 bytes [18:48 10/11/2010] [18:48 10/11/2010] C8C1BEB4CE11B26DA824D58249D68906
C:\Program Files (x86)\Nero\SyncUP\NeroContentLicenseCheck.Interop.dll --a---- 13608 bytes [15:11 29/04/2011] [15:11 29/04/2011] 8B017FBFEB8DC3D803F8F7FEE7484A57
C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe --a---- 66872 bytes [17:26 06/02/2012] [17:26 06/02/2012] 96E019ADDAD4F0632B9C0383BD1C020D
C:\Program Files (x86)\Nero\SyncUP\NeroLibrary.dll --a---- 199464 bytes [17:24 06/02/2012] [17:24 06/02/2012] DCD12093E5207A566478C57BBA2A6B00
C:\Program Files (x86)\Nero\SyncUP\NeroUpdate.Interop.dll --a---- 38184 bytes [15:11 29/04/2011] [15:11 29/04/2011] D212F796BD9566147EE37D40FBD86B23
C:\Program Files (x86)\Nero\SyncUP\Nero.BDGraphic\Nero.BDGraphic.manifest --a---- 1439 bytes [11:52 29/10/2010] [11:52 29/10/2010] B0794D1E48591F604A0E396BB1ABA03A
C:\Program Files (x86)\Nero\SyncUP\Nero.BDThumbnail\Nero.BDThumbnail.manifest --a---- 1171 bytes [11:52 29/10/2010] [11:52 29/10/2010] BD0B32A09EC56F6459959A891084557D
C:\Program Files (x86)\Nero\SyncUP\Nero.DiscNavBD\Nero.DiscNavBD.manifest --a---- 1513 bytes [11:52 29/10/2010] [11:52 29/10/2010] B6831581862BC29650687540FFD3EAB7
C:\Program Files (x86)\Nero\SyncUP\Nero.DiscNavDvd\Nero.DiscNavDvd.manifest --a---- 1516 bytes [11:52 29/10/2010] [11:52 29/10/2010] 63A7FD7BD8BEF945FB7F149ED514A07C
C:\Program Files (x86)\Nero\SyncUP\Nero.DiscNavVcd\Nero.DiscNavVcd.manifest --a---- 1400 bytes [11:52 29/10/2010] [11:52 29/10/2010] A6DDA03D576B5A3A000EFF7DF7B90AF3
C:\Program Files (x86)\Nero\SyncUP\Nero.DVDEngine\Nero.DVDEngine.manifest --a---- 559 bytes [12:45 16/11/2010] [12:45 16/11/2010] 3EF2EE2982FBA0DF96F1A88FCD6F12CC
C:\Program Files (x86)\Nero\SyncUP\Nero.NeDevDB\Nero.NeDevDB.manifest --a---- 2645 bytes [15:10 29/04/2011] [15:10 29/04/2011] 80DBC42B758D557982679313ECA176BB
C:\Program Files (x86)\Nero\SyncUP\Nero.NeDevDB\NeroDeviceDB.dbe --a---- 221891 bytes [17:24 06/02/2012] [17:24 06/02/2012] 1D2E1FF196567842EE84D5CD2E97C831
C:\Program Files (x86)\Nero\SyncUP\Nero.NeDiscManager\Nero.NeDiscManager.manifest --a---- 1169 bytes [11:52 29/10/2010] [11:52 29/10/2010] 7B010F55DA5FA601C1B69EA60F089C9F
C:\Program Files (x86)\Nero\SyncUP\Nero.VCDEngine\Nero.VCDEngine.manifest --a---- 523 bytes [13:37 16/11/2010] [13:37 16/11/2010] 3C98150EFC6C561E85FB387E3D3E8062
C:\Program Files (x86)\Nero\SyncUP\Nero3D\Nero3D.cat --a---- 6475 bytes [16:38 14/07/2010] [16:38 14/07/2010] 436D60B3F9C11A8BF4C6637ACDA6744E
C:\Program Files (x86)\Nero\SyncUP\Nero3D\Nero3D.manifest --a---- 1206 bytes [16:38 14/07/2010] [16:38 14/07/2010] 3A68442C51C45CA4FE05539E5445190A
C:\Program Files (x86)\Nero\SyncUP\Nero3D\Nero3DMenuEffects.dll --a---- 1111360 bytes [16:39 14/07/2010] [16:39 14/07/2010] A0E0C39F370C45529E4FDF7175E59221
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\NeroAPIEngine.dll --a---- 2159912 bytes [13:39 30/09/2010] [13:39 30/09/2010] 7117A2280C107B70E23A50717719EBCB
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\NeroAPIFiles.manifest --a---- 501 bytes [13:39 30/09/2010] [13:39 30/09/2010] 6BAC3079AB0EE609E05F28B45D40A221
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_cs-CZ.xml --a---- 73656 bytes [13:39 30/09/2010] [13:39 30/09/2010] 9726B9255B8B1D11C90ADB628D01183C
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_da-DK.xml --a---- 69127 bytes [13:39 30/09/2010] [13:39 30/09/2010] A8D25DAB650DDDBA786263E6989E5E95
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_de-DE.xml --a---- 74626 bytes [13:39 30/09/2010] [13:39 30/09/2010] 479CC5FC17852FFD800F59EBDECB3F74
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\nero_dev.xml --a---- 67403 bytes [13:39 30/09/2010] [13:39 30/09/2010] 18FC931E16C0D3C05BC8C0ABE59F3F21
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_el-GR.xml --a---- 111305 bytes [13:39 30/09/2010] [13:39 30/09/2010] 15F270DDE760DC4A4577256D68FA2879
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_en-US.xml --a---- 67417 bytes [13:39 30/09/2010] [13:39 30/09/2010] F7A1837E6E08875EBF2FA6E6B1955185
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_es-ES.xml --a---- 77510 bytes [13:39 30/09/2010] [13:39 30/09/2010] 6D0D8257B58ADE563CA05EA2846630C7
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_fi-FI.xml --a---- 71900 bytes [13:39 30/09/2010] [13:39 30/09/2010] A2E91F30874F55B4756A8B3905FFFFE4
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_fr-FR.xml --a---- 76927 bytes [13:39 30/09/2010] [13:39 30/09/2010] 31C3EF18DCF3FF82C772A3857AF3D97F
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_hu-HU.xml --a---- 73295 bytes [13:39 30/09/2010] [13:39 30/09/2010] 41C9B29F078EC1C5371A03083CE8C3D1
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_it-IT.xml --a---- 74411 bytes [13:39 30/09/2010] [13:39 30/09/2010] 71448957CC572FC315B40FAFFAEEA3A0
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_ja-JP.xml --a---- 84494 bytes [13:39 30/09/2010] [13:39 30/09/2010] 7DF698CF67E2ED65C1CB5720BD845C3E
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_ko-KR.xml --a---- 77894 bytes [13:39 30/09/2010] [13:39 30/09/2010] DFB93F64FFB58D07AF2644A677DDD1C4
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_nb-NO.xml --a---- 68381 bytes [13:39 30/09/2010] [13:39 30/09/2010] 057BEEAD423D794E1DA2F6BCAF686F03
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_nl-NL.xml --a---- 71198 bytes [13:39 30/09/2010] [13:39 30/09/2010] 5C6FBBF91FE02067B0622D32E41BB56F
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_pl-PL.xml --a---- 75972 bytes [13:39 30/09/2010] [13:39 30/09/2010] 8AB96152F23509297EE8A57E9888986E
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_pt-BR.xml --a---- 74680 bytes [13:39 30/09/2010] [13:39 30/09/2010] 763B1E072810DCC4C9D4C1594E0C907E
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_pt-PT.xml --a---- 77759 bytes [13:39 30/09/2010] [13:39 30/09/2010] 6347A10BF91422397FD8A15607EEEE60
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_ru-RU.xml --a---- 99668 bytes [13:39 30/09/2010] [13:39 30/09/2010] BA50CEB86B4BFBEC31E590C6A5315708
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_sv-SE.xml --a---- 68537 bytes [13:39 30/09/2010] [13:39 30/09/2010] C4DE3DC9696F635F6D69E03374E7BC82
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_th-TH.xml --a---- 129344 bytes [13:39 30/09/2010] [13:39 30/09/2010] 594BB8E61A5F8AC9081DEC3994068463
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_tr-TR.xml --a---- 71960 bytes [13:39 30/09/2010] [13:39 30/09/2010] 00C2B9EA344C39B6061EDFC6CC3A4415
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_zh-CN.xml --a---- 63654 bytes [13:39 30/09/2010] [13:39 30/09/2010] 4F381009A25353857BF210202A2BE769
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\Nero_zh-TW.xml --a---- 65394 bytes [13:39 30/09/2010] [13:39 30/09/2010] 621F5031B5A15E269B200D5B74CFEF4E
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\uNeroErr.dll --a---- 349480 bytes [13:39 30/09/2010] [13:39 30/09/2010] 9E5B70C3F4BF2E8C0F35BC265B6E74DA
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles\uNeroFSStandalone.dll --a---- 582952 bytes [13:39 30/09/2010] [13:39 30/09/2010] 47D71B87D6F9A6210822CF54C8E0CA56
C:\Program Files (x86)\Nero\SyncUP\PTT\NeroCaptureAPI.dll --a---- 558376 bytes [13:48 13/10/2011] [13:48 13/10/2011] EA13501B544955910EA4DA4BE038A7DD
C:\Program Files (x86)\Nero\SyncUP\SMC\NeroContentFinder.dll --a---- 132392 bytes [13:29 13/10/2011] [13:29 13/10/2011] 5F77462A6C321FB5CDA6C29D5F670026
C:\Program Files (x86)\Nero\SyncUP\SMC\NeroDigital.dll --a---- 4314408 bytes [13:07 13/10/2011] [13:07 13/10/2011] 7F3DAC8BE7CDC2AB5AA81BB2090C3843
C:\Program Files (x86)\Nero\SyncUP\SMC\NeroDigital.ocx --a---- 1353000 bytes [13:06 13/10/2011] [13:06 13/10/2011] 00E56B25D948561F521249B90247DB12
C:\Program Files (x86)\Nero\SyncUP\SMC\NeroDigitalProfiles.xml --a---- 257340 bytes [14:06 21/03/2011] [14:06 21/03/2011] 603D1A6B724777532E5D67FC3F81D39C
C:\Program Files (x86)\Nero\SyncUP\SMC\NeroDigitalProfilesPSP.xml --a---- 40776 bytes [14:07 21/03/2011] [14:07 21/03/2011] 03A43F91B32DCB3ED4A6888101A19813
C:\Program Files (x86)\Nero\SyncUP\SMC\NeroVMRModules.dll --a---- 464176 bytes [13:30 13/10/2011] [13:30 13/10/2011] 2517092391EFA1C46ABA241D9E949520
C:\Program Files (x86)\Nero\SyncUP\SMC\NeroVobuGenerator.ax --a---- 312616 bytes [13:31 13/10/2011] [13:31 13/10/2011] CD809C3AD05501DBF3336E49868C4AB9
C:\Program Files (x86)\Nero\SyncUP\SMC\uNeroMediaCon.dll --a---- 1926440 bytes [13:43 13/10/2011] [13:43 13/10/2011] BA29F39BD4093B43FF5DA18867153B3A
C:\ProgramData\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.22.0\Nero.Update.md5 --a---- 34 bytes [12:33 05/10/2011] [12:33 05/10/2011] (Unable to calculate MD5)
C:\ProgramData\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.22.0\Nero.Update.msi --a---- 1084928 bytes [12:33 05/10/2011] [12:33 05/10/2011] (Unable to calculate MD5)
C:\ProgramData\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.27.0\Nero.Update.md5 --a---- 34 bytes [12:24 14/12/2011] [12:24 14/12/2011] (Unable to calculate MD5)
C:\ProgramData\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.27.0\Nero.Update.msi --a---- 1148928 bytes [12:24 14/12/2011] [12:24 14/12/2011] (Unable to calculate MD5)
C:\ProgramData\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.28.0\Nero.Update.md5 --a---- 34 bytes [16:16 27/02/2012] [16:16 27/02/2012] (Unable to calculate MD5)
C:\ProgramData\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.28.0\Nero.Update.msi --a---- 1149440 bytes [16:16 27/02/2012] [16:16 27/02/2012] (Unable to calculate MD5)
C:\Users\All Users\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.22.0\Nero.Update.md5 --a---- 34 bytes [12:33 05/10/2011] [12:33 05/10/2011] (Unable to calculate MD5)
C:\Users\All Users\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.22.0\Nero.Update.msi --a---- 1084928 bytes [12:33 05/10/2011] [12:33 05/10/2011] (Unable to calculate MD5)
C:\Users\All Users\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.27.0\Nero.Update.md5 --a---- 34 bytes [12:24 14/12/2011] [12:24 14/12/2011] (Unable to calculate MD5)
C:\Users\All Users\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.27.0\Nero.Update.msi --a---- 1148928 bytes [12:24 14/12/2011] [12:24 14/12/2011] (Unable to calculate MD5)
C:\Users\All Users\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.28.0\Nero.Update.md5 --a---- 34 bytes [16:16 27/02/2012] [16:16 27/02/2012] (Unable to calculate MD5)
C:\Users\All Users\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.28.0\Nero.Update.msi --a---- 1149440 bytes [16:16 27/02/2012] [16:16 27/02/2012] (Unable to calculate MD5)
C:\Users\Home PC\AppData\Local\Nero\MobileSyncDevDB\NeroDeviceDB.dbe --a---- 233356 bytes [15:59 10/08/2011] [20:26 23/05/2013] BC464A693320A9D19CD052A5CF0E09B3
C:\Users\Home PC\AppData\Roaming\Ahead\Nero BackItUp\Cache\NeroBackItUp.txt --a---- 1146 bytes [18:24 09/06/2013] [18:24 09/06/2013] 27D6E0B89A041CFEB6E3AAEC61065C2D
C:\Users\Home PC\Desktop\Old Firefox Data\extensions\[email protected]db8838882.com\chrome\content\core\progressListenerObserver.js --a---- 1476 bytes [14:15 08/06/2013] [20:27 29/04/2013] 40FB0C3D57C2471E1F6614B06F126884
C:\Windows\Installer\{40F06490-8C14-43AA-99D3-EEEFDBAC3CFC}\Nero_IconAudio -ra---- 587048 bytes [22:47 05/08/2011] [16:28 26/05/2012] 2507C363D3B3F4350A86ED1325D16059
C:\Windows\Installer\{40F06490-8C14-43AA-99D3-EEEFDBAC3CFC}\Nero_IconImage -ra---- 587048 bytes [22:47 05/08/2011] [16:28 26/05/2012] A185390F24AF4DCD0AF163FF16858025
C:\Windows\Installer\{40F06490-8C14-43AA-99D3-EEEFDBAC3CFC}\Nero_IconVideo -ra---- 587048 bytes [22:47 05/08/2011] [16:28 26/05/2012] B95A330024D3E498543F470930BF0438
C:\Windows\Installer\{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}\NeroHelpIcon.BBDB24D3_07A5_496B_AA18_6A3ED03D6698 -ra---- 50472 bytes [22:47 05/08/2011] [22:47 05/08/2011] 5827E5041CFBA81EA467D66D87073E3A
C:\Windows\Prefetch\NERO.EXE-ED4F2072.pf --a---- 41484 bytes [20:09 10/06/2013] [20:09 10/06/2013] 08C5FD33B9497776EF9664265D03B7C1
C:\Windows\Prefetch\NEROHOME.EXE-EDD7B4E3.pf --a---- 22976 bytes [20:09 10/06/2013] [20:09 10/06/2013] FC5FDC11B84F4BCB44355BB98016B37A
C:\Windows\Prefetch\NEROREMOTECTRLHANDLER.EXE-E7B270E1.pf --a---- 15064 bytes [20:09 10/06/2013] [20:09 10/06/2013] 5D25F32BD3A2227C5426BBF930E2BCE4
C:\Windows\Prefetch\NEROVISION.EXE-2BEBA1D1.pf --a---- 38656 bytes [20:09 10/06/2013] [20:09 10/06/2013] 1D94D87BE6DA972251338AEC7C5E9DF7
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_ch-CN.rtf --a---- 0 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_ch-TW.rtf --a---- 0 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_de-DE.rtf --a---- 75368 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_en-US.rtf --a---- 61753 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_es-CL.rtf --a---- 72942 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_es-ES.rtf --a---- 204508 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_fr-FR.rtf --a---- 78724 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_it-IT.rtf --a---- 73038 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_ja-JP.rtf --a---- 173981 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_ko-KR.rtf --a---- 153131 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_nl-NL.rtf --a---- 72932 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_pl-PL.rtf --a---- 79039 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_pt-BR.rtf --a---- 73185 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_pt-PT.rtf --a---- 74414 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_ru-RU.rtf --a---- 206014 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_sv-SE.rtf --a---- 73300 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_zh-CN.rtf --a---- 111201 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\Eula_Nero_zh-TW.rtf --a---- 119909 bytes [12:32 06/04/2011] [12:32 06/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\NeroPatentActivation.exe --a---- 218408 bytes [18:48 27/04/2011] [18:48 27/04/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_de-DE.rtf -ra---- 76051 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_en-US.rtf -ra---- 60839 bytes  [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_es-CL.rtf -ra---- 73278 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_es-ES.rtf -ra---- 75115 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_fr-FR.rtf -ra---- 78849 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_it-IT.rtf -ra---- 72986 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_ja-JP.rtf -ra---- 172614 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_ko-KR.rtf -ra---- 152836 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_nl-NL.rtf -ra---- 73340 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_pl-PL.rtf -ra---- 78739 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_pt-BR.rtf -ra---- 73421 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_ru-RU.rtf -ra---- 206208 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_sv-SE.rtf -ra---- 73519 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_zh-CN.rtf -ra---- 118814 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\Eula_Nero_zh-TW.rtf -ra---- 119382 bytes [14:44 15/09/2011] [14:44 15/09/2011] (Unable to calculate MD5)
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr6\NeroPatentActivation.exe -ra---- 1642280 bytes [09:33 28/09/2011] [09:33 28/09/2011] (Unable to calculate MD5)

Searching for "*ADVRCNTR5*"
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5\AdvrCntr5.dll --a---- 5072168 bytes [18:48 27/04/2011] [18:48 27/04/2011] (Unable to calculate MD5)

========== folderfind ==========

Searching for "*Nero*"
C:\$WINDOWS.~Q\DATA\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero d------ [22:47 05/08/2011]
C:\$WINDOWS.~Q\DATA\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero\Nero 10 d------ [22:47 05/08/2011]
C:\$WINDOWS.~Q\DATA\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero\Nero 10\Nero Help d------ [22:47 05/08/2011]
C:\$WINDOWS.~Q\DATA\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero\Nero 10\Nero Help\Nero ControlCenter d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero d------ [22:47 05/08/2011]
C:\Program Files (x86)\Common Files\Nero d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\Nero 10 d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\Nero 7 d------ [20:01 07/06/2013]
C:\Program Files (x86)\Nero\NeroContent d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\Nero 10\Nero ControlCenter d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\SyncUP\Nero.BDGraphic d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\SyncUP\Nero.BDThumbnail d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\SyncUP\Nero.DiscNavBD d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\SyncUP\Nero.DiscNavDvd d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\SyncUP\Nero.DiscNavVcd d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\SyncUP\Nero.DVDEngine d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\SyncUP\Nero.NeDevDB d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\SyncUP\Nero.NeDiscManager d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\SyncUP\Nero.VCDEngine d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\SyncUP\Nero3D d------ [22:47 05/08/2011]
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles d------ [22:47 05/08/2011]
C:\ProgramData\Nero d------ [22:46 05/08/2011]
C:\ProgramData\Ahead\Nero BackItUp d------ [20:05 07/06/2013]
C:\ProgramData\Nero\Nero 10 d------ [22:46 05/08/2011]
C:\ProgramData\Nero\Nero 11 d------ [21:14 24/12/2011]
C:\ProgramData\Nero\Nero 10\OnlineServices\NOSWebConfig\MyNero d------ [22:47 05/08/2011]
C:\Users\All Users\Nero d------ [22:46 05/08/2011]
C:\Users\All Users\Ahead\Nero BackItUp d------ [20:05 07/06/2013]
C:\Users\All Users\Nero\Nero 10 d------ [22:46 05/08/2011]
C:\Users\All Users\Nero\Nero 11 d------ [21:14 24/12/2011]
C:\Users\All Users\Nero\Nero 10\OnlineServices\NOSWebConfig\MyNero d------ [22:47 05/08/2011]
C:\Users\Home PC\AppData\Local\Nero d------ [15:58 10/08/2011]
C:\Users\Home PC\AppData\Local\Nero_AG d------ [08:47 11/08/2011]
C:\Users\Home PC\AppData\Local\Ahead\Nero Home d------ [20:06 07/06/2013]
C:\Users\Home PC\AppData\Local\Nero\Nero 10 d------ [15:59 10/08/2011]
C:\Users\Home PC\AppData\Local\VirtualStore\Program Files (x86)\Nero d------ [22:47 05/08/2011]
C:\Users\Home PC\AppData\Roaming\Nero d------ [15:58 10/08/2011]
C:\Users\Home PC\AppData\Roaming\Ahead\Nero BackItUp d------ [18:23 09/06/2013]
C:\Users\Home PC\AppData\Roaming\Ahead\NeroVision d------ [20:05 07/06/2013]
C:\Users\Home PC\AppData\Roaming\Nero\Nero 10 d------ [15:58 10/08/2011]
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero d------ [22:47 05/08/2011]
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\Nero 10 d------ [16:27 26/05/2012]

Searching for "*ADVRCNTR5*"
C:\_OTM\MovedFiles\06122013_185326\C_Program Files (x86)\Common Files\Nero\AdvrCntr5 d------ [22:47 05/08/2011]

-= EOF =-

Chris


----------



## Mark1956 (May 7, 2011)

Nothing came up in the search for the location that Huggie was suggesting so no need to look.

Double click *OTM.exe* to start the tool.


*Copy* the text in the code box below to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose *Copy*):


```
:Processes
explorer.exe

:Files
C:\Program Files (x86)\Nero
C:\ProgramData\Nero
C:\Users\All Users\Nero
C:\Users\Home PC\AppData\Local\Nero\MobileSyncDevDB\NeroDeviceDB.dbe
C:\Users\Home PC\AppData\Roaming\Ahead
C:\Users\Home PC\Desktop\Old Firefox Data\extensions\[email protected]db8838882.com\chrome\content\core\progressListenerObserver.js
C:\Windows\Installer\{40F06490-8C14-43AA-99D3-EEEFDBAC3CFC}\Nero_IconAudio
C:\Windows\Installer\{40F06490-8C14-43AA-99D3-EEEFDBAC3CFC}\Nero_IconImage
C:\Windows\Installer\{40F06490-8C14-43AA-99D3-EEEFDBAC3CFC}\Nero_IconVideo
C:\Windows\Installer\{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}\NeroHelpIcon.BBDB24D3_07A5_496B_AA18_6A3ED03D6698
C:\Windows\Prefetch\NERO.EXE-ED4F2072.pf
C:\Windows\Prefetch\NEROHOME.EXE-EDD7B4E3.pf
C:\Windows\Prefetch\NEROREMOTECTRLHANDLER.EXE-E7B270E1.pf
C:\Windows\Prefetch\NEROVISION.EXE-2BEBA1D1.pf
C:\$WINDOWS.~Q\DATA\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
C:\Program Files (x86)\Common Files\Nero
C:\ProgramData\Ahead\Nero BackItUp
C:\ProgramData\Nero
C:\Users\All Users\Ahead
C:\Users\Home PC\AppData\Local\Nero
C:\Users\Home PC\AppData\Local\Nero_AG
C:\Users\Home PC\AppData\Local\Ahead
C:\Users\Home PC\AppData\Local\VirtualStore\Program Files (x86)\Nero
C:\Users\Home PC\AppData\Roaming\Nero
C:\Users\Home PC\AppData\Roaming\Ahead

:Commands
[createrestorepoint]

[reboot]
```

 Return to OTM, right click in the *"Paste Instructions for Items to be Moved"* window (under the yellow bar) and choose *Paste*.
Click the red *Moveit!* button.
All your desktop icons will disappear as the scan begins. It should complete within a few minutes.
Once complete you may see a box appear asking you to Restart the system to complete the file removal, accept it and it will reboot.
Even if that box does not appear the system should reboot as the command is included in the script.
When the system has come back to the desktop a Notepad document will open, please copy and paste that into your next post.

-- Note: The logs are saved here: C:\_OTM\MovedFiles


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Ran OTM as advised.Please see below. Unfortunately the which program do you want the file to run box came up again (The file states Home which is the computers name) I just close it and thats it until reboot so not that annoying but will let you know if the Nero error message reappears.

========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
C:\Program Files (x86)\Nero\Update\zh-TW folder moved successfully.
C:\Program Files (x86)\Nero\Update\zh-HK folder moved successfully.
C:\Program Files (x86)\Nero\Update\zh-Hant folder moved successfully.
C:\Program Files (x86)\Nero\Update\zh-CN folder moved successfully.
C:\Program Files (x86)\Nero\Update\zh folder moved successfully.
C:\Program Files (x86)\Nero\Update\tr-TR folder moved successfully.
C:\Program Files (x86)\Nero\Update\th-TH folder moved successfully.
C:\Program Files (x86)\Nero\Update\sv-SE folder moved successfully.
C:\Program Files (x86)\Nero\Update\ru-RU folder moved successfully.
C:\Program Files (x86)\Nero\Update\pt-BR folder moved successfully.
C:\Program Files (x86)\Nero\Update\pt folder moved successfully.
C:\Program Files (x86)\Nero\Update\pl-PL folder moved successfully.
C:\Program Files (x86)\Nero\Update\nl-NL folder moved successfully.
C:\Program Files (x86)\Nero\Update\nl folder moved successfully.
C:\Program Files (x86)\Nero\Update\nb-NO folder moved successfully.
C:\Program Files (x86)\Nero\Update\ko-KR folder moved successfully.
C:\Program Files (x86)\Nero\Update\ja-JP folder moved successfully.
C:\Program Files (x86)\Nero\Update\it-IT folder moved successfully.
C:\Program Files (x86)\Nero\Update\it folder moved successfully.
C:\Program Files (x86)\Nero\Update\hu-HU folder moved successfully.
C:\Program Files (x86)\Nero\Update\fr-FR folder moved successfully.
C:\Program Files (x86)\Nero\Update\fr folder moved successfully.
C:\Program Files (x86)\Nero\Update\fi-FI folder moved successfully.
C:\Program Files (x86)\Nero\Update\es-ES folder moved successfully.
C:\Program Files (x86)\Nero\Update\es folder moved successfully.
Folder move failed. C:\Program Files (x86)\Nero\Update\en-US scheduled to be moved on reboot.
C:\Program Files (x86)\Nero\Update\el-GR folder moved successfully.
C:\Program Files (x86)\Nero\Update\de-DE folder moved successfully.
C:\Program Files (x86)\Nero\Update\de folder moved successfully.
C:\Program Files (x86)\Nero\Update\da-DK folder moved successfully.
C:\Program Files (x86)\Nero\Update\cs-CZ folder moved successfully.
Folder move failed. C:\Program Files (x86)\Nero\Update scheduled to be moved on reboot.
C:\Program Files (x86)\Nero\SyncUP\zh-TW folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\zh-CN folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\tr-TR folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\th-TH folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\sv-SE folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\SMC\plug-ins folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\SMC folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\ru-RU folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Resources folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\PTT folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\pt-PT folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\pt-BR folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Plugins folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\pl-PL folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\OnlineServices folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\NScCoreComponents folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\nl-NL folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\NeroAPIFiles folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Nero3D\Licenses folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Nero3D folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Nero.VCDEngine folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Nero.NeDiscManager folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Nero.NeDevDB folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Nero.DVDEngine folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Nero.DiscNavVcd folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Nero.DiscNavDvd folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Nero.DiscNavBD folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Nero.BDThumbnail folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Nero.BDGraphic folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\NEE\plug_ins\SimpleAFX_Language folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\NEE\plug_ins\CoolVFX_Language folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\NEE\plug_ins\ClassicVFX_Language folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\NEE\plug_ins folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\NEE folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\nb-NO folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\NAE folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\NAddrBook folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\ko-KR folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\ja-JP folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\it-IT folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\hu-HU folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\fr-FR folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\fi-FI folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\es-ES folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\en-US folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\el-GR folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\DeviceConnectors folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\de-DE folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\da-DK folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\cs-CZ folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\BurnAPILib folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Adv.UDFReader folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP\Adv.ApplicationFormatDetector folder moved successfully.
C:\Program Files (x86)\Nero\SyncUP folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Standard2D\SD\Slideshow folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Standard2D\SD\OldFilm folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Standard2D\SD\Movement folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Standard2D\SD folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Standard2D\HD\Slideshow folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Standard2D\HD\OldFilm folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Standard2D\HD\Movement folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Standard2D\HD folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Standard2D folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Smart3D\IntrosOutros\4_3\MovingWalls folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Smart3D\IntrosOutros\4_3 folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Smart3D\IntrosOutros\16_9\MovingWalls folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Smart3D\IntrosOutros\16_9 folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Smart3D\IntrosOutros folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Smart3D folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\MovieWizard\Slideshow1 folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\MovieWizard\OldFilm folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\MovieWizard\MovingWalls folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\MovieWizard folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Audio\slideshow1_nsla folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Audio\oldfilm_nsla folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Audio\movingwalls_nsla folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent\Audio folder moved successfully.
C:\Program Files (x86)\Nero\NeroContent folder moved successfully.
C:\Program Files (x86)\Nero\Nero 7 folder moved successfully.
C:\Program Files (x86)\Nero\Nero 10\Nero ControlCenter folder moved successfully.
C:\Program Files (x86)\Nero\Nero 10 folder moved successfully.
C:\Program Files (x86)\Nero\Help\zh-TW folder moved successfully.
C:\Program Files (x86)\Nero\Help\zh-HK folder moved successfully.
C:\Program Files (x86)\Nero\Help\zh-CN folder moved successfully.
C:\Program Files (x86)\Nero\Help\zh folder moved successfully.
C:\Program Files (x86)\Nero\Help\tr-TR folder moved successfully.
C:\Program Files (x86)\Nero\Help\th-TH folder moved successfully.
C:\Program Files (x86)\Nero\Help\sv-SE folder moved successfully.
C:\Program Files (x86)\Nero\Help\ru-RU folder moved successfully.
C:\Program Files (x86)\Nero\Help\pt-PT folder moved successfully.
C:\Program Files (x86)\Nero\Help\pt-BR folder moved successfully.
C:\Program Files (x86)\Nero\Help\pt folder moved successfully.
C:\Program Files (x86)\Nero\Help\pl-PL folder moved successfully.
C:\Program Files (x86)\Nero\Help\nl-NL folder moved successfully.
C:\Program Files (x86)\Nero\Help\nl folder moved successfully.
C:\Program Files (x86)\Nero\Help\nb-NO folder moved successfully.
C:\Program Files (x86)\Nero\Help\ko-KR folder moved successfully.
C:\Program Files (x86)\Nero\Help\ja-JP folder moved successfully.
C:\Program Files (x86)\Nero\Help\it-IT folder moved successfully.
C:\Program Files (x86)\Nero\Help\it folder moved successfully.
C:\Program Files (x86)\Nero\Help\hu-HU folder moved successfully.
C:\Program Files (x86)\Nero\Help\fr-FR folder moved successfully.
C:\Program Files (x86)\Nero\Help\fr folder moved successfully.
C:\Program Files (x86)\Nero\Help\fi-FI folder moved successfully.
C:\Program Files (x86)\Nero\Help\es-ES folder moved successfully.
C:\Program Files (x86)\Nero\Help\es folder moved successfully.
C:\Program Files (x86)\Nero\Help\en-US folder moved successfully.
C:\Program Files (x86)\Nero\Help\en-GB folder moved successfully.
C:\Program Files (x86)\Nero\Help\el-GR folder moved successfully.
C:\Program Files (x86)\Nero\Help\de-DE folder moved successfully.
C:\Program Files (x86)\Nero\Help\de folder moved successfully.
C:\Program Files (x86)\Nero\Help\da-DK folder moved successfully.
C:\Program Files (x86)\Nero\Help\cs-CZ folder moved successfully.
C:\Program Files (x86)\Nero\Help folder moved successfully.
Folder move failed. C:\Program Files (x86)\Nero scheduled to be moved on reboot.
C:\ProgramData\Nero\Nero 11 folder moved successfully.
C:\ProgramData\Nero\Nero 10\OnlineServices\NOSWebConfig\YouTube folder moved successfully.
C:\ProgramData\Nero\Nero 10\OnlineServices\NOSWebConfig\MySpace folder moved successfully.
C:\ProgramData\Nero\Nero 10\OnlineServices\NOSWebConfig\MyNero folder moved successfully.
C:\ProgramData\Nero\Nero 10\OnlineServices\NOSWebConfig\Flickr folder moved successfully.
C:\ProgramData\Nero\Nero 10\OnlineServices\NOSWebConfig\Facebook folder moved successfully.
C:\ProgramData\Nero\Nero 10\OnlineServices\NOSWebConfig folder moved successfully.
C:\ProgramData\Nero\Nero 10\OnlineServices\MetaData folder moved successfully.
C:\ProgramData\Nero\Nero 10\OnlineServices folder moved successfully.
C:\ProgramData\Nero\Nero 10 folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{F9C0E428-CC5A-48D4-80BB-7C13D783251B}\{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F} folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{F9C0E428-CC5A-48D4-80BB-7C13D783251B} folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{E662C6C7-F7AE-455D-AF35-8FA0A484DE90}\{9193490D-5229-4FC4-9BB9-A6D63C09574A} folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{E662C6C7-F7AE-455D-AF35-8FA0A484DE90} folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{DF7EBE00-B52E-4BB2-AA7D-7CB21312AB21}\{40F06490-8C14-43AA-99D3-EEEFDBAC3CFC} folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{DF7EBE00-B52E-4BB2-AA7D-7CB21312AB21} folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.28.0 folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.27.0 folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}\11.0.22.0 folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101}\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A} folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{6A536445-D10A-4006-8AA5-2FFCEF1A1101} folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{403096B5-2B75-4FAE-BC57-6535C9E50B79}\{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7} folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{403096B5-2B75-4FAE-BC57-6535C9E50B79} folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{3DEBC5B2-FD93-4492-A6B3-4F2C7943F34C}\{6DFB899F-17A2-48F0-A533-ED8D6866CF38} folder moved successfully.
C:\ProgramData\Nero\Agent\Repository\{3DEBC5B2-FD93-4492-A6B3-4F2C7943F34C} folder moved successfully.
Folder move failed. C:\ProgramData\Nero\Agent\Repository scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Nero\Agent scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Nero scheduled to be moved on reboot.
C:\Users\All Users\Nero\Agent\Repository folder moved successfully.
Folder move failed. C:\Users\All Users\Nero\Agent scheduled to be moved on reboot.
Folder move failed. C:\Users\All Users\Nero scheduled to be moved on reboot.
C:\Users\Home PC\AppData\Local\Nero\MobileSyncDevDB\NeroDeviceDB.dbe moved successfully.
C:\Users\Home PC\AppData\Roaming\Ahead\NeroVision folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Ahead\Nero BackItUp\Files folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Ahead\Nero BackItUp\Cache folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Ahead\Nero BackItUp folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Ahead folder moved successfully.
C:\Users\Home PC\Desktop\Old Firefox Data\extensions\[email protected]db8838882.com\chrome\content\core\progressListenerObserver.js moved successfully.
C:\Windows\Installer\{40F06490-8C14-43AA-99D3-EEEFDBAC3CFC}\Nero_IconAudio moved successfully.
C:\Windows\Installer\{40F06490-8C14-43AA-99D3-EEEFDBAC3CFC}\Nero_IconImage moved successfully.
C:\Windows\Installer\{40F06490-8C14-43AA-99D3-EEEFDBAC3CFC}\Nero_IconVideo moved successfully.
C:\Windows\Installer\{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}\NeroHelpIcon.BBDB24D3_07A5_496B_AA18_6A3ED03D6698 moved successfully.
C:\Windows\Prefetch\NERO.EXE-ED4F2072.pf moved successfully.
C:\Windows\Prefetch\NEROHOME.EXE-EDD7B4E3.pf moved successfully.
C:\Windows\Prefetch\NEROREMOTECTRLHANDLER.EXE-E7B270E1.pf moved successfully.
C:\Windows\Prefetch\NEROVISION.EXE-2BEBA1D1.pf moved successfully.
C:\$WINDOWS.~Q\DATA\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero\Nero 10\Nero Help\Nero ControlCenter folder moved successfully.
C:\$WINDOWS.~Q\DATA\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero\Nero 10\Nero Help folder moved successfully.
C:\$WINDOWS.~Q\DATA\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero\Nero 10 folder moved successfully.
C:\$WINDOWS.~Q\DATA\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero folder moved successfully.
C:\Program Files (x86)\Common Files\Nero\BDCore\lib\zi folder moved successfully.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore\lib scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero scheduled to be moved on reboot.
C:\ProgramData\Ahead\Nero BackItUp\Cache folder moved successfully.
C:\ProgramData\Ahead\Nero BackItUp folder moved successfully.
Folder move failed. C:\ProgramData\Nero\Agent scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Nero scheduled to be moved on reboot.
C:\Users\All Users\Ahead folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\Nero 10\.thumbnails\small folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\Nero 10\.thumbnails\normal folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\Nero 10\.thumbnails\large folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\Nero 10\.thumbnails\fail folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\Nero 10\.thumbnails folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\Nero 10 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\f\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\f\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\f\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\f\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\f\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\e\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\e\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\e\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\e\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\d\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\d\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\d\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\d\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\d\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\d\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\c\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\c\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\b\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\b\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\a\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\a\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\a\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\9\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\8\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\7\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\7\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\7\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\6\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\5\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\5\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\5\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\5\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\4\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\3\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\3\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\3\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\3\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\3\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\3\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\3\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\3\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\2\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\1\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\1\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\0\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\0\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\0\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync_Device.Thumbnails folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSyncDevDB folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\e folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\d folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\b folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\a folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\9 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\8 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\7 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\6 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\5 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\4 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\3 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\2 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\1 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails\0 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.Thumbnails folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.History\f\c folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.History\f folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync.History folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero\MobileSync folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero_AG\MediaHub.Main.exe_StrongName_zbk4okbjfhopji4wyvza42k0d23jb1mg\1.8.33.100 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero_AG\MediaHub.Main.exe_StrongName_zbk4okbjfhopji4wyvza42k0d23jb1mg\1.12.10.100 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero_AG\MediaHub.Main.exe_StrongName_zbk4okbjfhopji4wyvza42k0d23jb1mg\1.10.8.100 folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero_AG\MediaHub.Main.exe_StrongName_zbk4okbjfhopji4wyvza42k0d23jb1mg folder moved successfully.
C:\Users\Home PC\AppData\Local\Nero_AG folder moved successfully.
C:\Users\Home PC\AppData\Local\Ahead\Nero Home\idx folder moved successfully.
C:\Users\Home PC\AppData\Local\Ahead\Nero Home folder moved successfully.
C:\Users\Home PC\AppData\Local\Ahead folder moved successfully.
C:\Users\Home PC\AppData\Local\VirtualStore\Program Files (x86)\Nero\SyncUP\Resources folder moved successfully.
C:\Users\Home PC\AppData\Local\VirtualStore\Program Files (x86)\Nero\SyncUP folder moved successfully.
C:\Users\Home PC\AppData\Local\VirtualStore\Program Files (x86)\Nero folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Nero\Nero 10\OnlineServices folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Nero\Nero 10\MediaStorage folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Nero\Nero 10 folder moved successfully.
C:\Users\Home PC\AppData\Roaming\Nero folder moved successfully.
File/Folder C:\Users\Home PC\AppData\Roaming\Ahead not found.
========== COMMANDS ==========
Restore point Set: OTM Restore Point

OTM by OldTimer - Version 3.1.21.0 log created on 06132013_162459

Files moved on Reboot...
C:\Program Files (x86)\Nero\Update\en-US folder moved successfully.
C:\Program Files (x86)\Nero\Update folder moved successfully.
C:\Program Files (x86)\Nero folder moved successfully.
File C:\ProgramData\Nero\Agent\Repository not found!
Folder move failed. C:\ProgramData\Nero\Agent scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Nero\Agent scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\Nero scheduled to be moved on reboot.
Folder move failed. C:\Users\All Users\Nero\Agent scheduled to be moved on reboot.
Folder move failed. C:\Users\All Users\Nero\Agent scheduled to be moved on reboot.
Folder move failed. C:\Users\All Users\Nero scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore\lib scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore\lib scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore\lib scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero\BDCore scheduled to be moved on reboot.
Folder move failed. C:\Program Files (x86)\Common Files\Nero scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Some good news and some bad news..

First the good news..I havent seen the NERO error message since I ran OTM. So thank you that appears to have resolved this.

The bad news is Itunes will not install. I have tried to resolve myself as it was suggested to uninstall all Apple software and then install Quick time before Installing Itunes.I have attempted this and also attempted to install Itunes first but each time I am getting error messages half way through instillation.they seem to be Administrator error messages.I have typed them belo.Please could you take a look and see if you can suggest a course of action.

Quick Time Error message

The installer has insufficient privleges to modify this file: C:\Program Files (86)\Common files \Apple Application Support\Apple Push Service.DLL

Itunes Error Message : Seems to install ok up to the point where it states "Starting Services"

Service "Apple Mobile Device" (Apple Mobile Device) Failed to Start. verify you have sufficient privleges to start system services.


Just when I think we are getting somewhere something else crops up!!

Thanks
Chris


----------



## superfrog25 (Mar 25, 2011)

Sorry meant to say when it does this you have three options 

Abort - just cancels the download

Retry - Just keeps coming up with the same error 

Ignore - States Instillation complete but when you try to access it states Itunes not installed correctly please re-install Itunes Error 7-Then when you click K you get Error 7 (Windows Error 5)


----------



## superfrog25 (Mar 25, 2011)

Mark,

I was wondering if a purge of Apple info via OTM as you did with Adobe might work with this.Clear all of the old information out and then try a re-instillation.What do you think? If you agree would you type me a text to run through it please?

Chris


----------



## Mark1956 (May 7, 2011)

Lets just first try to deal with this error:

The installer has insufficient privleges to modify this file: C:\Program Files (86)\Common files \Apple Application Support\Apple Push Service.DLL

See if the install will work after deleting the file:

Double click *OTM.exe* to start the tool.


*Copy* the text in the code box below to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose *Copy*):


```
:Processes
explorer.exe
:Files
C:\Program Files (86)\Common files \Apple Application Support
:Reg
:Commands
[createrestorepoint]

[reboot]
```

 Return to OTM, right click in the *"Paste Instructions for Items to be Moved"* window (under the yellow bar) and choose *Paste*.
Click the red *Moveit!* button.
All your desktop icons will disappear as the scan begins. It should complete within a few minutes.
Once complete you may see a box appear asking you to Restart the system to complete the file removal, accept it and it will reboot.
Even if that box does not appear the system should reboot as the command is included in the script.
When the system has come back to the desktop a Notepad document will open, please copy and paste that into your next post.

-- Note: The logs are saved here: C:\_OTM\MovedFiles


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I have complete this. Thank You .Shall I try installing Itunes or shall I install Quick time first?

Chris


----------



## superfrog25 (Mar 25, 2011)

Sorry Mark forgot to post the result.I have 2 notepad entries.Im not sure which one it is or if it is both?

[.ShellClassInfo]
[email protected]%SystemRoot%\system32\shell32.dll,-21799

[.ShellClassInfo]
[email protected]%SystemRoot%\system32\shell32.dll,-21769
IconResource=%SystemRoot%\system32\imageres.dll,-183


----------



## Mark1956 (May 7, 2011)

> [.ShellClassInfo]
> [email protected]%SystemRoot%\system32\shell32.dll,-21799
> 
> [.ShellClassInfo]
> ...


 I have no idea where you got this from, it isn't the OTM log. The log is saved to your C: drive.

I would go ahead and try to install iTunes first.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

I got the same error message as I got when I tried to install Quick Time,only on this icassion Im trying to install Itunes.See below for error message

The installer has insufficient privleges to modify this file: C:\Program Files (86)\Common files \Apple Application Support\Apple Push Service.DLL


----------



## superfrog25 (Mar 25, 2011)

P.S


I think I found the log for OTM

========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder C:\Program Files (86)\Common files \Apple Application Support\Apple Push Service.DLL not found.
========== REGISTRY ==========
========== COMMANDS ==========
Restore point Set: OTM Restore Point

OTM by OldTimer - Version 3.1.21.0 log created on 06132013_200211


----------



## Mark1956 (May 7, 2011)

Ok, lets try taking out the whole folder: Apple Application Support.

I have edited the script in post 174 so just run it again using the edited script.


----------



## superfrog25 (Mar 25, 2011)

I have just got a similar error 

The installer has insufficient privleges to modify this file: C:\Program Files (x86)\Common files \Apple\Apple Application Support\ApplePushService.DLL


----------



## Mark1956 (May 7, 2011)

Did you run OTM again, you haven't posted the log.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

It doesnt seem to come up automatically like it was doing but I have checked and the log from the last OPT is blank.Im going to run it again

Chris


----------



## superfrog25 (Mar 25, 2011)

Hi MArk,

Ran OTM again and the results come up with a blank notepad.I have chjecked one or two of my other programs and there seem to be problems with somw of them.E.G. I have word documents excel documents and power point documents which all open but Word, Power Point and Excel no longer exists in my control Panel.Its like this is a new PC and all my old programs relating to the old PC will work but not properly.Like there is registry entries for the programs allowing them to work but the programs dont exist in the control panel.


Im probably talking nonsense but Im not sure if we need to do the same thing with these as we did with Adobe and purge the PC of old info and re-install?

Chris

Chris


----------



## Mark1956 (May 7, 2011)

We will try a repair with this program. Don't have the time to look back through the thread so we may have used this before.

Download this and save it to the desktop: Windows Repair NOTE: DO NOT use the green buttons at the top of the page as this is dubious software that could infect your system with Adware.

Close your browser and any running programs, double click on the Tweaking icon to run the tool. When the program opens click on the *Step 4* tab. Under System Restore click on *Create* and wait for the confirmation to appear just below the button.

When complete click on the tab *Start Repairs*, click on the *Start* button. Then click on *Unselect All* and tick the boxes next to the following items only.

When done click on the *Start* button and leave it undisturbed until complete.


Reset Registry Permissions
Reset File Permissions
Register System Files
Remove Policies Set By Infections
Repair Missing Start Menu Icons Removed By Infections
Repair Icons
Remove Temp Files
Unhide Non System Files
Set Windows Services To Default Startup
Repair File Associations
Restore Important Windows Services

Let me if that helps.


----------



## superfrog25 (Mar 25, 2011)

Hi Mark

It wouldnt let me install this. Can I do it via a flash drive and run it from there? Please see error message I received

Could not create uninstall shortcut C:\Programs\Tweaking.com.\windows repair (All in one)\ uninstall tweaking.com - windowsrepair (All in one)


----------



## superfrog25 (Mar 25, 2011)

Whenever I try to install now it seems to start the instillation but it doesnt like a particular path or something and will not install the program properly E. G Itunes,the tweaking program.I was also getting an error on my printer software so I uninstalled and that will not re-install properly although it will allow me to print a document!! Its a shame I cant get the tweaking .com program to run as I think it might help.


----------



## Mark1956 (May 7, 2011)

Try running the Repair program in Safe Mode. It seems like some file permissions have been changed so it should fix it if it will run. Unfortunately you can't run it from a Flash Drive as it has to be installed.

If we can't get it to install we will have to have a look at your file permission settings.


----------



## superfrog25 (Mar 25, 2011)

Managed to install the program in safe mode and run it normally so this has been completed.Would you like me to have another go at installing Itunes


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

Definite progress my friend. I have re-installed Itunes successfully. All my Office programs Word,Excel and Powerpoint has also been installed ok.My Printer has also been re-installed successfully.

I initially couldnt install easyshare,however I realised (Too late) that I was installing an older verision. I have installed the new version but when I try to open it I get the message

I still have the pop box asking me what program to use at restart but I believe I can give you some more information on that one. It is asking to open a folder which is "Home" This has all our documents and is actually our Personal folder for our user account.If that helps.


I believe they are the only 2 problems left to resolve.There are some blank white files in the "Home" folder which have numbers and letters but no obvious elements as to what they are.

See below what they state when you hover over these

NTUSER.DAT - Nero showtime.files7.dat
ntuser.dat.log1 - log1 file
ntuser.dat.log2 - log2 file

and various others

Wondering if these are remnants of me trying to install Kodak Strange how one of them has a Nero connection do you think I need to put that back on too?


----------



## Mark1956 (May 7, 2011)

I looked up the error code for the Kodak software and this is all I got: http://support.en.kodak.com/app/answers/detail/a_id/1205/kw/1638x17x3780294368x/selected/true

Looking around the site the software has been discontinued so I have hit a wall with that one.



> I still have the pop box asking me what program to use at restart


 Is that still relating to the Nero file. What is the full text of the pop up.


----------



## superfrog25 (Mar 25, 2011)

No The pop up states it is trying to open our "Home file the Nero message you have already resolved and doesnt appear anymore.

The pop up just has a list of programs in the box.

I will log off and write them down for you

I hit a bit of a wall for Kodak. I got the CORRECT version to install but then it states

Once you update to a later version of easyshare software you cannot open the collection with an earlier version,to download latest version got o WWW.Kodak.com/go/easysharesw

I did this and they dont do a download anymore and dont support it!!

AAAAAHHHHHHH!!!!

Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark

The pop box states

OPEN WITH

File: Home

Then a box with these programs in it

Adobe
Itunes
Notepad
Windows Movie Player
Windows Media Centre
Windows Photo Viewer
Internet Explorer
Kodak Easyshare Software (Ha Ha)
Paint
Windows Live Photo Gallery
Windows Media Player
Wordpad


Then the Options are 
Browse

OK

Cancel

Chris


----------



## superfrog25 (Mar 25, 2011)

Hi Mark,

If it is any help.At some point our Administrator name was changed from "Home PC" to "Home" We seem to have 2 document folders 2 Download folders 2 Libraries 2 My Pictures etc. One folder states C:\Users\HomePC (This is the folder that opens if you click on the documents folder in the start button menu) and the other one when you click on the Home button after clicking the start menu button which is our PC's Personal folder. I sent a test word document to " Documents" and it was placed into BOTH Document folders. Maybe thats why at start up I get the Open with box?

Other than this and my photos which I still have to try and resolve the PC is pretty much back to a good state.If you want to call time on the log I am ok with that and would like to say a big thanks for all your help and any advice you have on maintenance would be appreciated.

I would be happy to make a donation for your chosen charity if this is the case?

Kind Regards
Chris

Chris


----------



## Mark1956 (May 7, 2011)

Your most welcome, but I do like to see things through to the end, I have had some threads with many more posts than this one 

You may have found the cause of the pop up. If the folders are just duplicates of each other try deleting the duplicate folders.

With the Easyshare problem it is still available here: http://www.pcworld.com/product/949419/kodak-easyshare-software.html I found a few reviews on this software claiming that it is buggy and known to cause crashes, may be that is why they have discontinued it.

You could try other software, all depends how deep you need to go with editing. Windows do a fairly basic photo editor called Windows Live Photo Gallery:http://windows.microsoft.com/en-gb/windows-live/photo-gallery#photogallery=overview



> I would be happy to make a donation for your chosen charity if this is the case?


 Thank you very much for that offer, but I don't actually have a charity of choice, you can make a donation to this site which helps to support it. There is a Donate button at the top of the page.


----------



## superfrog25 (Mar 25, 2011)

Great minds think alike!! I have already had a look at windows live photo gallery and believe that sufficient for my needs so I think I will stick with that.My only concern is how to transfer the pictures from the camera to the pc but I think I can figure something out maybe through an SD card or something instead of the USB cable.

I will have a look at the folder situation.

Thanks
Chris


----------



## superfrog25 (Mar 25, 2011)

I am concerned about deleting the Home account information as this is the PC Administrator. Im tempted to leave it as it is as this just means closing the program box on start up. it doesnt appear after that and Im worried by deleting I will do more harm than good!!

I would appreciate any advise on maintaining a healthy and reliable PC though

I will then close the thread as Solved

Please could you let me know who you would like me to make a donation to?

Chris


----------



## superfrog25 (Mar 25, 2011)

Just read the end of your last thread..I will donate to the site...Any advice for me as regards maintenance??


----------



## Mark1956 (May 7, 2011)

Re the camera: http://windows.microsoft.com/en-gb/windows7/how-do-i-get-pictures-from-my-camera-to-my-computer

I quite understand your concern with deleting the folders so probably (as you say) best to leave as is. It is not a problem I have seen before so not an easy one to resolve.

I'll leave you my closing speech for security. If there is anything else you need to know please feel free to post again. You can mark this thread as Solved by clicking on the Thread Tools tab at the top of the page.

=====================================================================

There are many places where you will find security advice, but most are biased towards a particular item of software that they are trying to promote. I have given some unbiased advice below that should help keep you better protected. Unfortunately there is no "best protection", new Malware is being produced every minute of the day so it is a cat & mouse game for all security software vendors to keep up with the latest infections.

It has always been the case that what one Anti Virus program will detect another one will miss and vice versa. That being said, never be tempted to install more than one Anti Virus program thinking that will give you better protection as in fact the reverse is true. Two or more AV programs will (in most cases) conflict with each other, slow your system down and actually reduce your security level. Don't assume that your present Anti Virus is no good on the grounds that you got infected, if I have seen you are using a poor Anti Virus I will have advised you earlier in the thread. There are a lot of nasty infections out there waiting to jump onto a PC and with some of the newest infections there is very little that will block them. Fortunately there are those who dedicate their spare time, for little reward, in making the tools we use here to remove these infections. It is those people that we have to thank as without them a reinstall would often be the only way out.

*Some additional security measures.*
If your present security software does not include a third party Firewall or AntiSpyware.

Go Here for a selection of third party Firewalls.

Go Here or Here for Anti Spyware.

Malwarebytes free version (which you may have used during this thread) is worth having for regular scans of your system, always check for updates before using it. If you can afford the Malwarebytes Pro version it will provide even better protection with a full time active scanner. Never have more than one active anti virus, anti spyware or firewall running on your system as it can cause conflicts and slow down the PC. You can safely run the Pro version of *Malwarebytes* with any Anti Virus software.

WOT (Web OF Trust) Will warn you (in most cases) about dangerous web sites. (This is only available for use with Internet Explorer).

Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Attacks exploiting vulnerable programs and plug-ins are rarely blocked by traditional anti-virus and are therefore increasingly "popular"among criminals.

WinPatrol is a useful facility to have. *WinPatrol* takes snapshots of your critical system resources and alerts you to any changes that may occur without your knowledge. It can also be used to control all your *start up* programs.

Finally, make sure that Windows Update is turned on as many updates are to fix newly discovered security holes in the Windows Operating System. You should also make sure that any Java or Adobe products are kept up to date and any old versions are uninstalled. Never use Registry Cleaners as they can and do damage the systems registry and stay well clear of P2P file sharing sites as these are one of the best places to get your PC infected.


----------



## superfrog25 (Mar 25, 2011)

Thats Fantastic Mark, thanks again for all you help and patience.It is greatly appreciated. I will definitely be making use of your protection advise but rest assured I do keep up to date with windows updates as well as Java and Adobe updates. I am tempted to go back to Mcafee security/anti virus as I think this gives me better protection and looks more comprehensive than the windows version.What are your views on this?


----------



## Mark1956 (May 7, 2011)

You're most welcome.

I am not in a position to state if McAfee is a better product than MSE, but personally I would not judge a product by all the bells and whistles, MSE is a basic no gimmicks Anti Virus that does exactly what it is supposed to do, it is very low on system resources and very easy to disable if the need ever arises. It is the one I use and recommend to people on this site and it is free, obviously the final choice has to be yours. As mentioned above, what one Anti Virus will find another will miss so there really is no 'best Anti Virus' and the most dangerous infections (Rootkits) are rarely detected by any Anti Virus that is available.


----------



## superfrog25 (Mar 25, 2011)

Ok thank you.I will have a think about that one

You have been brilliant and I cant thank you enough

Im already installing some of the items you have recommended for protection

Thanks again and all the best

I will make a donation after I am done installing


----------



## Mark1956 (May 7, 2011)

All the best, it has been a pleasure helping you


----------

