# laptop slow and freezing



## ste08ball (Apr 12, 2013)

my laptop is windows 7 and is very slow and also freezers we have tried a system clean and defrag but its not helped at all i have also got rid of a lot of files and am running at 2gb with 2gb free space iam so confused and would love some advice on what to do next thank you


----------



## flavallee (May 12, 2002)

Download and save the

*TSG System Information Utility* (SysInfo.exe)

After it's been downloaded and saved, double-click it to run it.

Information about your computer will appear.

Return here to your thread, then copy-and-paste the entire text here.

-------------------------------------------------------


----------



## ste08ball (Apr 12, 2013)

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows 7 Home Premium, Service Pack 1, 64 bit
Processor: Intel(R) Pentium(R) CPU P6200 @ 2.13GHz, Intel64 Family 6 Model 37 Stepping 5
Processor Count: 2
RAM: 3892 Mb
Graphics Card: Intel(R) Graphics Media Accelerator HD, 1722 Mb
Hard Drives: C: Total - 474889 MB, Free - 312753 MB;
Motherboard: FUJITSU, FJNBB06
Antivirus: AVG Anti-Virus 2013, Updated and Enabled


----------



## ste08ball (Apr 12, 2013)

that avg is useless i hope that helps to find a solution


----------



## flavallee (May 12, 2002)

According to your computer's hardware specs:

It has *4 GB(4096 MB)* of RAM.

The capacity of the hard drive is *463.75 GB* and has *305.42 GB* of free space.

I'm completely confused by this comment:



> i have also got rid of a lot of files and am running at 2gb with 2gb free space


-----------------------------------------------------------


----------



## ste08ball (Apr 12, 2013)

i had alot of films on my comp and thought it was a memory issue so deleated most of them maybe 100 films or so including tv series iam a complete beginer so excuse me if i confuse you lol


----------



## flavallee (May 12, 2002)

> i had alot of films on my comp and thought it was a memory issue so deleated most of them maybe 100 films or so including tv series


The amount of *memory* in a computer is the amount of RAM it has.

Memory has nothing to do with the capacity of the hard drive.

Deleting personal data and reclaiming more free space in the hard drive will not give the computer more *memory*.

-----------------------------------------------------------

If your laptop is running slow and is freezing, you need to be more detailed and specific about the problem so we can determine how to help you.

-----------------------------------------------------------


----------



## ste08ball (Apr 12, 2013)

ok so i press the button to go on internet explorer and it can take about half a minute to load when before it would react in a second our internet connection says excellent so dont think that is a issue and also i go on pkr poker and am playing a game i press the button to call and the timer continues to go down and finally kicks in and calls for me the graphics seem to be slow and not fluent its like having a old comp from the 90s weve only had this a year and with the freezing when i leave the comp unattended and wait for the screensaver to activate it freezers nothing works or have more then three windows open its like it candle handle all the information iam giving to it


----------



## ste08ball (Apr 12, 2013)

i downloaded healthboost and it says that i also have 8dll errors there are no viruses to my knowledge do you know any free programs that would help you determine a problem that i can run thank you so much for this


----------



## flavallee (May 12, 2002)

Download and save and then install the free version of

*Malwarebytes Anti-Malware 1.75.0.1300*

*SUPERAntiSpyware 5.6.0.1014*

Make sure to update their definition files during the install process.

Make sure to uncheck and decline to install any extras, such as toolbars and homepages, they may offer.

Make sure to uncheck and decline to use the "Pro" or "Trial" version, if it's offered.

After they're installed and updated, restart the computer.

Run a QUICK scan with each of them.

When each scan is finished, select and remove EVERYTHING they found.

Restart the computer, if prompted to, so the removal process can finish.

Note: DON'T use the computer while each scan is in progress.

-------------------------------------------------------


----------



## flavallee (May 12, 2002)

After the instructions in my last reply have been done, do the following:

Click Start, then type in

*%temp%* (% is the percentage symbol on the number 5 key)

in the search box, then click OK.

Once that temp folder appears and you can view its contents, select and delete EVERYTHING that's inside it.

If a few files resist being deleted, that's normal behavior. Leave them alone and delete EVERYTHING else.

If a massive number of files are being deleted, the computer may appear to "hang". Be patient and wait for the deletion process to finish.

After it's done, restart the computer.

------------------------------------------------------------


----------



## flavallee (May 12, 2002)

> i downloaded healthboost and it says that i also have 8dll errors there are no viruses to my knowledge do you know any free programs that would help you determine a problem that i can run


I strongly advise you to stay away from cleaner/booster/optimizer/tuneup type programs that claim to clean/fix your computer and make it run faster.

They can damage the Windows operating system and make certain programs stop working and generate error/warning messages and wreak havoc with your computer.

----------------------------------------------------------


----------



## flavallee (May 12, 2002)

I'm getting ready to turn off my computer for the rest of the day, so I'll check back here in the morning to see how far you've progressed.

I have a feeling you need some "hands on" help by a computer-knowledgeable person.

----------------------------------------------------------


----------



## Macboatmaster (Jan 15, 2010)

If you wish and my good colleague Flavallee is OK with it
I will be online for sometime and will assist you, when you respond


----------



## ste08ball (Apr 12, 2013)

hello there just ran a detailed scan with both programs and the 1st super spy wear found 1adware install mate 1 pup.cnetinstaller and 7 adware.tracking cookies i removed and comp restarted the 2nd malware.bytes found 6 pup playbryte 1 pup gameplay 4 trojan.h 8pupwxdfast and 1 pupfunmoods i clicked all even though it was just the trojans clicked and deleted all it then began to restart but froze windows then did a repair thing and restarted again and now iam here so


----------



## ste08ball (Apr 12, 2013)

hi there ive just done the next step you have told me to whilst trying to delete some files it has told me that i need to seek administrative permission even tho i am the administator and there are no other accounts on my computer


----------



## flavallee (May 12, 2002)

Macboatmaster:

Feel free to jump in, as you may have some suggestions and advice that I'm not aware of.

----------------------------------------------------------



> whilst trying to delete some files it has told me that i need to seek administrative permission


ste08ball:

I forewarned you that a few of those temp files might resist being deleted.

-----------------------------------------------------------


----------



## Macboatmaster (Jan 15, 2010)

Flavallee

from scan


> trojan.h


would not know how to progress, except for refer.

No chance of me having


> you may have some suggestions and advice that I'm not aware of.


just offered to continue as you were going offline.


----------



## flavallee (May 12, 2002)

Start Malwarebytes Anti-Malware.

Click "Logs"(tab).

Highlight the scan log entry, then click "Open".

When the scan log appears in Notepad, copy-and-paste it here.

---------------------------------------------------------

Start SUPERAntiSpyware.

Click "View Scan Logs".

Highlight the scan log entry, then click "View Selected Log".

When the scan log appears in Notepad, copy-and-paste it here.

---------------------------------------------------------


----------



## flavallee (May 12, 2002)

Go here and click the green "Download latest version" link to download and save *HiJackThis 2.0.4*

After it's been downloaded and saved, close all open windows first, then double-click it to install it.

Allow it to install in its default location - C:\Program Files.

After it's been installed, start it and allow its main window to load.

Uncheck "Do not show this window when I start HiJackThis".

Click "Do a system scan and save a log file".

When the scan is finished in 30 - 60 seconds, a log file will appear.

Save that log file.

Return here to your thread, then copy-and-paste the ENTIRE log file here.

-----------------------------------------------------------

Note: HiJackThis doesn't work properly with Windows 64-bit, but it still may show some obvious issues.

-----------------------------------------------------------


----------



## ste08ball (Apr 12, 2013)

the speed has increased greatly but the freezing is still a issue ive deleted cleaner systems boosts and everything you said to avoid I also need help finding a virus protection programme free until I can purchase one.


----------



## flavallee (May 12, 2002)

Complete the instructions in post #20.

---------------------------------------------------------


----------



## ste08ball (Apr 12, 2013)

I have not got the spywear on my comp anymore I believe it was deleted by accident when deleating health boosts and so on


----------



## ste08ball (Apr 12, 2013)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:50:19, on 13/04/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16537)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe
C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe
C:\Program Files (x86)\Virgin Media\Service Manager\ServiceManager.exe
C:\Program Files (x86)\Virgin Media\Digital Home Support\DHSClient.exe
C:\Program Files (x86)\Virgin Media\Virgin Media Security\10.0.38.58308\Rps.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - {3bbd3c14-4c16-4989-8366-95bc9179779d} - (no file)
R3 - URLSearchHook: (no name) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll
O2 - BHO: PlayBryte BHO - {61e0ef7a-9bc0-45ea-9b2f-f3e9f02692bd} - mscoree.dll (file missing)
O2 - BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\SRTOOL~1\Datamngr\BROWSE~1.DLL
O2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O2 - BHO: Search-Results Toolbar - {fa966923-4278-4558-b29c-8145edf5aaa9} - C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~1\searchresultsDx.dll
O3 - Toolbar: Virgin Media Toolbar - {AD8AD957-B30E-4842-8253-BFBC5F7440F3} - C:\Program Files (x86)\virgintoolbar\virgintoolbarDx.dll (file missing)
O3 - Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - (no file)
O3 - Toolbar: (no name) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - (no file)
O3 - Toolbar: (no name) - {b278d9f8-0fa9-465e-9938-0c392605d8e3} - (no file)
O3 - Toolbar: Search-Results Toolbar - {fa966923-4278-4558-b29c-8145edf5aaa9} - C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~1\searchresultsDx.dll
O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe
O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\3.0"
O4 - HKLM\..\Run: [DeskUpdateNotifier] "c:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe"
O4 - HKLM\..\Run: [ServiceManager.exe] "C:\Program Files (x86)\Virgin Media\Service Manager\ServiceManager.exe" /AUTORUN
O4 - HKLM\..\Run: [Virgin Media Security] "C:\Program Files (x86)\Virgin Media\Virgin Media Security\10.0.38.58308\RPS.exe" -set Silent "1" SplashURL "" 
O4 - HKLM\..\Run: [DHSClient.exe] "C:\Program Files (x86)\Virgin Media\Digital Home Support\DHSClient.exe" /AUTORUN
O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~2\SRTOOL~1\Datamngr\DATAMN~1.EXE
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe"
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll
O18 - Protocol: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\PROGRA~3\Wincert\WIN32C~1.DLL C:\PROGRA~2\SRTOOL~1\Datamngr\datamngr.dll C:\PROGRA~2\SRTOOL~1\Datamngr\IEBHO.dll c:\progra~2\sprote~1\sprote~1.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Trend Micro Solution Platform (Amsp) - Trend Micro Inc. - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\SysWOW64\CTsvcCDA.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: HsdService - Virgin Media - C:\Program Files (x86)\Virgin Media\Digital Home Support\HsdService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PFNService - FUJITSU LIMITED - C:\Program Files\Fujitsu\Plugfree NETWORK\PFNService.exe
O23 - Service: PowerSavingUtilityService - FUJITSU LIMITED - C:\Program Files\Fujitsu\PSUtility\PSUService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Virgin Media Security (Radialpoint Security Services) - Virgin Media - C:\Program Files (x86)\Virgin Media\Virgin Media Security\10.0.38.58308\RpsSecurityAwareR.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServicepointService - Radialpoint SafeCare Inc. - C:\Program Files (x86)\Virgin Media\Service Manager\ServicepointService.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: AVG PC TuneUp Service (TuneUp.UtilitiesSvc) - AVG - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: Bluetooth Feature Support (VFPRadioSupportService) - CSR, plc - C:\Program Files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 10503 bytes


----------



## flavallee (May 12, 2002)

Start HiJackThis, then click "Do a system scan only".

When the scan is finished in about 30 - 60 seconds, put a checkmark in these log entries:

*R3 - URLSearchHook: (no name) - {3bbd3c14-4c16-4989-8366-95bc9179779d} - (no file)

R3 - URLSearchHook: (no name) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - (no file)

O2 - BHO: PlayBryte BHO - {61e0ef7a-9bc0-45ea-9b2f-f3e9f02692bd} - mscoree.dll (file missing)

O2 - BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\SRTOOL~1\Datamngr\BROWSE~1.DLL

O2 - BHO: Search-Results Toolbar - {fa966923-4278-4558-b29c-8145edf5aaa9} - C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~1\searchresultsDx.dll

O3 - Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - (no file)

O3 - Toolbar: (no name) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - (no file)

O3 - Toolbar: (no name) - {b278d9f8-0fa9-465e-9938-0c392605d8e3} - (no file)

O3 - Toolbar: Search-Results Toolbar - {fa966923-4278-4558-b29c-8145edf5aaa9} - C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~1\searchresultsDx.dll

O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~2\SRTOOL~1\Datamngr\DATAMN~1.EXE

O20 - AppInit_DLLs: C:\PROGRA~3\Wincert\WIN32C~1.DLL C:\PROGRA~2\SRTOOL~1\Datamngr\datamngr.dll C:\PROGRA~2\SRTOOL~1\Datamngr\IEBHO.dll c:\progra~2\sprote~1\sprote~1.dll*

After you confirm that you selected the correct log entries, click "Fix Checked - Yes".

Close HiJackThis, then restart the computer.

----------------------------------------------------

Wait for the computer to settle down from the restart.

Start HiJackThis again, then click "Do a system scan and save a log file".

Save the new log that appears.

Copy-and-paste the entire log here.

----------------------------------------------------


----------



## ste08ball (Apr 12, 2013)

just one what you said and i tried to restart but it froze i tried 5 times to get back on eventually it went back to windows start up repair i need to download the program again and try again


----------



## flavallee (May 12, 2002)

You're having too many issues with that laptop.

Unless you can get some reliable "hands on" help to resolve the issues, doing a clean reinstall of Windows 7 SP1(64-bit) and getting a fresh start with it is probably your best option. 

---------------------------------------------------------

I've got some things to do, so I'll be shutting down for the rest of the day.

---------------------------------------------------------


----------



## Mark1956 (May 7, 2011)

> I also need help finding a virus protection programme free until I can purchase one.


Not sure why you have made the above comment or has your subscription expired for Trend Micro Titanium which appears to be on your system.

If you want to replace it follow this guide to remove it: 
Trend Micro Titanium removal: Trend Micro Titanium uninstall and then install 
Microsoft Security Essentials which is all you should require in an Anti Virus and is free for life.

There are some issues on your system which may or may not be Malware related, but one thing you should do is follow this as it may be connected:

There has been an alert about a recent Windows Update that is causing problems on some systems.

Click on Start, Control Panel, Programs & Features. Click on View Installed Updates in the left hand pane.
Then type KB2823324 into the search box (top right hand corner) wait to see if the update appears in the main window.

If it finds the update click on it to highlight it and then click on Uninstall.
Select Reboot when prompted.

If you cannot find the update or its removal does not improve anything them please run these scans and post all the logs:

If you cannot get a scan to run then please tell me and move on to the next one.

Please download RKill 
There are three buttons to choose from with different names on, select the first one and save it to your desktop.


Double-click on the *Rkill* desktop icon to run the tool.
If using Vista or Windows 7, right-click on it and *Run As Administrator*.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
A log pops up at the end of the run. This log file is located at *C:\rkill.log*. Please post this in your next reply.
If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time.
If the tool does not run from any of the links provided, please let me know.

*DO NOT* reboot, run *Malwarebytes*, let it update and run a *full* scan. If it finds anything, fix it and post the resulting log. If it finds nothing, post that log instead.

RKill will reset .exe .com & .bat file associations.

You can download Malwarebytes from here if you do not have it: Malwarebytes

============================================================

Please go Here and follow the instructions to run DDS, then *Copy and Paste* both the logs into your next reply. You need not run HJT or GMER.

============================================================

Please run these two scans and post the logs:

*SCAN 1*
Click on this link to download : ADWCleaner and save it to your desktop.

*NOTE:* If using Internet Explorer and you get an alert that stops the program downloading click on *Tools > Smartscreen Filter > Turn off Smartscreen Filter* then click on *OK* in the box that opens. Then click on the link again.

Close your browser and click on this icon on your desktop:









You will then see the screen below, click on the *Delete* button (as indicated), accept any prompts that appear and allow it to reboot the PC. When the PC has rebooted you will be presented with the report, copy & paste it into your next post. If the log does not appear you should find it on your C: drive using Windows Explorer as ADWCleaner[S1].










*SCAN 2*
Download RogueKiller (by tigzy) and save direct to your Desktop.
On the web page select the 32bit or 64bit button to match the bit rate of your version of Windows.


Quit all running programs.
Start RogueKiller.exe by double clicking on the icon.
Wait until Prescan has finished.
Ensure all boxes are ticked under "Report" tab.
Click on Scan.
Click on Report when complete. Copy/paste the contents of the report and paste into your next reply.
NOTE: *DO NOT attempt to remove anything that the scan detects.*


----------



## ste08ball (Apr 12, 2013)

I FOUND THAT VIRUS u told me about and uninstalled it and rebooted when the screen came up a small box showed up saying error with a aplication not installed right. i believe some files are missing or incomplete


----------



## Mark1956 (May 7, 2011)

What virus are you talking about?

Please complete all my instructions and post the logs requested.


----------



## ste08ball (Apr 12, 2013)

Rkill 2.4.7 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 04/14/2013 01:24:46 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* C:\Windows\SysWOW64\CTsvcCDA.exe (PID: 1896) [WD-HEUR]
1 proccess terminated!
Checking Registry for malware related settings:
* Explorer Policy Removed: NoActiveDesktopChanges [HKLM]
Backup Registry file created at:
C:\Users\Michaella\Desktop\rkill\rkill-04-14-2013-01-24-51.reg
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* Windows Defender Disabled
[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001
Checking Windows Service Integrity: 
* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual
Searching for Missing Digital Signatures: 
* No issues found.
Checking HOSTS File: 
* No issues found.
Program finished at: 04/14/2013 01:25:11 PM
Execution time: 0 hours(s), 0 minute(s), and 24 seconds(s)


----------



## ste08ball (Apr 12, 2013)

if lets say i wanted to preform a restore factory settings how would i go about that and would that be a solution to my problem


----------



## ste08ball (Apr 12, 2013)

would you be able to help me with that post frank?


----------



## flavallee (May 12, 2002)

You ran into a problem after completing my instructions in post #25, so *Mark1956* has jumped in to help you with some tools that I'm not trained and authorized to use here because I'm not a gold shield removal specialist. 
You need to be patient and wait for him to reply. 
We're all unpaid volunteers here and have our own lives and don't spend 24/7 monitoring these forums.

As I already said, a clean reinstall of Windows and getting a fresh start is probably your best option.

-----------------------------------------------------------


----------



## ste08ball (Apr 12, 2013)

i understand that i just wanted some information on restoring my computer to the day i got it if what marks ideas dont work if that would work then i would do as i have savedmy files on discs it was just some info on it pros and cons as a mate said that might be a gd idea.


----------



## ste08ball (Apr 12, 2013)

ive found a 25 digit word code on back of my computer was wanting to know if that was all i needed to succesfully do the process and as you helped me so greatly at the start i thought i would ask you as i value your opinions and knowledge


----------



## flavallee (May 12, 2002)

What's the model name and complete model number of that Fujitsu laptop?

Did it come with a set of reinstall disks or does it have a built-in recovery partition to revert it back to its original factory condition?

-----------------------------------------------------------

The 25-character code you see is in 5-character sets separated by dashes.

That's the product key to activate the version of Windows in your laptop. 

-----------------------------------------------------------

What country are you in?

-----------------------------------------------------------


----------



## ste08ball (Apr 12, 2013)

it is a fujitsu lifebook a series model number ah530 and it did not come with any discs not sure if its built in


----------



## ste08ball (Apr 12, 2013)

united kingdom (england


----------



## flavallee (May 12, 2002)

ste08ball said:


> it is a *fujitsu lifebook* a series model number *ah530* and it did not come with any discs not sure if its built in


This is the on-line "Getting Started" manual for the *Fujitsu Lifebook AH530* laptop.

Page 4 of 12 states that laptop does not come with a set of recovery discs. It advises you to use the laptop's "MyRecovery" app to create them. Did you do that?

----------------------------------------------------------

Here is the United Kingdom support site.

-----------------------------------------------------------


----------



## Mark1956 (May 7, 2011)

If you wish to do a Factory Recovery then that is your choice, but if you wish to continue with trying to clean up the system and rectify any file damage then you need to complete *all* my instructions, answer all questions asked and confirm you have done everything requested or the progress will be very slow.

I am sure Flavallee will give you all the information needed to restore the system but you should find all that information in your owners manual.

Please take note that if the issues with your system are not Malware or software related you might have a hardware issue which will not be rectified by doing a Factory Recovery, so it would be wise to try and find out what the cause of the issues are before making your decision to run the Recovery.


----------



## ste08ball (Apr 12, 2013)

thats fantastic frank thank you so much for your help ill wait till mark gets back see if he has any ideas if not ill progress with that


----------



## Mark1956 (May 7, 2011)

As I said in my post above I need you to respond fully to my earlier post. I can't give a judgement on your systems condition until you follow the instructions I gave.


----------



## flavallee (May 12, 2002)

Mark:

I'm not trying to convince her to do a system recovery. She inquired about that option in post #35, so I responded. I don't want to step on any toes here, so I'll leave it with you from here on.

-----------------------------------------------------------


----------



## Mark1956 (May 7, 2011)

I thought you mentioned it first in post 27:


> You're having too many issues with that laptop.
> 
> Unless you can get some reliable "hands on" help to resolve the issues, doing a clean reinstall of Windows 7 SP1(64-bit) and getting a fresh start with it is probably your best option.


There are no toes being trodden on, your input is always welcome. All I am trying to do is get a positive response from the OP so we know where we are going.

Ste08ball, could you please tell us how you wish to proceed.


----------



## flavallee (May 12, 2002)

> I thought you mentioned it first in post 27


Yep, you're right. I did previously make that suggestion.

--------------------------------------------------------------


----------



## ste08ball (Apr 12, 2013)

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org
Database version: v2013.04.04.07
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Michaella :: WILSON [administrator]
Protection: Enabled
14/04/2013 13:32:26
mbam-log-2013-04-14 (13-32-26).txt
Scan type: Full scan (C:\|F:\|Q:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 379783
Time elapsed: 1 hour(s), 51 minute(s), 33 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 8
HKCR\CLSID\{61e0ef7a-9bc0-45ea-9b2f-f3e9f02692bd} (PUP.PlayBryte) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{61E0EF7A-9BC0-45EA-9B2F-F3E9F02692BD} (PUP.PlayBryte) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{61E0EF7A-9BC0-45EA-9B2F-F3E9F02692BD} (PUP.PlayBryte) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{61e0ef7a-9bc0-45ea-9b2f-f3e9f02692bd} (PUP.PlayBryte) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GBoxUpdater (Trojan.Dropper.H) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OptimizerProUpdater (Trojan.Dropper.H) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki (PUP.Funmoods) -> Quarantined and deleted successfully.
Registry Values Detected: 2
HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow|playbryte.com (PUP.PlayBryte) -> Data: -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform|playbrytetoolbar_Playbryte (PUP.PlayBryte) -> Data: -> Quarantined and deleted successfully.
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 2
C:\ProgramData\GboxUpdater\updater.exe (Trojan.Dropper.H) -> Quarantined and deleted successfully.
C:\ProgramData\OptimizerPro\updater.exe (Trojan.Dropper.H) -> Quarantined and deleted successfully.
(end)


----------



## ste08ball (Apr 12, 2013)

DDS (Ver_2012-11-20.01) - NTFS_AMD64 
Internet Explorer: 9.0.8112.16476
Run by Michaella at 17:45:29 on 2013-04-14
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.3893.1626 [GMT 1:00]
.
AV: AVG Anti-Virus 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Virgin Media Security *Enabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}
AV: Norton 360 *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Virgin Media Security *Enabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AVG Anti-Virus 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton 360 *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
FW: Trend Micro Firewall Booster *Enabled* {50C2E989-60CF-0845-AFD3-290B7D301E79}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\SysWOW64\CTsvcCDA.exe
C:\Program Files (x86)\FixBee\FBDefragSrv64.exe
C:\Program Files (x86)\Virgin Media\Digital Home Support\HsdService.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe
C:\Program Files\Fujitsu\Plugfree NETWORK\PFNService.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Fujitsu\PSUtility\PSUService.exe
C:\Program Files (x86)\Virgin Media\Virgin Media Security\10.0.38.58308\RpsSecurityAwareR.exe
C:\Program Files (x86)\Virgin Media\Service Manager\ServicepointService.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
C:\Program Files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Fujitsu\PSUtility\TrayManager.exe
C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe
C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe
C:\Program Files\CSR\Bluetooth Feature Pack 5.0\CSRBipPushResponder.exe
C:\Program Files\VirginMedia\V Stuff Backup\Backup & Storage.exe
C:\Users\Michaella\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe
C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe
C:\Program Files (x86)\Virgin Media\Service Manager\ServiceManager.exe
C:\Program Files (x86)\Virgin Media\Digital Home Support\DHSClient.exe
C:\Program Files (x86)\SRToolbar\Datamngr\datamngrUI.exe
C:\Program Files\Fujitsu\Plugfree NETWORK\PFNetDm.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe
C:\Program Files\Fujitsu\Plugfree NETWORK\PFNTray.EXE
C:\Program Files\Fujitsu\Application Panel\BtnHndHkb.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files (x86)\PKR\pokerapp.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.co.uk/
uSearch Bar = Preserve
uURLSearchHooks: {3bbd3c14-4c16-4989-8366-95bc9179779d} - <orphaned>
uURLSearchHooks: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - <orphaned>
mWinlogon: Userinit = userinit.exe,
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: TmIEPlugInBHO Class: {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll
BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\coieplg.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\ips\ipsbho.dll
BHO: DataMngr: {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\SRToolbar\Datamngr\BrowserConnection.dll
BHO: TmBpIeBHO Class: {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
BHO: Search-Results Toolbar: {fa966923-4278-4558-b29c-8145edf5aaa9} - C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\searchresultsDx.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\coieplg.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\coieplg.dll
TB: Virgin Media Toolbar: {AD8AD957-B30E-4842-8253-BFBC5F7440F3} - 
TB: Search-Results Toolbar: {fa966923-4278-4558-b29c-8145edf5aaa9} - C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\searchresultsDx.dll
uRun: [Spotify Web Helper] "C:\Users\Michaella\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
uRun: [CTSyncU.exe] "C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe"
mRun: [LoadFUJ02E3] C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe
mRun: [IndicatorUtility] C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
mRun: [UCam_Menu] "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\3.0"
mRun: [DeskUpdateNotifier] "c:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe"
mRun: [ServiceManager.exe] "C:\Program Files (x86)\Virgin Media\Service Manager\ServiceManager.exe" /AUTORUN
mRun: [Virgin Media Security] "C:\Program Files (x86)\Virgin Media\Virgin Media Security\10.0.38.58308\RPS.exe" -set Silent "1" SplashURL "" 
mRun: [DHSClient.exe] "C:\Program Files (x86)\Virgin Media\Digital Home Support\DHSClient.exe" /AUTORUN
mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
mRun: [DATAMNGR] C:\PROGRA~2\SRTOOL~1\Datamngr\DATAMN~1.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
TCP: NameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{BB46C47B-4835-48B9-8018-6A5BADCDB9B5} : DHCPNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{FD5BED68-72EB-4E0A-8CFF-F86355BE6E5D} : DHCPNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{FD5BED68-72EB-4E0A-8CFF-F86355BE6E5D}\15740313 : DHCPNameServer = 158.43.128.1 208.67.222.222 208.67.220.220
TCP: Interfaces\{FD5BED68-72EB-4E0A-8CFF-F86355BE6E5D}\244575966496 : DHCPNameServer = 10.80.64.57 192.168.22.22 192.168.22.23
TCP: Interfaces\{FD5BED68-72EB-4E0A-8CFF-F86355BE6E5D}\2445F40756E6A7F6E656D284 : DHCPNameServer = 10.80.64.57 192.168.22.22 192.168.22.23
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
AppInit_DLLs= C:\PROGRA~3\Wincert\WIN32C~1.DLL C:\PROGRA~2\SRTOOL~1\Datamngr\datamngr.dll C:\PROGRA~2\SRTOOL~1\Datamngr\IEBHO.dll c:\progra~2\sprote~1\sprote~1.dll
SSODL: WebCheck - <orphaned>
x64-BHO: TmIEPlugInBHO Class: {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg.dll
x64-BHO: DataMngr: {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\SRToolbar\Datamngr\x64\BrowserConnection.dll
x64-BHO: TmBpIeBHO Class: {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\6.6.1010\6.6.1010\TmBpIe64.dll
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [PfNet] "C:\Program Files\Fujitsu\Plugfree NETWORK\PfNet.exe" /r
x64-Run: [PSUTility] C:\Program Files\Fujitsu\PSUtility\TrayManager.exe
x64-Run: [FDM7] C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe
x64-Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
x64-Run: [LoadBtnHnd] C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe
x64-Run: [CSRBIP] C:\Program Files\CSR\Bluetooth Feature Pack 5.0\CSRBipPushResponder.exe
x64-Run: [Backup & Storage] "C:\Program Files\VirginMedia\V Stuff Backup\Backup & Storage.exe"
x64-Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\6.6.1010\6.6.1010\TmBpIe64.dll
x64-Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg.dll
x64-Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - Search Results
FF - prefs.js: browser.startup.homepage - hxxp://www.searchnu.com/408
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=105&systemid=408&apn_dtid=BND408&apn_ptnrs=AGF&apn_uid=5143249915454200&o=APN10654&q=
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll
FF - plugin: C:\Program Files (x86)\Virgin Media\Service Manager\nprpspa.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
FF - ExtSQL: 2013-04-06 14:47; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
.
---- FIREFOX POLICIES ----
FF - user.js: extensions.funmoods_i.newTab - false
FF - user.js: extensions.funmoods_i.tlbrSrchUrl - hxxp://start.funmoods.com/results.php?f=3&a=axl&q=
FF - user.js: extensions.funmoods_i.id - 980e72c30000000000007ae9d3028cc7
FF - user.js: extensions.funmoods_i.instlDay - 15467
FF - user.js: extensions.funmoods_i.vrsn - 1.5.11.16
FF - user.js: extensions.funmoods_i.vrsni - 1.5.11.16
FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.11.1614:06:26
FF - user.js: extensions.funmoods_i.prtnrId - funmoods
FF - user.js: extensions.funmoods_i.prdct - funmoods
FF - user.js: extensions.funmoods_i.aflt - axl
FF - user.js: extensions.funmoods_i.smplGrp - none
FF - user.js: extensions.funmoods_i.tlbrId - base
FF - user.js: extensions.funmoods_i.instlRef - 
FF - user.js: extensions.funmoods_i.dfltLng - 
FF - user.js: extensions.funmoods_i.excTlbr - false
.
FF - user.js: extensions.autoDisableScopes - 14
.
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2012-10-15 63328]
R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2012-9-21 225120]
R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2012-11-15 111968]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2012-9-14 40800]
R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2012-10-22 154464]
R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2012-9-21 200032]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20130410.001\IDSviA64.sys [2013-4-11 513184]
R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;C:\Windows\System32\drivers\fuj02e3.sys [2012-4-5 7296]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2011-5-5 56344]
R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2012-4-5 151936]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2012-4-5 244736]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-4-14 25928]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-4-5 346144]
S1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2012-10-2 185696]
S1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20130322.001\BHDrvx64.sys [2013-3-22 1387608]
S1 ccSet_N360;Norton 360 Settings Manager;C:\Windows\System32\drivers\N360x64\0604010.00E\ccsetx64.sys [2013-4-5 167072]
S3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;C:\Windows\System32\drivers\BVRPMPR5a64.SYS [2012-4-19 35840]
.
=============== File Associations ===============
.
FileExt: .txt: Applications\msreader.exe - HKCR\Unknown\Shell=C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,OpenAs_RunDLL %1 [UserChoice] [default=openas]
.
=============== Created Last 30 ================
.
2013-04-14 12:30:28 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2013-04-13 16:12:37 -------- d-----w- C:\Program Files (x86)\Trend Micro
2013-04-13 12:33:58 -------- d-----w- C:\Users\Michaella\AppData\Roaming\BullGuard
2013-04-13 12:33:57 -------- d-----w- C:\ProgramData\BullGuard
2013-04-13 11:42:44 -------- d-----w- C:\Users\Michaella\AppData\Local\Avg2013
2013-04-12 20:37:01 -------- d-----w- C:\Users\Michaella\AppData\Roaming\SUPERAntiSpyware.com
2013-04-12 20:35:52 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2013-04-12 20:35:52 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2013-04-12 20:31:20 -------- d-----w- C:\Users\Michaella\AppData\Roaming\Malwarebytes
2013-04-12 20:30:35 -------- d-----w- C:\ProgramData\Malwarebytes
2013-04-12 20:30:31 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-04-12 20:29:39 -------- d-----w- C:\Users\Michaella\AppData\Local\Programs
2013-04-12 20:00:23 -------- d-----w- C:\Program Files (x86)\PC HealthBoost
2013-04-12 19:59:44 -------- d-----w- C:\ProgramData\PCHealthBoost
2013-04-11 17:09:24 35192 ----a-w- C:\Windows\System32\TURegOpt.exe
2013-04-11 17:09:20 26488 ----a-w- C:\Windows\System32\authuitu.dll
2013-04-11 17:09:19 21880 ----a-w- C:\Windows\SysWow64\authuitu.dll
2013-04-11 15:27:06 -------- d-----w- C:\Program Files (x86)\MSECache
2013-04-11 15:08:59 -------- d-----w- C:\Users\Michaella\AppData\Roaming\ParetoLogic
2013-04-11 15:08:59 -------- d-----w- C:\Users\Michaella\AppData\Roaming\DriverCure
2013-04-11 15:08:28 -------- d-----w- C:\Program Files (x86)\Common Files\ParetoLogic
2013-04-11 15:08:15 -------- d-----w- C:\ProgramData\ParetoLogic
2013-04-11 15:08:15 -------- d-----w- C:\Program Files (x86)\ParetoLogic
2013-04-11 01:44:23 -------- d-----w- C:\ProgramData\Browser Manager
2013-04-10 23:00:30 -------- d-----w- C:\ProgramData\Wincert
2013-04-10 22:59:57 -------- d-----w- C:\Users\Michaella\AppData\Roaming\FixBee
2013-04-10 22:59:57 -------- d-----w- C:\ProgramData\FixBee
2013-04-10 22:58:50 -------- d-----w- C:\Program Files (x86)\SRToolbar
2013-04-10 22:58:10 -------- d-----w- C:\Program Files (x86)\FixBee
2013-04-10 16:12:01 -------- d-----w- C:\Program Files (x86)\PKR
2013-04-10 07:34:32 3717632 ----a-w- C:\Windows\System32\mstscax.dll
2013-04-10 07:34:30 3217408 ----a-w- C:\Windows\SysWow64\mstscax.dll
2013-04-10 07:34:27 131584 ----a-w- C:\Windows\SysWow64\aaclient.dll
2013-04-10 07:34:26 44032 ----a-w- C:\Windows\System32\tsgqec.dll
2013-04-10 07:34:26 158720 ----a-w- C:\Windows\System32\aaclient.dll
2013-04-10 07:34:25 36864 ----a-w- C:\Windows\SysWow64\tsgqec.dll
2013-04-10 07:33:54 3153408 ----a-w- C:\Windows\System32\win32k.sys
2013-04-10 07:33:50 223752 ----a-w- C:\Windows\System32\drivers\fvevol.sys
2013-04-10 07:33:46 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe
2013-04-10 07:33:43 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2013-04-10 07:33:42 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2013-04-10 07:33:41 43520 ----a-w- C:\Windows\System32\csrsrv.dll
2013-04-10 07:33:41 112640 ----a-w- C:\Windows\System32\smss.exe
2013-04-10 07:33:40 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll
2013-04-06 14:29:05 -------- d-----w- C:\Users\Michaella\AppData\Roaming\AVG
2013-04-06 14:26:36 -------- d-----w- C:\ProgramData\AVG
2013-04-06 14:26:24 -------- d-sh--w- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2013-04-05 20:58:44 -------- d-----w- C:\Program Files\CCleaner
2013-04-05 20:04:09 710992 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2013-04-05 19:12:37 46080 ----a-w- C:\Windows\System32\atmlib.dll
2013-04-05 19:12:37 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2013-04-05 19:12:34 367616 ----a-w- C:\Windows\System32\atmfd.dll
2013-04-05 19:12:33 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll
2013-04-05 11:48:34 750592 ----a-w- C:\Windows\System32\win32spl.dll
2013-04-05 11:48:34 492032 ----a-w- C:\Windows\SysWow64\win32spl.dll
2013-04-05 11:45:55 800768 ----a-w- C:\Windows\System32\usp10.dll
2013-04-05 11:45:54 626688 ----a-w- C:\Windows\SysWow64\usp10.dll
2013-04-05 11:44:05 424448 ----a-w- C:\Windows\System32\KernelBase.dll
2013-04-05 11:44:03 274944 ----a-w- C:\Windows\SysWow64\KernelBase.dll
2013-04-05 11:44:01 362496 ----a-w- C:\Windows\System32\wow64win.dll
2013-04-05 11:44:01 338432 ----a-w- C:\Windows\System32\conhost.exe
2013-04-05 11:44:00 243200 ----a-w- C:\Windows\System32\wow64.dll
2013-04-05 11:44:00 16384 ----a-w- C:\Windows\System32\ntvdm64.dll
2013-04-05 11:44:00 13312 ----a-w- C:\Windows\System32\wow64cpu.dll
2013-04-05 11:23:23 -------- d-----w- C:\Users\Michaella\AppData\Roaming\AVG2013
2013-04-05 10:53:05 451192 ----a-r- C:\Windows\System32\drivers\N360x64\0604010.00E\symds64.sys
2013-04-05 10:53:05 405624 ----a-r- C:\Windows\System32\drivers\N360x64\0604010.00E\symnets.sys
2013-04-05 10:53:05 1129120 ----a-w- C:\Windows\System32\drivers\N360x64\0604010.00E\symefa64.sys
2013-04-05 10:53:04 737952 ----a-w- C:\Windows\System32\drivers\N360x64\0604010.00E\srtsp64.sys
2013-04-05 10:53:04 37536 ----a-w- C:\Windows\System32\drivers\N360x64\0604010.00E\srtspx64.sys
2013-04-05 10:53:04 190072 ----a-r- C:\Windows\System32\drivers\N360x64\0604010.00E\ironx64.sys
2013-04-05 10:53:03 167072 ----a-w- C:\Windows\System32\drivers\N360x64\0604010.00E\ccsetx64.sys
2013-04-05 10:52:29 163088 ----a-w- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10143.bin
2013-04-05 10:51:35 68608 ----a-w- C:\Windows\System32\taskhost.exe
2013-04-05 10:51:08 -------- d-----w- C:\Windows\System32\drivers\N360x64\0604010.00E
2013-04-05 10:50:09 -------- d-----w- C:\Users\Michaella\AppData\Roaming\TuneUp Software
2013-04-05 10:48:51 -------- d-----w- C:\ProgramData\AVG2013
2013-04-05 10:46:14 -------- d-----w- C:\Program Files (x86)\AVG
2013-04-05 10:40:25 -------- d--h--w- C:\ProgramData\Common Files
2013-04-05 10:40:24 -------- d-----w- C:\Users\Michaella\AppData\Local\MFAData
2013-04-05 10:40:24 -------- d-----w- C:\ProgramData\MFAData
2013-03-24 16:55:38 -------- d-----w- C:\Users\Michaella\AppData\Roaming\Petroglyph
2013-03-23 13:31:07 -------- d-----w- C:\Users\Michaella\AppData\Roaming\Atari
2013-03-23 13:29:59 197120 ----a-w- C:\Windows\patchw32.dll
2013-03-23 13:29:58 -------- d-----w- C:\Program Files (x86)\Common Files\PocketSoft
2013-03-23 13:21:52 -------- d-----w- C:\Program Files (x86)\Atari
2013-03-23 13:20:19 692224 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2013-03-23 13:20:19 57344 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2013-03-23 13:20:19 5632 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2013-03-23 13:20:19 237568 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2013-03-23 13:20:19 155648 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2013-03-23 13:20:13 282756 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2013-03-23 13:20:13 163972 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2013-03-15 19:14:05 -------- d-----w- C:\Program Files (x86)\Infogrames
2013-03-15 19:13:27 77824 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2013-03-15 19:13:27 32768 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2013-03-15 19:13:27 225280 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll
2013-03-15 19:13:27 176128 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
.
==================== Find3M ====================
.
2013-04-05 12:21:51 693976 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-04-05 12:21:50 73432 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-22 06:27:49 2312704 ----a-w- C:\Windows\System32\jscript9.dll
2013-02-22 06:20:51 1392128 ----a-w- C:\Windows\System32\wininet.dll
2013-02-22 06:19:37 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
2013-02-22 06:15:48 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
2013-02-22 06:15:23 599040 ----a-w- C:\Windows\System32\vbscript.dll
2013-02-22 06:12:41 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2013-02-22 03:46:00 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-02-22 03:38:00 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-02-22 03:37:50 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2013-02-22 03:34:17 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2013-02-22 03:34:03 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll
2013-02-22 03:31:46 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2013-02-12 05:45:24 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45:22 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45:22 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45:22 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48:31 474112 ----a-w- C:\Windows\apppatch\AcSpecfc.dll
2013-02-12 04:48:26 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll
2013-02-12 04:12:05 19968 ----a-w- C:\Windows\System32\drivers\usb8023.sys
.
============= FINISH: 17:47:58.70 ===============


----------



## ste08ball (Apr 12, 2013)

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium 
Boot Device: \Device\HarddiskVolume1
Install Date: 19/04/2012 20:27:48
System Uptime: 14/04/2013 17:39:08 (0 hours ago)
.
Motherboard: FUJITSU | | FJNBB06
Processor: Intel(R) Pentium(R) CPU P6200 @ 2.13GHz | On Board | 1045/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 464 GiB total, 297.485 GiB free.
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: AVG AVI Loader Driver
Device ID: ROOT\LEGACY_AVGLDX64\0000
Manufacturer: 
Name: AVG AVI Loader Driver
PNP Device ID: ROOT\LEGACY_AVGLDX64\0000
Service: Avgldx64
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: Symantec Iron Driver
Device ID: ROOT\LEGACY_SYMIRON\0000
Manufacturer: 
Name: Symantec Iron Driver
PNP Device ID: ROOT\LEGACY_SYMIRON\0000
Service: SymIRON
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: BHDrvx64
Device ID: ROOT\LEGACY_BHDRVX64\0000
Manufacturer: 
Name: BHDrvx64
PNP Device ID: ROOT\LEGACY_BHDRVX64\0000
Service: BHDrvx64
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: Norton 360 Settings Manager
Device ID: ROOT\LEGACY_CCSET_N360\0000
Manufacturer: 
Name: Norton 360 Settings Manager
PNP Device ID: ROOT\LEGACY_CCSET_N360\0000
Service: ccSet_N360
.
==== System Restore Points ===================
.
RP103: 11/04/2013 20:03:39 - Removed AVG PC TuneUp Language Pack (en-US)
RP104: 12/04/2013 00:38:35 - Removed Skype™ 6.3
RP105: 12/04/2013 03:00:13 - Windows Update
RP106: 12/04/2013 05:17:46 - Removed AVG 2013
RP107: 12/04/2013 17:11:40 - Windows Update
RP108: 12/04/2013 19:41:16 - FBDO : Disk Optimizer - FixBee Disk Optimizer
RP109: 13/04/2013 12:32:15 - Removed AVG 2013
RP110: 13/04/2013 14:56:57 - Removed Compatibility Pack for the 2007 Office system
RP111: 13/04/2013 15:03:15 - Windows Update
RP112: 13/04/2013 15:44:06 - Installed HiJackThis
RP113: 13/04/2013 17:11:43 - Installed HiJackThis
RP114: 14/04/2013 12:35:29 - Windows Modules Installer
.
==== Installed Programs ======================
.
1ClickDownloader
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9.5.2
Adobe Shockwave Player 11.6
AVG 2013
AVG PC TuneUp
AVG PC TuneUp Language Pack (en-US)
Backup & Storage v2.3.1.37683
Bluetooth Feature Pack 5.0
CCleaner
Compatibility Pack for the 2007 Office system
CyberLink YouCam
D3DX10
DeskUpdate 4.11
Dusk Till Dawn Poker
FixBee Disk Optimizer
FrostWire 5.5.1
Fujitsu Display Manager
Fujitsu Hotkey Utility
Fujitsu MobilityCenter Extension Utility
Fujitsu System Extension Utility
iLivid
Intel(R) Graphics Media Accelerator Driver
Intel(R) Management Engine Components
Internet TV for Windows Media Center
Java Auto Updater
Java(TM) 6 Update 22
Java(TM) 7 Update 3
Junk Mail filter update
LifeBook Application Panel
Malwarebytes Anti-Malware version 1.75.0.1300
Mesh Runtime
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Office 2010
Microsoft Office Click-to-Run 2010
Microsoft Office Starter 2010 - English
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Mozilla Firefox 15.0 (x86 en-US)
Mozilla Firefox 16.0.2 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Norton 360
PKR
Plugfree NETWORK
Power Saving Utility
Radialpoint Security Advisor 2.5.19
Realtek High Definition Audio Driver
Realtek USB 2.0 Card Reader
RegCure Pro
RollerCoaster Tycoon 2
RollerCoaster Tycoon 3
Search-Results Toolbar
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Skype™ 6.3
Spotify
SProtector
Star Wars Empire at War
swMSM
Synaptics Pointing Device Driver
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
VC80CRTRedist - 8.0.50727.6195
Virgin Media Digital Home Support 2.1.27
Virgin Media Security
Virgin Media Service Manager 4.1.16
Virgin Media Toolbar
Visual Studio 2010 x64 Redistributables
Visual Studio C++ 10.0 Runtime
VLC media player 1.1.11
War of the Ring(tm)
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
ZEN V Series Media Explorer
.
==== Event Viewer Messages From Past Week ========
.
14/04/2013 17:40:25, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx64 BHDrvx64 ccSet_N360 SymIRON
14/04/2013 17:39:46, Error: Service Control Manager [7024] - The AVG WatchDog service terminated with service-specific error %%-536805315.
14/04/2013 17:39:44, Error: Service Control Manager [7024] - The AVGIDSAgent service terminated with service-specific error %%-536753637.
14/04/2013 13:24:47, Error: Service Control Manager [7034] - The Creative Service for CDROM Access service terminated unexpectedly. It has done this 1 time(s).
13/04/2013 17:04:12, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Bluetooth Feature Support service to connect.
13/04/2013 17:04:12, Error: Service Control Manager [7000] - The Bluetooth Feature Support service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
13/04/2013 14:44:48, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
13/04/2013 14:40:38, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
13/04/2013 14:37:06, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
13/04/2013 14:36:06, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
13/04/2013 14:35:21, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
13/04/2013 14:35:21, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
13/04/2013 14:35:17, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
13/04/2013 14:35:16, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
13/04/2013 14:35:06, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AFW BdSpy DfsC discache NetBIOS NetBT NovaShieldFilterDriver NovaShieldTDIDriver nsiproxy Psched rdbss spldr tdx tmlwf tmtdi vwififlt Wanarpv6 WfpLwf
13/04/2013 14:35:06, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service TermService with arguments "" in order to run the server: {F9A874B6-F8A8-4D73-B5A8-AB610816828B}
13/04/2013 14:35:06, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
13/04/2013 14:34:55, Error: Service Control Manager [7001] - The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error: The dependency service or group failed to start.
13/04/2013 14:34:51, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
13/04/2013 14:34:51, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
13/04/2013 14:34:51, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
13/04/2013 14:34:51, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
13/04/2013 14:34:51, Error: Service Control Manager [7001] - The Media Center Extender Service service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
13/04/2013 14:34:51, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
13/04/2013 14:34:40, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
13/04/2013 14:34:40, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
13/04/2013 14:34:40, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
13/04/2013 14:34:40, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
13/04/2013 14:34:40, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
13/04/2013 14:20:50, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intel(R) Management & Security Application User Notification Service service to connect.
13/04/2013 14:20:50, Error: Service Control Manager [7000] - The Intel(R) Management & Security Application User Notification Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
13/04/2013 14:20:09, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Software Protection service to connect.
13/04/2013 14:20:09, Error: Service Control Manager [7000] - The Software Protection service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
13/04/2013 14:18:37, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Media Player Network Sharing Service service to connect.
13/04/2013 14:18:37, Error: Service Control Manager [7000] - The Windows Media Player Network Sharing Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
13/04/2013 14:17:24, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X64 service to connect.
13/04/2013 14:16:22, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
13/04/2013 14:09:33, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TuneUp.UtilitiesSvc service.
13/04/2013 13:51:05, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the wlidsvc service.
13/04/2013 12:39:59, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AVGIDSDriver Avgldx64 Avgtdia BHDrvx64 ccSet_N360 DfsC discache eeCtrl IDSVia64 NetBIOS NetBT nsiproxy Psched rdbss spldr SRTSPX SymIRON SymNetS tdx tmlwf tmtdi vwififlt Wanarpv6 WfpLwf
13/04/2013 12:39:49, Error: Service Control Manager [7001] - The AVGIDSAgent service depends on the AVGIDSDriver service which failed to start because of the following error: A device attached to the system is not functioning.
13/04/2013 12:28:10, Error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied.
13/04/2013 00:59:18, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x000000f4 (0x0000000000000003, 0xfffffa80085acb30, 0xfffffa80085ace10, 0xfffff800031e3350). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 041313-57938-01.
13/04/2013 00:41:48, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Interactive Services Detection service to connect.
13/04/2013 00:41:48, Error: Service Control Manager [7000] - The Interactive Services Detection service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
13/04/2013 00:40:46, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Print Spooler service to connect.
13/04/2013 00:40:46, Error: Service Control Manager [7000] - The Print Spooler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
12/04/2013 19:42:28, Error: Service Control Manager [7034] - The FBDiskOptimizer service terminated unexpectedly. It has done this 1 time(s).
12/04/2013 14:20:42, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the PFNService service to connect.
12/04/2013 14:20:42, Error: Service Control Manager [7000] - The PFNService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
12/04/2013 12:46:19, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D3DCB472-7261-43CE-924B-0704BD730D5F} and APPID {D3DCB472-7261-43CE-924B-0704BD730D5F} to the user Wilson\Michaella SID (S-1-5-21-3295424948-2256899820-3586588129-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
12/04/2013 12:46:18, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {145B4335-FE2A-4927-A040-7C35AD3180EF} and APPID {145B4335-FE2A-4927-A040-7C35AD3180EF} to the user Wilson\Michaella SID (S-1-5-21-3295424948-2256899820-3586588129-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
12/04/2013 10:56:35, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the AVG PC TuneUp Service service to connect.
12/04/2013 10:56:35, Error: Service Control Manager [7000] - The AVG PC TuneUp Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
12/04/2013 10:56:07, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000074 (0x0000000000000002, 0xfffff880068f4b20, 0x0000000000000002, 0xffffffffc000014c). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 041213-56238-01.
12/04/2013 00:29:04, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Virgin Media Security service to connect.
12/04/2013 00:29:04, Error: Service Control Manager [7000] - The Virgin Media Security service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/04/2013 17:35:56, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
11/04/2013 16:43:53, Error: Service Control Manager [7034] - The Trend Micro Solution Platform service terminated unexpectedly. It has done this 1 time(s).
11/04/2013 12:51:28, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.
.
==== End Of File ===========================


----------



## ste08ball (Apr 12, 2013)

# AdwCleaner v2.200 - Logfile created 04/14/2013 at 18:03:19
# Updated 02/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Michaella - WILSON
# Boot Mode : Normal
# Running from : C:\Users\Michaella\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Deleted on reboot : C:\ProgramData\Browser Manager
Deleted on reboot : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
File Deleted : C:\END
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
File Deleted : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml
File Deleted : C:\user.js
File Deleted : C:\Users\MICHAE~1\AppData\Local\Temp\Searchqu.ini
File Deleted : C:\Users\MICHAE~1\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
File Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
File Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\searchplugins\Askcom.xml
File Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\searchplugins\Search_Results.xml
File Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\searchplugins\SweetIm.xml
File Deleted : C:\Windows\Tasks\GboxUpdaterLogonTask.job
File Deleted : C:\Windows\Tasks\GboxUpdaterRefreshTask.job
Folder Deleted : C:\Program Files (x86)\1ClickDownload
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\Ilivid
Folder Deleted : C:\Program Files (x86)\Mozilla Firefox\Extensions\[email protected]
Folder Deleted : C:\Program Files (x86)\Playbryte
Folder Deleted : C:\Program Files\Babylon
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\ProgramData\GboxUpdater
Folder Deleted : C:\ProgramData\InstallMate
Folder Deleted : C:\ProgramData\Partner
Folder Deleted : C:\ProgramData\Premium
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\ProgramData\Trymedia
Folder Deleted : C:\Users\Michaella\AppData\Local\APN
Folder Deleted : C:\Users\Michaella\AppData\Local\Conduit
Folder Deleted : C:\Users\Michaella\AppData\Local\PackageAware
Folder Deleted : C:\Users\Michaella\AppData\Local\Wajam
Folder Deleted : C:\Users\Michaella\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Michaella\AppData\LocalLow\Playbryte
Folder Deleted : C:\Users\Michaella\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Michaella\AppData\LocalLow\wxDfast
Folder Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\extensions\[email protected]
Folder Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\[email protected]
Folder Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\[email protected]
Folder Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\jetpack
Folder Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\SweetPacksToolbarData
Folder Deleted : C:\Users\Michaella\AppData\Roaming\OpenCandy
Folder Deleted : C:\Users\Michaella\AppData\Roaming\yourfiledownloader
***** [Registry] *****
Data Deleted : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SRTOOL~1\Datamngr\x64\datamngr.dll
Data Deleted : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SRTOOL~1\Datamngr\x64\IEBHO.dll
Data Deleted : HKLM\..\Windows [AppInit_DLLs] = c:\progra~2\sprote~1\sprote~1.dll
Data Deleted : HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SRTOOL~1\Datamngr\datamngr.dll
Data Deleted : HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SRTOOL~1\Datamngr\IEBHO.dll
Key Deleted : HKCU\Software\1ClickDownload
Key Deleted : HKCU\Software\APN DTX
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\ilivid
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\SProtector
Key Deleted : HKCU\Software\YourFileDownloader
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6536801B-F50C-449B-9476-093DFD3789E3}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\BabylonHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll
Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Deleted : HKLM\SOFTWARE\Classes\BrowserConnection.Loader
Key Deleted : HKLM\SOFTWARE\Classes\BrowserConnection.Loader.1
Key Deleted : HKLM\SOFTWARE\Classes\ilivid
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\ilivid
Key Deleted : HKLM\Software\Iminent
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BabylonTC_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BabylonTC_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Vid-Saver_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Vid-Saver_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCS
Key Deleted : HKLM\Software\Playbryte
Key Deleted : HKLM\Software\SearchquSRTB
Key Deleted : HKLM\Software\SProtector
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jplinpmadfkdgipabgcdchbdikologlh
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ilivid
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Search Results Toolbar
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SProtector
Key Deleted : HKLM\Software\YourFileDownloader
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Key Deleted : HKLM\SOFTWARE\DataMngr
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKLM\SOFTWARE\Tarma Installer
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D7E97865-918F-41E4-9CD0-25AB1C574CE8}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [DataMngr]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{28387537-E3F9-4ED7-860C-11E69AF4A8A0}]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{B278D9F8-0FA9-465E-9938-0C392605D8E3}]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16476
[OK] Registry is clean.
-\\ Mozilla Firefox v15.0 (en-US)
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\user.js ... Deleted !
[OK] File is clean.
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\prefs.js
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\user.js ... Deleted !
Deleted : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Deleted : user_pref("browser.newtab.url", "hxxp://home.sweetim.com/?src=97&barid={F0C0A5DD-B40D-11E1-A833-E0CA[...]
Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Deleted : user_pref("browser.search.order.1", "Search Results");
Deleted : user_pref("browser.search.selectedEngine", "Search Results");
Deleted : user_pref("browser.startup.homepage", "hxxp://www.searchnu.com/408");
Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true);
Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=100291&tt=18031[...]
Deleted : user_pref("extensions.funmoods_i.aflt", "axl");
Deleted : user_pref("extensions.funmoods_i.dfltLng", "");
Deleted : user_pref("extensions.funmoods_i.excTlbr", false);
Deleted : user_pref("extensions.funmoods_i.id", "980e72c30000000000007ae9d3028cc7");
Deleted : user_pref("extensions.funmoods_i.instlDay", "15467");
Deleted : user_pref("extensions.funmoods_i.instlRef", "");
Deleted : user_pref("extensions.funmoods_i.newTab", false);
Deleted : user_pref("extensions.funmoods_i.prdct", "funmoods");
Deleted : user_pref("extensions.funmoods_i.prtnrId", "funmoods");
Deleted : user_pref("extensions.funmoods_i.smplGrp", "none");
Deleted : user_pref("extensions.funmoods_i.tlbrId", "base");
Deleted : user_pref("extensions.funmoods_i.tlbrSrchUrl", "hxxp://start.funmoods.com/results.php?f=3&a=axl&q=")[...]
Deleted : user_pref("extensions.funmoods_i.vrsn", "1.5.11.16");
Deleted : user_pref("extensions.funmoods_i.vrsnTs", "1.5.11.1614:06:26");
Deleted : user_pref("extensions.funmoods_i.vrsni", "1.5.11.16");
Deleted : user_pref("extensions.toolbar.mindspark._64Members_.homepage", "hxxp://home.mywebsearch.com/index.jh[...]
Deleted : user_pref("ibxcomtb.defSrchURL", "hxxp://search.sweetim.com/search.asp?src=2&crg=3.1010000.10011&q="[...]
Deleted : user_pref("ibxcomtb.defs", "<buttons>\n<TOOLBAR><EXTERNAL_SEARCH engin[...]
Deleted : user_pref("sweetim.toolbar.search.history.capacity", "10");
Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "0");
Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "0");
Deleted : user_pref("sweetim.toolbar.searchguard.enable", "false");
Deleted : user_pref("sweetim.toolbar.searchguard.initialized_by_rc", "true");
Deleted : user_pref("sweetim.toolbar.simapp_id", "{F0C0A5DD-B40D-11E1-A833-E0CA94A6FA8F}");
Deleted : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?crg=3.1010000.10011&barid={F0C0[...]
Deleted : user_pref("sweetim.toolbar.version", "1.7.0.3");
Deleted : user_pref("browser.search.defaultenginename", "Search Results");
*************************
AdwCleaner[S1].txt - [21374 octets] - [14/04/2013 18:03:19]
########## EOF - C:\AdwCleaner[S1].txt - [21435 octets] ##########


----------



## ste08ball (Apr 12, 2013)

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Michaella [Admin rights]
Mode : Scan -- Date : 04/14/2013 18:20:48
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 6 ¤¤¤
[TASK][BLPATH] OptimizerProUpdaterRefreshTask.job : C:\ProgramData\OptimizerPro\updater.exe /profilepath "C:\ProgramData\OptimizerPro\profile.ini" [x] -> FOUND
[TASK][BLPATH] OptimizerProUpdaterLogonTask.job : C:\ProgramData\OptimizerPro\updater.exe /schedule /profilepath "C:\ProgramData\OptimizerPro\profile.ini" [x] -> FOUND
[TASK][ROGUE ST] 0 : c:\program files (x86)\internet explorer\iexplore.exe -> FOUND
[TASK][ROGUE ST] 4779 : wscript.exe C:\Users\Michaella\AppData\Local\Temp\launchie.vbs //B -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ Infection : Rogue.ProgFiles ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK5076GSX +++++
--- User ---
[MBR] 6a7e11687ca14d7af9f10cfbe8203d17
[BSP] 10156bb398fe4131e44b5c8112c00ded : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 2049 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 4198400 | Size: 474889 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[1]_S_04142013_02d1820.txt >>
RKreport[1]_S_04142013_02d1820.txt


----------



## ste08ball (Apr 12, 2013)

ok all done also when the comp restarts a box comes up on screen saying; product update there is an error with your installation please reinstall the application. but it doesnt explain what or how is it spam nothing to worry about and i also get a pop up whenever on internet and open a window it says inksdata in the search bar was wondering if that was suspicious.


----------



## ste08ball (Apr 12, 2013)

and also i dont have trend micro titanium


----------



## Mark1956 (May 7, 2011)

You do have a Trend Micro Firewall. You also have four security products on your system which is bound to cause problems, please tell me which one you wish to keep so we can clean out the others. You are using Norton, Bullguard, Virgin and AVG, three of them have to go. The multiple Anti Virus programs could well be the reason for your systems poor performance, but we also need to make sure nothing that was found by Malwarebytes or ADWCleaner comes back after a reboot.

There is also an indication that your registry has been damaged, most likely due to using System Optimizer programs like RegCure and OptimizerPro, if you have any other Optimizer programs installed please remove them. We can repair the registry if it is damaged after taking care of all the Adware and infections.

I also see *Frostwire* which a file sharing program. Downloading files from unknown sources is one of the easiest ways to get your PC infected, I would advise you to remove it, but if you insist on keeping it DO NOT use it again until we are finished.

Please uninstall these items:

iLivid
Java Auto Updater
Java(TM) 6 Update 22
Java(TM) 7 Update 3
RegCure Pro

When done make sure you reboot the system before proceeding.

Please run RogueKiller again following these instructions as it has found Rogue programs on your system.


Quit all running programs.
Start RogueKiller.exe by double clicking on the icon.
Wait until Prescan has finished.
Ensure all boxes are ticked under "Report" tab.
Click on Scan.
Click on Delete when complete.
Click on Report when the Deletion completes. Copy/paste the contents of the report into your next reply.

Please also do another scan with ADWCleaner using the Delete button and post the log.

As we are now dealing with infections I have requested this is moved to the Malware forum.

*In your next reply I need you to post the following:*

New ADWCleaner log.
New RogueKiller log.
Tell me which Anti Virus you wish to keep.
Run a *Full* (not quick) system scan with Malwarebytes and post that log also.


----------



## flavallee (May 12, 2002)

Mark:

I'm going to unsubscribe from this thread so I don't receive an alert every time one of you replies to it.

If you want me to jump back in later, just let me know.

I think we're fighting a losing battle. 

---------------------------------------------------------


----------



## ste08ball (Apr 12, 2013)

ok iam trying to delete fix bee optimizer and a pop up comes up saying file"c:/programfiles(x86)/fixbee/unins000.dat"does not exist. can not uninstall.


----------



## Mark1956 (May 7, 2011)

Ok, don't worry about anything you cannot remove, just make sure you tell me . Post a list of anything that won't uninstall and we will remove them using Malware tools as we progress, the most important thing is to uninstall the Anti Virus programs and let me know the one you are keeping as these will be making your system run very badly.

Proceed with the other uninstalls and the remainder of the instructions.


----------



## ste08ball (Apr 12, 2013)

ok iam going to keep virgin. avg wont uninstall i think files are missing and may have to reinstall to uninstall and i cant find bullguard anywhere


----------



## ste08ball (Apr 12, 2013)

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Michaella [Admin rights]
Mode : Remove -- Date : 04/16/2013 02:28:25
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 6 ¤¤¤
[TASK][BLPATH] OptimizerProUpdaterRefreshTask.job : C:\ProgramData\OptimizerPro\updater.exe /profilepath "C:\ProgramData\OptimizerPro\profile.ini" [x] -> DELETED
[TASK][BLPATH] OptimizerProUpdaterLogonTask.job : C:\ProgramData\OptimizerPro\updater.exe /schedule /profilepath "C:\ProgramData\OptimizerPro\profile.ini" [x] -> DELETED
[TASK][ROGUE ST] 0 : c:\program files (x86)\internet explorer\iexplore.exe -> DELETED
[TASK][ROGUE ST] 4779 : wscript.exe C:\Users\Michaella\AppData\Local\Temp\launchie.vbs //B -> DELETED
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ Infection : Rogue.ProgFiles ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK5076GSX +++++
--- User ---
[MBR] 6a7e11687ca14d7af9f10cfbe8203d17
[BSP] 10156bb398fe4131e44b5c8112c00ded : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 2049 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 4198400 | Size: 474889 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[3]_D_04162013_02d0228.txt >>
RKreport[1]_S_04142013_02d1820.txt ; RKreport[2]_S_04162013_02d0222.txt ; RKreport[3]_D_04162013_02d0228.txt


----------



## ste08ball (Apr 12, 2013)

# AdwCleaner v2.200 - Logfile created 04/16/2013 at 02:32:01
# Updated 02/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Michaella - WILSON
# Boot Mode : Normal
# Running from : C:\Users\Michaella\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Deleted on reboot : C:\ProgramData\Browser Manager
Deleted on reboot : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
***** [Registry] *****

***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16476
[OK] Registry is clean.
-\\ Mozilla Firefox v15.0 (en-US)
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js
[OK] File is clean.
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\prefs.js
[OK] File is clean.
*************************
AdwCleaner[S1].txt - [21475 octets] - [14/04/2013 18:03:19]
AdwCleaner[S2].txt - [1053 octets] - [16/04/2013 02:32:01]
########## EOF - C:\AdwCleaner[S2].txt - [1113 octets] ##########


----------



## ste08ball (Apr 12, 2013)

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org
Database version: v2013.04.15.09
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Michaella :: WILSON [administrator]
Protection: Enabled
16/04/2013 02:39:30
mbam-log-2013-04-16 (02-39-30).txt
Scan type: Full scan (C:\|F:\|Q:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 375973
Time elapsed: 1 hour(s), 38 minute(s), 2 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)


----------



## Mark1956 (May 7, 2011)

ste08ball said:


> ok iam going to keep virgin. avg wont uninstall i think files are missing and may have to reinstall to uninstall and i cant find bullguard anywhere


What about Norton 360?

Please run this tool to clean out AVG: AVG Removal tool You must select the correct tool to match the version of AVG installed and the bit rate (32 or 64bit).

When you have uninstalled Norton please run this tool: Norton Uninstall Tool

NOTE: As you are keeping Virgin you can also keep the Trend Micro Firewall.

We will search for any leftovers when you are done, please tell me how well the system is performing after you have completed all of the above.


----------



## ste08ball (Apr 12, 2013)

its going at a decent speed did you say anything about a damaged registry or have what we done fixed that.


----------



## Mark1956 (May 7, 2011)

One step at a time . The increased performance is a good sign, we will be checking for any problems with the registry later.

I asked about Norton in my last post and you have not answered, please try not to miss any questions and always confirm that you have done as instructed so I can be quite sure you have not missed anything else.

There are still some things that need to be looked at in the ADWCleaner log as a couple of Adware items have returned. I also need to check what RogueKiller removed has gone for good.

As you have missed a question I need to be sure you have not missed any instructions. Please confirm that you have removed all but Virgin AV and run the Norton and AVG removal tools. Please also confirm if you have kept the Trend Micro Firewall.

Next, please run ADWCleaner again, using the Delete button, and run a normal scan with RogueKiller. Post both the logs when done.


----------



## ste08ball (Apr 12, 2013)

i used the tools you gave me and now virgin is the last one remaining i will now dothe 2 scans results will be posted shortly


----------



## ste08ball (Apr 12, 2013)

# AdwCleaner v2.200 - Logfile created 04/17/2013 at 16:54:54
# Updated 02/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Michaella - WILSON
# Boot Mode : Normal
# Running from : C:\Users\Michaella\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Deleted on reboot : C:\ProgramData\Browser Manager
Deleted on reboot : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
File Deleted : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml
File Deleted : C:\Users\MICHAE~1\AppData\Local\Temp\Searchqu.ini
File Deleted : C:\Users\MICHAE~1\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
File Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\searchplugins\Search_Results.xml
File Deleted : C:\Users\Public\Desktop\Get The Best Facebook Chat Messenger.lnk
***** [Registry] *****
Data Deleted : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SRTOOL~1\Datamngr\x64\datamngr.dll
Data Deleted : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SRTOOL~1\Datamngr\x64\IEBHO.dll
Data Deleted : HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SRTOOL~1\Datamngr\datamngr.dll
Data Deleted : HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SRTOOL~1\Datamngr\IEBHO.dll
Key Deleted : HKCU\Software\APN DTX
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll
Key Deleted : HKLM\SOFTWARE\Classes\BrowserConnection.Loader
Key Deleted : HKLM\SOFTWARE\Classes\BrowserConnection.Loader.1
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Deleted : HKLM\Software\SearchquSRTB
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Search Results Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Key Deleted : HKLM\SOFTWARE\DataMngr
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [DataMngr]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16476
[OK] Registry is clean.
-\\ Mozilla Firefox v15.0 (en-US)
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js
[OK] File is clean.
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\prefs.js
Deleted : user_pref("browser.search.selectedEngine", "Search Results");
Deleted : user_pref("browser.search.defaultenginename", "Search Results");
Deleted : user_pref("browser.search.order.1", "Search Results");
Deleted : user_pref("keyword.URL", "hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=104&systemid=408&apn[...]
Deleted : user_pref("browser.startup.homepage", "hxxp://www.searchnu.com/408");
*************************
AdwCleaner[S1].txt - [21475 octets] - [14/04/2013 18:03:19]
AdwCleaner[S2].txt - [1182 octets] - [16/04/2013 02:32:01]
AdwCleaner[S3].txt - [5011 octets] - [17/04/2013 16:54:54]
########## EOF - C:\AdwCleaner[S3].txt - [5071 octets] ##########


----------



## ste08ball (Apr 12, 2013)

with the rogue killer is that making sure boxes are ticked and then pressing scan


----------



## ste08ball (Apr 12, 2013)

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Michaella [Admin rights]
Mode : Scan -- Date : 04/17/2013 17:18:06
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 0 ¤¤¤
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK5076GSX +++++
--- User ---
[MBR] 6a7e11687ca14d7af9f10cfbe8203d17
[BSP] 10156bb398fe4131e44b5c8112c00ded : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 2049 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 4198400 | Size: 474889 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[4]_S_04172013_02d1718.txt >>
RKreport[1]_S_04142013_02d1820.txt ; RKreport[2]_S_04162013_02d0222.txt ; RKreport[3]_D_04162013_02d0228.txt ; RKreport[4]_S_04172013_02d1718.txt


----------



## ste08ball (Apr 12, 2013)

ok done thoes for you whats next


----------



## ste08ball (Apr 12, 2013)

just saw a guy on you tube who suggests google desktop and process manager to help speed computer up would that be beneficial for my computer mark


----------



## Mark1956 (May 7, 2011)

There is a whole heap of Adware that has re-populated your system, please follow these instructions below.

Please right-click on the link below and select "Save target as..." or "Save Link as...", click on Desktop in the left pane and type in the filename as Fix.txt then click on Save.

Vista or Win 7, 64 bit: Vista or Win 7 64 bit

---------------------------------------------

Click on this link OTL.exe by OldTimer and save the download to your Desktop.

---------------------------------------------

Double Click the OTL icon (Right click and choose "Run as administrator" in Vista/Win7)

Click the *Run Fix* button at the top.
You will see a popup dialog reporting "No fix has been provided. Click OK to load from a file or Cancel". Click on OK.
When the Open dialog comes up, Navigate to the Desktop, scroll to find the file named Fix.txt click on it so it is highlighted and then click on Open.
Some text will appear in the Custom scans/Fixes box.
Click the *Run Fix* button.
Let the program run unhindered, and click to allow the Reboot when it is done.
When the computer Reboots, and you start your usual account, a Notepad text file will appear.
Copy the contents of that file and post it in your next reply. The file will also be available at
C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log


----------



## Mark1956 (May 7, 2011)

ste08ball said:


> just saw a guy on you tube who suggests google desktop and process manager to help speed computer up would that be beneficial for my computer mark


You can do that when we are finished if you wish, I can't honestly see that it will give much of an improvement so you will need to experiment, for now please don't make any system changes as it can confuse scan results.


----------



## ste08ball (Apr 12, 2013)

ok mark whats desktop as cant fint it in the window when i right click the link save as


----------



## Mark1956 (May 7, 2011)

You should see Desktop at the top of the list in the left pane of the window that opens after you have selected "Save Link As..."


----------



## ste08ball (Apr 12, 2013)

ok a little confused i right clicked and ran as administrator but theres nothing about vista/win7


----------



## ste08ball (Apr 12, 2013)

i created shortcuts for them both is that ok lol my computer knowledge is rubbish glad ive got a expert helping me


----------



## Mark1956 (May 7, 2011)

There are two items to download, which one are you referring to OTL or the script.

When you right click you just have to select "Run as Administrator" to run OTL.

Take your time with the instructions and read them carefully .

You need to save both items to the desktop NOT as shortcuts.

If you are getting confused, delete what you have downloaded, delete the shortcuts and start again, nice and slowly. If your browser is set to save downloads to the downloads folder then change it, a quick Google will show you how.

I am off out now for the night so won't be here for several hours.


----------



## Mark1956 (May 7, 2011)

3 Days gone by without a reply, are you still with us?


----------



## ste08ball (Apr 12, 2013)

hi yes sorry i am still with you my partner had a operation and i have been busy looking after her and our son. 

right ive downloaded otl to desk top how ever as i have stupidly saved fix it to different part it wont let me re download once deleted to save it on desktop. i havent ran otl yet as i need help with fix it


----------



## Mark1956 (May 7, 2011)

I assume by 'fix it' you mean the file download you have to save as Fix.txt.

Have you deleted the one you saved in the wrong place?
What happens when you try to download and save the file to the desktop?


----------



## ste08ball (Apr 12, 2013)

hi mark deleting them all sorted it


----------



## ste08ball (Apr 12, 2013)

Error: Unable to interpret <<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">> in the current context!
Error: Unable to interpret <> in the current context!
Error: Unable to interpret <> in the current context!
Error: Unable to interpret <> in the current context!
Error: Unable to interpret <> in the current context!
Error: Unable to interpret <> in the current context!
Error: Unable to interpret <> in the current context!
Error: Unable to interpret <> in the current context!
Error: Unable to interpret <> in the current context!
Error: Unable to interpret <> in the current context!
Error: Unable to interpret <> in the current context!
Error: Unable to interpret <</head[/URL]>> in the current context!
Error: Unable to interpret <> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < 

> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < 

> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < http://downloads.malwareremoval.com/SQW7-Vista_x64.TXT> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <

> in the current context!
Error: Unable to interpret <

> in the current context!
Error: Unable to interpret < #> in the current context!
Error: Unable to interpret <

> in the current context!
Error: Unable to interpret <

> in the current context!
Error: Unable to interpret <

> in the current context!
Error: Unable to interpret <



> in the current context!
Error: Unable to interpret < 
> in the current context!
Error: Unable to interpret <
#> in the current context!
Error: Unable to interpret <
 > in the current context!
Error: Unable to interpret <
 > in the current context!
Error: Unable to interpret <
> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <

> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <> in the current context!
Error: Unable to interpret <> in the current context!

OTL by OldTimer - Version 3.2.69.0 log created on 04262013_144853


----------



## Mark1956 (May 7, 2011)

Unfortunately that has gone wrong, it looks like you did something wrong when saving the link to create the Fix.txt file. I have created the file for you and sent as an attachment, just click on it and it will download, save it to your desktop and then follow the instructions below, take it one line at a time as slow as you wish and it will then run correctly.

Double Click the OTL icon (Right click and choose "Run as administrator" in Vista/Win7)

Click the *Run Fix* button at the top.
You will see a popup dialog reporting "No fix has been provided. Click OK to load from a file or Cancel". Click on OK.
When the Open dialog comes up, Navigate to the Desktop, scroll to find the file named Fix.txt click on it so it is highlighted and then click on Open.
Some text will appear in the Custom scans/Fixes box.
Click the *Run Fix* button.
Let the program run unhindered, and click to allow the Reboot when it is done.
When the computer Reboots, and you start your usual account, a Notepad text file will appear.
Copy the contents of that file and post it in your next reply. The file will also be available at
C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log


----------



## ste08ball (Apr 12, 2013)

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page deleted successfully.
Registry key HKEY_CURRENT_USER\Software\AppDataLow\Software\searchqutoolbar\ not found.
Registry key HKEY_CURRENT_USER\Software\DataMngr\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Bandoo\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Searchqu 406 MediaBar\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\menuorder\start menu2\programs\bandoo\ not found.
Registry key HKEY_CURRENT_USER\Software\Trolltech\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\DataMngr_Toolbar\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\ilivid\ not found.
Registry key HKEY_CURRENT_USER\Software\searchqutoolbar\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\DataMngr\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Bandoo\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\BandooCore.EXE\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1301A8A5-3DFB-4731-A162-B357D00C9644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1.exe\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.BandooCore.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.BandooCore\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.ResourcesMngr.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.ResourcesMngr\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.SettingsMngr.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.SettingsMngr\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.StatisticMngr.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.StatisticMngr\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{477F210A-2A86-4666-9C4B-1189634D2C84}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FF871E51-2655-4D06-AED5-745962A96B32}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}\1.0\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4e1d-BDD0-1E9C9B7799CC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{424624F4-C5DD-4e1d-BDD0-1E9C9B7799CC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7f000001-db8e-f89c-2fec-49bf726f8c12}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7f000001-db8e-f89c-2fec-49bf726f8c12}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4fde-B055-AE7B0F4CF080}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F9189560-573A-4fde-B055-AE7B0F4CF080}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFBD6D47-F5E5-49E4-8157-8BCFF11F3CC3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFBD6D47-F5E5-49E4-8157-8BCFF11F3CC3}\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Save video on Savevid.com\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\ilivid.exe\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SetupDataMngr_searchqu_RASAPI32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SetupDataMngr_searchqu_RASMANCS\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\datamngrUI_RASAPI 32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\datamngrUI_RASMAN CS\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu 406 MediaBar\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\SearchquMediabarTb\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{27f69c85-64e1-43ce-98b5-3c9f22fb408e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27f69c85-64e1-43ce-98b5-3c9f22fb408e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{b543ef05-9758-464e-9f37-4c28525b4a4c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b543ef05-9758-464e-9f37-4c28525b4a4c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{8f5f1cb6-ea9e-40af-a5ca-c7fd63cc1971}\1.0\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\app management\arpcache\searchqu 406 mediabar\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{a40dc6c5-79d0-4ca8-a185-8ff989af1115}\inprocserver32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{cc1ac828-bb47-4361-afb5-96eee259dd87}\inprocserver32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{fefd3af5-a346-4451-aa23-a3ad54915515}\inprocserver32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{5b4144e1-b61d-495a-9a50-cd1a95d86d15}\1.0\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{6a4bcaba-c437-4c76-a54e-af31b8a76cb9}\1.0\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{841d5a49-e48d-413c-9c28-eb3d9081d705}\1.0\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\internet explorer\low rights\elevationpolicy\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\internet explorer\low rights\elevationpolicy\{d0a4be92-2216-42db-ab35-d72efb9f0176}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d0a4be92-2216-42db-ab35-d72efb9f0176}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\shared tools\msconfig\startupreg\datamngr\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\searchqu.com\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\2B1E51D87B2D71A44BB42DDD5E894160\ not found.
Registry key HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\WhiteSmoke\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\2B1E51D87B2D71A44BB42DDD5E894160\InstallProperties\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CFA942DEC3AFA384B94ECC932BD3DC5A\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CFE82A48FED40644C984C808A1785C7F\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EFB5D9F3E46440D4A9C379467CEADEBB\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\2B1E51D87B2D71A44BB42DDD5E894160\InstallProperties\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\2B1E51D87B2D71A44BB42DDD5E894160\InstallProperties\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Installer\Folders not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toobar not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{3B0118C8-8D12-46CD-A083-2116D587A11F} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B0118C8-8D12-46CD-A083-2116D587A11F}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{C39DB3DF-7935-4821-9BD7-170D277DA935} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C39DB3DF-7935-4821-9BD7-170D277DA935}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{6B2163BE-A595-4E6E-AAF0-E22A29D38262} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6B2163BE-A595-4E6E-AAF0-E22A29D38262}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A49227EB-05C7-449A-9BB6-18F653936F32} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A49227EB-05C7-449A-9BB6-18F653936F32}\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{3B0118C8-8D12-46CD-A083-2116D587A11F} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B0118C8-8D12-46CD-A083-2116D587A11F}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{C39DB3DF-7935-4821-9BD7-170D277DA935} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C39DB3DF-7935-4821-9BD7-170D277DA935}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{6B2163BE-A595-4E6E-AAF0-E22A29D38262} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6B2163BE-A595-4E6E-AAF0-E22A29D38262}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A49227EB-05C7-449A-9BB6-18F653936F32} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A49227EB-05C7-449A-9BB6-18F653936F32}\ not found.
Unable to set value : HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\ProxyStubClsid32\\@|"{B056521A-9B10-425E-B616-1FCD828DB3B1}" /E!
Unable to set value : HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\ProxyStubClsid32\\@|"{B056521A-9B10-425E-B616-1FCD828DB3B1}" /E!
Unable to set value : HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\\@|"ISearchQueryHelper" /E!
Unable to set value : HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\ProxyStubClsid32\\@|"{B056521A-9B10-425E-B616-1FCD828DB3B1}" /E!
========== FILES ==========
File/Folder C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\SearchquWebSearch.xml not found.
File/Folder C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\searchqutoolbar not found.
File/Folder C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\{99079a25-328f-4bd4-be04-00955acaa0a7} not found.
File/Folder C:\Users\Michaella\AppData\Roaming\Microsoft\Windows\Cookies\*@sweetim[1].txt not found.
File/Folder C:\Users\Michaella\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@ilivid[1].txt not found.
File/Folder C:\Users\Michaella\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@ilivid[2].txt not found.
File/Folder C:\Users\Michaella\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@searchqu[1].txt not found.
File/Folder C:\Users\Michaella\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@searchqu[2].txt not found.
File/Folder C:\Users\Michaella\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@stats.ilivid[1].txt not found.
File/Folder C:\Users\Michaella\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@sweetim[1].txt not found.
File/Folder C:\Users\Michaella\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@www.sweetim[2].txt not found.
File/Folder C:\Users\Michaella\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@www.sweetim[3].txt not found.
File/Folder C:\Users\Michaella\AppData\Local\Ilivid Player not found.
File/Folder C:\Users\Michaella\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\iLividSetupV1.exe not found.
File/Folder C:\Users\Michaella\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ilivid[1].7z not found.
File/Folder C:\Users\Michaella\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SetupDataMngr_Searchqu[1].exe not found.
File/Folder C:\Users\Michaella\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SweetImSetup.exe not found.
File/Folder C:\Users\Michaella\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BandooV6[1].exe not found.
File/Folder C:\Users\Michaella\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\searchqu_net[1].htm not found.
File/Folder C:\Users\MICHAE~1\AppData\Local\Temp\BandooFiles not found.
File/Folder C:\Users\MICHAE~1\AppData\Local\Temp\BandooV6.exe not found.
File/Folder C:\Users\MICHAE~1\AppData\Local\Temp\SetupDataMngr_Searchqu.exe not found.
File/Folder C:\Users\MICHAE~1\AppData\Local\Temp\SweetIMReinstall not found.
File/Folder C:\Users\MICHAE~1\AppData\Local\Temp\SweetIMReinstall\SweetImSetup.exe not found.
File/Folder C:\Users\MICHAE~1\AppData\Local\Temp\ilivid.7z not found.
File/Folder C:\Users\MICHAE~1\AppData\Local\Temp\searchqu.ini not found.
File/Folder C:\Users\MICHAE~1\AppData\Local\Temp\searchqutoolbar-manifest.xml not found.
File/Folder C:\Users\Michaella\AppData\LocalLow\searchquband not found.
File/Folder C:\Users\Michaella\AppData\LocalLow\searchqutoolbar not found.
File/Folder C:\Users\Michaella\Downloads\SweetImSetup.exe not found.
File/Folder C:\Users\Michaella\Downloads\iLividSetupV1.exe not found.
C:\Users\Michaella\AppData\LocalLow\DataMngr folder moved successfully.
File/Folder C:\Users\Michaella\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3AJVC1WF\www.ilivid[1].xml not found.
File/Folder C:\Users\Michaella\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\TYBUQFS4\www.searchqu[1].xml not found.
File\Folder C:\Windows\Prefetch\SEARCHQU TOOLBAR UNINSTALL.EX-4EFDDDEA.pf not found.
File\Folder C:\Program Files\Windows iLivid Toolbar not found.
File\Folder C:\Program Files\iLivid not found.
File\Folder C:\Windows\Prefetch\ILIVID* not found.
File\Folder C:\Windows\Prefetch\SEARCHQUMEDIABAR* not found.
File\Folder C:\Windows\Prefetch\SETUPDATAMNGR* not found.
File\Folder C:\Program Files (x86)\iLivid not found.
File\Folder C:\Program Files (x86)\Windows Savevid Toolbar not found.
File\Folder C:\Program Files (x86)\Savevid not found.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Michaella\Desktop\cmd.bat deleted successfully.
C:\Users\Michaella\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56478 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Journal

User: Mcx1-WILSON
->Temp folder emptied: 412 bytes
->Temporary Internet Files folder emptied: 406124 bytes
->Flash cache emptied: 56478 bytes

User: Michaella
->Temp folder emptied: 92091471 bytes
->Temporary Internet Files folder emptied: 597729233 bytes
->Java cache emptied: 8647115 bytes
->FireFox cache emptied: 66381785 bytes
->Flash cache emptied: 15266042 bytes

User: Public

User: RegBack

User: systemprofile

User: TxR

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 17893832 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42287714 bytes
RecycleBin emptied: 9345 bytes

Total Files Cleaned = 802.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 04272013_100912
Files\Folders moved on Reboot...
C:\Users\Michaella\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Michaella\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Y93OWJKZ\1095952-laptop-slow-freezing-6[1].htm moved successfully.
C:\Users\Michaella\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Michaella\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...


----------



## ste08ball (Apr 12, 2013)

hi mark i ran and posted what you asked and a dialog box with this keeps popping up 
C:\Program Files\Trend Micro\UniClient\UiFrmWrk

also i keep getting told my virgin media security has been turned off however when i turn it back on it goes off again and the dialog box above opens up again


----------



## Mark1956 (May 7, 2011)

Difficult to be sure what is causing that problem, but I doubt the above scan has caused it, as it only removed a couple of items of Adware.

There might be some file damage to either the Firewall or Virgin Media Security. To try and establish the cause please uninstall the Trend Micro Firewall and then let me know if the pop up warning stops appearing and if the problem with Virgin Media stops.

Please also run another scan with ADWCleaner and post the new log, use the Delete button just as before.

I would also like you to run these two scans to check the file system on the hard drive and to check for any damaged system files.


Click on *Start* and type *cmd* in the search box. Right click on *cmd* in the popup menu and select *Run as Administrator*.
Another box will open, at the Command Prompt, type *sfc /scannow* and press Enter. (Note the gap between the c and the /) 
Let the check run to completion. *DO NOT* reboot the PC or close the *cmd* window.
Copy & Paste the following command at the Command Prompt and press Enter:

* findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >%userprofile%\Desktop\sfcdetails.txt*


This will place a file on your desktop called *sfcdetails.txt* which contains the results of the scan.
Copy and Paste the contents of the file into your next post.

=======================================================

*Disk Check*


Click on *Start* then type *cmd* in the search box. A menu will pop up with *cmd* at the top, *right click* on it and select *Run as Administrator*. Another box will open, at the prompt type *chkdsk /r* and hit *Enter*._ *Note:* you must include a space between the *k* and the */*_
You will then see the following message:
*chkdsk* cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts?* (Y/N)*
Type *Y* for yes, and hit *Enter*. Then reboot the computer. 
*chkdsk* will start when Windows begins loading again. Let all 5 phases run and don't use or turn off the computer. (_The *chkdsk* process may take an hour or more to finish, if it appears to freeze this is normal so *do not* interrupt it. On drives above 500GB it can take several hours._)
When the Disk Check is done, it will finish loading Windows.

Then follow this guide to find the *chkdsk* log. *NOTE:* You need to do the search for *wininit* not *chkdsk*.
Windows 7 Disk Check log

Once the log is in view then click on* Copy* in the right hand pane and select *"Copy details as text".*
You can then *right click* on the message box on this forum and select *Paste* and the log will appear, add any further information asked for and then click on *Submit/Post Quick Reply* and your done.


----------



## ste08ball (Apr 12, 2013)

how do i uninstall it


----------



## Mark1956 (May 7, 2011)

When you open Programs & Features from the Control Panel is it in the list?

If not, click on Start, All Programs, look down the list for Trend Micro, if it is there, click on it and see if it shows an option to uninstall or Add Remove components.

If it does not show anywhere or it is only shown in the Programs list after opening the Stat menu, but there is no option to uninstall or modify it, let me know.

I'd just like to mention that as you had so many security programs installed there is a distinct possibility that they have damaged each others files, this could also be the reason why are are seeing the pop ups.


----------



## ste08ball (Apr 12, 2013)

hey mark just checked its not on the list


----------



## Mark1956 (May 7, 2011)

I'll have to guess that you also checked in the All Programs list from the Start menu.

Ok, lets just check if it is actually up and running.

Click on Start, then Control Panel, in the Control Panel click on Action Center.
Click on the button next to 'Security' and send me a screenshot.
Also, (still in the Action Center) click on 'View Installed Firewall Programs' and tell me what it shows.

How to take a screen shot in Vista/Windows 7

*How to attach a screenshot.*
Below the *Message Box* click on *Go Advanced*. Then scroll down until you see a button, *Manage Attachments*. Click on it and a new window opens.
• Click on the *Browse* button, find the screenshot/folder you made earlier and doubleclick on it.
• Now click on the *Upload* button. When done, click on the *Close this window* button at the top of the page.
• Enter your message-text in the message box, then click on *Submit Message/Reply.*


----------



## ste08ball (Apr 12, 2013)

hi mark ive attached this as requested and i cant find on action centre anything about firewalls


----------



## Mark1956 (May 7, 2011)

That screenshot shows an entry for Firewalls, not too sure why you can't see it. I have attached a screenshot of the entry, open the Action Center again and click on the line View installed firewall programs and tell me what it shows.

The screenshot you sent also clearly shows your Anti Virus is not running which we will need to deal with, as your system is not very well protected until we sort it out keep internet use to a bare minimum and only visit trusted sites like this one and others you may need to go to to download any further tools required.


----------



## ste08ball (Apr 12, 2013)

i didnt look under that section i will look throughly next time i have attached what it says


----------



## Mark1956 (May 7, 2011)

Ok, the Trend Micro Firewall is there, but as you cannot find the program anywhere and your Anti Virus is having a problem staying switched on please do the following.

Uninstall Virgin Media Security and then go here and install this: Microsoft Security Essentials, it is an excellent free Anti Virus from Microsoft and gives a good all round level of protection.

Once you have installed MSE launch the program and allow it to update. Then run a Full system scan with it and delete anything it finds, make a note of any detections and put them in your next post.

MSE will create a small green icon in the bottom left corner of the screen, keep an eye on it and let me know if it changes colour.

Next: We need to search for and remove the Trend Micro Firewall. As seen in the Action Center the Windows Firewall is active so you are covered by that until we can install something better.

Please download *SystemLook* from the following link below and save it to your Desktop.


*SystemLook (64-bit)*


Double-click *SystemLook.exe* to run it.
_*Vista*/*Windows 7* users right-click and select Run As Administrator_.
Copy and paste everything in the codebox below into the main textfield:


```
:filefind
*Trend*
:folderfind
*Trend*
:reg
*Trend*
```

Click the Look button to start the scan.
When finished, a Notepad window will open SystemLook.txt with the results of the search and save a copy on your Desktop.
Please copy and paste the contents of that log in your next reply.


----------



## ste08ball (Apr 12, 2013)

just removed virgin media security installed microsoft security essentials its just done a quick scan and said no threats were fine so im going to now do a full system scan and then i will download system look


----------



## Mark1956 (May 7, 2011)

Ok, good progress, the full scan may take a couple of hours or more as it scans the entire hard drive so be patient with it.


----------



## ste08ball (Apr 12, 2013)

i've ran the full scan mse its clear nothing was found.
i've downloaded systemlook and heres the results.

SystemLook 30.07.11 by jpshortstuff
Log created at 10:06 on 28/04/2013 by Michaella
Administrator - Elevation successful
========== filefind ==========
Searching for "*Trend*"
C:\ProgramData\Trend Micro\_Trend_Vizor_ShortCut_S-1-5-21-3295424948-2256899820-3586588129-1000.log --a---- 124322 bytes [20:54 05/07/2012] [22:05 27/04/2013] 10FEF75BDBDC00A98DB80701B16B94F9
C:\ProgramData\Trend Micro\_Trend_Vizor_TiPreAU_S-1-5-21-3295424948-2256899820-3586588129-1000.log --a---- 11801790 bytes [11:24 20/04/2012] [07:20 27/04/2013] A1D3D5C816BBB85CD6970E612780839E
C:\ProgramData\Trend Micro\_Trend_Vizor_TMSTOOL_S-1-5-21-3295424948-2256899820-3586588129-1000.log --a---- 1637138 bytes [20:54 05/07/2012] [22:07 27/04/2013] D1B16BC30A2668F369B750B0FEE552EE
C:\ProgramData\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-3295424948-2256899820-3586588129-1000.log --a---- 3258 bytes [20:54 05/07/2012] [22:05 27/04/2013] D4907B20D993F22508DC0921BC7F57CB
C:\Users\All Users\Trend Micro\_Trend_Vizor_ShortCut_S-1-5-21-3295424948-2256899820-3586588129-1000.log --a---- 124322 bytes [20:54 05/07/2012] [22:05 27/04/2013] 10FEF75BDBDC00A98DB80701B16B94F9
C:\Users\All Users\Trend Micro\_Trend_Vizor_TiPreAU_S-1-5-21-3295424948-2256899820-3586588129-1000.log --a---- 11801790 bytes [11:24 20/04/2012] [07:20 27/04/2013] A1D3D5C816BBB85CD6970E612780839E
C:\Users\All Users\Trend Micro\_Trend_Vizor_TMSTOOL_S-1-5-21-3295424948-2256899820-3586588129-1000.log --a---- 1637138 bytes [20:54 05/07/2012] [22:07 27/04/2013] D1B16BC30A2668F369B750B0FEE552EE
C:\Users\All Users\Trend Micro\_Trend_Vizor_VizorHtmlDialog_S-1-5-21-3295424948-2256899820-3586588129-1000.log --a---- 3258 bytes [20:54 05/07/2012] [22:05 27/04/2013] D4907B20D993F22508DC0921BC7F57CB
C:\Users\Michaella\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UUD89D83\webtrends[1].js --a---- 25340 bytes [11:33 27/04/2013] [11:33 27/04/2013] F790984984E6846B74D015CB98EC00A5
C:\Users\Michaella\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZCQKP0RM\webtrends[1].js --a---- 33118 bytes [22:18 27/04/2013] [22:18 27/04/2013] CD8EFD008511C0E4AABED27CEB8F633A
C:\Windows\Temp\_Trend_Vizor_TMSTOOL_ForceRemove.log --a---- 50906 bytes [22:07 27/04/2013] [22:09 27/04/2013] 41B6D58127E3222749FB12434B2816C9
========== folderfind ==========
Searching for "*Trend*"
C:\Program Files\Trend Micro d------ [11:11 20/04/2012]
C:\Program Files (x86)\Trend Micro d------ [16:12 13/04/2013]
C:\ProgramData\Trend Micro d------ [11:12 20/04/2012]
C:\Users\All Users\Trend Micro d------ [11:12 20/04/2012]
C:\Users\Michaella\AppData\Local\VirtualStore\Program Files (x86)\Trend Micro d------ [14:44 13/04/2013]
C:\Windows\System32\config\systemprofile\AppData\Roaming\Trend Micro d------ [11:13 20/04/2012]
========== reg ==========
[*Trend*]
Hive unrecognized.
-= EOF =-


----------



## Mark1956 (May 7, 2011)

Ok, we can now remove the Trend Micro files and folders. When this is complete please run the system for a while and tell me if the pop up warnings have stopped.

Please download *OTM by OldTimer*. Save it to your desktop.

Double click *OTM.exe* to start the tool.


*Copy* the text in the code box below to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose *Copy*):


```
:Processes
explorer.exe
:Files
C:\ProgramData\Trend Micro
C:\Program Files\Trend Micro
C:\Program Files (x86)\Trend Micro
C:\Users\All Users\Trend Micro
C:\Users\Michaella\AppData\Local\VirtualStore\Program Files (x86)\Trend Micro
C:\Windows\System32\config\systemprofile\AppData\Roaming\Trend Micro
:Commands
[createrestorepoint]
[emptyflash]
[emptytemp]
[resethosts]
[reboot]
```

 Return to OTM, right click in the *"Paste Instructions for Items to be Moved"* window (under the yellow bar) and choose *Paste*.
Click the red *Moveit!* button.
All your desktop icons will disappear as the scan begins. It should complete within a few minutes.
Once complete you may see a box appear asking you to Restart the system to complete the file removal, accept it and it will reboot.
Even if that box does not appear the system should reboot as the command is included in the script.
When the system has come back to the desktop a Notepad document will open, please copy and paste that into your next post.

-- Note: The logs are saved here: C:\_OTM\MovedFiles


----------



## ste08ball (Apr 12, 2013)

downloaded and ran otm. also no more pop up warnings

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
C:\ProgramData\Trend Micro\Corridor folder moved successfully.
C:\ProgramData\Trend Micro folder moved successfully.
C:\Program Files\Trend Micro\UniClient folder moved successfully.
C:\Program Files\Trend Micro\Titanium folder moved successfully.
C:\Program Files\Trend Micro\AMSP folder moved successfully.
C:\Program Files\Trend Micro folder moved successfully.
C:\Program Files (x86)\Trend Micro\HiJackThis folder moved successfully.
C:\Program Files (x86)\Trend Micro folder moved successfully.
File/Folder C:\Users\All Users\Trend Micro not found.
C:\Users\Michaella\AppData\Local\VirtualStore\Program Files (x86)\Trend Micro\HiJackThis\backups folder moved successfully.
C:\Users\Michaella\AppData\Local\VirtualStore\Program Files (x86)\Trend Micro\HiJackThis folder moved successfully.
C:\Users\Michaella\AppData\Local\VirtualStore\Program Files (x86)\Trend Micro folder moved successfully.
File/Folder C:\Windows\System32\config\systemprofile\AppData\Roaming\Trend Micro not found.
========== COMMANDS ==========
Restore point Set: OTM Restore Point

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Journal

User: Mcx1-WILSON
->Flash cache emptied: 0 bytes

User: Michaella
->Flash cache emptied: 5083 bytes

User: Public

User: RegBack

User: systemprofile

User: TxR

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Journal

User: Mcx1-WILSON
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Michaella
->Temp folder emptied: 3621317 bytes
->Temporary Internet Files folder emptied: 171727198 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: RegBack

User: systemprofile

User: TxR

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1142823727 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33505 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 49621 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1,257.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTM by OldTimer - Version 3.1.21.0 log created on 04282013_125919
Files moved on Reboot...
C:\Users\Michaella\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
Registry entries deleted on Reboot...


----------



## Mark1956 (May 7, 2011)

Ok, that has now sorted out your security software, so back to the Adware that we have been fighting.

Please run another scan with ADWCleaner using the Delete button and post the log.

Please also tell me if your PC is showing any remaining performance issues.


----------



## ste08ball (Apr 12, 2013)

it says my adw cleaner is a outdated version and sent me to a page to download the updated version i saved but then security said it could harm my comp has its not downloaded alot what should i do i pressed delete until you 
advise me thx


----------



## Mark1956 (May 7, 2011)

That is quite normal behavior as the software is updated on a regular basis. Ignore any warnings and install the update, it is perfectly safe.


----------



## ste08ball (Apr 12, 2013)

# AdwCleaner v2.300 - Logfile created 04/29/2013 at 00:43:36
# Updated 28/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Michaella - WILSON
# Boot Mode : Normal
# Running from : C:\Users\Michaella\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Deleted on reboot : C:\ProgramData\Browser Manager
Deleted on reboot : C:\ProgramData\BrowserProtect
Deleted on reboot : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
File Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\searchplugins\delta.xml
Folder Deleted : C:\Program Files (x86)\Delta
Folder Deleted : C:\Program Files (x86)\Mozilla Firefox\Extensions\[email protected]
Folder Deleted : C:\Program Files (x86)\TornTV.com
Folder Deleted : C:\Program Files (x86)\Yontoo
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Users\Michaella\AppData\LocalLow\Delta
Folder Deleted : C:\Users\Michaella\AppData\Roaming\BabSolution
Folder Deleted : C:\Users\Michaella\AppData\Roaming\Babylon
Folder Deleted : C:\Users\Michaella\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect
Folder Deleted : C:\Users\Michaella\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com
Folder Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\extensions\[email protected]
Folder Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\[email protected]
Folder Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\[email protected]
Folder Deleted : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\jetpack
Folder Deleted : C:\Users\Michaella\AppData\Roaming\Yontoo
***** [Registry] *****
Data Deleted : HKLM\..\Windows [AppInit_DLLs] = c:\progra~3\browse~2\261249~1.132\{c16c1~1\browse~1.dll
Key Deleted : HKCU\Software\1ClickDownload
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\BabylonToolbar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Delta
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{82E1477C-B154-48D3-9891-33D83C26BCD3}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKCU\Software\52ede8cb33ebf42
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Key Deleted : HKLM\SOFTWARE\Classes\delta.deltaappCore
Key Deleted : HKLM\SOFTWARE\Classes\delta.deltaappCore.1
Key Deleted : HKLM\SOFTWARE\Classes\delta.deltadskBnd
Key Deleted : HKLM\SOFTWARE\Classes\delta.deltadskBnd.1
Key Deleted : HKLM\SOFTWARE\Classes\delta.deltaHlpr
Key Deleted : HKLM\SOFTWARE\Classes\delta.deltaHlpr.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Deleted : HKLM\SOFTWARE\Classes\esrv.deltaESrvc
Key Deleted : HKLM\SOFTWARE\Classes\esrv.deltaESrvc.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Key Deleted : HKLM\Software\Delta
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\52ede8cb33ebf42
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Delta
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Key Deleted : HKLM\SOFTWARE\Tarma Installer
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Yontoo Desktop]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{82E1477C-B154-48D3-9891-33D83C26BCD3}]
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16476
[OK] Registry is clean.
-\\ Mozilla Firefox v15.0 (en-US)
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\user.js ... Deleted !
[OK] File is clean.
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\prefs.js
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\user.js ... Deleted !
Deleted : user_pref("browser.search.selectedEngine", "Delta Search");
Deleted : user_pref("browser.newtab.url", "hxxp://www2.delta-search.com/?affID=119776&babsrc=NT_ss&mntrId=980E[...]
Deleted : user_pref("browser.startup.homepage", "hxxp://www2.delta-search.com/?affID=119776&babsrc=HP_ss&mntrI[...]
*************************
AdwCleaner[S1].txt - [21475 octets] - [14/04/2013 18:03:19]
AdwCleaner[S2].txt - [1182 octets] - [16/04/2013 02:32:01]
AdwCleaner[S3].txt - [5126 octets] - [17/04/2013 16:54:54]
AdwCleaner[S4].txt - [1302 octets] - [20/04/2013 16:55:31]
AdwCleaner[S5].txt - [406 octets] - [28/04/2013 22:01:51]
AdwCleaner[S6].txt - [10024 octets] - [29/04/2013 00:43:36]
########## EOF - C:\AdwCleaner[S6].txt - [10085 octets] ##########


----------



## ste08ball (Apr 12, 2013)

the performance seems to be ok at the moment if anything it may be a little slow but big improvements on when we started this operation


----------



## Mark1956 (May 7, 2011)

Glad to hear it is running better, but that last scan has found many items of Adware that have returned, it may take a few more runs to clean it all out and if it keeps coming back we will have to do a search for the items and then run something else to delete them.

Please now run ADWCleaner again using the Delete button and post the new log, then reboot the system and run it again and post that log also.


----------



## ste08ball (Apr 12, 2013)

# AdwCleaner v2.300 - Logfile created 04/29/2013 at 01:30:40
# Updated 28/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Michaella - WILSON
# Boot Mode : Normal
# Running from : C:\Users\Michaella\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Deleted on reboot : C:\ProgramData\Browser Manager
Deleted on reboot : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
Folder Deleted : C:\ProgramData\BrowserProtect
***** [Registry] *****

***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16476
[OK] Registry is clean.
-\\ Mozilla Firefox v15.0 (en-US)
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js
[OK] File is clean.
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\prefs.js
[OK] File is clean.
*************************
AdwCleaner[S1].txt - [21475 octets] - [14/04/2013 18:03:19]
AdwCleaner[S2].txt - [1182 octets] - [16/04/2013 02:32:01]
AdwCleaner[S3].txt - [5126 octets] - [17/04/2013 16:54:54]
AdwCleaner[S4].txt - [1302 octets] - [20/04/2013 16:55:31]
AdwCleaner[S5].txt - [406 octets] - [28/04/2013 22:01:51]
AdwCleaner[S6].txt - [10143 octets] - [29/04/2013 00:43:36]
AdwCleaner[S7].txt - [1401 octets] - [29/04/2013 01:30:40]
########## EOF - C:\AdwCleaner[S7].txt - [1461 octets] ##########


----------



## ste08ball (Apr 12, 2013)

# AdwCleaner v2.300 - Logfile created 04/29/2013 at 01:38:20
# Updated 28/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Michaella - WILSON
# Boot Mode : Normal
# Running from : C:\Users\Michaella\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Deleted on reboot : C:\ProgramData\Browser Manager
Deleted on reboot : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
***** [Registry] *****

***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16476
[OK] Registry is clean.
-\\ Mozilla Firefox v15.0 (en-US)
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js
[OK] File is clean.
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\prefs.js
[OK] File is clean.
*************************
AdwCleaner[S1].txt - [21475 octets] - [14/04/2013 18:03:19]
AdwCleaner[S2].txt - [1182 octets] - [16/04/2013 02:32:01]
AdwCleaner[S3].txt - [5126 octets] - [17/04/2013 16:54:54]
AdwCleaner[S4].txt - [1302 octets] - [20/04/2013 16:55:31]
AdwCleaner[S5].txt - [406 octets] - [28/04/2013 22:01:51]
AdwCleaner[S6].txt - [10143 octets] - [29/04/2013 00:43:36]
AdwCleaner[S7].txt - [1530 octets] - [29/04/2013 01:30:40]
AdwCleaner[S8].txt - [1413 octets] - [29/04/2013 01:38:20]
########## EOF - C:\AdwCleaner[S8].txt - [1473 octets] ##########


----------



## Mark1956 (May 7, 2011)

Ok, it's looking better but there are some persistent items so we need to do a search. Make sure you copy everything in the Code box, this will search for the returning items plus any remnants of the ones already removed.


Double-click *SystemLook.exe* to run it.
_*Vista*/*Windows 7* users right-click and select Run As Administrator_.
Copy and paste everything in the codebox below into the main textfield:


```
:filefind
*ilivid*
*babylon*
*whitesmoke*
*protector*
*searchqu*
*conduit*
*freeze*
*iminstaller*
*datamngr*
*yontoo*
*sweetie*
*sweetim*
*bandoo*
*browsermngr*
*browsercompanion*
*smartbar*
*pricegong*
*crossrider*
*funmoods*
*trolltech*
*delta*
*1ClickDownload*
*tarma*

:folderfind
*ilivid*
*babylon*
*whitesmoke*
*protector*
*searchqu*
*conduit*
*freeze*
*iminstaller*
*datamngr*
*yontoo*
*sweetie*
*sweetim*
*bandoo*
*browsermngr*
*browsercompanion*
*smartbar*
*pricegong*
*crossrider*
*funmoods*
*trolltech*
*delta*
*1ClickDownload*
*tarma*

:regfind
ilivid
babylon
whitesmoke
bprotector
searchqu
conduit
freeze
iminstaller
datamngr
yontoo
sweetie
sweetim
bandoo
browsermngr
browsercompanion
smartbar
pricegong
crossrider
funmoods
trolltech
delta
1ClickDownload
tarma
```

Click the Look button to start the scan.
When finished, a Notepad window will open SystemLook.txt with the results of the search and save a copy on your Desktop.
Please copy and paste the contents of that log in your next reply.


----------



## ste08ball (Apr 12, 2013)

SystemLook 30.07.11 by jpshortstuff
Log created at 11:11 on 29/04/2013 by Michaella
Administrator - Elevation successful
========== filefind ==========
Searching for "*ilivid*"
No files found.
Searching for "*babylon*"
No files found.
Searching for "*whitesmoke*"
No files found.
Searching for "*protector*"
C:\Program Files (x86)\SProtector\sprotector.dll --a---- 379392 bytes [17:25 31/05/2012] [17:25 31/05/2012] 829D0A62CD404C4815439B8BDC0B31D1
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\modules\SearchProtector.jsm ------- 34674 bytes [14:11 01/05/2012] [23:39 17/04/2012] 5FA151FF96ABE41855052E93F775BA74
Searching for "*searchqu*"
No files found.
Searching for "*conduit*"
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\iSyncConduit.dll --a---- 1207392 bytes [11:43 06/12/2012] [11:43 06/12/2012] C963B2DECF0872C4A79D4E5E97062E8C
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\ConduitAutoCompleteSearch.js ------- 9052 bytes [14:11 01/05/2012] [23:39 17/04/2012] AF98421711C6CFA73D6720C455D92DAC
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\ConduitAutoCompleteSearch.xpt ------- 166 bytes [14:11 01/05/2012] [23:39 17/04/2012] 806EA6CC4DCBF88A20AA3331BCDC9918
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\searchplugin\conduit.xml ------- 935 bytes [14:11 01/05/2012] [23:39 17/04/2012] 9680591A24B87500B3F9FD45ACD250E8
Searching for "*freeze*"
C:\Program Files (x86)\Infogrames\RollerCoaster Tycoon 2\Tracks\Deep Freeze.TD6 --a---- 2024 bytes [19:14 15/03/2013] [11:48 20/06/2002] EC011C39196B7164B41E64D5AA5689C8
C:\Users\Michaella\Favorites\Computer freezes after 5-10 minutes of inactivity.... - Geeks to Go Forums.url --a---- 1300 bytes [16:06 12/04/2013] [14:24 13/04/2013] 7F6B4ACC626F2611EDA894CA40E9DD29
Searching for "*iminstaller*"
No files found.
Searching for "*datamngr*"
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF10_47.dll --a---- 736768 bytes [23:00 10/04/2013] [08:29 29/01/2013] E5F2670ADDDA22918453A13064E6D06A
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF11_47.dll --a---- 736768 bytes [23:00 10/04/2013] [08:29 29/01/2013] 9FCDE758D501AD05834A148E90DA028E
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF12_47.dll --a---- 736768 bytes [23:00 10/04/2013] [08:29 29/01/2013] 26577A4E480C0D7E011073132AA12642
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF13_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:30 29/01/2013] 914A0DBF9208622F923BCAD5AFA63E3F
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF3_47.dll --a---- 740352 bytes [23:00 10/04/2013] [08:27 29/01/2013] 63C9EA1C552D4F6EA9A3745DD161E1A8
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF4_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:27 29/01/2013] 8C9923A5ACC126BB88D860B68E05F2E7
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF5_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:27 29/01/2013] DB36E7A166D3A2CDC2AC65956CF3E16D
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF6_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:28 29/01/2013] 0376B046E5E1A6A44E8783E25701DDE4
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF7_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:28 29/01/2013] 9347C68E55D860CB049562BB62078603
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF8_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:28 29/01/2013] 7360CCAA940EDFED730CE9F48FF3ECB1
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF9_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:29 29/01/2013] 2CEBC0A78830846D2A18E02CCFF252F1
C:\Program Files (x86)\SRToolbar\Datamngr\datamngr.dll --a---- 1540096 bytes [22:59 10/04/2013] [08:31 29/01/2013] 21B1F4D43CBF432788A4E5A5092E93D3
C:\Program Files (x86)\SRToolbar\Datamngr\datamngrUI.exe --a---- 1683456 bytes [23:00 10/04/2013] [08:31 29/01/2013] 7C3A70BEB17C8F2A1BBE39F6B4AFEE67
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlp.xpt --a---- 1009 bytes [08:33 16/04/2013] [08:31 29/01/2013] C317A7493D9EB507391B0217CEEACAE1
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF10.dll --a---- 736768 bytes [08:33 16/04/2013] [08:29 29/01/2013] E5F2670ADDDA22918453A13064E6D06A
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF11.dll --a---- 736768 bytes [08:33 16/04/2013] [08:29 29/01/2013] 9FCDE758D501AD05834A148E90DA028E
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF12.dll --a---- 736768 bytes [08:33 16/04/2013] [08:29 29/01/2013] 26577A4E480C0D7E011073132AA12642
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF13.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 914A0DBF9208622F923BCAD5AFA63E3F
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF14.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 26209275084963CACD45B72BB46AC314
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF15.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 4C995E478C81222D31C20B0CB1751742
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF16.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 9054AC22CB45980755212C0EF216717D
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF17.dll --a---- 737280 bytes [08:33 16/04/2013] [08:31 29/01/2013] 54B28DCA6984A1D0E9C982610DE34F39
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF18.dll --a---- 737280 bytes [08:33 16/04/2013] [08:31 29/01/2013] 58107F0BB4569A388A8870E351FB1324
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF3.dll --a---- 740352 bytes [08:33 16/04/2013] [08:27 29/01/2013] 63C9EA1C552D4F6EA9A3745DD161E1A8
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF4.dll --a---- 737280 bytes [08:33 16/04/2013] [08:27 29/01/2013] 8C9923A5ACC126BB88D860B68E05F2E7
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF5.dll --a---- 737280 bytes [08:33 16/04/2013] [08:27 29/01/2013] DB36E7A166D3A2CDC2AC65956CF3E16D
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF6.dll --a---- 737280 bytes [08:33 16/04/2013] [08:28 29/01/2013] 0376B046E5E1A6A44E8783E25701DDE4
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF7.dll --a---- 737280 bytes [08:33 16/04/2013] [08:28 29/01/2013] 9347C68E55D860CB049562BB62078603
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF8.dll --a---- 737280 bytes [08:33 16/04/2013] [08:28 29/01/2013] 7360CCAA940EDFED730CE9F48FF3ECB1
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF9.dll --a---- 737280 bytes [08:33 16/04/2013] [08:29 29/01/2013] 2CEBC0A78830846D2A18E02CCFF252F1
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\content\DataMngr.js --a---- 19255 bytes [08:33 16/04/2013] [08:54 16/10/2012] 0482F311EC3BEFB2018232CC83E2D867
C:\Program Files (x86)\SRToolbar\Datamngr\x64\datamngr.dll --a---- 2018680 bytes [23:00 10/04/2013] [08:31 29/01/2013] A76CBD61AC008C25D6AA30E6F15BBAF5
Searching for "*yontoo*"
C:\Windows\Prefetch\YONTOODESKTOP.EXE-4C25B39F.pf --a---- 84006 bytes [04:17 28/04/2013] [18:04 28/04/2013] 40D50B254E9753268D2C1A969A7024CC
Searching for "*sweetie*"
No files found.
Searching for "*sweetim*"
No files found.
Searching for "*bandoo*"
No files found.
Searching for "*browsermngr*"
No files found.
Searching for "*browsercompanion*"
No files found.
Searching for "*smartbar*"
No files found.
Searching for "*pricegong*"
No files found.
Searching for "*crossrider*"
No files found.
Searching for "*funmoods*"
No files found.
Searching for "*trolltech*"
No files found.
Searching for "*delta*"
C:\Users\Michaella\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\R0O90FD4\www2.delta-search[1].xml --a---- 28142 bytes [11:42 26/04/2013] [11:52 28/04/2013] DE7A1E2481A3A7127022DA6FE20BA44C
C:\Windows\Prefetch\AM_DELTA_PATCH_1.149.774.0.EX-F45EA768.pf --a---- 8666 bytes [23:56 28/04/2013] [23:56 28/04/2013] 37898855334A4FCBE878BC1854FEB73A
C:\Windows\System32\msdelta.dll --a---- 451584 bytes [23:22 13/07/2009] [01:41 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\SysWOW64\msdelta.dll --a---- 305152 bytes [23:12 13/07/2009] [01:15 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
C:\Windows\winsxs\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_9c2159bf9f702069\msdelta.dll --a---- 451584 bytes [23:22 13/07/2009] [01:41 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\msdelta.dll --a---- 451584 bytes [02:55 14/07/2009] [02:55 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\msdelta.dll --a---- 451584 bytes [02:55 14/07/2009] [02:55 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17592_none_672ce6c3de2cb17f\msdelta.dll --a---- 451584 bytes [02:55 14/07/2009] [02:55 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\winsxs\FileMaps\$$_media_delta_0f36d7d9b4f7293c.cdf-ms --a---- 2436 bytes [02:59 14/07/2009] [05:32 14/07/2009] 0ED4291DC068EB860AC15A6E5360224C
C:\Windows\winsxs\Manifests\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_9c2159bf9f702069.manifest --a---- 2888 bytes [02:33 14/07/2009] [02:21 14/07/2009] 6B7D6AD4FA771B7D532B7AD67D396853
C:\Windows\winsxs\Manifests\amd64_microsoft-windows-deltapackageexpander_31bf3856ad364e35_6.1.7601.17514_none_c8049b9e4ba7658c.manifest --a---- 2461 bytes [03:17 21/11/2010] [03:17 21/11/2010] 8A388670A7B189FE5CE192B81E6F7401
C:\Windows\winsxs\Manifests\amd64_microsoft-windows-s..l-soundthemes-delta_31bf3856ad364e35_6.1.7600.16385_none_fbf7e0678b64a4b8.manifest --a---- 27794 bytes [02:17 14/07/2009] [02:18 14/07/2009] 2D159244CBBD3875345AFDD9C34B444B
C:\Windows\winsxs\Manifests\x86_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_4002be3be712af33.manifest --a---- 2886 bytes [02:33 14/07/2009] [01:54 14/07/2009] 110D843CC1C2B3A02A46D4AD962C04B6
C:\Windows\winsxs\Manifests\x86_microsoft-windows-deltapackageexpander_31bf3856ad364e35_6.1.7601.17514_none_6be6001a9349f456.manifest --a---- 2459 bytes [03:17 21/11/2010] [03:17 21/11/2010] 771093D6028BE8C764993524B6392E70
C:\Windows\winsxs\x86_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_4002be3be712af33\msdelta.dll --a---- 305152 bytes [23:12 13/07/2009] [01:15 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\msdelta.dll --a---- 305152 bytes [02:43 14/07/2009] [02:43 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\msdelta.dll --a---- 305152 bytes [02:43 14/07/2009] [02:43 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17592_none_0b0e4b4025cf4049\msdelta.dll --a---- 305152 bytes [02:43 14/07/2009] [02:43 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
Searching for "*1ClickDownload*"
No files found.
Searching for "*tarma*"
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac.common.ovl --a---- 256 bytes [13:24 23/03/2013] [14:31 08/09/2004] 75CA79973883A2061F6711026BFB2739
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac.unique.ovl --a---- 256 bytes [13:24 23/03/2013] [14:31 08/09/2004] 9B6BCEE0BCFF757C2E06894E36DEA489
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\TarmacTexture.common.ovl --a---- 67591 bytes [13:24 23/03/2013] [14:31 08/09/2004] BA4A2D1BEB67771D78A7D8FEE6C2151C
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\TarmacTexture.unique.ovl --a---- 393 bytes [13:24 23/03/2013] [14:31 08/09/2004] A5BCFEE5FF3B7C1E601F0EF25CB83AD6
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_A.common.ovl --a---- 14026 bytes [13:24 23/03/2013] [14:03 04/10/2004] 7267C9D3E2EFD6358C7C88D5E06EBCC3
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_A.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:03 04/10/2004] 7E87BD12777DF82EB1FA7A7D14EF45C0
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_B.common.ovl --a---- 17194 bytes [13:24 23/03/2013] [14:03 04/10/2004] 4191D8B0B46AA8A2A8AC96D358460A07
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_B.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:03 04/10/2004] B8558745ACDECA0DD7DCDCAE1DCD6A59
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_C.common.ovl --a---- 17194 bytes [13:24 23/03/2013] [14:03 04/10/2004] 0E2FA5DD184C754BB8A2FD0A493B2DEA
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_C.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:03 04/10/2004] A9EB28E01AFBAD817597FC293A488A1A
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_D.common.ovl --a---- 20346 bytes [13:24 23/03/2013] [14:03 04/10/2004] E7BFE1CB871CE0F1DE19E755B06E5BEC
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_D.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:03 04/10/2004] 8FDD4505FFB3A7575A2F1215DB87BFB0
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Flat.common.ovl --a---- 10255 bytes [13:24 23/03/2013] [14:03 04/10/2004] 3B5D8CFBDE00639055BE49C7DB85AD12
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Flat.unique.ovl --a---- 3834 bytes [13:24 23/03/2013] [14:03 04/10/2004] 75B38B38837E75CE3D2D6DD0338109BC
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Scenery.common.ovl --a---- 67591 bytes [13:24 23/03/2013] [14:31 08/09/2004] BA4A2D1BEB67771D78A7D8FEE6C2151C
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Scenery.unique.ovl --a---- 393 bytes [13:24 23/03/2013] [14:31 08/09/2004] A5BCFEE5FF3B7C1E601F0EF25CB83AD6
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope.common.ovl --a---- 23507 bytes [13:24 23/03/2013] [14:03 04/10/2004] 4277B4DB391ABB7402E7282402304441
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope.unique.ovl --a---- 4261 bytes [13:24 23/03/2013] [14:03 04/10/2004] 550D6840E5AF49F284ED52050208458B
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Mid.common.ovl --a---- 8084 bytes [13:24 23/03/2013] [14:03 04/10/2004] 1A212F14D9C2E8A6C05472D694C33393
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Mid.unique.ovl --a---- 3959 bytes [13:24 23/03/2013] [14:03 04/10/2004] C6945533D3330CB9F9751AB91399D783
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Straight.common.ovl --a---- 15795 bytes [13:24 23/03/2013] [14:03 04/10/2004] C83AEC916869FBB4CF933ADBC7D0E897
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Straight.unique.ovl --a---- 4504 bytes [13:24 23/03/2013] [14:03 04/10/2004] EF1EC7403BCE3C62725D5B7B6C24F42B
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Straight_left.common.ovl --a---- 11982 bytes [13:24 23/03/2013] [14:03 04/10/2004] 43D21A6BFEF1B2E4FFEA59DF42DB1610
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Straight_left.unique.ovl --a---- 4639 bytes [13:24 23/03/2013] [14:03 04/10/2004] 06E5DB132E55D892201A18529DD06B9A
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Straight_Right.common.ovl --a---- 12019 bytes [13:24 23/03/2013] [14:03 04/10/2004] C95A77EA1BCDD710616D5C105EFC5A79
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Straight_Right.unique.ovl --a---- 4666 bytes [13:24 23/03/2013] [14:03 04/10/2004] 7D3240EB13FD6EA841C995D9F8FD951B
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Straight_A.common.ovl --a---- 17530 bytes [13:24 23/03/2013] [14:03 04/10/2004] 70773B54B81E4C7F52D9F61EA50FC2F7
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Straight_A.unique.ovl --a---- 4396 bytes [13:24 23/03/2013] [14:03 04/10/2004] 852BF8F445B2B0BC7A58B58E12B56199
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Straight_B.common.ovl --a---- 13922 bytes [13:24 23/03/2013] [14:04 04/10/2004] 9B4D1442874CE0A634964738E0A3CB90
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Straight_B.unique.ovl --a---- 4396 bytes [13:24 23/03/2013] [14:04 04/10/2004] A371DF46ECEA57BCC9A31D59C3277344
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Stub.common.ovl --a---- 12788 bytes [13:24 23/03/2013] [10:58 28/09/2004] 2D65E121BD713C7CAC97007A37A9B0F6
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Stub.unique.ovl --a---- 13291 bytes [13:24 23/03/2013] [10:58 28/09/2004] C42B4DD606C300C80361F8236159CFA0
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Texture.common.ovl --a---- 176201 bytes [13:24 23/03/2013] [17:36 04/11/2004] 87BB6186D468BE9A13A78C44399B50EA
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Texture.unique.ovl --a---- 1285 bytes [13:24 23/03/2013] [17:36 04/11/2004] 0773383D06B45FD134001CEA5752A13D
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_L_A.common.ovl --a---- 22034 bytes [13:24 23/03/2013] [14:04 04/10/2004] B4710A15D678C5A53D404A2EB9E2D880
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_L_A.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:04 04/10/2004] B74B9746EE1776FBC1E7D433514E7810
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_L_B.common.ovl --a---- 18882 bytes [13:24 23/03/2013] [14:04 04/10/2004] 5BEEB5E9320B22B9670B9398EC2D699B
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_L_B.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:04 04/10/2004] 36CBA084BD6B178DB450DFB64D99C931
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_T_A.common.ovl --a---- 20130 bytes [13:24 23/03/2013] [14:04 04/10/2004] 895A9CC1075FA8146A1F89A5070C645F
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_T_A.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:04 04/10/2004] B5FC18F78171914C85786307717E4E41
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_T_B.common.ovl --a---- 16962 bytes [13:24 23/03/2013] [14:04 04/10/2004] EEF8332307D747D42389744F77FEDF25
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_T_B.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:04 04/10/2004] C8EE11F881FA80E861A70D534358AAB3
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_T_C.common.ovl --a---- 16962 bytes [13:24 23/03/2013] [14:04 04/10/2004] C3BB867EFD40226099C50F3CA5B46CD7
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_T_C.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:04 04/10/2004] 40BF8B2ED776629E5A3786753FD72029
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_U.common.ovl --a---- 23841 bytes [13:24 23/03/2013] [14:04 04/10/2004] 23E90BDEC0CC0FFDBF7358CA94581418
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_U.unique.ovl --a---- 4288 bytes [13:24 23/03/2013] [14:04 04/10/2004] 31C38D91E33860367B1C18DA9C1431AF
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_X.common.ovl --a---- 23385 bytes [13:24 23/03/2013] [14:04 04/10/2004] 1DA7F6D91AE751B5020471E3865DFE5D
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_X.unique.ovl --a---- 4288 bytes [13:24 23/03/2013] [14:04 04/10/2004] 6FC8855F41B715D44246E6B02A6DF10A
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\PathTarmacTextures.common.ovl --a---- 256 bytes [13:26 23/03/2013] [16:16 08/09/2004] 75CA79973883A2061F6711026BFB2739
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\PathTarmacTextures.unique.ovl --a---- 289 bytes [13:26 23/03/2013] [16:16 08/09/2004] A552067A472A8D984F25DD8FE28540AF
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac1m.common.ovl --a---- 6642 bytes [13:26 23/03/2013] [14:05 04/10/2004] C1123C0EDC1B59ADEDA59863BE5FFF30
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac1m.unique.ovl --a---- 2551 bytes [13:26 23/03/2013] [14:05 04/10/2004] D653459A8330B5A576D4A37F1F2B633C
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac1mbot.common.ovl --a---- 6721 bytes [13:26 23/03/2013] [14:05 04/10/2004] 5A1D5A519F3DC377C746A725C903EEF8
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac1mbot.unique.ovl --a---- 2602 bytes [13:26 23/03/2013] [14:05 04/10/2004] 2A7B031CA09487BB70974846C89D282A
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac1mbotextra.common.ovl --a---- 6847 bytes [13:26 23/03/2013] [14:05 04/10/2004] 062B31B393870B9BDF32B5640DA9F361
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac1mbotextra.unique.ovl --a---- 2687 bytes [13:26 23/03/2013] [14:05 04/10/2004] 0BA2A499B77F03E80C7D9C29566FAB02
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac2m.common.ovl --a---- 6642 bytes [13:26 23/03/2013] [14:05 04/10/2004] E7455CDAA47AD7424B62226A4597F991
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac2m.unique.ovl --a---- 2551 bytes [13:26 23/03/2013] [14:05 04/10/2004] BCD50182207DBD9E22AB623E6FEAC47A
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac4m.common.ovl --a---- 6642 bytes [13:26 23/03/2013] [14:05 04/10/2004] 1D7BF75016243A5C154BBE4056B7D4AA
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac4m.unique.ovl --a---- 2551 bytes [13:26 23/03/2013] [14:05 04/10/2004] 3DC6DE5F52CC8F1025719B59C9EDFFB3
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac8m.common.ovl --a---- 6642 bytes [13:26 23/03/2013] [14:05 04/10/2004] 5E8686E1374AE0F753FF4BFB77E3DAE5
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac8m.unique.ovl --a---- 2551 bytes [13:26 23/03/2013] [14:05 04/10/2004] 1007B6ADD2117F24FDF718549D6B756D
C:\Program Files (x86)\Infogrames\RollerCoaster Tycoon 2\ObjData\TARMAC.DAT --a---- 129962 bytes [19:14 15/03/2013] [01:51 13/09/2002] 898990ACB4C98903E4B9F12D6192B7FA
C:\Program Files (x86)\Infogrames\RollerCoaster Tycoon 2\ObjData\TARMACB.DAT --a---- 87601 bytes [19:14 15/03/2013] [01:51 13/09/2002] 97F2391F0503A3E227B1A6120B37C151
C:\Program Files (x86)\Infogrames\RollerCoaster Tycoon 2\ObjData\TARMACG.DAT --a---- 87521 bytes [19:14 15/03/2013] [01:51 13/09/2002] D6EF3DDAD271A466F8F7B679441115F2
========== folderfind ==========
Searching for "*ilivid*"
No folders found.
Searching for "*babylon*"
No folders found.
Searching for "*whitesmoke*"
No folders found.
Searching for "*protector*"
C:\Program Files (x86)\SProtector d------ [21:05 11/06/2012]
Searching for "*searchqu*"
No folders found.
Searching for "*conduit*"
No folders found.
Searching for "*freeze*"
No folders found.
Searching for "*iminstaller*"
No folders found.
Searching for "*datamngr*"
C:\Program Files (x86)\SRToolbar\Datamngr d------ [22:59 10/04/2013]
C:\_OTL\MovedFiles\04272013_100912\C_Users\Michaella\AppData\LocalLow\DataMngr d------ [14:29 01/05/2012]
Searching for "*yontoo*"
No folders found.
Searching for "*sweetie*"
No folders found.
Searching for "*sweetim*"
No folders found.
Searching for "*bandoo*"
No folders found.
Searching for "*browsermngr*"
No folders found.
Searching for "*browsercompanion*"
No folders found.
Searching for "*smartbar*"
No folders found.
Searching for "*pricegong*"
No folders found.
Searching for "*crossrider*"
No folders found.
Searching for "*funmoods*"
No folders found.
Searching for "*trolltech*"
No folders found.
Searching for "*delta*"
C:\Windows\Media\Delta dr--s-- [03:20 14/07/2009]
C:\Windows\winsxs\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_9c2159bf9f702069 d------ [03:20 14/07/2009]
C:\Windows\winsxs\amd64_microsoft-windows-deltapackageexpander_31bf3856ad364e35_6.1.7601.17514_none_c8049b9e4ba7658c d------ [03:24 21/11/2010]
C:\Windows\winsxs\amd64_microsoft-windows-s..l-soundthemes-delta_31bf3856ad364e35_6.1.7600.16385_none_fbf7e0678b64a4b8 d------ [05:30 14/07/2009]
C:\Windows\winsxs\x86_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_4002be3be712af33 d------ [03:20 14/07/2009]
C:\Windows\winsxs\x86_microsoft-windows-deltapackageexpander_31bf3856ad364e35_6.1.7601.17514_none_6be6001a9349f456 d------ [03:24 21/11/2010]
Searching for "*1ClickDownload*"
No folders found.
Searching for "*tarma*"
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac d------ [13:24 23/03/2013]
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac d------ [13:26 23/03/2013]
========== regfind ==========
Searching for "ilivid"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1 (1).exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1(2).exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\iLividSetupV1(2)_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\iLividSetupV1(2)_RASMANCS]
Searching for "babylon"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"
Searching for "whitesmoke"
No data found.
Searching for "bprotector"
No data found.
Searching for "searchqu"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}]
"SuggestionsURL_JSON"="http://www.searchqu.com/suggest.php...uid=2215230001324024&qu={searchTerms}&ft=json"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
@="ISearchQueryHelper"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
@="ISearchQueryHelper"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}]
"SuggestionsURL_JSON"="http://www.searchqu.com/suggest.php...uid=2215230001324024&qu={searchTerms}&ft=json"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}]
"SuggestionsURL_JSON"="http://www.searchqu.com/suggest.php...uid=2215230001324024&qu={searchTerms}&ft=json"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
@="ISearchQueryHelper"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}]
"SuggestionsURL_JSON"="http://www.searchqu.com/suggest.php...uid=2215230001324024&qu={searchTerms}&ft=json"
Searching for "conduit"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966]
"045F27F206F16624596059B2126D46D0"="C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\iSyncConduit.dll"
Searching for "freeze"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SQM\FreezeUploads]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\SQM\FreezeUploads]
Searching for "iminstaller"
No data found.
Searching for "datamngr"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fa966923-4278-4558-b29c-8145edf5aaa9}\InprocServer32]
@="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2\searchresultsDx.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\070F394B126DDE645BD3CA9084552369]
"00000000000000000000000000000000"="C:\Users\MICHAE~1\AppData\Local\Temp\SetupDataMngr_iMesh.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{26AE4809-8879-4B6A-A29E-42C460B8D7EE}]
"AppPath"="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2A2D6E15-A029-497A-BB7E-099CE833D69C}]
"AppPath"="C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\ToolBar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{943A386A-457F-4CD4-A4B0-0BB65F52537B}]
"AppPath"="C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A0D51E52-DDB7-43EA-B519-F88C8599F678}]
"AppPath"="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2C670EB-344A-410A-A8FA-0F11CAAA418C}]
"AppPath"="C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D66429E0-2304-453E-A8B9-AD269F1D4A49}]
"AppPath"="C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E3AB3D8D-AB44-47A1-9659-9571DEAD0E95}]
"AppPath"="C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fa966923-4278-4558-b29c-8145edf5aaa9}]
"AppPath"="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\fixbeetoolbargaw]
"DisplayIcon"="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2\install.ico"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\fixbeetoolbargaw]
"InstallLocation"="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\fixbeetoolbargaw]
"UninstallString"="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2\uninstall.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{fa966923-4278-4558-b29c-8145edf5aaa9}\InprocServer32]
@="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2\searchresultsDx.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
Searching for "yontoo"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-28A8_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-28A8_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0B90_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0B90_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-1760_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-1760_RASMANCS]
Searching for "sweetie"
No data found.
Searching for "sweetim"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\SweetIM]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\SweetIM]
Searching for "bandoo"
No data found.
Searching for "browsermngr"
No data found.
Searching for "browsercompanion"
No data found.
Searching for "smartbar"
No data found.
Searching for "pricegong"
No data found.
Searching for "crossrider"
No data found.
Searching for "funmoods"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\funmoods_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\funmoods_RASMANCS]
Searching for "trolltech"
No data found.
Searching for "delta"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\.Default\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\.Default\Delta]
@="C:\Windows\Media\Delta\Windows Ding.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Critical.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Insert.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Remove.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Fail.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Low.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
@="C:\Windows\Media\Delta\Windows Print complete.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
@="C:\Windows\Media\Delta\Windows Error.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
@="C:\Windows\Media\Delta\Windows Exclamation.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemExit\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
@="C:\Windows\Media\Delta\Windows Critical Stop.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
@="C:\Windows\Media\Delta\Windows Balloon.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
@="C:\Windows\Media\Delta\Windows Logoff Sound.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
@="C:\Windows\Media\Delta\Windows User Account Control.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
@="C:\Windows\Media\Delta\Windows Pop-up Blocked.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FaxError\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FaxLineRings\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FaxSent\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
@="C:\Windows\Media\Delta\Windows Feed Discovered.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
".saved"="C:\Windows\Media\Delta\Windows Navigation Start.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
@="C:\Windows\Media\Delta\Windows Information Bar.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\HubOnSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\PanelSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Names\Delta]
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Adobe\Shockwave 11\uicontrol\sw3dbaddriverlist1]
@="*2k*savage/ix!^5.12.01.7012$79x=stbnvidiatnt16mb!=4.10.01.9131$o2k=diamondstealthiiis530!=5.12.01.8007-8.30.24$72k=m!=5.00.2180.3711$***=atigraphicsproturbopci(atim64-gx)!^9999.0.0.0$ont=nvidiageforce256!=4.00.1381.0327$****virge!^9999.0.0.0$*9x=ibmthinkpad(cyber9397dvd)!=4.10.01.2173$79x=mach64:ragepro!=4.11.2560$*2k=m!^5.12.01.1200$o9x=intel(r)82810graphicscontroller!=4.12.01.2656$o**=m!^5.12.01.1509$o2k=3dfxvoodooseries!=5.00.2195.0197$ont=3dfxvoodooseries!=4.00.1381.0229$o2k=diamondstealthiiis540!=5.12.01.8007-8.30.24$*9x*permedia2!^4.10.01.2359$****mystique!^9999.0.0.0$*9x*g400!^4.12.1.1710$***=2164w!^9999.0.0.0$*9x=mach64:ragepro!^4.10.1720$ont*3dblasterriva!^4.03.00.2100$ont*nvidia!^4.00.1381.0508$79x*nvidia!^4.12.01.0513$o9x*diamondviperv770!^4.11.01.0402$****g100!^9999.0.0.0$59x*nvidiariva128!=4.10.1713$ont*radeon!^4.3.3109$o2k*voodoobanshee!=5.00.2195.2b$o***permedia3!^4.12.01.2107$o***ragefury!^4.3.
[HKEY_CURRENT_USER\Software\Macromedia\Shockwave 8\uicontrol\sw3dbaddriverlist1]
@="*2k*savage/ix!^5.12.01.7012$79x=stbnvidiatnt16mb!=4.10.01.9131$o2k=diamondstealthiiis530!=5.12.01.8007-8.30.24$72k=m!=5.00.2180.3711$***=atigraphicsproturbopci(atim64-gx)!^9999.0.0.0$ont=nvidiageforce256!=4.00.1381.0327$****virge!^9999.0.0.0$*9x=ibmthinkpad(cyber9397dvd)!=4.10.01.2173$79x=mach64:ragepro!=4.11.2560$*2k=m!^5.12.01.1200$o9x=intel(r)82810graphicscontroller!=4.12.01.2656$o**=m!^5.12.01.1509$o2k=3dfxvoodooseries!=5.00.2195.0197$ont=3dfxvoodooseries!=4.00.1381.0229$o2k=diamondstealthiiis540!=5.12.01.8007-8.30.24$*9x*permedia2!^4.10.01.2359$****mystique!^9999.0.0.0$*9x*g400!^4.12.1.1710$***=2164w!^9999.0.0.0$*9x=mach64:ragepro!^4.10.1720$ont*3dblasterriva!^4.03.00.2100$ont*nvidia!^4.00.1381.0508$79x*nvidia!^4.12.01.0513$o9x*diamondviperv770!^4.11.01.0402$****g100!^9999.0.0.0$59x*nvidiariva128!=4.10.1713$ont*radeon!^4.3.3109$o2k*voodoobanshee!=5.00.2195.2b$o***permedia3!^4.12.01.2107$o***ragefury!^4.3.139$o***rage128g
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\delta]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\delta\iestrg]
"prdct"="delta"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\delta\iestrg]
"prtnrid"="delta"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows Media\WMSDK\Namespace]
"LocalDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows Media\WMSDK\Namespace]
"RemoteDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\delta-search.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\Namespace]
"LocalDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML"
[HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\Namespace]
"RemoteDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML"
[HKEY_CURRENT_USER\Software\Synaptics\Scrybe\System\Symbols\4\delta]
[HKEY_CURRENT_USER\Software\Synaptics\Scrybe\System\Symbols\5\Delta]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Document]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Email]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Music]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Music]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Picture]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Picture]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Video]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Video]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Appointment]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Appointment]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Contact]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Contact]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Schedule.Meeting]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Schedule.Meeting]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Record\{8F6D68FF-81A4-3F8A-AD32-8E8DDDA7FC41}\2.0.0.0]
"Class"="System.Diagnostics.SymbolStore.SymbolLineDelta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Record\{8F6D68FF-81A4-3F8A-AD32-8E8DDDA7FC41}\4.0.0.0]
"Class"="System.Diagnostics.SymbolStore.SymbolLineDelta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msg]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msg]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_none_9afd56f432219a2e]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-deltapackageexpander_31bf3856ad364e35_none_0a20a2633b1984ad]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-s..l-soundthemes-delta_31bf3856ad364e35_none_f2cfa9dc6d3f5297]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-deltacompressionengine_31bf3856ad364e35_none_3edebb7079c428f8]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-deltapackageexpander_31bf3856ad364e35_none_ae0206df82bc1377]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\Half SD]
"WinSAT_CPU Delta"="-1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\HD Default]
"WinSAT_CPU Delta"="2.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MP4]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MPG-ISO]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MPG-TTS]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD Default]
"WinSAT_CPU Delta"="0.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD WMV]
"WinSAT_CPU Delta"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idle thread tha
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idl
[HKEY_LOCAL_MACHINE\SOFTWARE\Realtek\AECBF\icrcAudioProcessingDemo\GSCBeamformer\PostFiltering]
"delta"="0.000100"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Shockwave 11\uicontrol\sw3dbaddriverlist1]
@="*2k*savage/ix!^5.12.01.70129x=stbnvidiatnt16mb!=4.10.01.9131$o2k=diamondstealthiiis530!=5.12.01.8007-8.30.24$72k=m!=5.00.2180.3711$***=atigraphicsproturbopci(atim64-gx)!^9999.0.0.0$ont=nvidiageforce256!=4.00.1381.0327$****virge!^9999.0.0.0$*9x=ibmthinkpad(cyber9397dvd)!=4.10.01.2173$79x=mach64:ragepro!=4.11.2560$*2k=m!^5.12.01.1200$o9x=intel(r)82810graphicscontroller!=4.12.01.2656$o**=m!^5.12.01.1509$o2k=3dfxvoodooseries!=5.00.2195.0197$ont=3dfxvoodooseries!=4.00.1381.0229$o2k=diamondstealthiiis540!=5.12.01.8007-8.30.24$*9x*permedia2!^4.10.01.2359$****mystique!^9999.0.0.0$*9x*g400!^4.12.1.1710$***=2164w!^9999.0.0.0$*9x=mach64:ragepro!^4.10.1720$ont*3dblasterriva!^4.03.00.2100$ont*nvidia!^4.00.1381.0508$79x*nvidia!^4.12.01.0513$o9x*diamondviperv770!^4.11.01.0402$****g100!^9999.0.0.0$59x*nvidiariva128!=4.10.1713$ont*radeon!^4.3.3109$o2k*voodoobanshee!=5.00.2195.2b$o***permedia3!^4.12.01.2107$o***ragefury!^4.3.139$o***r
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\nohfdhapjjlndfgjnmdlcabloeembdkj]
"path"="C:\Users\Michaella\AppData\Roaming\BabSolution\CR\delta2.crx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\CVH\Connect\{90140011-0066-0409-0000-0000000FF1CE}]
"deltaCacheFolderName"="140066.enu-90140011-66-409"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\Half SD]
"WinSAT_CPU Delta"="-1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\HD Default]
"WinSAT_CPU Delta"="2.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MP4]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MPG-ISO]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MPG-TTS]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD Default]
"WinSAT_CPU Delta"="0.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD WMV]
"WinSAT_CPU Delta"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\009]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idl
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processo
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\.Default\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\.Default\Delta]
@="C:\Windows\Media\Delta\Windows Ding.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Critical.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Insert.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Remove.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Fail.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Low.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
@="C:\Windows\Media\Delta\Windows Print complete.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
@="C:\Windows\Media\Delta\Windows Error.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
@="C:\Windows\Media\Delta\Windows Exclamation.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemExit\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
@="C:\Windows\Media\Delta\Windows Critical Stop.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
@="C:\Windows\Media\Delta\Windows Balloon.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
@="C:\Windows\Media\Delta\Windows Logoff Sound.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
@="C:\Windows\Media\Delta\Windows User Account Control.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
@="C:\Windows\Media\Delta\Windows Pop-up Blocked.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FaxError\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FaxLineRings\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FaxSent\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
@="C:\Windows\Media\Delta\Windows Feed Discovered.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
@="C:\Windows\Media\Delta\Windows Navigation Start.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
@="C:\Windows\Media\Delta\Windows Information Bar.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\HubOnSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\PanelSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Names\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\.Default\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\.Default\Delta]
@="C:\Windows\Media\Delta\Windows Ding.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Critical.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Insert.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Remove.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Fail.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Low.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
@="C:\Windows\Media\Delta\Windows Print complete.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
@="C:\Windows\Media\Delta\Windows Error.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
@="C:\Windows\Media\Delta\Windows Exclamation.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemExit\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
@="C:\Windows\Media\Delta\Windows Critical Stop.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
@="C:\Windows\Media\Delta\Windows Balloon.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
@="C:\Windows\Media\Delta\Windows Logoff Sound.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
@="C:\Windows\Media\Delta\Windows User Account Control.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
@="C:\Windows\Media\Delta\Windows Pop-up Blocked.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FaxError\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FaxLineRings\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FaxSent\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
@="C:\Windows\Media\Delta\Windows Feed Discovered.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
@="C:\Windows\Media\Delta\Windows Navigation Start.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
@="C:\Windows\Media\Delta\Windows Information Bar.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubOnSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\PanelSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Names\Delta]
[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\Namespace]
"LocalDelta"="C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML"
[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\Namespace]
"RemoteDelta"="C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\.Default\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\.Default\Delta]
@="C:\Windows\Media\Delta\Windows Ding.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Critical.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Insert.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Remove.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Fail.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Low.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
@="C:\Windows\Media\Delta\Windows Print complete.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
@="C:\Windows\Media\Delta\Windows Error.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
@="C:\Windows\Media\Delta\Windows Exclamation.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemExit\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
@="C:\Windows\Media\Delta\Windows Critical Stop.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
@="C:\Windows\Media\Delta\Windows Balloon.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
@="C:\Windows\Media\Delta\Windows Logoff Sound.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
@="C:\Windows\Media\Delta\Windows User Account Control.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
@="C:\Windows\Media\Delta\Windows Pop-up Blocked.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\FaxError\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\FaxLineRings\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\FaxSent\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
@="C:\Windows\Media\Delta\Windows Feed Discovered.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
".saved"="C:\Windows\Media\Delta\Windows Navigation Start.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
@="C:\Windows\Media\Delta\Windows Information Bar.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\sapisvr\HubOnSound\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\sapisvr\PanelSound\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Names\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\AppDataLow\Software\Adobe\Shockwave 11\uicontrol\sw3dbaddriverlist1]
@="*2k*savage/ix!^5.12.01.7012$79x=stbnvidiatnt16mb!=4.10.01.9131$o2k=diamondstealthiiis530!=5.12.01.8007-8.30.24$72k=m!=5.00.2180.3711$***=atigraphicsproturbopci(atim64-gx)!^9999.0.0.0$ont=nvidiageforce256!=4.00.1381.0327$****virge!^9999.0.0.0$*9x=ibmthinkpad(cyber9397dvd)!=4.10.01.2173$79x=mach64:ragepro!=4.11.2560$*2k=m!^5.12.01.1200$o9x=intel(r)82810graphicscontroller!=4.12.01.2656$o**=m!^5.12.01.1509$o2k=3dfxvoodooseries!=5.00.2195.0197$ont=3dfxvoodooseries!=4.00.1381.0229$o2k=diamondstealthiiis540!=5.12.01.8007-8.30.24$*9x*permedia2!^4.10.01.2359$****mystique!^9999.0.0.0$*9x*g400!^4.12.1.1710$***=2164w!^9999.0.0.0$*9x=mach64:ragepro!^4.10.1720$ont*3dblasterriva!^4.03.00.2100$ont*nvidia!^4.00.1381.0508$79x*nvidia!^4.12.01.0513$o9x*diamondviperv770!^4.11.01.0402$****g100!^9999.0.0.0$59x*nvidiariva128!=4.10.1713$ont*radeon!^4.3.3109$o2k*voodoobanshee!=5.00.2195.2b$o***pe
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Macromedia\Shockwave 8\uicontrol\sw3dbaddriverlist1]
@="*2k*savage/ix!^5.12.01.7012$79x=stbnvidiatnt16mb!=4.10.01.9131$o2k=diamondstealthiiis530!=5.12.01.8007-8.30.24$72k=m!=5.00.2180.3711$***=atigraphicsproturbopci(atim64-gx)!^9999.0.0.0$ont=nvidiageforce256!=4.00.1381.0327$****virge!^9999.0.0.0$*9x=ibmthinkpad(cyber9397dvd)!=4.10.01.2173$79x=mach64:ragepro!=4.11.2560$*2k=m!^5.12.01.1200$o9x=intel(r)82810graphicscontroller!=4.12.01.2656$o**=m!^5.12.01.1509$o2k=3dfxvoodooseries!=5.00.2195.0197$ont=3dfxvoodooseries!=4.00.1381.0229$o2k=diamondstealthiiis540!=5.12.01.8007-8.30.24$*9x*permedia2!^4.10.01.2359$****mystique!^9999.0.0.0$*9x*g400!^4.12.1.1710$***=2164w!^9999.0.0.0$*9x=mach64:ragepro!^4.10.1720$ont*3dblasterriva!^4.03.00.2100$ont*nvidia!^4.00.1381.0508$79x*nvidia!^4.12.01.0513$o9x*diamondviperv770!^4.11.01.0402$****g100!^9999.0.0.0$59x*nvidiariva128!=4.10.1713$ont*radeon!^4.3.3109$o2k*voodoobanshee!=5.00.2195.2b$o***permedia3!^4.12.01
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\delta\iestrg]
"prdct"="delta"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\delta\iestrg]
"prtnrid"="delta"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows Media\WMSDK\Namespace]
"LocalDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows Media\WMSDK\Namespace]
"RemoteDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\delta-search.com]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows Media\WMSDK\Namespace]
"LocalDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows Media\WMSDK\Namespace]
"RemoteDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Synaptics\Scrybe\System\Symbols\4\delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Synaptics\Scrybe\System\Symbols\5\Delta]
Searching for "1ClickDownload"
No data found.
Searching for "tarma"
No data found.
-= EOF =-


----------



## Mark1956 (May 7, 2011)

That log will take me hours to go through so lets see if we can slim down the results by running another Adware remover.

Please download Junkware Removal Tool  to your desktop.


Shutdown your antivirus to avoid any conflicts.
Right-mouse click JRT.exe and select Run as administrator
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

When that is done please post the log and then repeat the instructions in post 108.


----------



## ste08ball (Apr 12, 2013)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.2 (04.29.2013:1)
OS: Windows 7 Home Premium x64
Ran by Michaella on 29/04/2013 at 17:46:32.66
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{fa966923-4278-4558-b29c-8145edf5aaa9}

~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}

~~~ Files
Successfully deleted: [File] C:\Windows\syswow64\sho2AE.tmp

~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\big fish games"
Failed to delete: [Folder] "C:\ProgramData\fighters"
Successfully deleted: [Folder] "C:\ProgramData\optimizerpro"
Successfully deleted: [Folder] "C:\ProgramData\wincert"
Successfully deleted: [Folder] "C:\Users\Michaella\AppData\Roaming\drivercure"
Failed to delete: [Folder] "C:\Users\Michaella\AppData\Roaming\fighters"
Successfully deleted: [Folder] "C:\Users\Michaella\AppData\Roaming\registry mechanic"
Successfully deleted: [Folder] "C:\Users\Michaella\AppData\Roaming\systweak"
Successfully deleted: [Folder] "C:\Program Files (x86)\imesh applications"
Successfully deleted: [Folder] "C:\Program Files (x86)\sprotector"
Successfully deleted: [Empty Folder] C:\Users\Michaella\appdata\local\{2F2CBD3B-69D7-4532-88AF-4FE04E33C4D9}
Successfully deleted: [Empty Folder] C:\Users\Michaella\appdata\local\{9B1620AA-D056-4147-8716-23E64E5E7C40}

~~~ FireFox
Successfully deleted: [File] C:\Users\Michaella\AppData\Roaming\mozilla\firefox\profiles\gkzx4muu.default\extensions\[email protected]
Failed to delete: [Folder] "C:\Program Files (x86)\Mozilla Firefox\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}"
Failed to delete: [Folder] C:\Users\Michaella\AppData\Roaming\mozilla\firefox\profiles\gkzx4muu.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
Successfully deleted the following from C:\Users\Michaella\AppData\Roaming\mozilla\firefox\profiles\gkzx4muu.default\prefs.js
user_pref("extensions.toolbar.mindspark._64Members_.hp.user.defined", true);
user_pref("extensions.toolbar.mindspark._64Members_.initialized", true);
user_pref("extensions.toolbar.mindspark._64Members_.installation.installDate", "2012070413");
user_pref("extensions.toolbar.mindspark._64Members_.installation.partnerId", "^XP^xdm016^LENUK^gb");
user_pref("extensions.toolbar.mindspark._64Members_.installation.partnerSubId", "CNPwxq7Q_rACFYwhtAoduyKGPQ");
user_pref("extensions.toolbar.mindspark._64Members_.installation.success", true);
user_pref("extensions.toolbar.mindspark._64Members_.installation.toolbarId", "5862C569-F3CA-4A95-9AED-E98D95FB7AE4");
user_pref("extensions.toolbar.mindspark._64Members_.lastActivePing", "1341851521999");
user_pref("extensions.toolbar.mindspark._64Members_.options.defaultSearch", false);
user_pref("extensions.toolbar.mindspark._64Members_.options.homePageEnabled", false);
user_pref("extensions.toolbar.mindspark._64Members_.options.keywordEnabled", false);
user_pref("extensions.toolbar.mindspark._64Members_.options.tabEnabled", false);
user_pref("extensions.toolbar.mindspark._64Members_.weather.location", "10001");
user_pref("extensions.toolbar.mindspark.lastInstalled", "[email protected]");
user_pref("ibxcomtb.skin", "\n\n <expand firstbutton=\"11\" combo=\"27\" lastbutton=\"45\"/>\n <offset fb=\"2\" cb=\

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29/04/2013 at 17:52:57.50
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


----------



## ste08ball (Apr 12, 2013)

this popped up and turned my virus protection off thats now back up and running however windows defender is flashing on and off


----------



## Mark1956 (May 7, 2011)

You should have turned off MSE before running the last scan, Windows Defender should automatically be disabled by MSE. Try rebooting the system, if all is well continue with my last instruction.


----------



## ste08ball (Apr 12, 2013)

you have missed a post mark i posted the results before that popped up after a reboot all seems to be fine.


----------



## Mark1956 (May 7, 2011)

I have not missed anything, sorry to say that you have, read post 110 again and you will see.


----------



## ste08ball (Apr 12, 2013)

SystemLook 30.07.11 by jpshortstuff
Log created at 20:57 on 29/04/2013 by Michaella
Administrator - Elevation successful
========== filefind ==========
Searching for "*ilivid*"
No files found.
Searching for "*babylon*"
No files found.
Searching for "*whitesmoke*"
No files found.
Searching for "*protector*"
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\modules\SearchProtector.jsm ------- 34674 bytes [14:11 01/05/2012] [23:39 17/04/2012] 5FA151FF96ABE41855052E93F775BA74
Searching for "*searchqu*"
No files found.
Searching for "*conduit*"
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\iSyncConduit.dll --a---- 1207392 bytes [11:43 06/12/2012] [11:43 06/12/2012] C963B2DECF0872C4A79D4E5E97062E8C
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\ConduitAutoCompleteSearch.js ------- 9052 bytes [14:11 01/05/2012] [23:39 17/04/2012] AF98421711C6CFA73D6720C455D92DAC
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\ConduitAutoCompleteSearch.xpt ------- 166 bytes [14:11 01/05/2012] [23:39 17/04/2012] 806EA6CC4DCBF88A20AA3331BCDC9918
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\searchplugin\conduit.xml ------- 935 bytes [14:11 01/05/2012] [23:39 17/04/2012] 9680591A24B87500B3F9FD45ACD250E8
Searching for "*freeze*"
C:\Program Files (x86)\Infogrames\RollerCoaster Tycoon 2\Tracks\Deep Freeze.TD6 --a---- 2024 bytes [19:14 15/03/2013] [11:48 20/06/2002] EC011C39196B7164B41E64D5AA5689C8
C:\Users\Michaella\Favorites\Computer freezes after 5-10 minutes of inactivity.... - Geeks to Go Forums.url --a---- 1300 bytes [16:06 12/04/2013] [14:24 13/04/2013] 7F6B4ACC626F2611EDA894CA40E9DD29
Searching for "*iminstaller*"
No files found.
Searching for "*datamngr*"
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF10_47.dll --a---- 736768 bytes [23:00 10/04/2013] [08:29 29/01/2013] E5F2670ADDDA22918453A13064E6D06A
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF11_47.dll --a---- 736768 bytes [23:00 10/04/2013] [08:29 29/01/2013] 9FCDE758D501AD05834A148E90DA028E
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF12_47.dll --a---- 736768 bytes [23:00 10/04/2013] [08:29 29/01/2013] 26577A4E480C0D7E011073132AA12642
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF13_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:30 29/01/2013] 914A0DBF9208622F923BCAD5AFA63E3F
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF3_47.dll --a---- 740352 bytes [23:00 10/04/2013] [08:27 29/01/2013] 63C9EA1C552D4F6EA9A3745DD161E1A8
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF4_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:27 29/01/2013] 8C9923A5ACC126BB88D860B68E05F2E7
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF5_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:27 29/01/2013] DB36E7A166D3A2CDC2AC65956CF3E16D
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF6_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:28 29/01/2013] 0376B046E5E1A6A44E8783E25701DDE4
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF7_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:28 29/01/2013] 9347C68E55D860CB049562BB62078603
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF8_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:28 29/01/2013] 7360CCAA940EDFED730CE9F48FF3ECB1
C:\Program Files (x86)\SRToolbar\del_DataMngrHlpFF9_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:29 29/01/2013] 2CEBC0A78830846D2A18E02CCFF252F1
C:\Program Files (x86)\SRToolbar\Datamngr\datamngr.dll --a---- 1540096 bytes [22:59 10/04/2013] [08:31 29/01/2013] 21B1F4D43CBF432788A4E5A5092E93D3
C:\Program Files (x86)\SRToolbar\Datamngr\datamngrUI.exe --a---- 1683456 bytes [23:00 10/04/2013] [08:31 29/01/2013] 7C3A70BEB17C8F2A1BBE39F6B4AFEE67
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlp.xpt --a---- 1009 bytes [08:33 16/04/2013] [08:31 29/01/2013] C317A7493D9EB507391B0217CEEACAE1
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF10.dll --a---- 736768 bytes [08:33 16/04/2013] [08:29 29/01/2013] E5F2670ADDDA22918453A13064E6D06A
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF11.dll --a---- 736768 bytes [08:33 16/04/2013] [08:29 29/01/2013] 9FCDE758D501AD05834A148E90DA028E
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF12.dll --a---- 736768 bytes [08:33 16/04/2013] [08:29 29/01/2013] 26577A4E480C0D7E011073132AA12642
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF13.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 914A0DBF9208622F923BCAD5AFA63E3F
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF14.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 26209275084963CACD45B72BB46AC314
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF15.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 4C995E478C81222D31C20B0CB1751742
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF16.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 9054AC22CB45980755212C0EF216717D
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF17.dll --a---- 737280 bytes [08:33 16/04/2013] [08:31 29/01/2013] 54B28DCA6984A1D0E9C982610DE34F39
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF18.dll --a---- 737280 bytes [08:33 16/04/2013] [08:31 29/01/2013] 58107F0BB4569A388A8870E351FB1324
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF3.dll --a---- 740352 bytes [08:33 16/04/2013] [08:27 29/01/2013] 63C9EA1C552D4F6EA9A3745DD161E1A8
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF4.dll --a---- 737280 bytes [08:33 16/04/2013] [08:27 29/01/2013] 8C9923A5ACC126BB88D860B68E05F2E7
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF5.dll --a---- 737280 bytes [08:33 16/04/2013] [08:27 29/01/2013] DB36E7A166D3A2CDC2AC65956CF3E16D
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF6.dll --a---- 737280 bytes [08:33 16/04/2013] [08:28 29/01/2013] 0376B046E5E1A6A44E8783E25701DDE4
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF7.dll --a---- 737280 bytes [08:33 16/04/2013] [08:28 29/01/2013] 9347C68E55D860CB049562BB62078603
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF8.dll --a---- 737280 bytes [08:33 16/04/2013] [08:28 29/01/2013] 7360CCAA940EDFED730CE9F48FF3ECB1
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF9.dll --a---- 737280 bytes [08:33 16/04/2013] [08:29 29/01/2013] 2CEBC0A78830846D2A18E02CCFF252F1
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\content\DataMngr.js --a---- 19255 bytes [08:33 16/04/2013] [08:54 16/10/2012] 0482F311EC3BEFB2018232CC83E2D867
C:\Program Files (x86)\SRToolbar\Datamngr\x64\datamngr.dll --a---- 2018680 bytes [23:00 10/04/2013] [08:31 29/01/2013] A76CBD61AC008C25D6AA30E6F15BBAF5
Searching for "*yontoo*"
C:\Windows\Prefetch\YONTOODESKTOP.EXE-4C25B39F.pf --a---- 84006 bytes [04:17 28/04/2013] [18:04 28/04/2013] 40D50B254E9753268D2C1A969A7024CC
Searching for "*sweetie*"
No files found.
Searching for "*sweetim*"
No files found.
Searching for "*bandoo*"
No files found.
Searching for "*browsermngr*"
C:\JRT\browsermngr_keys.cfg --a---- 128 bytes [16:46 29/04/2013] [07:18 29/04/2013] AA81F713E52CE4E6DDCBFF4248AADCE3
C:\JRT\browsermngr_values.cfg --a---- 94 bytes [16:46 29/04/2013] [11:32 08/12/2012] F122E40C356FD4504242D61607063949
C:\JRT\FFbrowsermngr.dat --a---- 119 bytes [16:46 29/04/2013] [16:27 07/12/2012] 3B95732A1F2A804A6390BAB62B1DD1DB
Searching for "*browsercompanion*"
No files found.
Searching for "*smartbar*"
No files found.
Searching for "*pricegong*"
No files found.
Searching for "*crossrider*"
No files found.
Searching for "*funmoods*"
No files found.
Searching for "*trolltech*"
No files found.
Searching for "*delta*"
C:\Users\Michaella\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\R0O90FD4\www2.delta-search[1].xml --a---- 28142 bytes [11:42 26/04/2013] [11:52 28/04/2013] DE7A1E2481A3A7127022DA6FE20BA44C
C:\Windows\Prefetch\AM_DELTA_PATCH_1.149.774.0.EX-F45EA768.pf --a---- 8666 bytes [23:56 28/04/2013] [23:56 28/04/2013] 37898855334A4FCBE878BC1854FEB73A
C:\Windows\System32\msdelta.dll --a---- 451584 bytes [23:22 13/07/2009] [01:41 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\SysWOW64\msdelta.dll --a---- 305152 bytes [23:12 13/07/2009] [01:15 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
C:\Windows\winsxs\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_9c2159bf9f702069\msdelta.dll --a---- 451584 bytes [23:22 13/07/2009] [01:41 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\msdelta.dll --a---- 451584 bytes [02:55 14/07/2009] [02:55 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\msdelta.dll --a---- 451584 bytes [02:55 14/07/2009] [02:55 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17592_none_672ce6c3de2cb17f\msdelta.dll --a---- 451584 bytes [02:55 14/07/2009] [02:55 14/07/2009] D9A5B279A8D2F8775FA254927F33DA6D
C:\Windows\winsxs\FileMaps\$$_media_delta_0f36d7d9b4f7293c.cdf-ms --a---- 2436 bytes [02:59 14/07/2009] [05:32 14/07/2009] 0ED4291DC068EB860AC15A6E5360224C
C:\Windows\winsxs\Manifests\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_9c2159bf9f702069.manifest --a---- 2888 bytes [02:33 14/07/2009] [02:21 14/07/2009] 6B7D6AD4FA771B7D532B7AD67D396853
C:\Windows\winsxs\Manifests\amd64_microsoft-windows-deltapackageexpander_31bf3856ad364e35_6.1.7601.17514_none_c8049b9e4ba7658c.manifest --a---- 2461 bytes [03:17 21/11/2010] [03:17 21/11/2010] 8A388670A7B189FE5CE192B81E6F7401
C:\Windows\winsxs\Manifests\amd64_microsoft-windows-s..l-soundthemes-delta_31bf3856ad364e35_6.1.7600.16385_none_fbf7e0678b64a4b8.manifest --a---- 27794 bytes [02:17 14/07/2009] [02:18 14/07/2009] 2D159244CBBD3875345AFDD9C34B444B
C:\Windows\winsxs\Manifests\x86_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_4002be3be712af33.manifest --a---- 2886 bytes [02:33 14/07/2009] [01:54 14/07/2009] 110D843CC1C2B3A02A46D4AD962C04B6
C:\Windows\winsxs\Manifests\x86_microsoft-windows-deltapackageexpander_31bf3856ad364e35_6.1.7601.17514_none_6be6001a9349f456.manifest --a---- 2459 bytes [03:17 21/11/2010] [03:17 21/11/2010] 771093D6028BE8C764993524B6392E70
C:\Windows\winsxs\x86_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_4002be3be712af33\msdelta.dll --a---- 305152 bytes [23:12 13/07/2009] [01:15 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\msdelta.dll --a---- 305152 bytes [02:43 14/07/2009] [02:43 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\msdelta.dll --a---- 305152 bytes [02:43 14/07/2009] [02:43 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17592_none_0b0e4b4025cf4049\msdelta.dll --a---- 305152 bytes [02:43 14/07/2009] [02:43 14/07/2009] 739E51268B4BB79AB4F9E55F0018D0BC
Searching for "*1ClickDownload*"
No files found.
Searching for "*tarma*"
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac.common.ovl --a---- 256 bytes [13:24 23/03/2013] [14:31 08/09/2004] 75CA79973883A2061F6711026BFB2739
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac.unique.ovl --a---- 256 bytes [13:24 23/03/2013] [14:31 08/09/2004] 9B6BCEE0BCFF757C2E06894E36DEA489
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\TarmacTexture.common.ovl --a---- 67591 bytes [13:24 23/03/2013] [14:31 08/09/2004] BA4A2D1BEB67771D78A7D8FEE6C2151C
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\TarmacTexture.unique.ovl --a---- 393 bytes [13:24 23/03/2013] [14:31 08/09/2004] A5BCFEE5FF3B7C1E601F0EF25CB83AD6
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_A.common.ovl --a---- 14026 bytes [13:24 23/03/2013] [14:03 04/10/2004] 7267C9D3E2EFD6358C7C88D5E06EBCC3
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_A.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:03 04/10/2004] 7E87BD12777DF82EB1FA7A7D14EF45C0
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_B.common.ovl --a---- 17194 bytes [13:24 23/03/2013] [14:03 04/10/2004] 4191D8B0B46AA8A2A8AC96D358460A07
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_B.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:03 04/10/2004] B8558745ACDECA0DD7DCDCAE1DCD6A59
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_C.common.ovl --a---- 17194 bytes [13:24 23/03/2013] [14:03 04/10/2004] 0E2FA5DD184C754BB8A2FD0A493B2DEA
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_C.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:03 04/10/2004] A9EB28E01AFBAD817597FC293A488A1A
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_D.common.ovl --a---- 20346 bytes [13:24 23/03/2013] [14:03 04/10/2004] E7BFE1CB871CE0F1DE19E755B06E5BEC
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Corner_D.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:03 04/10/2004] 8FDD4505FFB3A7575A2F1215DB87BFB0
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Flat.common.ovl --a---- 10255 bytes [13:24 23/03/2013] [14:03 04/10/2004] 3B5D8CFBDE00639055BE49C7DB85AD12
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Flat.unique.ovl --a---- 3834 bytes [13:24 23/03/2013] [14:03 04/10/2004] 75B38B38837E75CE3D2D6DD0338109BC
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Scenery.common.ovl --a---- 67591 bytes [13:24 23/03/2013] [14:31 08/09/2004] BA4A2D1BEB67771D78A7D8FEE6C2151C
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Scenery.unique.ovl --a---- 393 bytes [13:24 23/03/2013] [14:31 08/09/2004] A5BCFEE5FF3B7C1E601F0EF25CB83AD6
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope.common.ovl --a---- 23507 bytes [13:24 23/03/2013] [14:03 04/10/2004] 4277B4DB391ABB7402E7282402304441
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope.unique.ovl --a---- 4261 bytes [13:24 23/03/2013] [14:03 04/10/2004] 550D6840E5AF49F284ED52050208458B
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Mid.common.ovl --a---- 8084 bytes [13:24 23/03/2013] [14:03 04/10/2004] 1A212F14D9C2E8A6C05472D694C33393
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Mid.unique.ovl --a---- 3959 bytes [13:24 23/03/2013] [14:03 04/10/2004] C6945533D3330CB9F9751AB91399D783
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Straight.common.ovl --a---- 15795 bytes [13:24 23/03/2013] [14:03 04/10/2004] C83AEC916869FBB4CF933ADBC7D0E897
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Straight.unique.ovl --a---- 4504 bytes [13:24 23/03/2013] [14:03 04/10/2004] EF1EC7403BCE3C62725D5B7B6C24F42B
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Straight_left.common.ovl --a---- 11982 bytes [13:24 23/03/2013] [14:03 04/10/2004] 43D21A6BFEF1B2E4FFEA59DF42DB1610
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Straight_left.unique.ovl --a---- 4639 bytes [13:24 23/03/2013] [14:03 04/10/2004] 06E5DB132E55D892201A18529DD06B9A
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Straight_Right.common.ovl --a---- 12019 bytes [13:24 23/03/2013] [14:03 04/10/2004] C95A77EA1BCDD710616D5C105EFC5A79
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Slope_Straight_Right.unique.ovl --a---- 4666 bytes [13:24 23/03/2013] [14:03 04/10/2004] 7D3240EB13FD6EA841C995D9F8FD951B
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Straight_A.common.ovl --a---- 17530 bytes [13:24 23/03/2013] [14:03 04/10/2004] 70773B54B81E4C7F52D9F61EA50FC2F7
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Straight_A.unique.ovl --a---- 4396 bytes [13:24 23/03/2013] [14:03 04/10/2004] 852BF8F445B2B0BC7A58B58E12B56199
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Straight_B.common.ovl --a---- 13922 bytes [13:24 23/03/2013] [14:04 04/10/2004] 9B4D1442874CE0A634964738E0A3CB90
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Straight_B.unique.ovl --a---- 4396 bytes [13:24 23/03/2013] [14:04 04/10/2004] A371DF46ECEA57BCC9A31D59C3277344
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Stub.common.ovl --a---- 12788 bytes [13:24 23/03/2013] [10:58 28/09/2004] 2D65E121BD713C7CAC97007A37A9B0F6
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Stub.unique.ovl --a---- 13291 bytes [13:24 23/03/2013] [10:58 28/09/2004] C42B4DD606C300C80361F8236159CFA0
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Texture.common.ovl --a---- 176201 bytes [13:24 23/03/2013] [17:36 04/11/2004] 87BB6186D468BE9A13A78C44399B50EA
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Texture.unique.ovl --a---- 1285 bytes [13:24 23/03/2013] [17:36 04/11/2004] 0773383D06B45FD134001CEA5752A13D
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_L_A.common.ovl --a---- 22034 bytes [13:24 23/03/2013] [14:04 04/10/2004] B4710A15D678C5A53D404A2EB9E2D880
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_L_A.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:04 04/10/2004] B74B9746EE1776FBC1E7D433514E7810
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_L_B.common.ovl --a---- 18882 bytes [13:24 23/03/2013] [14:04 04/10/2004] 5BEEB5E9320B22B9670B9398EC2D699B
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_L_B.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:04 04/10/2004] 36CBA084BD6B178DB450DFB64D99C931
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_T_A.common.ovl --a---- 20130 bytes [13:24 23/03/2013] [14:04 04/10/2004] 895A9CC1075FA8146A1F89A5070C645F
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_T_A.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:04 04/10/2004] B5FC18F78171914C85786307717E4E41
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_T_B.common.ovl --a---- 16962 bytes [13:24 23/03/2013] [14:04 04/10/2004] EEF8332307D747D42389744F77FEDF25
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_T_B.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:04 04/10/2004] C8EE11F881FA80E861A70D534358AAB3
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_T_C.common.ovl --a---- 16962 bytes [13:24 23/03/2013] [14:04 04/10/2004] C3BB867EFD40226099C50F3CA5B46CD7
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_T_C.unique.ovl --a---- 4342 bytes [13:24 23/03/2013] [14:04 04/10/2004] 40BF8B2ED776629E5A3786753FD72029
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_U.common.ovl --a---- 23841 bytes [13:24 23/03/2013] [14:04 04/10/2004] 23E90BDEC0CC0FFDBF7358CA94581418
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_U.unique.ovl --a---- 4288 bytes [13:24 23/03/2013] [14:04 04/10/2004] 31C38D91E33860367B1C18DA9C1431AF
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_X.common.ovl --a---- 23385 bytes [13:24 23/03/2013] [14:04 04/10/2004] 1DA7F6D91AE751B5020471E3865DFE5D
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac\Tarmac_Turn_X.unique.ovl --a---- 4288 bytes [13:24 23/03/2013] [14:04 04/10/2004] 6FC8855F41B715D44246E6B02A6DF10A
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\PathTarmacTextures.common.ovl --a---- 256 bytes [13:26 23/03/2013] [16:16 08/09/2004] 75CA79973883A2061F6711026BFB2739
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\PathTarmacTextures.unique.ovl --a---- 289 bytes [13:26 23/03/2013] [16:16 08/09/2004] A552067A472A8D984F25DD8FE28540AF
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac1m.common.ovl --a---- 6642 bytes [13:26 23/03/2013] [14:05 04/10/2004] C1123C0EDC1B59ADEDA59863BE5FFF30
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac1m.unique.ovl --a---- 2551 bytes [13:26 23/03/2013] [14:05 04/10/2004] D653459A8330B5A576D4A37F1F2B633C
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac1mbot.common.ovl --a---- 6721 bytes [13:26 23/03/2013] [14:05 04/10/2004] 5A1D5A519F3DC377C746A725C903EEF8
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac1mbot.unique.ovl --a---- 2602 bytes [13:26 23/03/2013] [14:05 04/10/2004] 2A7B031CA09487BB70974846C89D282A
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac1mbotextra.common.ovl --a---- 6847 bytes [13:26 23/03/2013] [14:05 04/10/2004] 062B31B393870B9BDF32B5640DA9F361
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac1mbotextra.unique.ovl --a---- 2687 bytes [13:26 23/03/2013] [14:05 04/10/2004] 0BA2A499B77F03E80C7D9C29566FAB02
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac2m.common.ovl --a---- 6642 bytes [13:26 23/03/2013] [14:05 04/10/2004] E7455CDAA47AD7424B62226A4597F991
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac2m.unique.ovl --a---- 2551 bytes [13:26 23/03/2013] [14:05 04/10/2004] BCD50182207DBD9E22AB623E6FEAC47A
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac4m.common.ovl --a---- 6642 bytes [13:26 23/03/2013] [14:05 04/10/2004] 1D7BF75016243A5C154BBE4056B7D4AA
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac4m.unique.ovl --a---- 2551 bytes [13:26 23/03/2013] [14:05 04/10/2004] 3DC6DE5F52CC8F1025719B59C9EDFFB3
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac8m.common.ovl --a---- 6642 bytes [13:26 23/03/2013] [14:05 04/10/2004] 5E8686E1374AE0F753FF4BFB77E3DAE5
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac\Tarmac8m.unique.ovl --a---- 2551 bytes [13:26 23/03/2013] [14:05 04/10/2004] 1007B6ADD2117F24FDF718549D6B756D
C:\Program Files (x86)\Infogrames\RollerCoaster Tycoon 2\ObjData\TARMAC.DAT --a---- 129962 bytes [19:14 15/03/2013] [01:51 13/09/2002] 898990ACB4C98903E4B9F12D6192B7FA
C:\Program Files (x86)\Infogrames\RollerCoaster Tycoon 2\ObjData\TARMACB.DAT --a---- 87601 bytes [19:14 15/03/2013] [01:51 13/09/2002] 97F2391F0503A3E227B1A6120B37C151
C:\Program Files (x86)\Infogrames\RollerCoaster Tycoon 2\ObjData\TARMACG.DAT --a---- 87521 bytes [19:14 15/03/2013] [01:51 13/09/2002] D6EF3DDAD271A466F8F7B679441115F2
========== folderfind ==========
Searching for "*ilivid*"
No folders found.
Searching for "*babylon*"
No folders found.
Searching for "*whitesmoke*"
No folders found.
Searching for "*protector*"
No folders found.
Searching for "*searchqu*"
No folders found.
Searching for "*conduit*"
No folders found.
Searching for "*freeze*"
No folders found.
Searching for "*iminstaller*"
No folders found.
Searching for "*datamngr*"
C:\Program Files (x86)\SRToolbar\Datamngr d------ [22:59 10/04/2013]
C:\_OTL\MovedFiles\04272013_100912\C_Users\Michaella\AppData\LocalLow\DataMngr d------ [14:29 01/05/2012]
Searching for "*yontoo*"
No folders found.
Searching for "*sweetie*"
No folders found.
Searching for "*sweetim*"
No folders found.
Searching for "*bandoo*"
No folders found.
Searching for "*browsermngr*"
No folders found.
Searching for "*browsercompanion*"
No folders found.
Searching for "*smartbar*"
No folders found.
Searching for "*pricegong*"
No folders found.
Searching for "*crossrider*"
No folders found.
Searching for "*funmoods*"
No folders found.
Searching for "*trolltech*"
No folders found.
Searching for "*delta*"
C:\Windows\Media\Delta dr--s-- [03:20 14/07/2009]
C:\Windows\winsxs\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_9c2159bf9f702069 d------ [03:20 14/07/2009]
C:\Windows\winsxs\amd64_microsoft-windows-deltapackageexpander_31bf3856ad364e35_6.1.7601.17514_none_c8049b9e4ba7658c d------ [03:24 21/11/2010]
C:\Windows\winsxs\amd64_microsoft-windows-s..l-soundthemes-delta_31bf3856ad364e35_6.1.7600.16385_none_fbf7e0678b64a4b8 d------ [05:30 14/07/2009]
C:\Windows\winsxs\x86_microsoft-windows-deltacompressionengine_31bf3856ad364e35_6.1.7600.16385_none_4002be3be712af33 d------ [03:20 14/07/2009]
C:\Windows\winsxs\x86_microsoft-windows-deltapackageexpander_31bf3856ad364e35_6.1.7601.17514_none_6be6001a9349f456 d------ [03:24 21/11/2010]
Searching for "*1ClickDownload*"
No folders found.
Searching for "*tarma*"
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Path\Tarmac d------ [13:24 23/03/2013]
C:\Program Files (x86)\Atari\RollerCoaster Tycoon 3\Supports\PathTarmac d------ [13:26 23/03/2013]
========== regfind ==========
Searching for "ilivid"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1 (1).exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1(2).exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\iLividSetupV1(2)_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\iLividSetupV1(2)_RASMANCS]
Searching for "babylon"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"
Searching for "whitesmoke"
No data found.
Searching for "bprotector"
No data found.
Searching for "searchqu"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
@="ISearchQueryHelper"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
@="ISearchQueryHelper"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}]
"SuggestionsURL_JSON"="http://www.searchqu.com/suggest.php...uid=2215230001324024&qu={searchTerms}&ft=json"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
@="ISearchQueryHelper"
Searching for "conduit"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966]
"045F27F206F16624596059B2126D46D0"="C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\iSyncConduit.dll"
Searching for "freeze"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SQM\FreezeUploads]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\SQM\FreezeUploads]
Searching for "iminstaller"
No data found.
Searching for "datamngr"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fa966923-4278-4558-b29c-8145edf5aaa9}\InprocServer32]
@="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2\searchresultsDx.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\070F394B126DDE645BD3CA9084552369]
"00000000000000000000000000000000"="C:\Users\MICHAE~1\AppData\Local\Temp\SetupDataMngr_iMesh.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{26AE4809-8879-4B6A-A29E-42C460B8D7EE}]
"AppPath"="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2A2D6E15-A029-497A-BB7E-099CE833D69C}]
"AppPath"="C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\ToolBar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{943A386A-457F-4CD4-A4B0-0BB65F52537B}]
"AppPath"="C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A0D51E52-DDB7-43EA-B519-F88C8599F678}]
"AppPath"="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2C670EB-344A-410A-A8FA-0F11CAAA418C}]
"AppPath"="C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D66429E0-2304-453E-A8B9-AD269F1D4A49}]
"AppPath"="C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E3AB3D8D-AB44-47A1-9659-9571DEAD0E95}]
"AppPath"="C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fa966923-4278-4558-b29c-8145edf5aaa9}]
"AppPath"="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\fixbeetoolbargaw]
"DisplayIcon"="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2\install.ico"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\fixbeetoolbargaw]
"InstallLocation"="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\fixbeetoolbargaw]
"UninstallString"="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2\uninstall.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{fa966923-4278-4558-b29c-8145edf5aaa9}\InprocServer32]
@="C:\PROGRA~2\SRTOOL~1\Datamngr\SRTOOL~2\searchresultsDx.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
Searching for "yontoo"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-28A8_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-28A8_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0B90_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0B90_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-1760_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-1760_RASMANCS]
Searching for "sweetie"
No data found.
Searching for "sweetim"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\SweetIM]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\SweetIM]
Searching for "bandoo"
No data found.
Searching for "browsermngr"
No data found.
Searching for "browsercompanion"
No data found.
Searching for "smartbar"
No data found.
Searching for "pricegong"
No data found.
Searching for "crossrider"
No data found.
Searching for "funmoods"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\funmoods_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\funmoods_RASMANCS]
Searching for "trolltech"
No data found.
Searching for "delta"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\.Default\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\.Default\Delta]
@="C:\Windows\Media\Delta\Windows Ding.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Critical.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Insert.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Remove.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Fail.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Low.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
@="C:\Windows\Media\Delta\Windows Print complete.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
@="C:\Windows\Media\Delta\Windows Error.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
@="C:\Windows\Media\Delta\Windows Exclamation.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemExit\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
@="C:\Windows\Media\Delta\Windows Critical Stop.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
@="C:\Windows\Media\Delta\Windows Balloon.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
@="C:\Windows\Media\Delta\Windows Logoff Sound.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
@="C:\Windows\Media\Delta\Windows User Account Control.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
@="C:\Windows\Media\Delta\Windows Pop-up Blocked.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FaxError\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FaxLineRings\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FaxSent\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
@="C:\Windows\Media\Delta\Windows Feed Discovered.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
".saved"="C:\Windows\Media\Delta\Windows Navigation Start.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
@="C:\Windows\Media\Delta\Windows Information Bar.wav"
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\HubOnSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\sapisvr\PanelSound\Delta]
[HKEY_CURRENT_USER\AppEvents\Schemes\Names\Delta]
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Adobe\Shockwave 11\uicontrol\sw3dbaddriverlist1]
@="*2k*savage/ix!^5.12.01.7012$79x=stbnvidiatnt16mb!=4.10.01.9131$o2k=diamondstealthiiis530!=5.12.01.8007-8.30.24$72k=m!=5.00.2180.3711$***=atigraphicsproturbopci(atim64-gx)!^9999.0.0.0$ont=nvidiageforce256!=4.00.1381.0327$****virge!^9999.0.0.0$*9x=ibmthinkpad(cyber9397dvd)!=4.10.01.2173$79x=mach64:ragepro!=4.11.2560$*2k=m!^5.12.01.1200$o9x=intel(r)82810graphicscontroller!=4.12.01.2656$o**=m!^5.12.01.1509$o2k=3dfxvoodooseries!=5.00.2195.0197$ont=3dfxvoodooseries!=4.00.1381.0229$o2k=diamondstealthiiis540!=5.12.01.8007-8.30.24$*9x*permedia2!^4.10.01.2359$****mystique!^9999.0.0.0$*9x*g400!^4.12.1.1710$***=2164w!^9999.0.0.0$*9x=mach64:ragepro!^4.10.1720$ont*3dblasterriva!^4.03.00.2100$ont*nvidia!^4.00.1381.0508$79x*nvidia!^4.12.01.0513$o9x*diamondviperv770!^4.11.01.0402$****g100!^9999.0.0.0$59x*nvidiariva128!=4.10.1713$ont*radeon!^4.3.3109$o2k*voodoobanshee!=5.00.2195.2b$o***permedia3!^4.12.01.2107$o***ragefury!^4.3.
[HKEY_CURRENT_USER\Software\Macromedia\Shockwave 8\uicontrol\sw3dbaddriverlist1]
@="*2k*savage/ix!^5.12.01.7012$79x=stbnvidiatnt16mb!=4.10.01.9131$o2k=diamondstealthiiis530!=5.12.01.8007-8.30.24$72k=m!=5.00.2180.3711$***=atigraphicsproturbopci(atim64-gx)!^9999.0.0.0$ont=nvidiageforce256!=4.00.1381.0327$****virge!^9999.0.0.0$*9x=ibmthinkpad(cyber9397dvd)!=4.10.01.2173$79x=mach64:ragepro!=4.11.2560$*2k=m!^5.12.01.1200$o9x=intel(r)82810graphicscontroller!=4.12.01.2656$o**=m!^5.12.01.1509$o2k=3dfxvoodooseries!=5.00.2195.0197$ont=3dfxvoodooseries!=4.00.1381.0229$o2k=diamondstealthiiis540!=5.12.01.8007-8.30.24$*9x*permedia2!^4.10.01.2359$****mystique!^9999.0.0.0$*9x*g400!^4.12.1.1710$***=2164w!^9999.0.0.0$*9x=mach64:ragepro!^4.10.1720$ont*3dblasterriva!^4.03.00.2100$ont*nvidia!^4.00.1381.0508$79x*nvidia!^4.12.01.0513$o9x*diamondviperv770!^4.11.01.0402$****g100!^9999.0.0.0$59x*nvidiariva128!=4.10.1713$ont*radeon!^4.3.3109$o2k*voodoobanshee!=5.00.2195.2b$o***permedia3!^4.12.01.2107$o***ragefury!^4.3.139$o***rage128g
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\delta]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\delta\iestrg]
"prdct"="delta"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\delta\iestrg]
"prtnrid"="delta"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows Media\WMSDK\Namespace]
"LocalDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows Media\WMSDK\Namespace]
"RemoteDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\delta-search.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\Namespace]
"LocalDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML"
[HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\Namespace]
"RemoteDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML"
[HKEY_CURRENT_USER\Software\Synaptics\Scrybe\System\Symbols\4\delta]
[HKEY_CURRENT_USER\Software\Synaptics\Scrybe\System\Symbols\5\Delta]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Document]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Email]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Music]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Music]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Picture]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Picture]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Video]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Kind.Video]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Appointment]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Appointment]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Contact]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Contact]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Schedule.Meeting]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MAPI/IPM.Schedule.Meeting]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Record\{8F6D68FF-81A4-3F8A-AD32-8E8DDDA7FC41}\2.0.0.0]
"Class"="System.Diagnostics.SymbolStore.SymbolLineDelta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Record\{8F6D68FF-81A4-3F8A-AD32-8E8DDDA7FC41}\4.0.0.0]
"Class"="System.Diagnostics.SymbolStore.SymbolLineDelta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msg]
"ContentViewModeLayoutPatternForBrowse"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msg]
"ContentViewModeLayoutPatternForSearch"="delta"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-deltacompressionengine_31bf3856ad364e35_none_9afd56f432219a2e]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-deltapackageexpander_31bf3856ad364e35_none_0a20a2633b1984ad]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-s..l-soundthemes-delta_31bf3856ad364e35_none_f2cfa9dc6d3f5297]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-deltacompressionengine_31bf3856ad364e35_none_3edebb7079c428f8]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-deltapackageexpander_31bf3856ad364e35_none_ae0206df82bc1377]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\Half SD]
"WinSAT_CPU Delta"="-1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\HD Default]
"WinSAT_CPU Delta"="2.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MP4]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MPG-ISO]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MPG-TTS]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD Default]
"WinSAT_CPU Delta"="0.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD WMV]
"WinSAT_CPU Delta"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idle thread tha
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idl
[HKEY_LOCAL_MACHINE\SOFTWARE\Realtek\AECBF\icrcAudioProcessingDemo\GSCBeamformer\PostFiltering]
"delta"="0.000100"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Shockwave 11\uicontrol\sw3dbaddriverlist1]
@="*2k*savage/ix!^5.12.01.70129x=stbnvidiatnt16mb!=4.10.01.9131$o2k=diamondstealthiiis530!=5.12.01.8007-8.30.24$72k=m!=5.00.2180.3711$***=atigraphicsproturbopci(atim64-gx)!^9999.0.0.0$ont=nvidiageforce256!=4.00.1381.0327$****virge!^9999.0.0.0$*9x=ibmthinkpad(cyber9397dvd)!=4.10.01.2173$79x=mach64:ragepro!=4.11.2560$*2k=m!^5.12.01.1200$o9x=intel(r)82810graphicscontroller!=4.12.01.2656$o**=m!^5.12.01.1509$o2k=3dfxvoodooseries!=5.00.2195.0197$ont=3dfxvoodooseries!=4.00.1381.0229$o2k=diamondstealthiiis540!=5.12.01.8007-8.30.24$*9x*permedia2!^4.10.01.2359$****mystique!^9999.0.0.0$*9x*g400!^4.12.1.1710$***=2164w!^9999.0.0.0$*9x=mach64:ragepro!^4.10.1720$ont*3dblasterriva!^4.03.00.2100$ont*nvidia!^4.00.1381.0508$79x*nvidia!^4.12.01.0513$o9x*diamondviperv770!^4.11.01.0402$****g100!^9999.0.0.0$59x*nvidiariva128!=4.10.1713$ont*radeon!^4.3.3109$o2k*voodoobanshee!=5.00.2195.2b$o***permedia3!^4.12.01.2107$o***ragefury!^4.3.139$o***r
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\nohfdhapjjlndfgjnmdlcabloeembdkj]
"path"="C:\Users\Michaella\AppData\Roaming\BabSolution\CR\delta2.crx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\CVH\Connect\{90140011-0066-0409-0000-0000000FF1CE}]
"deltaCacheFolderName"="140066.enu-90140011-66-409"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\Half SD]
"WinSAT_CPU Delta"="-1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\HD Default]
"WinSAT_CPU Delta"="2.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MP4]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MPG-ISO]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD AVC-MPG-TTS]
"WinSAT_CPU Delta"="0.2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD Default]
"WinSAT_CPU Delta"="0.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Media Player NSS\3.0\Input Formats\SD WMV]
"WinSAT_CPU Delta"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\009]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idl
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processo
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\.Default\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\.Default\Delta]
@="C:\Windows\Media\Delta\Windows Ding.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Critical.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Insert.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Remove.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Fail.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Low.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
@="C:\Windows\Media\Delta\Windows Print complete.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
@="C:\Windows\Media\Delta\Windows Error.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
@="C:\Windows\Media\Delta\Windows Exclamation.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemExit\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
@="C:\Windows\Media\Delta\Windows Critical Stop.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
@="C:\Windows\Media\Delta\Windows Balloon.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
@="C:\Windows\Media\Delta\Windows Logoff Sound.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
@="C:\Windows\Media\Delta\Windows User Account Control.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
@="C:\Windows\Media\Delta\Windows Pop-up Blocked.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FaxError\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FaxLineRings\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FaxSent\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
@="C:\Windows\Media\Delta\Windows Feed Discovered.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
@="C:\Windows\Media\Delta\Windows Navigation Start.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
@="C:\Windows\Media\Delta\Windows Information Bar.wav"
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\HubOnSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\PanelSound\Delta]
[HKEY_USERS\S-1-5-19\AppEvents\Schemes\Names\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\.Default\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\.Default\Delta]
@="C:\Windows\Media\Delta\Windows Ding.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Critical.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Insert.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Remove.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Fail.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Low.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
@="C:\Windows\Media\Delta\Windows Print complete.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
@="C:\Windows\Media\Delta\Windows Error.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
@="C:\Windows\Media\Delta\Windows Exclamation.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemExit\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
@="C:\Windows\Media\Delta\Windows Critical Stop.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
@="C:\Windows\Media\Delta\Windows Balloon.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
@="C:\Windows\Media\Delta\Windows Logoff Sound.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
@="C:\Windows\Media\Delta\Windows User Account Control.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
@="C:\Windows\Media\Delta\Windows Pop-up Blocked.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FaxError\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FaxLineRings\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FaxSent\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
@="C:\Windows\Media\Delta\Windows Feed Discovered.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
@="C:\Windows\Media\Delta\Windows Navigation Start.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
@="C:\Windows\Media\Delta\Windows Information Bar.wav"
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubOnSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\PanelSound\Delta]
[HKEY_USERS\S-1-5-20\AppEvents\Schemes\Names\Delta]
[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\Namespace]
"LocalDelta"="C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML"
[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\Namespace]
"RemoteDelta"="C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\.Default\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\.Default\Delta]
@="C:\Windows\Media\Delta\Windows Ding.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\ChangeTheme\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Critical.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\DeviceConnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Insert.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Remove.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\DeviceFail\Delta]
@="C:\Windows\Media\Delta\Windows Hardware Fail.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\Delta]
@="C:\Windows\Media\Delta\Windows Battery Low.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\MailBeep\Delta]
@="C:\Windows\Media\Delta\Windows Notify.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\PrintComplete\Delta]
@="C:\Windows\Media\Delta\Windows Print complete.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Delta]
@="C:\Windows\Media\Delta\Windows Error.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemExclamation\Delta]
@="C:\Windows\Media\Delta\Windows Exclamation.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemExit\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemHand\Delta]
@="C:\Windows\Media\Delta\Windows Critical Stop.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\SystemNotification\Delta]
@="C:\Windows\Media\Delta\Windows Balloon.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta]
@="C:\Windows\Media\Delta\Windows Logoff Sound.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\WindowsLogon\Delta]
@="C:\Windows\Media\Delta\Windows Logon Sound.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\.Default\WindowsUAC\Delta]
@="C:\Windows\Media\Delta\Windows User Account Control.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta]
@="C:\Windows\Media\Delta\Windows Pop-up Blocked.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\FaxError\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\FaxLineRings\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\FaxSent\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Delta]
@="C:\Windows\Media\Delta\Windows Feed Discovered.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\Navigating\Delta]
".saved"="C:\Windows\Media\Delta\Windows Navigation Start.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\Explorer\SecurityBand\Delta]
@="C:\Windows\Media\Delta\Windows Information Bar.wav"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\sapisvr\HubOnSound\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Apps\sapisvr\PanelSound\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\AppEvents\Schemes\Names\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\AppDataLow\Software\Adobe\Shockwave 11\uicontrol\sw3dbaddriverlist1]
@="*2k*savage/ix!^5.12.01.7012$79x=stbnvidiatnt16mb!=4.10.01.9131$o2k=diamondstealthiiis530!=5.12.01.8007-8.30.24$72k=m!=5.00.2180.3711$***=atigraphicsproturbopci(atim64-gx)!^9999.0.0.0$ont=nvidiageforce256!=4.00.1381.0327$****virge!^9999.0.0.0$*9x=ibmthinkpad(cyber9397dvd)!=4.10.01.2173$79x=mach64:ragepro!=4.11.2560$*2k=m!^5.12.01.1200$o9x=intel(r)82810graphicscontroller!=4.12.01.2656$o**=m!^5.12.01.1509$o2k=3dfxvoodooseries!=5.00.2195.0197$ont=3dfxvoodooseries!=4.00.1381.0229$o2k=diamondstealthiiis540!=5.12.01.8007-8.30.24$*9x*permedia2!^4.10.01.2359$****mystique!^9999.0.0.0$*9x*g400!^4.12.1.1710$***=2164w!^9999.0.0.0$*9x=mach64:ragepro!^4.10.1720$ont*3dblasterriva!^4.03.00.2100$ont*nvidia!^4.00.1381.0508$79x*nvidia!^4.12.01.0513$o9x*diamondviperv770!^4.11.01.0402$****g100!^9999.0.0.0$59x*nvidiariva128!=4.10.1713$ont*radeon!^4.3.3109$o2k*voodoobanshee!=5.00.2195.2b$o***pe
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Macromedia\Shockwave 8\uicontrol\sw3dbaddriverlist1]
@="*2k*savage/ix!^5.12.01.7012$79x=stbnvidiatnt16mb!=4.10.01.9131$o2k=diamondstealthiiis530!=5.12.01.8007-8.30.24$72k=m!=5.00.2180.3711$***=atigraphicsproturbopci(atim64-gx)!^9999.0.0.0$ont=nvidiageforce256!=4.00.1381.0327$****virge!^9999.0.0.0$*9x=ibmthinkpad(cyber9397dvd)!=4.10.01.2173$79x=mach64:ragepro!=4.11.2560$*2k=m!^5.12.01.1200$o9x=intel(r)82810graphicscontroller!=4.12.01.2656$o**=m!^5.12.01.1509$o2k=3dfxvoodooseries!=5.00.2195.0197$ont=3dfxvoodooseries!=4.00.1381.0229$o2k=diamondstealthiiis540!=5.12.01.8007-8.30.24$*9x*permedia2!^4.10.01.2359$****mystique!^9999.0.0.0$*9x*g400!^4.12.1.1710$***=2164w!^9999.0.0.0$*9x=mach64:ragepro!^4.10.1720$ont*3dblasterriva!^4.03.00.2100$ont*nvidia!^4.00.1381.0508$79x*nvidia!^4.12.01.0513$o9x*diamondviperv770!^4.11.01.0402$****g100!^9999.0.0.0$59x*nvidiariva128!=4.10.1713$ont*radeon!^4.3.3109$o2k*voodoobanshee!=5.00.2195.2b$o***permedia3!^4.12.01
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\delta\iestrg]
"prdct"="delta"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\delta\iestrg]
"prtnrid"="delta"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows Media\WMSDK\Namespace]
"LocalDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows Media\WMSDK\Namespace]
"RemoteDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\delta-search.com]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows Media\WMSDK\Namespace]
"LocalDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows Media\WMSDK\Namespace]
"RemoteDelta"="C:\Users\Michaella\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Synaptics\Scrybe\System\Symbols\4\delta]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Synaptics\Scrybe\System\Symbols\5\Delta]
Searching for "1ClickDownload"
No data found.
Searching for "tarma"
No data found.
-= EOF =-


----------



## Mark1956 (May 7, 2011)

Now we need to remove all the Adware remnants, once you have followed all the instructions below and posted the log, run ADWCleaner again and post the new log from that.

Please download *OTM by OldTimer*. Save it to your desktop.

Double click *OTM.exe* to start the tool.


*Copy* the text in the code box below to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose *Copy*):


```
:Processes
explorer.exe

:Files
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\modules\SearchProtector.jsm
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\ConduitAutoCompleteSearch.js
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\ConduitAutoCompleteSearch.xpt 
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\searchplugin\conduit.xml
C:\Program Files (x86)\SRToolbar
C:\Users\Michaella\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\R0O90FD4\www2.delta-search[1].xml
C:\Program Files (x86)\SRToolbar\Datamngr
:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1 (1).exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1(2).exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\iLividSetupV1(2)_ RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\iLividSetupV1(2)_ RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fa966923-4278-4558-b29c-8145edf5aaa9}\InprocServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{26AE4809-8879-4B6A-A29E-42C460B8D7EE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2A2D6E15-A029-497A-BB7E-099CE833D69C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{943A386A-457F-4CD4-A4B0-0BB65F52537B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A0D51E52-DDB7-43EA-B519-F88C8599F678}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2C670EB-344A-410A-A8FA-0F11CAAA418C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D66429E0-2304-453E-A8B9-AD269F1D4A49}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E3AB3D8D-AB44-47A1-9659-9571DEAD0E95}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fa966923-4278-4558-b29c-8145edf5aaa9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\fixbeetoolbargaw]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{fa966923-4278-4558-b29c-8145edf5aaa9}\InprocServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-28A8_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-28A8_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0B90_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0B90_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-1760_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-1760_RASMANCS]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\SweetIM]
[-HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\SweetIM]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\funmoods_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\funmoods_RASMANCS]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta]
[-HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta]

:Commands
[createrestorepoint]
[emptyflash]
[emptytemp]
[resethosts]
[reboot]
```

 Return to OTM, right click in the *"Paste Instructions for Items to be Moved"* window (under the yellow bar) and choose *Paste*.
Click the red *Moveit!* button.
All your desktop icons will disappear as the scan begins. It should complete within a few minutes.
Once complete you may see a box appear asking you to Restart the system to complete the file removal, accept it and it will reboot.
Even if that box does not appear the system should reboot as the command is included in the script.
When the system has come back to the desktop a Notepad document will open, please copy and paste that into your next post.

-- Note: The logs are saved here: C:\_OTM\MovedFiles


----------



## ste08ball (Apr 12, 2013)

otm results

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\modules\SearchProtector.jsm moved successfully.
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\ConduitAutoCompleteSearch.js moved successfully.
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\ConduitAutoCompleteSearch.xpt moved successfully.
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\searchplugin\conduit.xml moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\x64 folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\components folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\searchbar folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\options folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\weatherbutton\icons folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\uwa folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\panels\js folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\panels\images folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\panels\default\scripts folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\panels\default folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\panels\css folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\panels folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib\debugbar folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin\lib folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\skin folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\locale\toolbar folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\locale\lib folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\locale folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\data\weather folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\data\search folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\data folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\content\modules folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\content\lib folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome\content folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\chrome folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2 folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\components folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\searchbar folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\options folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\weatherbutton\icons folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\uwa folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\panels\js folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\panels\images folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\panels\default\scripts folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\panels\default folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\panels\css folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\panels folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib\debugbar folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin\lib folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\skin folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\locale\toolbar folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\locale\lib folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\locale folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\data\weather folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\data\search folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\data folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\content\modules folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\content\lib folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome\content folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\chrome folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1 folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\content folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension folder moved successfully.
C:\Program Files (x86)\SRToolbar\Datamngr folder moved successfully.
C:\Program Files (x86)\SRToolbar folder moved successfully.
C:\Users\Michaella\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\R0O90FD4\www2.delta-search[1].xml moved successfully.
File/Folder C:\Program Files (x86)\SRToolbar\Datamngr not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1 (1).exe\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1(2).exe\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\iLividSetupV1(2)_ RASAPI32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\iLividSetupV1(2)_ RASMANCS\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fa966923-4278-4558-b29c-8145edf5aaa9}\InprocServer32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{26AE4809-8879-4B6A-A29E-42C460B8D7EE}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26AE4809-8879-4B6A-A29E-42C460B8D7EE}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2A2D6E15-A029-497A-BB7E-099CE833D69C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2A2D6E15-A029-497A-BB7E-099CE833D69C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{943A386A-457F-4CD4-A4B0-0BB65F52537B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{943A386A-457F-4CD4-A4B0-0BB65F52537B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A0D51E52-DDB7-43EA-B519-F88C8599F678}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0D51E52-DDB7-43EA-B519-F88C8599F678}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2C670EB-344A-410A-A8FA-0F11CAAA418C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B2C670EB-344A-410A-A8FA-0F11CAAA418C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D66429E0-2304-453E-A8B9-AD269F1D4A49}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D66429E0-2304-453E-A8B9-AD269F1D4A49}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E3AB3D8D-AB44-47A1-9659-9571DEAD0E95}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3AB3D8D-AB44-47A1-9659-9571DEAD0E95}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fa966923-4278-4558-b29c-8145edf5aaa9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fa966923-4278-4558-b29c-8145edf5aaa9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\fixbeetoolbargaw\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{fa966923-4278-4558-b29c-8145edf5aaa9}\InprocServer32\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASMANCS\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-28A8_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-28A8_RASMANCS\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0B90_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0B90_RASMANCS\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-1760_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-1760_RASMANCS\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\SweetIM\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\SweetIM\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\funmoods_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\funmoods_RASMANCS\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Delta\ not found.
========== COMMANDS ==========
Restore point Set: OTM Restore Point

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Journal

User: Mcx1-WILSON
->Flash cache emptied: 0 bytes

User: Michaella
->Flash cache emptied: 8289 bytes

User: Public

User: RegBack

User: systemprofile

User: TxR

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Journal

User: Mcx1-WILSON
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 37542 bytes
->Flash cache emptied: 0 bytes

User: Michaella
->Temp folder emptied: 9272314 bytes
->Temporary Internet Files folder emptied: 54066604 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: RegBack

User: systemprofile

User: TxR

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 55238 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50400 bytes
RecycleBin emptied: 628743 bytes

Total Files Cleaned = 61.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTM by OldTimer - Version 3.1.21.0 log created on 04302013_093307
Files moved on Reboot...
C:\Users\Michaella\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
Registry entries deleted on Reboot...


----------



## ste08ball (Apr 12, 2013)

# AdwCleaner v2.300 - Logfile created 04/30/2013 at 09:43:47
# Updated 28/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Michaella - WILSON
# Boot Mode : Normal
# Running from : C:\Users\Michaella\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Deleted on reboot : C:\ProgramData\Browser Manager
Deleted on reboot : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
***** [Registry] *****

***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16476
[OK] Registry is clean.
-\\ Mozilla Firefox v15.0 (en-US)
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js
[OK] File is clean.
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\prefs.js
[OK] File is clean.
*************************
AdwCleaner[S1].txt - [21475 octets] - [14/04/2013 18:03:19]
AdwCleaner[S2].txt - [1182 octets] - [16/04/2013 02:32:01]
AdwCleaner[S3].txt - [5126 octets] - [17/04/2013 16:54:54]
AdwCleaner[S4].txt - [1302 octets] - [20/04/2013 16:55:31]
AdwCleaner[S5].txt - [406 octets] - [28/04/2013 22:01:51]
AdwCleaner[S6].txt - [10143 octets] - [29/04/2013 00:43:36]
AdwCleaner[S7].txt - [1530 octets] - [29/04/2013 01:30:40]
AdwCleaner[S8].txt - [1542 octets] - [29/04/2013 01:38:20]
AdwCleaner[S9].txt - [1473 octets] - [30/04/2013 09:43:47]
########## EOF - C:\AdwCleaner[S9].txt - [1533 octets] ##########


----------



## Mark1956 (May 7, 2011)

One item left to find. Please run SystemLook again and use this script below then post the log.


```
:filefind
*Browser Manager*
*Datamngr*
*BrowserConnection*
:folderfind
*Browser Manager*
*Datamngr*
*BrowserConnection*
:regfind
Browser Manager
Datamngr
BrowserConnection
```


----------



## ste08ball (Apr 12, 2013)

SystemLook 30.07.11 by jpshortstuff
Log created at 13:25 on 30/04/2013 by Michaella
Administrator - Elevation successful
========== filefind ==========
Searching for "*Browser Manager*"
No files found.
Searching for "*Datamngr*"
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF10_47.dll --a---- 736768 bytes [23:00 10/04/2013] [08:29 29/01/2013] E5F2670ADDDA22918453A13064E6D06A
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF11_47.dll --a---- 736768 bytes [23:00 10/04/2013] [08:29 29/01/2013] 9FCDE758D501AD05834A148E90DA028E
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF12_47.dll --a---- 736768 bytes [23:00 10/04/2013] [08:29 29/01/2013] 26577A4E480C0D7E011073132AA12642
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF13_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:30 29/01/2013] 914A0DBF9208622F923BCAD5AFA63E3F
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF3_47.dll --a---- 740352 bytes [23:00 10/04/2013] [08:27 29/01/2013] 63C9EA1C552D4F6EA9A3745DD161E1A8
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF4_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:27 29/01/2013] 8C9923A5ACC126BB88D860B68E05F2E7
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF5_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:27 29/01/2013] DB36E7A166D3A2CDC2AC65956CF3E16D
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF6_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:28 29/01/2013] 0376B046E5E1A6A44E8783E25701DDE4
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF7_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:28 29/01/2013] 9347C68E55D860CB049562BB62078603
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF8_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:28 29/01/2013] 7360CCAA940EDFED730CE9F48FF3ECB1
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF9_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:29 29/01/2013] 2CEBC0A78830846D2A18E02CCFF252F1
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\datamngr.dll --a---- 1540096 bytes [22:59 10/04/2013] [08:31 29/01/2013] 21B1F4D43CBF432788A4E5A5092E93D3
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\datamngrUI.exe --a---- 1683456 bytes [23:00 10/04/2013] [08:31 29/01/2013] 7C3A70BEB17C8F2A1BBE39F6B4AFEE67
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlp.xpt --a---- 1009 bytes [08:33 16/04/2013] [08:31 29/01/2013] C317A7493D9EB507391B0217CEEACAE1
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF10.dll --a---- 736768 bytes [08:33 16/04/2013] [08:29 29/01/2013] E5F2670ADDDA22918453A13064E6D06A
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF11.dll --a---- 736768 bytes [08:33 16/04/2013] [08:29 29/01/2013] 9FCDE758D501AD05834A148E90DA028E
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF12.dll --a---- 736768 bytes [08:33 16/04/2013] [08:29 29/01/2013] 26577A4E480C0D7E011073132AA12642
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF13.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 914A0DBF9208622F923BCAD5AFA63E3F
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF14.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 26209275084963CACD45B72BB46AC314
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF15.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 4C995E478C81222D31C20B0CB1751742
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF16.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 9054AC22CB45980755212C0EF216717D
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF17.dll --a---- 737280 bytes [08:33 16/04/2013] [08:31 29/01/2013] 54B28DCA6984A1D0E9C982610DE34F39
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF18.dll --a---- 737280 bytes [08:33 16/04/2013] [08:31 29/01/2013] 58107F0BB4569A388A8870E351FB1324
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF3.dll --a---- 740352 bytes [08:33 16/04/2013] [08:27 29/01/2013] 63C9EA1C552D4F6EA9A3745DD161E1A8
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF4.dll --a---- 737280 bytes [08:33 16/04/2013] [08:27 29/01/2013] 8C9923A5ACC126BB88D860B68E05F2E7
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF5.dll --a---- 737280 bytes [08:33 16/04/2013] [08:27 29/01/2013] DB36E7A166D3A2CDC2AC65956CF3E16D
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF6.dll --a---- 737280 bytes [08:33 16/04/2013] [08:28 29/01/2013] 0376B046E5E1A6A44E8783E25701DDE4
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF7.dll --a---- 737280 bytes [08:33 16/04/2013] [08:28 29/01/2013] 9347C68E55D860CB049562BB62078603
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF8.dll --a---- 737280 bytes [08:33 16/04/2013] [08:28 29/01/2013] 7360CCAA940EDFED730CE9F48FF3ECB1
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF9.dll --a---- 737280 bytes [08:33 16/04/2013] [08:29 29/01/2013] 2CEBC0A78830846D2A18E02CCFF252F1
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\content\DataMngr.js --a---- 19255 bytes [08:33 16/04/2013] [08:54 16/10/2012] 0482F311EC3BEFB2018232CC83E2D867
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\x64\datamngr.dll --a---- 2018680 bytes [23:00 10/04/2013] [08:31 29/01/2013] A76CBD61AC008C25D6AA30E6F15BBAF5
Searching for "*BrowserConnection*"
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\BrowserConnection.dll --a---- 89464 bytes [22:59 10/04/2013] [08:31 29/01/2013] 460D239FFB40F701A4B425CD29EED029
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\x64\BrowserConnection.dll --a---- 104312 bytes [22:59 10/04/2013] [08:31 29/01/2013] 956DBCDA4AC74C242E52B2C5DA80315E
========== folderfind ==========
Searching for "*Browser Manager*"
C:\ProgramData\Browser Manager d------ [01:44 11/04/2013]
C:\Users\All Users\Browser Manager d------ [01:44 11/04/2013]
Searching for "*Datamngr*"
C:\_OTL\MovedFiles\04272013_100912\C_Users\Michaella\AppData\LocalLow\DataMngr d------ [14:29 01/05/2012]
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr d------ [22:59 10/04/2013]
Searching for "*BrowserConnection*"
No folders found.
========== regfind ==========
Searching for "Browser Manager"
No data found.
Searching for "Datamngr"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\070F394B126DDE645BD3CA9084552369]
"00000000000000000000000000000000"="C:\Users\MICHAE~1\AppData\Local\Temp\SetupDataMngr_iMesh.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
Searching for "BrowserConnection"
[HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\AVG\AWL2012\PerformanceOptimizer]
"tidx"="searchindex:windowssearch:1;inetsettings:inetbrowserconnection:1;inetsettings:firefoxbrowserconnection:1;visualeffects:SetSelRect:1;visualeffects:QuickInfo:1;visualeffects:SmoothScroll:1;visualeffects:FieldAnimation:1;visualeffects:LBSmoothScroll:1;visualeffects:MenuFade:1;visualeffects:MenuAnimation:1;visualeffects:menuresponsiveness:1;performanceowerplan:1;browser:FirefoxAdblockPlus:1;browser:browserfirefox:1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\AWL2012\PerformanceOptimizer]
"tidx"="searchindex:windowssearch:1;inetsettings:inetbrowserconnection:1;inetsettings:firefoxbrowserconnection:1;visualeffects:SetSelRect:1;visualeffects:QuickInfo:1;visualeffects:SmoothScroll:1;visualeffects:FieldAnimation:1;visualeffects:LBSmoothScroll:1;visualeffects:MenuFade:1;visualeffects:MenuAnimation:1;visualeffects:menuresponsiveness:1;performanceowerplan:1;browser:FirefoxAdblockPlus:1;browser:browserfirefox:1"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\AVG\AWL2012\PerformanceOptimizer]
"tidx"="searchindex:windowssearch:1;inetsettings:inetbrowserconnection:1;inetsettings:firefoxbrowserconnection:1;visualeffects:SetSelRect:1;visualeffects:QuickInfo:1;visualeffects:SmoothScroll:1;visualeffects:FieldAnimation:1;visualeffects:LBSmoothScroll:1;visualeffects:MenuFade:1;visualeffects:MenuAnimation:1;visualeffects:menuresponsiveness:1;performanceowerplan:1;browser:FirefoxAdblockPlus:1;browser:browserfirefox:1"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\AVG\AWL2012\PerformanceOptimizer]
"tidx"="searchindex:windowssearch:1;inetsettings:inetbrowserconnection:1;inetsettings:firefoxbrowserconnection:1;visualeffects:SetSelRect:1;visualeffects:QuickInfo:1;visualeffects:SmoothScroll:1;visualeffects:FieldAnimation:1;visualeffects:LBSmoothScroll:1;visualeffects:MenuFade:1;visualeffects:MenuAnimation:1;visualeffects:menuresponsiveness:1;performanceowerplan:1;browser:FirefoxAdblockPlus:1;browser:browserfirefox:1"
-= EOF =-


----------



## Mark1956 (May 7, 2011)

Not much more to go, please follow the instructions below and post the log. When complete please run ADWCleaner using the Delete button and post the new log

Please also run this software to clean out all the temp files, there is no log to post from this one.

Download Temporary file cleaner and save it to the desktop.
Double click on the icon to run it (it appears as a dark grey dustbin). For Windows 7 and Vista right click the icon and select *Run as Administrator*.
When the window opens click on* Start*. It will close all running programs and clear the desktop icons.
When complete you may be asked to reboot, if so accept the request and your PC will reboot automatically.

Double click *OTM.exe* to start the tool.


*Copy* the text in the code box below to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose *Copy*):


```
:Processes
explorer.exe
:Files
C:\ProgramData\Browser Manager
C:\Users\All Users\Browser Manager 
:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\070F394B126DDE645BD3CA9084552369]
:Commands
[createrestorepoint]
[emptyflash]
[emptytemp]
[resethosts]
[reboot]
```

 Return to OTM, right click in the *"Paste Instructions for Items to be Moved"* window (under the yellow bar) and choose *Paste*.
Click the red *Moveit!* button.
All your desktop icons will disappear as the scan begins. It should complete within a few minutes.
Once complete you may see a box appear asking you to Restart the system to complete the file removal, accept it and it will reboot.
Even if that box does not appear the system should reboot as the command is included in the script.
When the system has come back to the desktop a Notepad document will open, please copy and paste that into your next post.

-- Note: The logs are saved here: C:\_OTM\MovedFiles


----------



## ste08ball (Apr 12, 2013)

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
Folder move failed. C:\ProgramData\Browser Manager scheduled to be moved on reboot.
C:\Users\All Users\Browser Manager folder moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\070F394B126DDE645BD3CA9084552369\ not found.
========== COMMANDS ==========
Restore point Set: OTM Restore Point

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Journal

User: Mcx1-WILSON
->Flash cache emptied: 0 bytes

User: Michaella
->Flash cache emptied: 492 bytes

User: Public

User: RegBack

User: systemprofile

User: TxR

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Journal

User: Mcx1-WILSON
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Michaella
->Temp folder emptied: 104372 bytes
->Temporary Internet Files folder emptied: 3546955 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: RegBack

User: systemprofile

User: TxR

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 826 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 4.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTM by OldTimer - Version 3.1.21.0 log created on 04302013_163705
Files moved on Reboot...
File C:\ProgramData\Browser Manager not found!
C:\Users\Michaella\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File C:\Users\Michaella\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W6IET0S0\1095952-laptop-slow-freezing-9[1].htm not found!
File C:\Users\Michaella\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W6IET0S0\si[1].htm not found!
Registry entries deleted on Reboot...


----------



## ste08ball (Apr 12, 2013)

# AdwCleaner v2.300 - Logfile created 04/30/2013 at 16:41:59
# Updated 28/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Michaella - WILSON
# Boot Mode : Normal
# Running from : C:\Users\Michaella\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Deleted on reboot : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
***** [Registry] *****

***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16476
[OK] Registry is clean.
-\\ Mozilla Firefox v15.0 (en-US)
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js
[OK] File is clean.
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\prefs.js
[OK] File is clean.
*************************
AdwCleaner[S10].txt - [1663 octets] - [30/04/2013 13:18:30]
AdwCleaner[S11].txt - [1001 octets] - [30/04/2013 16:42:00]
AdwCleaner[S1].txt - [21475 octets] - [14/04/2013 18:03:19]
AdwCleaner[S2].txt - [1182 octets] - [16/04/2013 02:32:01]
AdwCleaner[S3].txt - [5126 octets] - [17/04/2013 16:54:54]
AdwCleaner[S4].txt - [1302 octets] - [20/04/2013 16:55:31]
AdwCleaner[S5].txt - [406 octets] - [28/04/2013 22:01:51]
AdwCleaner[S6].txt - [10143 octets] - [29/04/2013 00:43:36]
AdwCleaner[S7].txt - [1530 octets] - [29/04/2013 01:30:40]
AdwCleaner[S8].txt - [1542 octets] - [29/04/2013 01:38:20]
AdwCleaner[S9].txt - [1602 octets] - [30/04/2013 09:43:47]
########## EOF - C:\AdwCleaner[S11].txt - [1603 octets] ##########


----------



## Mark1956 (May 7, 2011)

There is one entry that is refusing to go, therefore we need to run a more powerful tool. Run the scan with it as instructed below, we will then use it to delete the item.

*STEP 1*
*NOTE:* If you have already used Combofix please delete the icon from your desktop.


Please download DeFogger and save it to your desktop.
Once downloaded, double-click on the *DeFogger* icon to start the tool.
The application window will appear.
You should now click on the *Disable* button to disable your CD Emulation drivers.
When it prompts you whether or not you want to continue, please click on the *Yes* button to continue.
When the program has completed you will see a *Finished!* message. Click on the *OK* button to exit the program.
If CD Emulation programs are present and have been disabled, *DeFogger* will now ask you to reboot the machine. Please allow it to do so by clicking on the *OK* button.

*STEP 2*
Please download *ComboFix*







from one of the locations below and *save it to your Desktop. <-Important!!!*


Download Mirror #1
Download Mirror #2

Be sure to print out and follow these instructions: *A guide and tutorial on using ComboFix*

*Vista*/*Windows 7* users can skip the Recovery Console instructions and use the Windows DVD to boot into the Vista Recovery Environment or Windows 7 System Recovery Options if something goes awry. If you do not have a Windows 7 DVD then please create a Windows 7 Repair Disc. *XP* users need to install the Recovery Console first.


Temporarily *disable* your *anti-virus*, script blocking and any *anti-malware* real-time protection _*before*_ performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause _"unpredictable results"_. Click this link to see a list of such programs and how to disable them.
If ComboFix detects an older version of itself, you will be asked to update the program.
ComboFix will begin by showing a Disclaimer. Read it and click *I Agree* if you want to continue.
Follow the prompts and click on *Yes* to continue scanning for malware.
If using Windows 7 or Vista and you receive a UAC prompt asking if you want to continue running the program, you should press the *Continue* button.
When finished, please copy and paste the contents of C:\*ComboFix.txt* (_which will open after reboot_) in your next reply.
Be sure to *re-enable* your anti-virus and other security programs.

_-- Do not touch your mouse/keyboard until the ComboFix scan has completed, as this may cause the process to stall or the computer to lock.
-- ComboFix will temporarily disable your desktop, and if interrupted may leave it disabled. If this occurs, please reboot to restore it.
-- ComboFix disables autorun of all CD, floppy and USB devices to assist with malware removal and increase security._

If you no longer have access to your Internet connection after running ComboFix, please reboot to restore it. If that does not restore the connection, then follow the instructions for Manually restoring the Internet connection provided in the "_How to Guide_" you printed out earlier. Those instructions only apply to XP, for Vista and Windows 7 go here: Internet connection repair

*NOTE:* if you see a message like this when you attempt to open anything after the reboot *"Illegal Operation attempted on a registry key that has been marked for deletion"* please reboot the system again and the warning should not return.



> *Do NOT use ComboFix* unless you have been instructed to do so by a Malware Removal Expert. It is a powerful tool intended by its creator to be used under the guidance and supervision of an expert, *NOT for general public or personal use*. *Using this tool incorrectly could lead to serious problems with your operating system such as preventing it from ever starting again.* This site, sUBs and myself *will not* be responsible for any damage caused to your machine by misusing or running ComboFix on your own. Please read *ComboFix's Disclaimer*.


----------



## ste08ball (Apr 12, 2013)

ComboFix 13-05-01.03 - Michaella 02/05/2013 8:11.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.3893.2270 [GMT 1:00]
Running from: c:\users\Michaella\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-04-02 to 2013-05-02 )))))))))))))))))))))))))))))))
.
.
2013-05-02 07:20 . 2013-05-02 07:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-01 18:13 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4B74E4A9-1354-4217-BA35-46E776E80C52}\mpengine.dll
2013-04-30 07:51 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- c:\windows\ERUNT
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- C:\JRT
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\searchplugins
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\Extensions
2013-04-28 11:59 . 2013-04-28 11:59 -------- d-----w- C:\_OTM
2013-04-27 22:23 . 2013-04-27 22:22 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{65B4CDE1-2AA7-4EB2-A309-4516ABDE28C5}\gapaengine.dll
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files\Microsoft Security Client
2013-04-27 16:57 . 2013-04-27 16:57 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\offreg.dll
2013-04-26 13:48 . 2013-04-26 13:48 -------- d-----w- C:\_OTL
2013-04-26 13:29 . 2013-04-27 07:10 -------- d-----w- c:\users\Michaella\AppData\Local\Spotify
2013-04-26 13:29 . 2013-04-27 09:24 -------- d-----w- c:\users\Michaella\AppData\Roaming\Spotify
2013-04-26 11:19 . 2013-04-27 10:19 -------- d-----w- c:\users\Michaella\AppData\Roaming\BitTorrent
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-04-26 09:28 . 2013-04-26 09:28 -------- d-----w- c:\program files (x86)\QuickTime
2013-04-26 07:53 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\mpengine.dll
2013-04-25 09:49 . 2012-08-21 12:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2013-04-25 09:48 . 2013-04-25 09:48 -------- d-----w- c:\program files\iPod
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files\iTunes
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files (x86)\iTunes
2013-04-25 09:47 . 2013-04-25 09:47 -------- d-----w- c:\program files (x86)\Apple Software Update
2013-04-25 09:47 . 2013-04-26 09:29 -------- d-----w- c:\program files\Common Files\Apple
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files\Bonjour
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files (x86)\Bonjour
2013-04-25 09:46 . 2013-04-26 09:29 -------- d-----w- c:\program files (x86)\Common Files\Apple
2013-04-24 07:32 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-17 17:52 . 2013-04-17 17:53 602112 ----a-w- c:\users\Michaella\AppData\Roaming\Microsoft\Windows\Network Shortcuts\OTL.exe
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\users\Michaella\AppData\Roaming\{90140011-0066-0409-0000-0000000FF1CE}
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\programdata\Virtualized Applications
2013-04-14 17:03 . 2013-04-30 15:42 2399 ----a-w- c:\windows\DeleteOnReboot.bat
2013-04-14 12:30 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-13 12:33 . 2013-04-13 13:06 -------- d-----w- c:\users\Michaella\AppData\Roaming\BullGuard
2013-04-13 12:33 . 2013-04-13 13:53 -------- d-----w- c:\programdata\BullGuard
2013-04-12 20:37 . 2013-04-12 20:37 -------- d-----w- c:\users\Michaella\AppData\Roaming\SUPERAntiSpyware.com
2013-04-12 20:35 . 2013-04-12 23:56 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-04-12 20:35 . 2013-04-12 20:35 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2013-04-12 20:31 . 2013-04-12 20:31 -------- d-----w- c:\users\Michaella\AppData\Roaming\Malwarebytes
2013-04-12 20:30 . 2013-04-12 20:30 -------- d-----w- c:\programdata\Malwarebytes
2013-04-12 20:30 . 2013-04-14 12:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-12 20:29 . 2013-04-12 20:29 -------- d-----w- c:\users\Michaella\AppData\Local\Programs
2013-04-12 20:00 . 2013-04-12 23:56 -------- d-----w- c:\program files (x86)\PC HealthBoost
2013-04-12 19:59 . 2013-04-12 23:56 -------- d-----w- c:\programdata\PCHealthBoost
2013-04-11 15:27 . 2013-04-11 15:27 -------- d-----w- c:\program files (x86)\MSECache
2013-04-11 15:08 . 2013-04-11 15:08 -------- d-----w- c:\users\Michaella\AppData\Roaming\ParetoLogic
2013-04-11 15:08 . 2013-04-12 03:51 -------- d-----w- c:\programdata\ParetoLogic
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\users\Michaella\AppData\Roaming\FixBee
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\programdata\FixBee
2013-04-10 22:58 . 2013-04-16 08:33 -------- d-----w- c:\program files (x86)\FixBee
2013-04-10 16:12 . 2013-04-23 08:09 -------- d-----w- c:\program files (x86)\PKR
2013-04-10 11:47 . 2013-02-22 06:29 10925568 ----a-w- c:\windows\system32\ieframe.dll
2013-04-10 07:34 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2013-04-10 07:34 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll
2013-04-10 07:34 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll
2013-04-10 07:34 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll
2013-04-10 07:33 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 07:33 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-10 07:33 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 07:33 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 07:33 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-04-10 07:33 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-04-06 22:56 . 2013-04-14 11:14 -------- d-----w- c:\users\Mcx1-WILSON
2013-04-06 14:29 . 2013-04-06 14:29 -------- d-----w- c:\users\Michaella\AppData\Roaming\AVG
2013-04-06 14:26 . 2013-04-06 14:30 -------- d-----w- c:\programdata\AVG
2013-04-06 14:26 . 2013-04-06 14:26 -------- d-sh--w- c:\programdata\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2013-04-05 20:04 . 2013-04-05 20:04 710992 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2013-04-05 19:12 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2013-04-05 19:12 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2013-04-05 19:12 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2013-04-05 19:12 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2013-04-05 18:49 . 2013-04-05 18:49 -------- d-----w- c:\program files\Microsoft Silverlight
2013-04-05 18:49 . 2013-04-05 18:49 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2013-04-05 18:38 . 2013-04-16 01:11 -------- d-----w- c:\programdata\Skype
2013-04-05 11:48 . 2012-11-09 05:45 750592 ----a-w- c:\windows\system32\win32spl.dll
2013-04-05 11:48 . 2012-11-09 04:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll
2013-04-05 11:45 . 2012-11-22 05:44 800768 ----a-w- c:\windows\system32\usp10.dll
2013-04-05 11:45 . 2012-11-22 04:45 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2013-04-05 11:44 . 2012-11-30 05:41 424448 ----a-w- c:\windows\system32\KernelBase.dll
2013-04-05 11:44 . 2012-11-30 04:53 274944 ----a-w- c:\windows\SysWow64\KernelBase.dll
2013-04-05 11:44 . 2012-11-30 05:41 1161216 ----a-w- c:\windows\system32\kernel32.dll
2013-04-05 11:44 . 2012-11-30 05:45 362496 ----a-w- c:\windows\system32\wow64win.dll
2013-04-05 11:44 . 2012-11-30 03:23 338432 ----a-w- c:\windows\system32\conhost.exe
2013-04-05 11:44 . 2012-11-30 05:45 243200 ----a-w- c:\windows\system32\wow64.dll
2013-04-05 11:44 . 2012-11-30 05:45 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2013-04-05 11:44 . 2012-11-30 05:43 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2013-04-05 10:52 . 2013-04-05 10:52 163088 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10143.bin
2013-04-05 10:51 . 2012-11-23 03:13 68608 ----a-w- c:\windows\system32\taskhost.exe
2013-04-05 10:51 . 2013-04-16 08:51 -------- d-----w- c:\windows\system32\drivers\N360x64\0604010.00E
2013-04-05 10:50 . 2013-04-05 10:50 -------- d-----w- c:\users\Michaella\AppData\Roaming\TuneUp Software
2013-04-05 10:40 . 2013-04-05 10:40 -------- d--h--w- c:\programdata\Common Files
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-10 11:53 . 2012-04-26 22:18 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-05 20:04 . 2012-06-29 23:37 895088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-04-05 20:04 . 2012-06-29 23:37 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-04-05 12:21 . 2012-04-21 20:49 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-05 12:21 . 2012-04-21 20:49 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-02 10:34 . 2010-11-21 03:27 282744 ------w- c:\windows\system32\MpSigStub.exe
2013-02-12 05:45 . 2013-04-05 11:52 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-04-05 11:52 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-04-05 11:52 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 05:45 . 2013-04-05 11:52 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 04:48 . 2013-04-05 11:52 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-04-05 11:52 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="c:\program files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-05-30 868352]
"Spotify Web Helper"="c:\users\Michaella\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-04-26 1105408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LoadFUJ02E3"="c:\program files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe" [2009-10-08 36712]
"IndicatorUtility"="c:\program files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2009-10-09 47976]
"UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"DeskUpdateNotifier"="c:\fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe" [2013-02-26 102968]
"ServiceManager.exe"="c:\program files (x86)\Virgin Media\Service Manager\ServiceManager.exe" [2011-11-16 10200376]
"DHSClient.exe"="c:\program files (x86)\Virgin Media\Digital Home Support\DHSClient.exe" [2011-03-23 2032952]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"RequireSignedAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HsdService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-07-08 35840]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-04-21 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2010-09-17 194640]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 FBDiskOptimizer;FBDiskOptimizer;c:\program files (x86)\FixBee\FBDefragSrv64.exe [2012-12-05 631664]
S2 HsdService;HsdService;c:\program files (x86)\Virgin Media\Digital Home Support\HsdService.exe [2011-03-23 1406264]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 PFNService;PFNService;c:\program files\Fujitsu\Plugfree NETWORK\PFNService.exe [2010-06-24 330240]
S2 PowerSavingUtilityService;PowerSavingUtilityService;c:\program files\Fujitsu\PSUtility\PSUService.exe [2009-07-30 63336]
S2 ServicepointService;ServicepointService;c:\program files (x86)\Virgin Media\Service Manager\ServicepointService.exe [2011-11-16 10310968]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-01 2314240]
S2 VFPRadioSupportService;Bluetooth Feature Support;c:\program files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [2009-12-24 145840]
S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\DRIVERS\FUJ02E3.sys [2006-11-01 7296]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-11-01 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-11-27 244736]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-04 346144]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 12:21]
.
2013-04-30 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoBackuped]
@="{7E5951A0-8683-432A-9483-5F43168D6A8C}"
[HKEY_CLASSES_ROOT\CLSID\{7E5951A0-8683-432A-9483-5F43168D6A8C}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoSelected]
@="{15054241-49B4-4FA6-B4C7-A0071F118110}"
[HKEY_CLASSES_ROOT\CLSID\{15054241-49B4-4FA6-B4C7-A0071F118110}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-01-12 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-01-12 390680]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-01-12 410136]
"PfNet"="c:\program files\Fujitsu\Plugfree NETWORK\PfNet.exe" [2010-06-24 6310912]
"PSUTility"="c:\program files\Fujitsu\PSUtility\TrayManager.exe" [2009-07-30 188264]
"FDM7"="c:\program files\Fujitsu\FDM7\FdmDaemon.exe" [2009-11-26 164712]
"LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2009-10-15 157544]
"LoadBtnHnd"="c:\program files\Fujitsu\Application Panel\BtnHnd.exe" [2009-10-15 35176]
"CSRBIP"="c:\program files\CSR\Bluetooth Feature Pack 5.0\CSRBipPushResponder.exe" [2009-12-24 419752]
"Backup & Storage"="c:\program files\VirginMedia\V Stuff Backup\Backup & Storage.exe" [2011-09-28 17483952]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.co.uk/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
FF - ProfilePath - c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\
FF - prefs.js: browser.search.defaulturl - 
FF - ExtSQL: 2013-04-16 09:33; {fa966923-4278-4558-b29c-8145edf5aaa9}; c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}
FF - ExtSQL: !HIDDEN! 2013-04-16 09:33; {1FD91A9C-410C-4090-BBCC-55D3450EF433}; c:\program files (x86)\SRToolbar\Datamngr\FirefoxExtension
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{3bbd3c14-4c16-4989-8366-95bc9179779d} - (no file)
URLSearchHooks-{7b13ec3e-999a-4b70-b9cb-2617b8323822} - (no file)
BHO-{fa966923-4278-4558-b29c-8145edf5aaa9} - (no file)
Toolbar-Locked - (no file)
Toolbar-{AD8AD957-B30E-4842-8253-BFBC5F7440F3} - c:\program files (x86)\virgintoolbar\virgintoolbarDx.dll
Toolbar-Locked - (no file)
WebBrowser-{7B13EC3E-999A-4B70-B9CB-2617B8323822} - (no file)
WebBrowser-{687578B9-7132-4A7A-80E4-30EE31099E03} - (no file)
WebBrowser-{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1} - (no file)
WebBrowser-{3BBD3C14-4C16-4989-8366-95BC9179779D} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-virgintoolbar - c:\program files (x86)\virgintoolbar\uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DIB\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ICO\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.ico.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JFIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPE\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPEG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PNG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.png.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIFF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WDP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.wdp.15.4"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-05-02 08:23:58
ComboFix-quarantined-files.txt 2013-05-02 07:23
.
Pre-Run: 334,812,278,784 bytes free
Post-Run: 334,659,665,920 bytes free
.
- - End Of File - - 73EA8E2FDDC7398A14828C30539A25EF


----------



## Mark1956 (May 7, 2011)

We are now going to run ComboFix a different way.

Open Notepad by clicking on







and in the *Search* box type: *Notepad.exe* and hit *Enter*.
Copy and paste everything in the *code box* below into it.
_-- Note: Make sure Word Wrap is *unchecked* in Notepad by clicking on *Format* in the top menu._


```
KillAll::

Folder::
c:\users\Michaella\AppData\Roaming\BullGuard
c:\programdata\BullGuard

Firefox::
FF - ProfilePath - c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\
FF - ExtSQL: 2013-04-16 09:33; {fa966923-4278-4558-b29c-8145edf5aaa9}; c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}
FF - ExtSQL: !HIDDEN! 2013-04-16 09:33; {1FD91A9C-410C-4090-BBCC-55D3450EF433}; c:\program files (x86)\SRToolbar\Datamngr\FirefoxExtension


Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\070F394B126DDE645BD3CA9084552369]

ClearJavaCache::

Reboot::
```

Save the file as *CFScript.txt* by choosing _Save As..._ in the File Menu, and save it to your Desktop where the ComboFix icon is also located.
Close your browser and* disconnect* from the Internet.
Now use your mouse to *drag*, then *drop* the CFScript.txt file on top of ComboFix.exe as seen in the image below.









This will start ComboFix again and launch the script.
ComboFix may reboot your system when it finishes. This is normal.
A log will be created just as before and saved to C:\ComboFix.txt. Please copy and paste the contents of *ComboFix.txt* in your next reply.
Be sure to *re-enable* your anti-virus and other security programs *after* the scan is complete.
NOTE: if you see a message like this when you attempt to open anything after the reboot *"Illegal Operation attempted on a registry key that has been marked for deletion"* please reboot the system again and the warning should not return.


----------



## ste08ball (Apr 12, 2013)

ComboFix 13-05-01.03 - Michaella 02/05/2013 15:21:13.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.3893.2365 [GMT 1:00]
Running from: c:\users\Michaella\Desktop\ComboFix.exe
Command switches used :: c:\users\Michaella\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\BullGuard
c:\programdata\BullGuard\AccountTools-Michaella.log
c:\programdata\BullGuard\AccountTools-SYSTEM.log
c:\programdata\BullGuard\BdSpy.log
c:\programdata\BullGuard\bgavc.db
c:\programdata\BullGuard\BsBackup.log
c:\programdata\BullGuard\BsFileScan.log
c:\programdata\BullGuard\BsFire.log
c:\programdata\BullGuard\BsMailProxy.log
c:\programdata\BullGuard\BsMain.log
c:\programdata\BullGuard\BsUpdate.log
c:\programdata\BullGuard\BullGuard-Michaella.log
c:\programdata\BullGuard\BullGuardBhvScanner.log
c:\programdata\BullGuard\BullGuardScanner.log
c:\programdata\BullGuard\Logs\Firewall\fw-2013-04-13.txt
c:\programdata\BullGuard\Ns.bkup
c:\programdata\BullGuard\Ns.db-journal
c:\programdata\BullGuard\Ns.db
c:\programdata\BullGuard\NSLogs\NSLogException20130413.dat
c:\programdata\BullGuard\PACEngine.log
c:\programdata\BullGuard\ParentalControl\PACReports.db
c:\programdata\BullGuard\SafeBrowsingEngine.log
c:\programdata\BullGuard\SecondaryUpdater.log
c:\programdata\BullGuard\TuneUp\Restore.db
c:\programdata\BullGuard\TuneUpEngine.log
c:\programdata\BullGuard\urls.db
c:\programdata\BullGuard\words.hdb-journal
c:\programdata\BullGuard\words.hdb
c:\users\Michaella\AppData\Roaming\BullGuard
c:\users\Michaella\AppData\Roaming\BullGuard\Antivirus\Profiles\###1.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Antivirus\Profiles\###2.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Antivirus\Profiles\###4.xml
c:\users\Michaella\AppData\Roaming\BullGuard\BgLearning.txt
c:\users\Michaella\AppData\Roaming\BullGuard\BsConnect(AVIR).txt
c:\users\Michaella\AppData\Roaming\BullGuard\BsConnect(FWALL).txt
c:\users\Michaella\AppData\Roaming\BullGuard\BsConnect(MVIR).txt
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Log\GamingPlugin.log
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Aion.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\ARMA 2.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Batman Arkham Asylum.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Borderlands.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Call of Duty Modern Warfare 2.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Call of Duty Modern Warfare.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\DiRT 2.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Dragon Age Origins.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Empire Total War.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\FIFA 10.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Game Mode.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Killing Floor.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Left 4 Dead 2.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Left 4 Dead.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\NBA 2K10.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Need for Speed Shift.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Psychonauts.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Red Faction Guerilla.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Resident Evil 5.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Shattered Horizon.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Street Fighter IV.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Team Fortress 2.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\The Sims 3.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Torchlight.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Tropico 3.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Unreal Tournament 2004.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Unreal Tournament 3.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Warhammer 40,000 Dawn of War 2.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\World of Warcraft.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Gaming\Profiles\Zombie Driver.xml
c:\users\Michaella\AppData\Roaming\BullGuard\Inspector\InspectorScan.log
c:\users\Michaella\AppData\Roaming\BullGuard\TuneUp\BpTuneUp.log
c:\users\Michaella\Desktop\Internet Explorer.lnk
.
.
((((((((((((((((((((((((( Files Created from 2013-04-02 to 2013-05-02 )))))))))))))))))))))))))))))))
.
.
2013-05-02 14:30 . 2013-05-02 14:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-02 07:43 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E253949-F31F-44E4-B8C0-757FC46F5ED3}\mpengine.dll
2013-04-30 07:51 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- c:\windows\ERUNT
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- C:\JRT
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\searchplugins
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\Extensions
2013-04-28 11:59 . 2013-04-28 11:59 -------- d-----w- C:\_OTM
2013-04-27 22:23 . 2013-04-27 22:22 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{65B4CDE1-2AA7-4EB2-A309-4516ABDE28C5}\gapaengine.dll
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files\Microsoft Security Client
2013-04-27 16:57 . 2013-04-27 16:57 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\offreg.dll
2013-04-26 13:48 . 2013-04-26 13:48 -------- d-----w- C:\_OTL
2013-04-26 13:29 . 2013-04-27 07:10 -------- d-----w- c:\users\Michaella\AppData\Local\Spotify
2013-04-26 13:29 . 2013-04-27 09:24 -------- d-----w- c:\users\Michaella\AppData\Roaming\Spotify
2013-04-26 11:19 . 2013-04-27 10:19 -------- d-----w- c:\users\Michaella\AppData\Roaming\BitTorrent
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-04-26 09:28 . 2013-04-26 09:28 -------- d-----w- c:\program files (x86)\QuickTime
2013-04-26 07:53 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\mpengine.dll
2013-04-25 09:49 . 2012-08-21 12:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2013-04-25 09:48 . 2013-04-25 09:48 -------- d-----w- c:\program files\iPod
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files\iTunes
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files (x86)\iTunes
2013-04-25 09:47 . 2013-04-25 09:47 -------- d-----w- c:\program files (x86)\Apple Software Update
2013-04-25 09:47 . 2013-04-26 09:29 -------- d-----w- c:\program files\Common Files\Apple
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files\Bonjour
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files (x86)\Bonjour
2013-04-25 09:46 . 2013-04-26 09:29 -------- d-----w- c:\program files (x86)\Common Files\Apple
2013-04-24 07:32 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-17 17:52 . 2013-04-17 17:53 602112 ----a-w- c:\users\Michaella\AppData\Roaming\Microsoft\Windows\Network Shortcuts\OTL.exe
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\users\Michaella\AppData\Roaming\{90140011-0066-0409-0000-0000000FF1CE}
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\programdata\Virtualized Applications
2013-04-14 17:03 . 2013-04-30 15:42 2399 ----a-w- c:\windows\DeleteOnReboot.bat
2013-04-14 12:30 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-12 20:37 . 2013-04-12 20:37 -------- d-----w- c:\users\Michaella\AppData\Roaming\SUPERAntiSpyware.com
2013-04-12 20:35 . 2013-04-12 23:56 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-04-12 20:35 . 2013-04-12 20:35 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2013-04-12 20:31 . 2013-04-12 20:31 -------- d-----w- c:\users\Michaella\AppData\Roaming\Malwarebytes
2013-04-12 20:30 . 2013-04-12 20:30 -------- d-----w- c:\programdata\Malwarebytes
2013-04-12 20:30 . 2013-04-14 12:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-12 20:29 . 2013-04-12 20:29 -------- d-----w- c:\users\Michaella\AppData\Local\Programs
2013-04-12 20:00 . 2013-04-12 23:56 -------- d-----w- c:\program files (x86)\PC HealthBoost
2013-04-12 19:59 . 2013-04-12 23:56 -------- d-----w- c:\programdata\PCHealthBoost
2013-04-11 15:27 . 2013-04-11 15:27 -------- d-----w- c:\program files (x86)\MSECache
2013-04-11 15:08 . 2013-04-11 15:08 -------- d-----w- c:\users\Michaella\AppData\Roaming\ParetoLogic
2013-04-11 15:08 . 2013-04-12 03:51 -------- d-----w- c:\programdata\ParetoLogic
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\users\Michaella\AppData\Roaming\FixBee
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\programdata\FixBee
2013-04-10 22:58 . 2013-04-16 08:33 -------- d-----w- c:\program files (x86)\FixBee
2013-04-10 16:12 . 2013-04-23 08:09 -------- d-----w- c:\program files (x86)\PKR
2013-04-10 11:47 . 2013-02-22 06:29 10925568 ----a-w- c:\windows\system32\ieframe.dll
2013-04-10 07:34 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2013-04-10 07:34 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll
2013-04-10 07:34 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll
2013-04-10 07:34 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll
2013-04-10 07:33 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 07:33 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-10 07:33 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 07:33 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 07:33 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-04-10 07:33 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-04-06 22:56 . 2013-04-14 11:14 -------- d-----w- c:\users\Mcx1-WILSON
2013-04-06 14:29 . 2013-04-06 14:29 -------- d-----w- c:\users\Michaella\AppData\Roaming\AVG
2013-04-06 14:26 . 2013-04-06 14:30 -------- d-----w- c:\programdata\AVG
2013-04-06 14:26 . 2013-04-06 14:26 -------- d-sh--w- c:\programdata\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2013-04-05 20:04 . 2013-04-05 20:04 710992 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2013-04-05 19:12 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2013-04-05 19:12 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2013-04-05 19:12 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2013-04-05 19:12 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2013-04-05 18:49 . 2013-04-05 18:49 -------- d-----w- c:\program files\Microsoft Silverlight
2013-04-05 18:49 . 2013-04-05 18:49 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2013-04-05 18:38 . 2013-04-16 01:11 -------- d-----w- c:\programdata\Skype
2013-04-05 11:48 . 2012-11-09 05:45 750592 ----a-w- c:\windows\system32\win32spl.dll
2013-04-05 11:48 . 2012-11-09 04:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll
2013-04-05 11:45 . 2012-11-22 05:44 800768 ----a-w- c:\windows\system32\usp10.dll
2013-04-05 11:45 . 2012-11-22 04:45 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2013-04-05 11:44 . 2012-11-30 05:41 424448 ----a-w- c:\windows\system32\KernelBase.dll
2013-04-05 11:44 . 2012-11-30 04:53 274944 ----a-w- c:\windows\SysWow64\KernelBase.dll
2013-04-05 11:44 . 2012-11-30 05:41 1161216 ----a-w- c:\windows\system32\kernel32.dll
2013-04-05 11:44 . 2012-11-30 05:45 362496 ----a-w- c:\windows\system32\wow64win.dll
2013-04-05 11:44 . 2012-11-30 03:23 338432 ----a-w- c:\windows\system32\conhost.exe
2013-04-05 11:44 . 2012-11-30 05:45 243200 ----a-w- c:\windows\system32\wow64.dll
2013-04-05 11:44 . 2012-11-30 05:45 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2013-04-05 11:44 . 2012-11-30 05:43 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2013-04-05 10:52 . 2013-04-05 10:52 163088 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10143.bin
2013-04-05 10:51 . 2012-11-23 03:13 68608 ----a-w- c:\windows\system32\taskhost.exe
2013-04-05 10:51 . 2013-04-16 08:51 -------- d-----w- c:\windows\system32\drivers\N360x64\0604010.00E
2013-04-05 10:50 . 2013-04-05 10:50 -------- d-----w- c:\users\Michaella\AppData\Roaming\TuneUp Software
2013-04-05 10:40 . 2013-04-05 10:40 -------- d--h--w- c:\programdata\Common Files
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-10 11:53 . 2012-04-26 22:18 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-05 20:04 . 2012-06-29 23:37 895088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-04-05 20:04 . 2012-06-29 23:37 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-04-05 12:21 . 2012-04-21 20:49 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-05 12:21 . 2012-04-21 20:49 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-02 10:34 . 2010-11-21 03:27 282744 ------w- c:\windows\system32\MpSigStub.exe
2013-02-12 05:45 . 2013-04-05 11:52 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-04-05 11:52 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-04-05 11:52 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 05:45 . 2013-04-05 11:52 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 04:48 . 2013-04-05 11:52 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-04-05 11:52 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{AD8AD957-B30E-4842-8253-BFBC5F7440F3}"= "c:\program files (x86)\virgintoolbar\virgintoolbarDx.dll" [BU]
.
[HKEY_CLASSES_ROOT\clsid\{ad8ad957-b30e-4842-8253-bfbc5f7440f3}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="c:\program files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-05-30 868352]
"Spotify Web Helper"="c:\users\Michaella\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-04-26 1105408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LoadFUJ02E3"="c:\program files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe" [2009-10-08 36712]
"IndicatorUtility"="c:\program files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2009-10-09 47976]
"UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"DeskUpdateNotifier"="c:\fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe" [2013-02-26 102968]
"ServiceManager.exe"="c:\program files (x86)\Virgin Media\Service Manager\ServiceManager.exe" [2011-11-16 10200376]
"DHSClient.exe"="c:\program files (x86)\Virgin Media\Digital Home Support\DHSClient.exe" [2011-03-23 2032952]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"RequireSignedAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HsdService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-07-08 35840]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-04-21 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2010-09-17 194640]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 FBDiskOptimizer;FBDiskOptimizer;c:\program files (x86)\FixBee\FBDefragSrv64.exe [2012-12-05 631664]
S2 HsdService;HsdService;c:\program files (x86)\Virgin Media\Digital Home Support\HsdService.exe [2011-03-23 1406264]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 PFNService;PFNService;c:\program files\Fujitsu\Plugfree NETWORK\PFNService.exe [2010-06-24 330240]
S2 PowerSavingUtilityService;PowerSavingUtilityService;c:\program files\Fujitsu\PSUtility\PSUService.exe [2009-07-30 63336]
S2 ServicepointService;ServicepointService;c:\program files (x86)\Virgin Media\Service Manager\ServicepointService.exe [2011-11-16 10310968]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-01 2314240]
S2 VFPRadioSupportService;Bluetooth Feature Support;c:\program files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [2009-12-24 145840]
S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\DRIVERS\FUJ02E3.sys [2006-11-01 7296]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-11-01 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-11-27 244736]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-04 346144]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 12:21]
.
2013-04-30 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoBackuped]
@="{7E5951A0-8683-432A-9483-5F43168D6A8C}"
[HKEY_CLASSES_ROOT\CLSID\{7E5951A0-8683-432A-9483-5F43168D6A8C}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoSelected]
@="{15054241-49B4-4FA6-B4C7-A0071F118110}"
[HKEY_CLASSES_ROOT\CLSID\{15054241-49B4-4FA6-B4C7-A0071F118110}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-01-12 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-01-12 390680]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-01-12 410136]
"PfNet"="c:\program files\Fujitsu\Plugfree NETWORK\PfNet.exe" [2010-06-24 6310912]
"PSUTility"="c:\program files\Fujitsu\PSUtility\TrayManager.exe" [2009-07-30 188264]
"FDM7"="c:\program files\Fujitsu\FDM7\FdmDaemon.exe" [2009-11-26 164712]
"LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2009-10-15 157544]
"LoadBtnHnd"="c:\program files\Fujitsu\Application Panel\BtnHnd.exe" [2009-10-15 35176]
"CSRBIP"="c:\program files\CSR\Bluetooth Feature Pack 5.0\CSRBipPushResponder.exe" [2009-12-24 419752]
"Backup & Storage"="c:\program files\VirginMedia\V Stuff Backup\Backup & Storage.exe" [2011-09-28 17483952]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.co.uk/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
FF - ProfilePath - c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\
FF - prefs.js: browser.search.defaulturl - 
FF - ExtSQL: 2013-04-16 09:33; {fa966923-4278-4558-b29c-8145edf5aaa9}; c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}
FF - ExtSQL: !HIDDEN! 2013-04-16 09:33; {1FD91A9C-410C-4090-BBCC-55D3450EF433}; c:\program files (x86)\SRToolbar\Datamngr\FirefoxExtension
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{fa966923-4278-4558-b29c-8145edf5aaa9} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{687578B9-7132-4A7A-80E4-30EE31099E03} - (no file)
WebBrowser-{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1} - (no file)
AddRemove-virgintoolbar - c:\program files (x86)\virgintoolbar\uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DIB\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ICO\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.ico.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JFIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPE\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPEG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PNG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.png.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIFF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WDP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.wdp.15.4"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\CTsvcCDA.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
.
**************************************************************************
.
Completion time: 2013-05-02 15:37:23 - machine was rebooted
ComboFix-quarantined-files.txt 2013-05-02 14:37
ComboFix2.txt 2013-05-02 07:23
.
Pre-Run: 334,405,029,888 bytes free
Post-Run: 334,331,015,168 bytes free
.
- - End Of File - - 5F469F1F4384F6065332AFD63241F399


----------



## Mark1956 (May 7, 2011)

Bullguard has been removed ok, but the more important entries for the Adware have not. There were some extra spaces in the script which may have caused this to happen.

I have edited the script in post 127 please repeat the process and post the new log.


----------



## ste08ball (Apr 12, 2013)

ComboFix 13-05-01.03 - Michaella 03/05/2013 8:46.3.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.3893.2361 [GMT 1:00]
Running from: c:\users\Michaella\Desktop\ComboFix.exe
Command switches used :: c:\users\Michaella\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2013-04-03 to 2013-05-03 )))))))))))))))))))))))))))))))
.
.
2013-05-03 07:54 . 2013-05-03 07:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-02 14:42 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{43EFAA04-F090-4A1E-8313-84AF36D54093}\mpengine.dll
2013-04-30 07:51 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- c:\windows\ERUNT
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- C:\JRT
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\searchplugins
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\Extensions
2013-04-28 11:59 . 2013-04-28 11:59 -------- d-----w- C:\_OTM
2013-04-27 22:23 . 2013-04-27 22:22 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{65B4CDE1-2AA7-4EB2-A309-4516ABDE28C5}\gapaengine.dll
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files\Microsoft Security Client
2013-04-27 16:57 . 2013-04-27 16:57 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\offreg.dll
2013-04-26 13:48 . 2013-04-26 13:48 -------- d-----w- C:\_OTL
2013-04-26 13:29 . 2013-04-27 07:10 -------- d-----w- c:\users\Michaella\AppData\Local\Spotify
2013-04-26 13:29 . 2013-04-27 09:24 -------- d-----w- c:\users\Michaella\AppData\Roaming\Spotify
2013-04-26 11:19 . 2013-04-27 10:19 -------- d-----w- c:\users\Michaella\AppData\Roaming\BitTorrent
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-04-26 09:28 . 2013-04-26 09:28 -------- d-----w- c:\program files (x86)\QuickTime
2013-04-26 07:53 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\mpengine.dll
2013-04-25 09:49 . 2012-08-21 12:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2013-04-25 09:48 . 2013-04-25 09:48 -------- d-----w- c:\program files\iPod
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files\iTunes
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files (x86)\iTunes
2013-04-25 09:47 . 2013-04-25 09:47 -------- d-----w- c:\program files (x86)\Apple Software Update
2013-04-25 09:47 . 2013-04-26 09:29 -------- d-----w- c:\program files\Common Files\Apple
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files\Bonjour
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files (x86)\Bonjour
2013-04-25 09:46 . 2013-04-26 09:29 -------- d-----w- c:\program files (x86)\Common Files\Apple
2013-04-24 07:32 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-17 17:52 . 2013-04-17 17:53 602112 ----a-w- c:\users\Michaella\AppData\Roaming\Microsoft\Windows\Network Shortcuts\OTL.exe
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\users\Michaella\AppData\Roaming\{90140011-0066-0409-0000-0000000FF1CE}
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\programdata\Virtualized Applications
2013-04-14 17:03 . 2013-04-30 15:42 2399 ----a-w- c:\windows\DeleteOnReboot.bat
2013-04-14 12:30 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-12 20:37 . 2013-04-12 20:37 -------- d-----w- c:\users\Michaella\AppData\Roaming\SUPERAntiSpyware.com
2013-04-12 20:35 . 2013-04-12 23:56 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-04-12 20:35 . 2013-04-12 20:35 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2013-04-12 20:31 . 2013-04-12 20:31 -------- d-----w- c:\users\Michaella\AppData\Roaming\Malwarebytes
2013-04-12 20:30 . 2013-04-12 20:30 -------- d-----w- c:\programdata\Malwarebytes
2013-04-12 20:30 . 2013-04-14 12:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-12 20:29 . 2013-04-12 20:29 -------- d-----w- c:\users\Michaella\AppData\Local\Programs
2013-04-12 20:00 . 2013-04-12 23:56 -------- d-----w- c:\program files (x86)\PC HealthBoost
2013-04-12 19:59 . 2013-04-12 23:56 -------- d-----w- c:\programdata\PCHealthBoost
2013-04-11 15:27 . 2013-04-11 15:27 -------- d-----w- c:\program files (x86)\MSECache
2013-04-11 15:08 . 2013-04-11 15:08 -------- d-----w- c:\users\Michaella\AppData\Roaming\ParetoLogic
2013-04-11 15:08 . 2013-04-12 03:51 -------- d-----w- c:\programdata\ParetoLogic
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\users\Michaella\AppData\Roaming\FixBee
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\programdata\FixBee
2013-04-10 22:58 . 2013-04-16 08:33 -------- d-----w- c:\program files (x86)\FixBee
2013-04-10 16:12 . 2013-04-23 08:09 -------- d-----w- c:\program files (x86)\PKR
2013-04-10 11:47 . 2013-02-22 06:29 10925568 ----a-w- c:\windows\system32\ieframe.dll
2013-04-10 07:34 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2013-04-10 07:34 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll
2013-04-10 07:34 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll
2013-04-10 07:34 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll
2013-04-10 07:33 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 07:33 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-10 07:33 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 07:33 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 07:33 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-04-10 07:33 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-04-06 22:56 . 2013-04-14 11:14 -------- d-----w- c:\users\Mcx1-WILSON
2013-04-06 14:29 . 2013-04-06 14:29 -------- d-----w- c:\users\Michaella\AppData\Roaming\AVG
2013-04-06 14:26 . 2013-04-06 14:30 -------- d-----w- c:\programdata\AVG
2013-04-06 14:26 . 2013-04-06 14:26 -------- d-sh--w- c:\programdata\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2013-04-05 20:04 . 2013-04-05 20:04 710992 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2013-04-05 19:12 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2013-04-05 19:12 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2013-04-05 19:12 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2013-04-05 19:12 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2013-04-05 18:49 . 2013-04-05 18:49 -------- d-----w- c:\program files\Microsoft Silverlight
2013-04-05 18:49 . 2013-04-05 18:49 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2013-04-05 18:38 . 2013-04-16 01:11 -------- d-----w- c:\programdata\Skype
2013-04-05 11:48 . 2012-11-09 05:45 750592 ----a-w- c:\windows\system32\win32spl.dll
2013-04-05 11:48 . 2012-11-09 04:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll
2013-04-05 11:45 . 2012-11-22 05:44 800768 ----a-w- c:\windows\system32\usp10.dll
2013-04-05 11:45 . 2012-11-22 04:45 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2013-04-05 11:44 . 2012-11-30 05:41 424448 ----a-w- c:\windows\system32\KernelBase.dll
2013-04-05 11:44 . 2012-11-30 04:53 274944 ----a-w- c:\windows\SysWow64\KernelBase.dll
2013-04-05 11:44 . 2012-11-30 05:41 1161216 ----a-w- c:\windows\system32\kernel32.dll
2013-04-05 11:44 . 2012-11-30 05:45 362496 ----a-w- c:\windows\system32\wow64win.dll
2013-04-05 11:44 . 2012-11-30 03:23 338432 ----a-w- c:\windows\system32\conhost.exe
2013-04-05 11:44 . 2012-11-30 05:45 243200 ----a-w- c:\windows\system32\wow64.dll
2013-04-05 11:44 . 2012-11-30 05:45 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2013-04-05 11:44 . 2012-11-30 05:43 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2013-04-05 10:52 . 2013-04-05 10:52 163088 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10143.bin
2013-04-05 10:51 . 2012-11-23 03:13 68608 ----a-w- c:\windows\system32\taskhost.exe
2013-04-05 10:51 . 2013-04-16 08:51 -------- d-----w- c:\windows\system32\drivers\N360x64\0604010.00E
2013-04-05 10:50 . 2013-04-05 10:50 -------- d-----w- c:\users\Michaella\AppData\Roaming\TuneUp Software
2013-04-05 10:40 . 2013-04-05 10:40 -------- d--h--w- c:\programdata\Common Files
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-10 11:53 . 2012-04-26 22:18 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-05 20:04 . 2012-06-29 23:37 895088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-04-05 20:04 . 2012-06-29 23:37 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-04-05 12:21 . 2012-04-21 20:49 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-05 12:21 . 2012-04-21 20:49 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-02 10:34 . 2010-11-21 03:27 282744 ------w- c:\windows\system32\MpSigStub.exe
2013-02-12 05:45 . 2013-04-05 11:52 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-04-05 11:52 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-04-05 11:52 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 05:45 . 2013-04-05 11:52 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 04:48 . 2013-04-05 11:52 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-04-05 11:52 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{AD8AD957-B30E-4842-8253-BFBC5F7440F3}"= "c:\program files (x86)\virgintoolbar\virgintoolbarDx.dll" [BU]
.
[HKEY_CLASSES_ROOT\clsid\{ad8ad957-b30e-4842-8253-bfbc5f7440f3}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="c:\program files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-05-30 868352]
"Spotify Web Helper"="c:\users\Michaella\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-04-26 1105408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LoadFUJ02E3"="c:\program files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe" [2009-10-08 36712]
"IndicatorUtility"="c:\program files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2009-10-09 47976]
"UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"DeskUpdateNotifier"="c:\fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe" [2013-02-26 102968]
"ServiceManager.exe"="c:\program files (x86)\Virgin Media\Service Manager\ServiceManager.exe" [2011-11-16 10200376]
"DHSClient.exe"="c:\program files (x86)\Virgin Media\Digital Home Support\DHSClient.exe" [2011-03-23 2032952]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"RequireSignedAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HsdService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-07-08 35840]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-04-21 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2010-09-17 194640]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 FBDiskOptimizer;FBDiskOptimizer;c:\program files (x86)\FixBee\FBDefragSrv64.exe [2012-12-05 631664]
S2 HsdService;HsdService;c:\program files (x86)\Virgin Media\Digital Home Support\HsdService.exe [2011-03-23 1406264]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 PFNService;PFNService;c:\program files\Fujitsu\Plugfree NETWORK\PFNService.exe [2010-06-24 330240]
S2 PowerSavingUtilityService;PowerSavingUtilityService;c:\program files\Fujitsu\PSUtility\PSUService.exe [2009-07-30 63336]
S2 ServicepointService;ServicepointService;c:\program files (x86)\Virgin Media\Service Manager\ServicepointService.exe [2011-11-16 10310968]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-01 2314240]
S2 VFPRadioSupportService;Bluetooth Feature Support;c:\program files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [2009-12-24 145840]
S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\DRIVERS\FUJ02E3.sys [2006-11-01 7296]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-11-01 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-11-27 244736]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-04 346144]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 12:21]
.
2013-05-02 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoBackuped]
@="{7E5951A0-8683-432A-9483-5F43168D6A8C}"
[HKEY_CLASSES_ROOT\CLSID\{7E5951A0-8683-432A-9483-5F43168D6A8C}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoSelected]
@="{15054241-49B4-4FA6-B4C7-A0071F118110}"
[HKEY_CLASSES_ROOT\CLSID\{15054241-49B4-4FA6-B4C7-A0071F118110}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-01-12 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-01-12 390680]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-01-12 410136]
"PfNet"="c:\program files\Fujitsu\Plugfree NETWORK\PfNet.exe" [2010-06-24 6310912]
"PSUTility"="c:\program files\Fujitsu\PSUtility\TrayManager.exe" [2009-07-30 188264]
"FDM7"="c:\program files\Fujitsu\FDM7\FdmDaemon.exe" [2009-11-26 164712]
"LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2009-10-15 157544]
"LoadBtnHnd"="c:\program files\Fujitsu\Application Panel\BtnHnd.exe" [2009-10-15 35176]
"CSRBIP"="c:\program files\CSR\Bluetooth Feature Pack 5.0\CSRBipPushResponder.exe" [2009-12-24 419752]
"Backup & Storage"="c:\program files\VirginMedia\V Stuff Backup\Backup & Storage.exe" [2011-09-28 17483952]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.co.uk/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
FF - ProfilePath - c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\
FF - prefs.js: browser.search.defaulturl - 
FF - ExtSQL: 2013-04-16 09:33; {fa966923-4278-4558-b29c-8145edf5aaa9}; c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}
FF - ExtSQL: !HIDDEN! 2013-04-16 09:33; {1FD91A9C-410C-4090-BBCC-55D3450EF433}; c:\program files (x86)\SRToolbar\Datamngr\FirefoxExtension
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{fa966923-4278-4558-b29c-8145edf5aaa9} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{687578B9-7132-4A7A-80E4-30EE31099E03} - (no file)
WebBrowser-{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1} - (no file)
AddRemove-virgintoolbar - c:\program files (x86)\virgintoolbar\uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DIB\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ICO\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.ico.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JFIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPE\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPEG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PNG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.png.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIFF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WDP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.wdp.15.4"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\CTsvcCDA.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
.
**************************************************************************
.
Completion time: 2013-05-03 09:01:41 - machine was rebooted
ComboFix-quarantined-files.txt 2013-05-03 08:01
ComboFix2.txt 2013-05-02 14:37
ComboFix3.txt 2013-05-02 07:23
.
Pre-Run: 334,259,601,408 bytes free
Post-Run: 334,183,780,352 bytes free
.
- - End Of File - - BC9EE12A9E9E56A2B8AF55BE63E12247


----------



## Mark1956 (May 7, 2011)

Unfortunately that has still failed to remove the entries. We will try a different approach as follows:

We are now going to run ComboFix a different way.

Open Notepad by clicking on









and in the *Search* box type: *Notepad.exe* and hit *Enter*.
Copy and paste everything in the *code box* below into it.
_-- Note: Make sure Word Wrap is *unchecked* in Notepad by clicking on *Format* in the top menu._


```
KillAll::

File::
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}
c:\program files (x86)\SRToolbar\Datamngr\FirefoxExtension

Reboot::
```

Save the file as *CFScript.txt* by choosing _Save As..._ in the File Menu, and save it to your Desktop where the ComboFix icon is also located.
Close your browser and* disconnect* from the Internet.
Now use your mouse to *drag*, then *drop* the CFScript.txt file on top of ComboFix.exe as seen in the image below.









This will start ComboFix again and launch the script.
ComboFix may reboot your system when it finishes. This is normal.
A log will be created just as before and saved to C:\ComboFix.txt. Please copy and paste the contents of *ComboFix.txt* in your next reply.
Be sure to *re-enable* your anti-virus and other security programs *after* the scan is complete.
NOTE: if you see a message like this when you attempt to open anything after the reboot *"Illegal Operation attempted on a registry key that has been marked for deletion"* please reboot the system again and the warning should not return.


----------



## ste08ball (Apr 12, 2013)

ComboFix 13-05-01.03 - Michaella 03/05/2013 15:48:59.4.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.3893.2231 [GMT 1:00]
Running from: c:\users\Michaella\Desktop\ComboFix.exe
Command switches used :: c:\users\Michaella\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files (x86)\SRToolbar\Datamngr\FirefoxExtension"
"c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
c:\programdata\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}\{D3742F82-1C1A-4DCC-ABBD-0E831C0185CC}.msi
.
.
((((((((((((((((((((((((( Files Created from 2013-04-03 to 2013-05-03 )))))))))))))))))))))))))))))))
.
.
2013-05-03 14:57 . 2013-05-03 14:57 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-03 08:15 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2B3A491A-80F5-4D3F-81E7-58F82A053B1F}\mpengine.dll
2013-05-03 08:04 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- c:\windows\ERUNT
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- C:\JRT
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\searchplugins
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\Extensions
2013-04-28 11:59 . 2013-04-28 11:59 -------- d-----w- C:\_OTM
2013-04-27 22:23 . 2013-04-27 22:22 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{65B4CDE1-2AA7-4EB2-A309-4516ABDE28C5}\gapaengine.dll
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files\Microsoft Security Client
2013-04-27 16:57 . 2013-04-27 16:57 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\offreg.dll
2013-04-26 13:48 . 2013-04-26 13:48 -------- d-----w- C:\_OTL
2013-04-26 13:29 . 2013-04-27 07:10 -------- d-----w- c:\users\Michaella\AppData\Local\Spotify
2013-04-26 13:29 . 2013-04-27 09:24 -------- d-----w- c:\users\Michaella\AppData\Roaming\Spotify
2013-04-26 11:19 . 2013-04-27 10:19 -------- d-----w- c:\users\Michaella\AppData\Roaming\BitTorrent
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-04-26 09:28 . 2013-04-26 09:28 -------- d-----w- c:\program files (x86)\QuickTime
2013-04-26 07:53 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\mpengine.dll
2013-04-25 09:49 . 2012-08-21 12:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2013-04-25 09:48 . 2013-04-25 09:48 -------- d-----w- c:\program files\iPod
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files\iTunes
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files (x86)\iTunes
2013-04-25 09:47 . 2013-04-25 09:47 -------- d-----w- c:\program files (x86)\Apple Software Update
2013-04-25 09:47 . 2013-04-26 09:29 -------- d-----w- c:\program files\Common Files\Apple
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files\Bonjour
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files (x86)\Bonjour
2013-04-25 09:46 . 2013-04-26 09:29 -------- d-----w- c:\program files (x86)\Common Files\Apple
2013-04-24 07:32 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-17 17:52 . 2013-04-17 17:53 602112 ----a-w- c:\users\Michaella\AppData\Roaming\Microsoft\Windows\Network Shortcuts\OTL.exe
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\users\Michaella\AppData\Roaming\{90140011-0066-0409-0000-0000000FF1CE}
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\programdata\Virtualized Applications
2013-04-14 17:03 . 2013-04-30 15:42 2399 ----a-w- c:\windows\DeleteOnReboot.bat
2013-04-14 12:30 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-12 20:37 . 2013-04-12 20:37 -------- d-----w- c:\users\Michaella\AppData\Roaming\SUPERAntiSpyware.com
2013-04-12 20:35 . 2013-04-12 23:56 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-04-12 20:35 . 2013-04-12 20:35 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2013-04-12 20:31 . 2013-04-12 20:31 -------- d-----w- c:\users\Michaella\AppData\Roaming\Malwarebytes
2013-04-12 20:30 . 2013-04-12 20:30 -------- d-----w- c:\programdata\Malwarebytes
2013-04-12 20:30 . 2013-04-14 12:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-12 20:29 . 2013-04-12 20:29 -------- d-----w- c:\users\Michaella\AppData\Local\Programs
2013-04-12 20:00 . 2013-04-12 23:56 -------- d-----w- c:\program files (x86)\PC HealthBoost
2013-04-12 19:59 . 2013-04-12 23:56 -------- d-----w- c:\programdata\PCHealthBoost
2013-04-11 15:27 . 2013-04-11 15:27 -------- d-----w- c:\program files (x86)\MSECache
2013-04-11 15:08 . 2013-04-11 15:08 -------- d-----w- c:\users\Michaella\AppData\Roaming\ParetoLogic
2013-04-11 15:08 . 2013-04-12 03:51 -------- d-----w- c:\programdata\ParetoLogic
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\users\Michaella\AppData\Roaming\FixBee
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\programdata\FixBee
2013-04-10 22:58 . 2013-04-16 08:33 -------- d-----w- c:\program files (x86)\FixBee
2013-04-10 16:12 . 2013-04-23 08:09 -------- d-----w- c:\program files (x86)\PKR
2013-04-10 11:47 . 2013-02-22 06:29 10925568 ----a-w- c:\windows\system32\ieframe.dll
2013-04-10 07:34 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2013-04-10 07:34 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll
2013-04-10 07:34 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll
2013-04-10 07:34 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll
2013-04-10 07:33 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 07:33 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-10 07:33 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 07:33 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 07:33 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-04-10 07:33 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-04-06 22:56 . 2013-04-14 11:14 -------- d-----w- c:\users\Mcx1-WILSON
2013-04-06 14:29 . 2013-04-06 14:29 -------- d-----w- c:\users\Michaella\AppData\Roaming\AVG
2013-04-06 14:26 . 2013-04-06 14:30 -------- d-----w- c:\programdata\AVG
2013-04-05 20:04 . 2013-04-05 20:04 710992 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2013-04-05 19:12 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2013-04-05 19:12 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2013-04-05 19:12 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2013-04-05 19:12 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2013-04-05 18:49 . 2013-04-05 18:49 -------- d-----w- c:\program files\Microsoft Silverlight
2013-04-05 18:49 . 2013-04-05 18:49 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2013-04-05 18:38 . 2013-04-16 01:11 -------- d-----w- c:\programdata\Skype
2013-04-05 11:48 . 2012-11-09 05:45 750592 ----a-w- c:\windows\system32\win32spl.dll
2013-04-05 11:48 . 2012-11-09 04:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll
2013-04-05 11:45 . 2012-11-22 05:44 800768 ----a-w- c:\windows\system32\usp10.dll
2013-04-05 11:45 . 2012-11-22 04:45 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2013-04-05 11:44 . 2012-11-30 05:41 424448 ----a-w- c:\windows\system32\KernelBase.dll
2013-04-05 11:44 . 2012-11-30 04:53 274944 ----a-w- c:\windows\SysWow64\KernelBase.dll
2013-04-05 11:44 . 2012-11-30 05:41 1161216 ----a-w- c:\windows\system32\kernel32.dll
2013-04-05 11:44 . 2012-11-30 05:45 362496 ----a-w- c:\windows\system32\wow64win.dll
2013-04-05 11:44 . 2012-11-30 03:23 338432 ----a-w- c:\windows\system32\conhost.exe
2013-04-05 11:44 . 2012-11-30 05:45 243200 ----a-w- c:\windows\system32\wow64.dll
2013-04-05 11:44 . 2012-11-30 05:45 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2013-04-05 11:44 . 2012-11-30 05:43 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2013-04-05 10:52 . 2013-04-05 10:52 163088 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10143.bin
2013-04-05 10:51 . 2012-11-23 03:13 68608 ----a-w- c:\windows\system32\taskhost.exe
2013-04-05 10:51 . 2013-04-16 08:51 -------- d-----w- c:\windows\system32\drivers\N360x64\0604010.00E
2013-04-05 10:50 . 2013-04-05 10:50 -------- d-----w- c:\users\Michaella\AppData\Roaming\TuneUp Software
2013-04-05 10:40 . 2013-04-05 10:40 -------- d--h--w- c:\programdata\Common Files
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-02 15:29 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-10 11:53 . 2012-04-26 22:18 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-05 20:04 . 2012-06-29 23:37 895088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-04-05 20:04 . 2012-06-29 23:37 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-04-05 12:21 . 2012-04-21 20:49 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-05 12:21 . 2012-04-21 20:49 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-12 05:45 . 2013-04-05 11:52 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-04-05 11:52 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-04-05 11:52 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 05:45 . 2013-04-05 11:52 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 04:48 . 2013-04-05 11:52 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-04-05 11:52 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{AD8AD957-B30E-4842-8253-BFBC5F7440F3}"= "c:\program files (x86)\virgintoolbar\virgintoolbarDx.dll" [BU]
.
[HKEY_CLASSES_ROOT\clsid\{ad8ad957-b30e-4842-8253-bfbc5f7440f3}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="c:\program files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-05-30 868352]
"Spotify Web Helper"="c:\users\Michaella\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-04-26 1105408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LoadFUJ02E3"="c:\program files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe" [2009-10-08 36712]
"IndicatorUtility"="c:\program files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2009-10-09 47976]
"UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"DeskUpdateNotifier"="c:\fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe" [2013-02-26 102968]
"ServiceManager.exe"="c:\program files (x86)\Virgin Media\Service Manager\ServiceManager.exe" [2011-11-16 10200376]
"DHSClient.exe"="c:\program files (x86)\Virgin Media\Digital Home Support\DHSClient.exe" [2011-03-23 2032952]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"RequireSignedAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HsdService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-07-08 35840]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-04-21 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2010-09-17 194640]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 FBDiskOptimizer;FBDiskOptimizer;c:\program files (x86)\FixBee\FBDefragSrv64.exe [2012-12-05 631664]
S2 HsdService;HsdService;c:\program files (x86)\Virgin Media\Digital Home Support\HsdService.exe [2011-03-23 1406264]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 PFNService;PFNService;c:\program files\Fujitsu\Plugfree NETWORK\PFNService.exe [2010-06-24 330240]
S2 PowerSavingUtilityService;PowerSavingUtilityService;c:\program files\Fujitsu\PSUtility\PSUService.exe [2009-07-30 63336]
S2 ServicepointService;ServicepointService;c:\program files (x86)\Virgin Media\Service Manager\ServicepointService.exe [2011-11-16 10310968]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-01 2314240]
S2 VFPRadioSupportService;Bluetooth Feature Support;c:\program files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [2009-12-24 145840]
S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\DRIVERS\FUJ02E3.sys [2006-11-01 7296]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-11-01 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-11-27 244736]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-04 346144]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 12:21]
.
2013-05-02 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoBackuped]
@="{7E5951A0-8683-432A-9483-5F43168D6A8C}"
[HKEY_CLASSES_ROOT\CLSID\{7E5951A0-8683-432A-9483-5F43168D6A8C}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoSelected]
@="{15054241-49B4-4FA6-B4C7-A0071F118110}"
[HKEY_CLASSES_ROOT\CLSID\{15054241-49B4-4FA6-B4C7-A0071F118110}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-01-12 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-01-12 390680]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-01-12 410136]
"PfNet"="c:\program files\Fujitsu\Plugfree NETWORK\PfNet.exe" [2010-06-24 6310912]
"PSUTility"="c:\program files\Fujitsu\PSUtility\TrayManager.exe" [2009-07-30 188264]
"FDM7"="c:\program files\Fujitsu\FDM7\FdmDaemon.exe" [2009-11-26 164712]
"LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2009-10-15 157544]
"LoadBtnHnd"="c:\program files\Fujitsu\Application Panel\BtnHnd.exe" [2009-10-15 35176]
"CSRBIP"="c:\program files\CSR\Bluetooth Feature Pack 5.0\CSRBipPushResponder.exe" [2009-12-24 419752]
"Backup & Storage"="c:\program files\VirginMedia\V Stuff Backup\Backup & Storage.exe" [2011-09-28 17483952]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.co.uk/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
FF - ProfilePath - c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\
FF - prefs.js: browser.search.defaulturl - 
FF - ExtSQL: 2013-04-16 09:33; {fa966923-4278-4558-b29c-8145edf5aaa9}; c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}
FF - ExtSQL: !HIDDEN! 2013-04-16 09:33; {1FD91A9C-410C-4090-BBCC-55D3450EF433}; c:\program files (x86)\SRToolbar\Datamngr\FirefoxExtension
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{fa966923-4278-4558-b29c-8145edf5aaa9} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{687578B9-7132-4A7A-80E4-30EE31099E03} - (no file)
WebBrowser-{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1} - (no file)
AddRemove-virgintoolbar - c:\program files (x86)\virgintoolbar\uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DIB\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ICO\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.ico.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JFIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPE\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPEG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PNG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.png.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIFF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WDP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.wdp.15.4"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\CTsvcCDA.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
.
**************************************************************************
.
Completion time: 2013-05-03 16:03:59 - machine was rebooted
ComboFix-quarantined-files.txt 2013-05-03 15:03
ComboFix2.txt 2013-05-03 08:01
ComboFix3.txt 2013-05-02 14:37
ComboFix4.txt 2013-05-02 07:23
.
Pre-Run: 333,787,250,688 bytes free
Post-Run: 333,712,830,464 bytes free
.
- - End Of File - - 2FEFEB4767049EB9B8736FB0D0DA5834


----------



## Mark1956 (May 7, 2011)

The files have been removed but the entries are still showing in Firefox. Open Firefox and then close it again to reset it. Then just run Combofix as you did the first time you used it and post the new log.


----------



## ste08ball (Apr 12, 2013)

ComboFix 13-05-01.03 - Michaella 03/05/2013 17:50:26.7.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.3893.2470 [GMT 1:00]
Running from: c:\users\Michaella\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-04-03 to 2013-05-03 )))))))))))))))))))))))))))))))
.
.
2013-05-03 16:59 . 2013-05-03 16:59 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-03 15:07 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BE789F99-D16D-484B-8EAE-C4A5E4F9E4B3}\mpengine.dll
2013-05-03 08:04 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- c:\windows\ERUNT
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- C:\JRT
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\searchplugins
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\Extensions
2013-04-28 11:59 . 2013-04-28 11:59 -------- d-----w- C:\_OTM
2013-04-27 22:23 . 2013-04-27 22:22 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{65B4CDE1-2AA7-4EB2-A309-4516ABDE28C5}\gapaengine.dll
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files\Microsoft Security Client
2013-04-27 16:57 . 2013-04-27 16:57 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\offreg.dll
2013-04-26 13:48 . 2013-04-26 13:48 -------- d-----w- C:\_OTL
2013-04-26 13:29 . 2013-04-27 07:10 -------- d-----w- c:\users\Michaella\AppData\Local\Spotify
2013-04-26 13:29 . 2013-04-27 09:24 -------- d-----w- c:\users\Michaella\AppData\Roaming\Spotify
2013-04-26 11:19 . 2013-04-27 10:19 -------- d-----w- c:\users\Michaella\AppData\Roaming\BitTorrent
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-04-26 09:28 . 2013-04-26 09:28 -------- d-----w- c:\program files (x86)\QuickTime
2013-04-26 07:53 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\mpengine.dll
2013-04-25 09:49 . 2012-08-21 12:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2013-04-25 09:48 . 2013-04-25 09:48 -------- d-----w- c:\program files\iPod
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files\iTunes
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files (x86)\iTunes
2013-04-25 09:47 . 2013-04-25 09:47 -------- d-----w- c:\program files (x86)\Apple Software Update
2013-04-25 09:47 . 2013-04-26 09:29 -------- d-----w- c:\program files\Common Files\Apple
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files\Bonjour
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files (x86)\Bonjour
2013-04-25 09:46 . 2013-04-26 09:29 -------- d-----w- c:\program files (x86)\Common Files\Apple
2013-04-24 07:32 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-17 17:52 . 2013-04-17 17:53 602112 ----a-w- c:\users\Michaella\AppData\Roaming\Microsoft\Windows\Network Shortcuts\OTL.exe
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\users\Michaella\AppData\Roaming\{90140011-0066-0409-0000-0000000FF1CE}
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\programdata\Virtualized Applications
2013-04-14 17:03 . 2013-04-30 15:42 2399 ----a-w- c:\windows\DeleteOnReboot.bat
2013-04-14 12:30 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-12 20:37 . 2013-04-12 20:37 -------- d-----w- c:\users\Michaella\AppData\Roaming\SUPERAntiSpyware.com
2013-04-12 20:35 . 2013-04-12 23:56 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-04-12 20:35 . 2013-04-12 20:35 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2013-04-12 20:31 . 2013-04-12 20:31 -------- d-----w- c:\users\Michaella\AppData\Roaming\Malwarebytes
2013-04-12 20:30 . 2013-04-12 20:30 -------- d-----w- c:\programdata\Malwarebytes
2013-04-12 20:30 . 2013-04-14 12:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-12 20:29 . 2013-04-12 20:29 -------- d-----w- c:\users\Michaella\AppData\Local\Programs
2013-04-12 20:00 . 2013-04-12 23:56 -------- d-----w- c:\program files (x86)\PC HealthBoost
2013-04-12 19:59 . 2013-04-12 23:56 -------- d-----w- c:\programdata\PCHealthBoost
2013-04-11 15:27 . 2013-04-11 15:27 -------- d-----w- c:\program files (x86)\MSECache
2013-04-11 15:08 . 2013-04-11 15:08 -------- d-----w- c:\users\Michaella\AppData\Roaming\ParetoLogic
2013-04-11 15:08 . 2013-04-12 03:51 -------- d-----w- c:\programdata\ParetoLogic
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\users\Michaella\AppData\Roaming\FixBee
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\programdata\FixBee
2013-04-10 22:58 . 2013-04-16 08:33 -------- d-----w- c:\program files (x86)\FixBee
2013-04-10 16:12 . 2013-04-23 08:09 -------- d-----w- c:\program files (x86)\PKR
2013-04-10 11:47 . 2013-02-22 06:29 10925568 ----a-w- c:\windows\system32\ieframe.dll
2013-04-10 07:34 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2013-04-10 07:34 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll
2013-04-10 07:34 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll
2013-04-10 07:34 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll
2013-04-10 07:33 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 07:33 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-10 07:33 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 07:33 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 07:33 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-04-10 07:33 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-04-06 22:56 . 2013-04-14 11:14 -------- d-----w- c:\users\Mcx1-WILSON
2013-04-06 14:29 . 2013-04-06 14:29 -------- d-----w- c:\users\Michaella\AppData\Roaming\AVG
2013-04-06 14:26 . 2013-04-06 14:30 -------- d-----w- c:\programdata\AVG
2013-04-05 20:04 . 2013-04-05 20:04 710992 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2013-04-05 19:12 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2013-04-05 19:12 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2013-04-05 19:12 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2013-04-05 19:12 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2013-04-05 18:49 . 2013-04-05 18:49 -------- d-----w- c:\program files\Microsoft Silverlight
2013-04-05 18:49 . 2013-04-05 18:49 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2013-04-05 18:38 . 2013-04-16 01:11 -------- d-----w- c:\programdata\Skype
2013-04-05 11:48 . 2012-11-09 05:45 750592 ----a-w- c:\windows\system32\win32spl.dll
2013-04-05 11:48 . 2012-11-09 04:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll
2013-04-05 11:45 . 2012-11-22 05:44 800768 ----a-w- c:\windows\system32\usp10.dll
2013-04-05 11:45 . 2012-11-22 04:45 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2013-04-05 11:44 . 2012-11-30 05:41 424448 ----a-w- c:\windows\system32\KernelBase.dll
2013-04-05 11:44 . 2012-11-30 04:53 274944 ----a-w- c:\windows\SysWow64\KernelBase.dll
2013-04-05 11:44 . 2012-11-30 05:41 1161216 ----a-w- c:\windows\system32\kernel32.dll
2013-04-05 11:44 . 2012-11-30 05:45 362496 ----a-w- c:\windows\system32\wow64win.dll
2013-04-05 11:44 . 2012-11-30 03:23 338432 ----a-w- c:\windows\system32\conhost.exe
2013-04-05 11:44 . 2012-11-30 05:45 243200 ----a-w- c:\windows\system32\wow64.dll
2013-04-05 11:44 . 2012-11-30 05:45 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2013-04-05 11:44 . 2012-11-30 05:43 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2013-04-05 10:52 . 2013-04-05 10:52 163088 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10143.bin
2013-04-05 10:51 . 2012-11-23 03:13 68608 ----a-w- c:\windows\system32\taskhost.exe
2013-04-05 10:51 . 2013-04-16 08:51 -------- d-----w- c:\windows\system32\drivers\N360x64\0604010.00E
2013-04-05 10:50 . 2013-04-05 10:50 -------- d-----w- c:\users\Michaella\AppData\Roaming\TuneUp Software
2013-04-05 10:40 . 2013-04-05 10:40 -------- d--h--w- c:\programdata\Common Files
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-02 15:29 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-10 11:53 . 2012-04-26 22:18 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-05 20:04 . 2012-06-29 23:37 895088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-04-05 20:04 . 2012-06-29 23:37 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-04-05 12:21 . 2012-04-21 20:49 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-05 12:21 . 2012-04-21 20:49 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-12 05:45 . 2013-04-05 11:52 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-04-05 11:52 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-04-05 11:52 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 05:45 . 2013-04-05 11:52 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 04:48 . 2013-04-05 11:52 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-04-05 11:52 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{AD8AD957-B30E-4842-8253-BFBC5F7440F3}"= "c:\program files (x86)\virgintoolbar\virgintoolbarDx.dll" [BU]
.
[HKEY_CLASSES_ROOT\clsid\{ad8ad957-b30e-4842-8253-bfbc5f7440f3}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="c:\program files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-05-30 868352]
"Spotify Web Helper"="c:\users\Michaella\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-04-26 1105408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LoadFUJ02E3"="c:\program files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe" [2009-10-08 36712]
"IndicatorUtility"="c:\program files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2009-10-09 47976]
"UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"DeskUpdateNotifier"="c:\fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe" [2013-02-26 102968]
"ServiceManager.exe"="c:\program files (x86)\Virgin Media\Service Manager\ServiceManager.exe" [2011-11-16 10200376]
"DHSClient.exe"="c:\program files (x86)\Virgin Media\Digital Home Support\DHSClient.exe" [2011-03-23 2032952]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"RequireSignedAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HsdService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-07-08 35840]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-04-21 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2010-09-17 194640]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 FBDiskOptimizer;FBDiskOptimizer;c:\program files (x86)\FixBee\FBDefragSrv64.exe [2012-12-05 631664]
S2 HsdService;HsdService;c:\program files (x86)\Virgin Media\Digital Home Support\HsdService.exe [2011-03-23 1406264]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 PFNService;PFNService;c:\program files\Fujitsu\Plugfree NETWORK\PFNService.exe [2010-06-24 330240]
S2 PowerSavingUtilityService;PowerSavingUtilityService;c:\program files\Fujitsu\PSUtility\PSUService.exe [2009-07-30 63336]
S2 ServicepointService;ServicepointService;c:\program files (x86)\Virgin Media\Service Manager\ServicepointService.exe [2011-11-16 10310968]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-01 2314240]
S2 VFPRadioSupportService;Bluetooth Feature Support;c:\program files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [2009-12-24 145840]
S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\DRIVERS\FUJ02E3.sys [2006-11-01 7296]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-11-01 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-11-27 244736]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-04 346144]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 12:21]
.
2013-05-03 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoBackuped]
@="{7E5951A0-8683-432A-9483-5F43168D6A8C}"
[HKEY_CLASSES_ROOT\CLSID\{7E5951A0-8683-432A-9483-5F43168D6A8C}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoSelected]
@="{15054241-49B4-4FA6-B4C7-A0071F118110}"
[HKEY_CLASSES_ROOT\CLSID\{15054241-49B4-4FA6-B4C7-A0071F118110}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-01-12 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-01-12 390680]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-01-12 410136]
"PfNet"="c:\program files\Fujitsu\Plugfree NETWORK\PfNet.exe" [2010-06-24 6310912]
"PSUTility"="c:\program files\Fujitsu\PSUtility\TrayManager.exe" [2009-07-30 188264]
"FDM7"="c:\program files\Fujitsu\FDM7\FdmDaemon.exe" [2009-11-26 164712]
"LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2009-10-15 157544]
"LoadBtnHnd"="c:\program files\Fujitsu\Application Panel\BtnHnd.exe" [2009-10-15 35176]
"CSRBIP"="c:\program files\CSR\Bluetooth Feature Pack 5.0\CSRBipPushResponder.exe" [2009-12-24 419752]
"Backup & Storage"="c:\program files\VirginMedia\V Stuff Backup\Backup & Storage.exe" [2011-09-28 17483952]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.co.uk/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
FF - ProfilePath - c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\
FF - prefs.js: browser.search.defaulturl - 
FF - ExtSQL: 2013-04-16 09:33; {fa966923-4278-4558-b29c-8145edf5aaa9}; c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}
FF - ExtSQL: 2013-04-26 12:24; [email protected]; c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\[email protected]
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{fa966923-4278-4558-b29c-8145edf5aaa9} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{687578B9-7132-4A7A-80E4-30EE31099E03} - (no file)
WebBrowser-{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1} - (no file)
AddRemove-virgintoolbar - c:\program files (x86)\virgintoolbar\uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DIB\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ICO\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.ico.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JFIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPE\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPEG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PNG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.png.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIFF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WDP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.wdp.15.4"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-05-03 18:03:21
ComboFix-quarantined-files.txt 2013-05-03 17:03
ComboFix2.txt 2013-05-03 16:22
ComboFix3.txt 2013-05-03 15:04
ComboFix4.txt 2013-05-03 08:01
ComboFix5.txt 2013-05-03 16:24
.
Pre-Run: 333,774,843,904 bytes free
Post-Run: 333,695,475,712 bytes free
.
- - End Of File - - D0F75978E49D1500CC8982C7A8E8F84C


----------



## Mark1956 (May 7, 2011)

The items we are trying to remove have partly gone, but there is a persistent entry that keeps coming back. A new entry has appeared for TornTV, do you know anything about that?

I've posted this problem in our private forum for Malware staff so hope to get some pointers on how to deal with this problem.


----------



## ste08ball (Apr 12, 2013)

no dont know about it at all


----------



## Mark1956 (May 7, 2011)

I received some advice, please follow this:

We are now going to run ComboFix a different way.

Open Notepad by clicking on







and in the *Search* box type: *Notepad.exe* and hit *Enter*.
Copy and paste everything in the *code box* below into it.
_-- Note: Make sure Word Wrap is *unchecked* in Notepad by clicking on *Format* in the top menu._


```
KillAll::

File::
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\[email protected]

Folder::
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}
c:\program files (x86)\SRToolbar

Reboot::
```

Save the file as *CFScript.txt* by choosing _Save As..._ in the File Menu, and save it to your Desktop where the ComboFix icon is also located.
Close your browser and* disconnect* from the Internet.
Now use your mouse to *drag*, then *drop* the CFScript.txt file on top of ComboFix.exe as seen in the image below.










This will start ComboFix again and launch the script.
ComboFix may reboot your system when it finishes. This is normal.
A log will be created just as before and saved to C:\ComboFix.txt. Please copy and paste the contents of *ComboFix.txt* in your next reply.
Be sure to *re-enable* your anti-virus and other security programs *after* the scan is complete.
NOTE: if you see a message like this when you attempt to open anything after the reboot *"Illegal Operation attempted on a registry key that has been marked for deletion"* please reboot the system again and the warning should not return.


----------



## ste08ball (Apr 12, 2013)

ComboFix 13-05-01.03 - Michaella 05/05/2013 8:53.8.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.3893.2396 [GMT 1:00]
Running from: c:\users\Michaella\Desktop\ComboFix.exe
Command switches used :: c:\users\Michaella\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\[email protected]"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome.manifest
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\custom.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\about.xml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\custom.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\dtxpanel.xul
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\dtxpaneltransparent.xul
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\dtxpanelwin.xul
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\dtxprefwin.xul
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\dtxtransparentwin.xul
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\dtxwin.xul
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\emailnotifierproviders.xml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\external.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\neterror.xhtml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\rsspreview.html
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\rsswin.xml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\rsswin.xsl
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\lib\wmpstreamer.html
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\modules\datastore.jsm
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\modules\nsDragAndDrop.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\neterror.xhtml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\preferences.xml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\template.xml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\toolbar.htm
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\toolbar.xul
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\vmncode.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\content\vmnrsswin.xml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\data\search\engines.xml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\data\search\search.xsl
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\data\weather\icons.xml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\locale\lib\en.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\locale\locale.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\locale\toolbar\de.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\locale\toolbar\en.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\locale\toolbar\es.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\locale\toolbar\fr.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\locale\toolbar\it.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\blip.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\bluelite.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\bluesky.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\btn-search-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\btn-search.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\btn-settings-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\btn-settings.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\btn-widgets-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\btn-widgets.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\btn_settings.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\custom.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\dailymotion.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\divider.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\ebay.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\facebook.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\find-videos.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\grey.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\icon_games.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\images.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\add.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\alexabutton.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\aol.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\arrow-dn.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\arrow-right-disabled.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\arrow-right.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\arrow-up.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\bg-btn-divider.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\bg-btn-end.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\bg-btn-mdl.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\bg-btn-mdl_ff.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\bg-btn-start.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\bg-btnover-divider.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\bg-btnover-end.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\bg-btnover-mdl.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\bg-btnover-mdl_ff.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\bg-btnover-start.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\blank.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\btn-widgets-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\btn-widgets.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\btn_slider.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\btnback-down-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\btnback-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\btnleft-down-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\btnleft-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\btnright-down-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\btnright-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\button-splitter-down-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\button-splitter-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\button-splitter.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\checkmark.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\chevron.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\collapse.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\debugbar\debug.html
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\dtx-test.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\dtx.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\edit-back-hot.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\edit-back.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\expand.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\found.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\gmail.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\highlight.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\highlight_blue.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\highlight_cyan.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\highlight_lime.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\highlight_magenta.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\highlight_yellow.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\hotmail.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\imap.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\lastsearch-thumb-back.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\launchers.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\loadingMid.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\lock.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\logo-separator.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\mailcom.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\menu_bg-basic.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\menu_separator_bar.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\menu_separator_white.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\menuitem-splitter.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\menuitemback-down-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\menuitemback-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\menuitemleft-down-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\menuitemleft-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\menuitemleft.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\menuitemright-down-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\menuitemright-vista.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\minus.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\modify.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\move.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\movetarget.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\css\ie-only.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\css\ie7-only.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\css\panels.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\css\popupAbout.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\css\popupGames.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\css\popupWidgets.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\css\dialog.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\bg.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\btn-close-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\btn-close.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\btn-search.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\btn-wide-close-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\btn-wide-close.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\default.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\footer-short-left.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\footer-short-middle.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\footer-short-right.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\tab-off-l.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\tab-off-r.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\tab-on-l.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\tab-on-r.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\titlebar-left.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\titlebar-middle.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\titlebar-right.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\transparent.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\ttlbar-left.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\ttlbar-mdl.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\ttlbar-right.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\win-btm-left.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\win-btm-mdl.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\win-btm-right-resize.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\win-btm-right.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\win-left.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\images\win-right.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\main.html
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\main.html.bak
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\scripts\defscript.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\default\scripts\defscript.js.bak
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\footer.htm
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\gamecategory.xsl
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\gameData.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\gameList.xsl
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\gametype.xsl
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ajax-loader.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\apps-bg-gradient-grid.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\apps-hover.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\appsfeatured-bg-gradient-grid.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\arrow-dn.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\arrow-down-white.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\arrow-left.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\arrow-right.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\arrow-sml-drop.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\arrow-sml.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\arrow-up.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\arrowr-bluew5.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\bg-aboutbox.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\bg-btnover.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\bg-pnl520x390.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\bg-scrollbar-thumb-y.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\bg-scrollbar-track-y.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\bg-scrollbar-trackend-y.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-add-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-add.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-addtoolbar-left-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-addtoolbar-left.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-addtoolbar-right.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-back.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-close-grey-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-close-grey.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-close-greyover.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-close-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-close.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-dark-left22-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-dark-left22.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-dark-middle22-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-dark-middle22.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-dark-right22-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-dark-right22.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-drag.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-install.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-launch-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-launch.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-mdl-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-mdl.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-moredetails.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-next-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-next.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-play-left-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-play-left.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-previous-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-previous.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-right-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-search-pnlbtm-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-search-pnlbtm.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-try-left-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\btn-try-left.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\bullet-orange.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\categories-bg-gradient-grid.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\featured-bg-btm-gradient.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\footer-short-left.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\footer-short-middle.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\footer-short-right.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\gamethumb-on.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\gamethumb2-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ico-box-next.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ico-calendar.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ico-dollar.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ico-download.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ico-info-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ico-info.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ico-joystick24.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ico-news24.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ico-play.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ico-pref-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ico-pref.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ico-tags.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\ico-user-monitor.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\icon-Add.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\icon-download.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\icon-Info.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\icon-play.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\icon-shop.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\left-menu-hover.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\menul-bgon.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\menul-bgover.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\panel-botm-noscroll.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\scroll-bg-206.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\scroll-bg.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\scroll-topwin.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\scrollb-disable.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\scrollb-down.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\scrollb-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\scrollb.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\scrollt-disable.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\scrollt-down.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\scrollt-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\scrollt.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\searchbox-pnlbtm.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\searchbox.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\searchboxlite.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\searchboxlite_end.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\shadow-leftmenu.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\sprite-dropdown.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\star.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\star_blank.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\star_x_grey.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\star_x_orange.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\titlebar-left.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\titlebar-middle.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\titlebar-right.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\topbar-inside-gradient.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\TRUSTe_about.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\view-detailed-on.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\view-detailed-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\view-thumb-on.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\view-thumb-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\widgets-square-16px.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\widgets-square-24px.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\widgets.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\win-bottom-middleglow.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\win-left-bottomglow.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\win-left-middleglow.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\win-left-topglow.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\win-right-bottomglow.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\win-right-middleglow.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\win-right-topglow.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\images\win-top-middleglow.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\initHTML.html
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\js\default.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\js\jquery.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\js\jquery.tinyscrollbar.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\js\jquery.tinyscrollbar.min.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\js\jquery.uniform.min.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\js\jquery.url.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\popupGames.html
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\popupHTML.html
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\popupWidgets.html
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\panels\scroll.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\plus.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\pop.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\radio.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\reload.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\remove.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\rename.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\resize-box.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\rss.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\rsschannelback.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\RSSLogo.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\rsstabdivider.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\scroll-left.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\scroll-right.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\search-go.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\search.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\separator.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\text-ellipsis.xml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\throbber.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\toolbarsplitter.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\transparent_1px.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_02.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_03.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_04.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_06.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_07.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_08.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_09.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_10.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_11.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_12.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_13.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_14.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_15.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_16.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_18.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_19.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_20.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\border_21.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\btn-close-grey.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\btn-close-greyover.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\close-hot.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\close-normal.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\loadingMid.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\paneltemplate.html
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\proxy.html
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\template.html
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\template.html.bak
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\template.xml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\templateFF.html
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\uwa\throbber.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\icons\cond999.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\icons\icons.xml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\icons\na-s.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\icons\na-t.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\icons\na.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\icons\weather.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\add.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\arrowr-bluew5.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\bg-pnl.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue-whitebg.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\box-check.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\box-uncheck.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\btn-close-grey.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\btn-close-greyover.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\btn-delete.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next-off.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous-off.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\ico-check.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid-s.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\options-weather.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\over-blue.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\over-orange.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug2.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\radio-checked.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\radio-unchecked.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\searchbox-pnlbtm.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\images\weather-contour.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\popupWeather.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\weatherbutton\panels\popupWeather.html
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lib\yahoo.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\lichen.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\logo-about.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\logo-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\logo-separator.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\logo.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\menuseparatorback.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\metacafe.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\modify-save.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\modify.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\modifyhot.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\namespacetoolbar.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\options-search.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\options\options-main.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\options\options-search.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\options\options-weather.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\options\options-weather.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\options\options-widgets.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\orange.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\search-over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\search_icon.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\searchbar\searchbar-background-left.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\searchbar\searchbar-background-middle.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\searchbar\searchbar-background-right.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\setting_stb_16x.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\settings.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\settings_stb_19x.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\settings_stb_19x_over.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\skin-bluelite.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\skin-bluesky.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\skin-grey.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\skin-lichen.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\skin-orange.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\skin-yellow.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\skin.xml
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\sv.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\throbber.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\toolbarsplitter.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\TRUSTe_about.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\tv.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\twitter.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\veoh.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\video.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\vimeo.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\vmn.css
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\web.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\websearch.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\yellow.gif
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\chrome\skin\youtube.png
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\components\dtTransparency.dll
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\components\IdtTransparency.xpt
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\components\windowmediator.js
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\install.rdf
c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}\manifest.xml
.
.
((((((((((((((((((((((((( Files Created from 2013-04-05 to 2013-05-05 )))))))))))))))))))))))))))))))
.
.
2013-05-05 08:01 . 2013-05-05 08:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-04 12:28 . 2012-12-10 09:04 81920 ----a-w- c:\windows\eSellerateControl350.dll
2013-05-04 12:28 . 2012-12-10 09:04 356352 ----a-w- c:\windows\eSellerateEngine.dll
2013-05-04 12:28 . 2009-07-23 16:32 274432 ----a-w- c:\windows\SysWow64\ssleay32.dll
2013-05-04 12:28 . 2009-07-23 16:32 1122304 ----a-w- c:\windows\SysWow64\libeay32.dll
2013-05-04 12:28 . 2013-05-04 12:45 -------- d-----w- c:\program files (x86)\Torn TVRemoval Tool
2013-05-04 09:59 . 2013-05-04 10:34 -------- d-----w- c:\users\Michaella\Incomplete
2013-05-04 09:55 . 2013-05-04 10:34 -------- d-----w- c:\users\Michaella\AppData\Roaming\LimeWire Music
2013-05-04 09:55 . 2013-05-04 10:22 -------- d-----w- c:\users\Michaella\Shared
2013-05-04 09:55 . 2013-05-04 09:55 -------- d-----w- c:\programdata\LimeWire Music
2013-05-04 08:37 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E524F4E5-1307-4B6D-854C-674CAAAAD680}\mpengine.dll
2013-05-03 17:05 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- c:\windows\ERUNT
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- C:\JRT
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\searchplugins
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\Extensions
2013-04-28 11:59 . 2013-04-28 11:59 -------- d-----w- C:\_OTM
2013-04-27 22:23 . 2013-04-27 22:22 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{65B4CDE1-2AA7-4EB2-A309-4516ABDE28C5}\gapaengine.dll
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files\Microsoft Security Client
2013-04-26 13:48 . 2013-04-26 13:48 -------- d-----w- C:\_OTL
2013-04-26 13:29 . 2013-05-04 11:15 -------- d-----w- c:\users\Michaella\AppData\Local\Spotify
2013-04-26 13:29 . 2013-05-04 11:15 -------- d-----w- c:\users\Michaella\AppData\Roaming\Spotify
2013-04-26 11:19 . 2013-04-27 10:19 -------- d-----w- c:\users\Michaella\AppData\Roaming\BitTorrent
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-04-26 09:28 . 2013-04-26 09:28 -------- d-----w- c:\program files (x86)\QuickTime
2013-04-25 09:49 . 2012-08-21 12:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2013-04-25 09:48 . 2013-04-25 09:48 -------- d-----w- c:\program files\iPod
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files\iTunes
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files (x86)\iTunes
2013-04-25 09:47 . 2013-04-25 09:47 -------- d-----w- c:\program files (x86)\Apple Software Update
2013-04-25 09:47 . 2013-04-26 09:29 -------- d-----w- c:\program files\Common Files\Apple
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files\Bonjour
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files (x86)\Bonjour
2013-04-25 09:46 . 2013-04-26 09:29 -------- d-----w- c:\program files (x86)\Common Files\Apple
2013-04-24 07:32 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\users\Michaella\AppData\Roaming\{90140011-0066-0409-0000-0000000FF1CE}
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\programdata\Virtualized Applications
2013-04-14 17:03 . 2013-04-30 15:42 2399 ----a-w- c:\windows\DeleteOnReboot.bat
2013-04-14 12:30 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-12 20:37 . 2013-04-12 20:37 -------- d-----w- c:\users\Michaella\AppData\Roaming\SUPERAntiSpyware.com
2013-04-12 20:35 . 2013-04-12 23:56 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-04-12 20:35 . 2013-04-12 20:35 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2013-04-12 20:31 . 2013-04-12 20:31 -------- d-----w- c:\users\Michaella\AppData\Roaming\Malwarebytes
2013-04-12 20:30 . 2013-04-12 20:30 -------- d-----w- c:\programdata\Malwarebytes
2013-04-12 20:30 . 2013-04-14 12:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-12 20:29 . 2013-04-12 20:29 -------- d-----w- c:\users\Michaella\AppData\Local\Programs
2013-04-12 20:00 . 2013-04-12 23:56 -------- d-----w- c:\program files (x86)\PC HealthBoost
2013-04-12 19:59 . 2013-04-12 23:56 -------- d-----w- c:\programdata\PCHealthBoost
2013-04-11 15:27 . 2013-04-11 15:27 -------- d-----w- c:\program files (x86)\MSECache
2013-04-11 15:08 . 2013-04-11 15:08 -------- d-----w- c:\users\Michaella\AppData\Roaming\ParetoLogic
2013-04-11 15:08 . 2013-04-12 03:51 -------- d-----w- c:\programdata\ParetoLogic
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\users\Michaella\AppData\Roaming\FixBee
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\programdata\FixBee
2013-04-10 22:58 . 2013-04-16 08:33 -------- d-----w- c:\program files (x86)\FixBee
2013-04-10 16:12 . 2013-04-23 08:09 -------- d-----w- c:\program files (x86)\PKR
2013-04-10 11:47 . 2013-02-22 06:29 10925568 ----a-w- c:\windows\system32\ieframe.dll
2013-04-10 07:34 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2013-04-10 07:34 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll
2013-04-10 07:34 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll
2013-04-10 07:34 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll
2013-04-10 07:33 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 07:33 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-10 07:33 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 07:33 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 07:33 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-04-10 07:33 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-04-06 22:56 . 2013-04-14 11:14 -------- d-----w- c:\users\Mcx1-WILSON
2013-04-06 14:29 . 2013-04-06 14:29 -------- d-----w- c:\users\Michaella\AppData\Roaming\AVG
2013-04-06 14:26 . 2013-04-06 14:30 -------- d-----w- c:\programdata\AVG
2013-04-05 20:04 . 2013-04-05 20:04 710992 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2013-04-05 19:12 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2013-04-05 19:12 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2013-04-05 19:12 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2013-04-05 19:12 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2013-04-05 18:49 . 2013-04-05 18:49 -------- d-----w- c:\program files\Microsoft Silverlight
2013-04-05 18:49 . 2013-04-05 18:49 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2013-04-05 18:38 . 2013-04-16 01:11 -------- d-----w- c:\programdata\Skype
2013-04-05 11:48 . 2012-11-09 05:45 750592 ----a-w- c:\windows\system32\win32spl.dll
2013-04-05 11:48 . 2012-11-09 04:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll
2013-04-05 11:45 . 2012-11-22 05:44 800768 ----a-w- c:\windows\system32\usp10.dll
2013-04-05 11:45 . 2012-11-22 04:45 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2013-04-05 11:44 . 2012-11-30 05:41 424448 ----a-w- c:\windows\system32\KernelBase.dll
2013-04-05 11:44 . 2012-11-30 04:53 274944 ----a-w- c:\windows\SysWow64\KernelBase.dll
2013-04-05 11:44 . 2012-11-30 05:41 1161216 ----a-w- c:\windows\system32\kernel32.dll
2013-04-05 11:44 . 2012-11-30 05:45 362496 ----a-w- c:\windows\system32\wow64win.dll
2013-04-05 11:44 . 2012-11-30 03:23 338432 ----a-w- c:\windows\system32\conhost.exe
2013-04-05 11:44 . 2012-11-30 05:45 243200 ----a-w- c:\windows\system32\wow64.dll
2013-04-05 11:44 . 2012-11-30 05:45 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2013-04-05 11:44 . 2012-11-30 05:43 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2013-04-05 10:51 . 2012-11-23 03:13 68608 ----a-w- c:\windows\system32\taskhost.exe
2013-04-05 10:51 . 2013-04-16 08:51 -------- d-----w- c:\windows\system32\drivers\N360x64\0604010.00E
2013-04-05 10:50 . 2013-04-05 10:50 -------- d-----w- c:\users\Michaella\AppData\Roaming\TuneUp Software
2013-04-05 10:40 . 2013-04-05 10:40 -------- d--h--w- c:\programdata\Common Files
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-04 09:58 . 2012-04-20 17:56 866720 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-05-04 09:58 . 2012-04-20 17:56 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-05-03 17:55 . 2012-06-12 22:22 895088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2013-05-03 17:55 . 2012-06-12 22:22 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2013-05-02 15:29 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-27 16:57 . 2013-04-27 16:57 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\offreg.dll
2013-04-10 11:53 . 2012-04-26 22:18 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-10 03:46 . 2013-04-26 07:53 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\mpengine.dll
2013-04-05 20:04 . 2012-06-29 23:37 895088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-04-05 20:04 . 2012-06-29 23:37 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-04-05 12:21 . 2012-04-21 20:49 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-05 12:21 . 2012-04-21 20:49 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-05 10:52 . 2013-04-05 10:52 163088 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10143.bin
2013-02-12 05:45 . 2013-04-05 11:52 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-04-05 11:52 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-04-05 11:52 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 05:45 . 2013-04-05 11:52 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 04:48 . 2013-04-05 11:52 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-04-05 11:52 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{AD8AD957-B30E-4842-8253-BFBC5F7440F3}"= "c:\program files (x86)\virgintoolbar\virgintoolbarDx.dll" [BU]
.
[HKEY_CLASSES_ROOT\clsid\{ad8ad957-b30e-4842-8253-bfbc5f7440f3}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="c:\program files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-05-30 868352]
"Spotify Web Helper"="c:\users\Michaella\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-05-04 1105408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LoadFUJ02E3"="c:\program files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe" [2009-10-08 36712]
"IndicatorUtility"="c:\program files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2009-10-09 47976]
"UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"DeskUpdateNotifier"="c:\fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe" [2013-02-26 102968]
"ServiceManager.exe"="c:\program files (x86)\Virgin Media\Service Manager\ServiceManager.exe" [2011-11-16 10200376]
"DHSClient.exe"="c:\program files (x86)\Virgin Media\Digital Home Support\DHSClient.exe" [2011-03-23 2032952]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"RequireSignedAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HsdService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-07-08 35840]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-04-21 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2010-09-17 194640]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 FBDiskOptimizer;FBDiskOptimizer;c:\program files (x86)\FixBee\FBDefragSrv64.exe [2012-12-05 631664]
S2 HsdService;HsdService;c:\program files (x86)\Virgin Media\Digital Home Support\HsdService.exe [2011-03-23 1406264]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 PFNService;PFNService;c:\program files\Fujitsu\Plugfree NETWORK\PFNService.exe [2010-06-24 330240]
S2 PowerSavingUtilityService;PowerSavingUtilityService;c:\program files\Fujitsu\PSUtility\PSUService.exe [2009-07-30 63336]
S2 ServicepointService;ServicepointService;c:\program files (x86)\Virgin Media\Service Manager\ServicepointService.exe [2011-11-16 10310968]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-01 2314240]
S2 VFPRadioSupportService;Bluetooth Feature Support;c:\program files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [2009-12-24 145840]
S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\DRIVERS\FUJ02E3.sys [2006-11-01 7296]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-11-01 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-11-27 244736]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-04 346144]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 12:21]
.
2013-05-04 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoBackuped]
@="{7E5951A0-8683-432A-9483-5F43168D6A8C}"
[HKEY_CLASSES_ROOT\CLSID\{7E5951A0-8683-432A-9483-5F43168D6A8C}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoSelected]
@="{15054241-49B4-4FA6-B4C7-A0071F118110}"
[HKEY_CLASSES_ROOT\CLSID\{15054241-49B4-4FA6-B4C7-A0071F118110}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-01-12 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-01-12 390680]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-01-12 410136]
"PfNet"="c:\program files\Fujitsu\Plugfree NETWORK\PfNet.exe" [2010-06-24 6310912]
"PSUTility"="c:\program files\Fujitsu\PSUtility\TrayManager.exe" [2009-07-30 188264]
"FDM7"="c:\program files\Fujitsu\FDM7\FdmDaemon.exe" [2009-11-26 164712]
"LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2009-10-15 157544]
"LoadBtnHnd"="c:\program files\Fujitsu\Application Panel\BtnHnd.exe" [2009-10-15 35176]
"CSRBIP"="c:\program files\CSR\Bluetooth Feature Pack 5.0\CSRBipPushResponder.exe" [2009-12-24 419752]
"Backup & Storage"="c:\program files\VirginMedia\V Stuff Backup\Backup & Storage.exe" [2011-09-28 17483952]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.co.uk/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
FF - ProfilePath - c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\
FF - prefs.js: browser.search.defaulturl - 
FF - ExtSQL: 2013-04-16 09:33; {fa966923-4278-4558-b29c-8145edf5aaa9}; c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\{fa966923-4278-4558-b29c-8145edf5aaa9}
FF - ExtSQL: 2013-04-26 12:24; [email protected]; c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\[email protected]
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{fa966923-4278-4558-b29c-8145edf5aaa9} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{687578B9-7132-4A7A-80E4-30EE31099E03} - (no file)
WebBrowser-{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1} - (no file)
AddRemove-virgintoolbar - c:\program files (x86)\virgintoolbar\uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DIB\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ICO\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.ico.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JFIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPE\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPEG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PNG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.png.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIFF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WDP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.wdp.15.4"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\CTsvcCDA.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
.
**************************************************************************
.
Completion time: 2013-05-05 09:08:26 - machine was rebooted
ComboFix-quarantined-files.txt 2013-05-05 08:08
ComboFix2.txt 2013-05-03 17:03
ComboFix3.txt 2013-05-03 16:22
ComboFix4.txt 2013-05-03 15:04
ComboFix5.txt 2013-05-05 07:52
.
Pre-Run: 332,309,262,336 bytes free
Post-Run: 332,030,971,904 bytes free
.


----------



## Mark1956 (May 7, 2011)

Ok, we are making progress. Now please open Firefox, let it load up and then close it. Then do a normal scan with Combofix and post the new log. We should then see that the bad entries in Firefox have completely gone.


----------



## ste08ball (Apr 12, 2013)

ComboFix 13-05-06.01 - Michaella 06/05/2013 9:47.9.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.3893.2447 [GMT 1:00]
Running from: c:\users\Michaella\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-04-06 to 2013-05-06 )))))))))))))))))))))))))))))))
.
.
2013-05-06 08:56 . 2013-05-06 08:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-05 15:05 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BF299633-367C-4FA8-A8D6-C4189D92D38C}\mpengine.dll
2013-05-05 08:11 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-05-04 12:28 . 2012-12-10 09:04 81920 ----a-w- c:\windows\eSellerateControl350.dll
2013-05-04 12:28 . 2012-12-10 09:04 356352 ----a-w- c:\windows\eSellerateEngine.dll
2013-05-04 12:28 . 2009-07-23 16:32 274432 ----a-w- c:\windows\SysWow64\ssleay32.dll
2013-05-04 12:28 . 2009-07-23 16:32 1122304 ----a-w- c:\windows\SysWow64\libeay32.dll
2013-05-04 12:28 . 2013-05-04 12:45 -------- d-----w- c:\program files (x86)\Torn TVRemoval Tool
2013-05-04 09:59 . 2013-05-04 10:34 -------- d-----w- c:\users\Michaella\Incomplete
2013-05-04 09:55 . 2013-05-04 10:34 -------- d-----w- c:\users\Michaella\AppData\Roaming\LimeWire Music
2013-05-04 09:55 . 2013-05-04 10:22 -------- d-----w- c:\users\Michaella\Shared
2013-05-04 09:55 . 2013-05-04 09:55 -------- d-----w- c:\programdata\LimeWire Music
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- c:\windows\ERUNT
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- C:\JRT
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\searchplugins
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\Extensions
2013-04-28 11:59 . 2013-04-28 11:59 -------- d-----w- C:\_OTM
2013-04-27 22:23 . 2013-04-27 22:22 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{65B4CDE1-2AA7-4EB2-A309-4516ABDE28C5}\gapaengine.dll
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files\Microsoft Security Client
2013-04-27 16:57 . 2013-04-27 16:57 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\offreg.dll
2013-04-26 13:48 . 2013-04-26 13:48 -------- d-----w- C:\_OTL
2013-04-26 13:29 . 2013-05-04 11:15 -------- d-----w- c:\users\Michaella\AppData\Local\Spotify
2013-04-26 13:29 . 2013-05-04 11:15 -------- d-----w- c:\users\Michaella\AppData\Roaming\Spotify
2013-04-26 11:19 . 2013-04-27 10:19 -------- d-----w- c:\users\Michaella\AppData\Roaming\BitTorrent
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-04-26 09:28 . 2013-04-26 09:28 -------- d-----w- c:\program files (x86)\QuickTime
2013-04-26 07:53 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\mpengine.dll
2013-04-25 09:49 . 2012-08-21 12:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2013-04-25 09:48 . 2013-04-25 09:48 -------- d-----w- c:\program files\iPod
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files\iTunes
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files (x86)\iTunes
2013-04-25 09:47 . 2013-04-25 09:47 -------- d-----w- c:\program files (x86)\Apple Software Update
2013-04-25 09:47 . 2013-04-26 09:29 -------- d-----w- c:\program files\Common Files\Apple
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files\Bonjour
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files (x86)\Bonjour
2013-04-25 09:46 . 2013-04-26 09:29 -------- d-----w- c:\program files (x86)\Common Files\Apple
2013-04-24 07:32 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\users\Michaella\AppData\Roaming\{90140011-0066-0409-0000-0000000FF1CE}
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\programdata\Virtualized Applications
2013-04-14 17:03 . 2013-04-30 15:42 2399 ----a-w- c:\windows\DeleteOnReboot.bat
2013-04-14 12:30 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-12 20:37 . 2013-04-12 20:37 -------- d-----w- c:\users\Michaella\AppData\Roaming\SUPERAntiSpyware.com
2013-04-12 20:35 . 2013-04-12 23:56 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-04-12 20:35 . 2013-04-12 20:35 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2013-04-12 20:31 . 2013-04-12 20:31 -------- d-----w- c:\users\Michaella\AppData\Roaming\Malwarebytes
2013-04-12 20:30 . 2013-04-12 20:30 -------- d-----w- c:\programdata\Malwarebytes
2013-04-12 20:30 . 2013-04-14 12:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-12 20:29 . 2013-04-12 20:29 -------- d-----w- c:\users\Michaella\AppData\Local\Programs
2013-04-12 20:00 . 2013-04-12 23:56 -------- d-----w- c:\program files (x86)\PC HealthBoost
2013-04-12 19:59 . 2013-04-12 23:56 -------- d-----w- c:\programdata\PCHealthBoost
2013-04-11 15:27 . 2013-04-11 15:27 -------- d-----w- c:\program files (x86)\MSECache
2013-04-11 15:08 . 2013-04-11 15:08 -------- d-----w- c:\users\Michaella\AppData\Roaming\ParetoLogic
2013-04-11 15:08 . 2013-04-12 03:51 -------- d-----w- c:\programdata\ParetoLogic
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\users\Michaella\AppData\Roaming\FixBee
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\programdata\FixBee
2013-04-10 22:58 . 2013-04-16 08:33 -------- d-----w- c:\program files (x86)\FixBee
2013-04-10 16:12 . 2013-04-23 08:09 -------- d-----w- c:\program files (x86)\PKR
2013-04-10 11:47 . 2013-02-22 06:29 10925568 ----a-w- c:\windows\system32\ieframe.dll
2013-04-10 07:34 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll
2013-04-10 07:34 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2013-04-10 07:34 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll
2013-04-10 07:34 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll
2013-04-10 07:34 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll
2013-04-10 07:33 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 07:33 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-10 07:33 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 07:33 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 07:33 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 07:33 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-04-10 07:33 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-04-06 22:56 . 2013-04-14 11:14 -------- d-----w- c:\users\Mcx1-WILSON
2013-04-06 14:29 . 2013-04-06 14:29 -------- d-----w- c:\users\Michaella\AppData\Roaming\AVG
2013-04-06 14:26 . 2013-04-06 14:30 -------- d-----w- c:\programdata\AVG
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-04 09:58 . 2012-04-20 17:56 866720 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-05-04 09:58 . 2012-04-20 17:56 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-05-03 17:55 . 2012-06-12 22:22 895088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2013-05-03 17:55 . 2012-06-12 22:22 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2013-05-02 15:29 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-10 11:53 . 2012-04-26 22:18 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-05 20:04 . 2012-06-29 23:37 895088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-04-05 20:04 . 2012-06-29 23:37 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-04-05 20:04 . 2013-04-05 20:04 710992 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2013-04-05 12:21 . 2012-04-21 20:49 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-05 12:21 . 2012-04-21 20:49 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-05 10:52 . 2013-04-05 10:52 163088 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10143.bin
2013-02-12 05:45 . 2013-04-05 11:52 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-04-05 11:52 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-04-05 11:52 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 05:45 . 2013-04-05 11:52 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 04:48 . 2013-04-05 11:52 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-04-05 11:52 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-02-12 04:12 . 2013-04-05 11:46 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{AD8AD957-B30E-4842-8253-BFBC5F7440F3}"= "c:\program files (x86)\virgintoolbar\virgintoolbarDx.dll" [BU]
.
[HKEY_CLASSES_ROOT\clsid\{ad8ad957-b30e-4842-8253-bfbc5f7440f3}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="c:\program files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-05-30 868352]
"Spotify Web Helper"="c:\users\Michaella\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-05-04 1105408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LoadFUJ02E3"="c:\program files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe" [2009-10-08 36712]
"IndicatorUtility"="c:\program files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2009-10-09 47976]
"UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"DeskUpdateNotifier"="c:\fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe" [2013-02-26 102968]
"ServiceManager.exe"="c:\program files (x86)\Virgin Media\Service Manager\ServiceManager.exe" [2011-11-16 10200376]
"DHSClient.exe"="c:\program files (x86)\Virgin Media\Digital Home Support\DHSClient.exe" [2011-03-23 2032952]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"RequireSignedAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HsdService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-07-08 35840]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-04-21 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2010-09-17 194640]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 FBDiskOptimizer;FBDiskOptimizer;c:\program files (x86)\FixBee\FBDefragSrv64.exe [2012-12-05 631664]
S2 HsdService;HsdService;c:\program files (x86)\Virgin Media\Digital Home Support\HsdService.exe [2011-03-23 1406264]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 PFNService;PFNService;c:\program files\Fujitsu\Plugfree NETWORK\PFNService.exe [2010-06-24 330240]
S2 PowerSavingUtilityService;PowerSavingUtilityService;c:\program files\Fujitsu\PSUtility\PSUService.exe [2009-07-30 63336]
S2 ServicepointService;ServicepointService;c:\program files (x86)\Virgin Media\Service Manager\ServicepointService.exe [2011-11-16 10310968]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-01 2314240]
S2 VFPRadioSupportService;Bluetooth Feature Support;c:\program files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [2009-12-24 145840]
S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\DRIVERS\FUJ02E3.sys [2006-11-01 7296]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-11-01 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-11-27 244736]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-04 346144]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 12:21]
.
2013-05-05 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoBackuped]
@="{7E5951A0-8683-432A-9483-5F43168D6A8C}"
[HKEY_CLASSES_ROOT\CLSID\{7E5951A0-8683-432A-9483-5F43168D6A8C}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoSelected]
@="{15054241-49B4-4FA6-B4C7-A0071F118110}"
[HKEY_CLASSES_ROOT\CLSID\{15054241-49B4-4FA6-B4C7-A0071F118110}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-01-12 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-01-12 390680]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-01-12 410136]
"PfNet"="c:\program files\Fujitsu\Plugfree NETWORK\PfNet.exe" [2010-06-24 6310912]
"PSUTility"="c:\program files\Fujitsu\PSUtility\TrayManager.exe" [2009-07-30 188264]
"FDM7"="c:\program files\Fujitsu\FDM7\FdmDaemon.exe" [2009-11-26 164712]
"LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2009-10-15 157544]
"LoadBtnHnd"="c:\program files\Fujitsu\Application Panel\BtnHnd.exe" [2009-10-15 35176]
"CSRBIP"="c:\program files\CSR\Bluetooth Feature Pack 5.0\CSRBipPushResponder.exe" [2009-12-24 419752]
"Backup & Storage"="c:\program files\VirginMedia\V Stuff Backup\Backup & Storage.exe" [2011-09-28 17483952]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.co.uk/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
FF - ProfilePath - c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\
FF - prefs.js: browser.search.defaulturl - 
FF - ExtSQL: 2013-04-26 12:24; [email protected]; c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\[email protected]
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{fa966923-4278-4558-b29c-8145edf5aaa9} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{687578B9-7132-4A7A-80E4-30EE31099E03} - (no file)
WebBrowser-{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1} - (no file)
AddRemove-virgintoolbar - c:\program files (x86)\virgintoolbar\uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DIB\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ICO\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.ico.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JFIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPE\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPEG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PNG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.png.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIFF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WDP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.wdp.15.4"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-05-06 10:00:05
ComboFix-quarantined-files.txt 2013-05-06 09:00
ComboFix2.txt 2013-05-05 08:08
ComboFix3.txt 2013-05-03 17:03
ComboFix4.txt 2013-05-03 16:22
ComboFix5.txt 2013-05-06 08:44
.
Pre-Run: 332,195,631,104 bytes free
Post-Run: 331,890,896,896 bytes free
.
- - End Of File - - FFD700D6C4A893C60B6E33EF40A36627


----------



## Mark1956 (May 7, 2011)

Ok, we have managed to get rid of the original Firefox extension but the other one that appeared during the removal has returned.

I'd now like you to run an on-line scan with Eset. This will go deep into the system and may take several hours to complete. Please read the instructions carefully.

*Eset online scan instructions.*
*IMPORTANT --->* Please make sure you follow the instruction to *uncheck* the box next to *Remove found threats*. Eset will detect anything that looks even remotely suspicious, this can include legitimate program files. If you do not uncheck the box, as instructed, Eset will automatically remove all suspect files which could leave some of your software inoperative. If you make a mistake these files can be restored from quarantine, but it would be preferable not to add any extra work to the clean up of your system.


Disable your existing Anti Virus following these instructions.
Please go here to use the Eset Online Scanner.
When the web page opens click on this button








If you are not using *Internet Explorer* you will see a message box open asking you to to download the *ESET Smart Installer*, click on the link and allow it to download and then run it. Accept the *Terms of use* and click on *Start*. The required components will download.
If using Internet Explorer the *Terms of use* box will open immediately, accept it and click on *Start*.
After the download is complete the *Computer scan settings* window will open, *IMPORTANT ---->* *uncheck* the box next to *Remove found threats* and click on *Start*. The virus signature database will then download which may take some time depending on the speed of your internet connection. The scan will automatically start when the download is complete.
This is a very thorough scan and may take several hours to complete depending on how much data you have on your hard drive. *Do not* interrupt it, be patient and let it finish.
A Scan Results window will appear at the end of the scan. If it lists any number of Infected Files click on List of found threats. Click on Copy to clipboard, come back to this thread and right click on the message box. Select *Paste* and the report will appear, add any comments you have and post the reply.
Back on the *Eset* window, click the *Back* button and then click on *Finish*.


----------



## ste08ball (Apr 12, 2013)

this scan found no infected files


----------



## Mark1956 (May 7, 2011)

Ok, we now need to do another search with SystemLook, launch the program and copy the contents of the code box below into the text field and hit the Look button. Post the log when done.


```
:filefind
*SRToolbar*
*Datamngr*
*searchresultsdx*
*search-results*
*torntv*
:folderfind
*SRToolbar*
*Datamngr*
*searchresultsdx*
*search-results*
*torntv*
:regfind
SRToolbar
Datamngr
searchresultsdx
search-results
torntv
```


----------



## ste08ball (Apr 12, 2013)

SystemLook 30.07.11 by jpshortstuff
Log created at 15:48 on 06/05/2013 by Michaella
Administrator - Elevation successful
========== filefind ==========
Searching for "*SRToolbar*"
No files found.
Searching for "*Datamngr*"
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF10_47.dll --a---- 736768 bytes [23:00 10/04/2013] [08:29 29/01/2013] E5F2670ADDDA22918453A13064E6D06A
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF11_47.dll --a---- 736768 bytes [23:00 10/04/2013] [08:29 29/01/2013] 9FCDE758D501AD05834A148E90DA028E
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF12_47.dll --a---- 736768 bytes [23:00 10/04/2013] [08:29 29/01/2013] 26577A4E480C0D7E011073132AA12642
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF13_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:30 29/01/2013] 914A0DBF9208622F923BCAD5AFA63E3F
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF3_47.dll --a---- 740352 bytes [23:00 10/04/2013] [08:27 29/01/2013] 63C9EA1C552D4F6EA9A3745DD161E1A8
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF4_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:27 29/01/2013] 8C9923A5ACC126BB88D860B68E05F2E7
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF5_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:27 29/01/2013] DB36E7A166D3A2CDC2AC65956CF3E16D
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF6_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:28 29/01/2013] 0376B046E5E1A6A44E8783E25701DDE4
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF7_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:28 29/01/2013] 9347C68E55D860CB049562BB62078603
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF8_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:28 29/01/2013] 7360CCAA940EDFED730CE9F48FF3ECB1
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\del_DataMngrHlpFF9_47.dll --a---- 737280 bytes [23:00 10/04/2013] [08:29 29/01/2013] 2CEBC0A78830846D2A18E02CCFF252F1
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\datamngr.dll --a---- 1540096 bytes [22:59 10/04/2013] [08:31 29/01/2013] 21B1F4D43CBF432788A4E5A5092E93D3
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\datamngrUI.exe --a---- 1683456 bytes [23:00 10/04/2013] [08:31 29/01/2013] 7C3A70BEB17C8F2A1BBE39F6B4AFEE67
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlp.xpt --a---- 1009 bytes [08:33 16/04/2013] [08:31 29/01/2013] C317A7493D9EB507391B0217CEEACAE1
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF10.dll --a---- 736768 bytes [08:33 16/04/2013] [08:29 29/01/2013] E5F2670ADDDA22918453A13064E6D06A
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF11.dll --a---- 736768 bytes [08:33 16/04/2013] [08:29 29/01/2013] 9FCDE758D501AD05834A148E90DA028E
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF12.dll --a---- 736768 bytes [08:33 16/04/2013] [08:29 29/01/2013] 26577A4E480C0D7E011073132AA12642
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF13.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 914A0DBF9208622F923BCAD5AFA63E3F
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF14.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 26209275084963CACD45B72BB46AC314
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF15.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 4C995E478C81222D31C20B0CB1751742
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF16.dll --a---- 737280 bytes [08:33 16/04/2013] [08:30 29/01/2013] 9054AC22CB45980755212C0EF216717D
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF17.dll --a---- 737280 bytes [08:33 16/04/2013] [08:31 29/01/2013] 54B28DCA6984A1D0E9C982610DE34F39
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF18.dll --a---- 737280 bytes [08:33 16/04/2013] [08:31 29/01/2013] 58107F0BB4569A388A8870E351FB1324
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF3.dll --a---- 740352 bytes [08:33 16/04/2013] [08:27 29/01/2013] 63C9EA1C552D4F6EA9A3745DD161E1A8
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF4.dll --a---- 737280 bytes [08:33 16/04/2013] [08:27 29/01/2013] 8C9923A5ACC126BB88D860B68E05F2E7
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF5.dll --a---- 737280 bytes [08:33 16/04/2013] [08:27 29/01/2013] DB36E7A166D3A2CDC2AC65956CF3E16D
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF6.dll --a---- 737280 bytes [08:33 16/04/2013] [08:28 29/01/2013] 0376B046E5E1A6A44E8783E25701DDE4
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF7.dll --a---- 737280 bytes [08:33 16/04/2013] [08:28 29/01/2013] 9347C68E55D860CB049562BB62078603
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF8.dll --a---- 737280 bytes [08:33 16/04/2013] [08:28 29/01/2013] 7360CCAA940EDFED730CE9F48FF3ECB1
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF9.dll --a---- 737280 bytes [08:33 16/04/2013] [08:29 29/01/2013] 2CEBC0A78830846D2A18E02CCFF252F1
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\FirefoxExtension\content\DataMngr.js --a---- 19255 bytes [08:33 16/04/2013] [08:54 16/10/2012] 0482F311EC3BEFB2018232CC83E2D867
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\x64\datamngr.dll --a---- 2018680 bytes [23:00 10/04/2013] [08:31 29/01/2013] A76CBD61AC008C25D6AA30E6F15BBAF5
Searching for "*searchresultsdx*"
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\searchresultsDx.dll --a---- 89288 bytes [22:07 05/12/2012] [22:07 05/12/2012] 731C9F6D56A26C98BF37607F98900549
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\searchresultsDx.dll --a---- 89288 bytes [22:07 05/12/2012] [22:07 05/12/2012] 731C9F6D56A26C98BF37607F98900549
Searching for "*search-results*"
No files found.
Searching for "*torntv*"
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\[email protected] --a---- 213470 bytes [11:24 26/04/2013] [11:24 26/04/2013] E1BCBA938C81A2ABA1E35F80F80776B0
========== folderfind ==========
Searching for "*SRToolbar*"
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar d------ [22:58 10/04/2013]
Searching for "*Datamngr*"
C:\_OTL\MovedFiles\04272013_100912\C_Users\Michaella\AppData\LocalLow\DataMngr d------ [14:29 01/05/2012]
C:\_OTM\MovedFiles\04302013_093307\C_Program Files (x86)\SRToolbar\Datamngr d------ [22:59 10/04/2013]
Searching for "*searchresultsdx*"
No folders found.
Searching for "*search-results*"
No folders found.
Searching for "*torntv*"
C:\Program Files (x86)\Torn TVRemoval Tool d------ [12:28 04/05/2013]
========== regfind ==========
Searching for "SRToolbar"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
Searching for "Datamngr"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\070F394B126DDE645BD3CA9084552369]
"00000000000000000000000000000000"="C:\Users\MICHAE~1\AppData\Local\Temp\SetupDataMngr_iMesh.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
Searching for "searchresultsdx"
No data found.
Searching for "search-results"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DoNotAskAgain"="search-results.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}]
"URL"="http://dts.search-results.com/sr?sr...10654&apn_uid=2215230001324024&q={searchTerms}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{fa966923-4278-4558-b29c-8145edf5aaa9}]
@="Search-Results Toolbar"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{9BDBF293-DFF1-49E5-B459-D3181067755F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6E963B28-05B4-4A83-AFDB-418B003B861C}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{36FE30E9-6DC7-4E12-9C74-3A017705CC0A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0823181D-B2BF-48F0-B71A-5E262B70D1F1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\SRToolbar\Datamngr\SRTOOL~2\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\SearchScopes]
"DoNotAskAgain"="search-results.com"
Searching for "torntv"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\TornTVRemovalTool.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\nbmafkdmkkckhggblphicnnhlgljnoje]
"path"="C:\Program Files (x86)\TornTV.com\torn2_10.crx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TornTVRemovalTool_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TornTVRemovalTool_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TornTV_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TornTV_RASMANCS]
-= EOF =-


----------



## Mark1956 (May 7, 2011)

Ok, we shall remove some more files and registry entries. We will use OTM this time, follow the instructions below. When it has completed, post the log and reboot the system. Open Firefox for a while and then close it again, follow that with another ordinary scan with Combofix and post the new log from it.

Double click *OTM.exe* to start the tool.


*Copy* the text in the code box below to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose *Copy*):


```
:Processes
explorer.exe

:Files
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\[email protected]
C:\Users\MICHAE~1\AppData\Local\Temp\SetupDataMngr_iMesh.exe
C:\Program Files (x86)\Torn TVRemoval Tool
C:\Program Files (x86)\TornTV.com
:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\070F394B126DDE645BD3CA9084552369]
"00000000000000000000000000000000"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DoNotAskAgain"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{fa966923-4278-4558-b29c-8145edf5aaa9}]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\SearchScopes]
"DoNotAskAgain"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\TornTVRemovalTool.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\nbmafkdmkkckhggblphicnnhlgljnoje]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TornTVRemovalTool_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TornTVRemovalTool_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TornTV_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TornTV_RASMANCS]
:Commands
[createrestorepoint]
[emptyflash]
[emptytemp]
[resethosts]
[reboot]
```

 Return to OTM, right click in the *"Paste Instructions for Items to be Moved"* window (under the yellow bar) and choose *Paste*.
Click the red *Moveit!* button.
All your desktop icons will disappear as the scan begins. It should complete within a few minutes.
Once complete you may see a box appear asking you to Restart the system to complete the file removal, accept it and it will reboot.
Even if that box does not appear the system should reboot as the command is included in the script.
When the system has come back to the desktop a Notepad document will open, please copy and paste that into your next post.

-- Note: The logs are saved here: C:\_OTM\MovedFiles


----------



## ste08ball (Apr 12, 2013)

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\extensions\[email protected] moved successfully.
File/Folder C:\Users\MICHAE~1\AppData\Local\Temp\SetupDataMngr_iMesh.exe not found.
C:\Program Files (x86)\Torn TVRemoval Tool\backuped folder moved successfully.
C:\Program Files (x86)\Torn TVRemoval Tool folder moved successfully.
File/Folder C:\Program Files (x86)\TornTV.com not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\070F394B126DDE645BD3CA9084552369 not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\\DoNotAskAgain deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{fa966923-4278-4558-b29c-8145edf5aaa9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fa966923-4278-4558-b29c-8145edf5aaa9}\ not found.
Registry value HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DoNotAskAgain not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\TornTVRemovalTool.exe\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\nbmafkdmkkckhggblphicnnhlgljnoje\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TornTVRemovalTool_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TornTVRemovalTool_RASMANCS\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TornTV_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\TornTV_RASMANCS\ deleted successfully.
========== COMMANDS ==========
Restore point Set: OTM Restore Point

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Journal

User: Mcx1-WILSON
->Flash cache emptied: 0 bytes

User: Michaella
->Flash cache emptied: 9276 bytes

User: Public

User: RegBack

User: systemprofile

User: TxR

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Journal
->Temp folder emptied: 0 bytes

User: Mcx1-WILSON
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Michaella
->Temp folder emptied: 4876516 bytes
->Temporary Internet Files folder emptied: 251937249 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 5929203 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: RegBack
->Temp folder emptied: 0 bytes

User: systemprofile
->Temp folder emptied: 0 bytes

User: TxR
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 18032 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 251.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTM by OldTimer - Version 3.1.21.0 log created on 05072013_092205
Files moved on Reboot...
C:\Users\Michaella\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
Registry entries deleted on Reboot...


----------



## Mark1956 (May 7, 2011)

That log looks fine, but you have not completed the instructions:



> Open Firefox for a while and then close it again, follow that with another ordinary scan with Combofix and post the new log from it.


----------



## ste08ball (Apr 12, 2013)

ComboFix 13-05-10.01 - Michaella 10/05/2013 10:26:16.10.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.3893.2462 [GMT 1:00]
Running from: c:\users\Michaella\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-04-10 to 2013-05-10 )))))))))))))))))))))))))))))))
.
.
2013-05-10 09:35 . 2013-05-10 09:35 -------- d-----w- c:\users\Mcx1-WILSON\AppData\Local\temp
2013-05-10 09:35 . 2013-05-10 09:35 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-09 12:03 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AAF34105-C4F6-4626-A117-C793421507D2}\mpengine.dll
2013-05-08 10:47 . 2013-04-09 19:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-05-07 11:01 . 2013-05-07 11:01 -------- d-----w- c:\users\Michaella\AppData\Local\Macromedia
2013-05-06 12:21 . 2013-05-06 12:21 -------- d-----w- c:\program files (x86)\ESET
2013-05-04 12:28 . 2012-12-10 09:04 81920 ----a-w- c:\windows\eSellerateControl350.dll
2013-05-04 12:28 . 2012-12-10 09:04 356352 ----a-w- c:\windows\eSellerateEngine.dll
2013-05-04 12:28 . 2009-07-23 16:32 274432 ----a-w- c:\windows\SysWow64\ssleay32.dll
2013-05-04 12:28 . 2009-07-23 16:32 1122304 ----a-w- c:\windows\SysWow64\libeay32.dll
2013-05-04 09:59 . 2013-05-04 10:34 -------- d-----w- c:\users\Michaella\Incomplete
2013-05-04 09:55 . 2013-05-04 10:34 -------- d-----w- c:\users\Michaella\AppData\Roaming\LimeWire Music
2013-05-04 09:55 . 2013-05-04 10:22 -------- d-----w- c:\users\Michaella\Shared
2013-05-04 09:55 . 2013-05-04 09:55 -------- d-----w- c:\programdata\LimeWire Music
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- c:\windows\ERUNT
2013-04-29 16:46 . 2013-04-29 16:46 -------- d-----w- C:\JRT
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\searchplugins
2013-04-28 12:02 . 2013-04-28 12:02 -------- d-----w- c:\windows\SysWow64\Extensions
2013-04-28 11:59 . 2013-04-28 11:59 -------- d-----w- C:\_OTM
2013-04-27 22:23 . 2013-04-27 22:22 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{65B4CDE1-2AA7-4EB2-A309-4516ABDE28C5}\gapaengine.dll
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2013-04-27 22:20 . 2013-04-27 22:20 -------- d-----w- c:\program files\Microsoft Security Client
2013-04-27 16:57 . 2013-04-27 16:57 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\offreg.dll
2013-04-26 13:48 . 2013-04-26 13:48 -------- d-----w- C:\_OTL
2013-04-26 13:29 . 2013-05-07 08:05 -------- d-----w- c:\users\Michaella\AppData\Local\Spotify
2013-04-26 13:29 . 2013-05-07 08:15 -------- d-----w- c:\users\Michaella\AppData\Roaming\Spotify
2013-04-26 11:19 . 2013-04-27 10:19 -------- d-----w- c:\users\Michaella\AppData\Roaming\BitTorrent
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-04-26 09:28 . 2013-04-26 09:28 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-04-26 09:28 . 2013-04-26 09:28 -------- d-----w- c:\program files (x86)\QuickTime
2013-04-26 07:53 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\mpengine.dll
2013-04-25 09:49 . 2012-08-21 12:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2013-04-25 09:48 . 2013-04-25 09:48 -------- d-----w- c:\program files\iPod
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files\iTunes
2013-04-25 09:48 . 2013-04-25 09:49 -------- d-----w- c:\program files (x86)\iTunes
2013-04-25 09:47 . 2013-04-25 09:47 -------- d-----w- c:\program files (x86)\Apple Software Update
2013-04-25 09:47 . 2013-04-26 09:29 -------- d-----w- c:\program files\Common Files\Apple
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files\Bonjour
2013-04-25 09:46 . 2013-04-25 09:46 -------- d-----w- c:\program files (x86)\Bonjour
2013-04-25 09:46 . 2013-04-26 09:29 -------- d-----w- c:\program files (x86)\Common Files\Apple
2013-04-24 07:32 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\users\Michaella\AppData\Roaming\{90140011-0066-0409-0000-0000000FF1CE}
2013-04-17 12:51 . 2013-04-17 12:51 -------- d-----w- c:\programdata\Virtualized Applications
2013-04-14 17:03 . 2013-04-30 15:42 2399 ----a-w- c:\windows\DeleteOnReboot.bat
2013-04-14 12:30 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-12 20:37 . 2013-04-12 20:37 -------- d-----w- c:\users\Michaella\AppData\Roaming\SUPERAntiSpyware.com
2013-04-12 20:35 . 2013-04-12 23:56 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-04-12 20:35 . 2013-04-12 20:35 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2013-04-12 20:31 . 2013-04-12 20:31 -------- d-----w- c:\users\Michaella\AppData\Roaming\Malwarebytes
2013-04-12 20:30 . 2013-04-12 20:30 -------- d-----w- c:\programdata\Malwarebytes
2013-04-12 20:30 . 2013-04-14 12:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-12 20:29 . 2013-04-12 20:29 -------- d-----w- c:\users\Michaella\AppData\Local\Programs
2013-04-12 20:00 . 2013-04-12 23:56 -------- d-----w- c:\program files (x86)\PC HealthBoost
2013-04-12 19:59 . 2013-04-12 23:56 -------- d-----w- c:\programdata\PCHealthBoost
2013-04-11 15:27 . 2013-04-11 15:27 -------- d-----w- c:\program files (x86)\MSECache
2013-04-11 15:08 . 2013-04-11 15:08 -------- d-----w- c:\users\Michaella\AppData\Roaming\ParetoLogic
2013-04-11 15:08 . 2013-04-12 03:51 -------- d-----w- c:\programdata\ParetoLogic
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\users\Michaella\AppData\Roaming\FixBee
2013-04-10 22:59 . 2013-04-16 08:33 -------- d-----w- c:\programdata\FixBee
2013-04-10 22:58 . 2013-04-16 08:33 -------- d-----w- c:\program files (x86)\FixBee
2013-04-10 16:12 . 2013-04-23 08:09 -------- d-----w- c:\program files (x86)\PKR
2013-04-10 11:47 . 2013-02-22 06:29 10925568 ----a-w- c:\windows\system32\ieframe.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-04 09:58 . 2012-04-20 17:56 866720 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-05-04 09:58 . 2012-04-20 17:56 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-05-03 17:55 . 2012-06-12 22:22 895088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2013-05-03 17:55 . 2012-06-12 22:22 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2013-05-02 15:29 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-10 11:53 . 2012-04-26 22:18 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-04-05 20:04 . 2012-06-29 23:37 895088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-04-05 20:04 . 2012-06-29 23:37 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-04-05 20:04 . 2013-04-05 20:04 710992 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2013-04-05 12:21 . 2012-04-21 20:49 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-05 12:21 . 2012-04-21 20:49 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-05 10:52 . 2013-04-05 10:52 163088 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10143.bin
2013-03-19 06:04 . 2013-04-10 07:33 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 07:33 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 07:33 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 07:33 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 07:33 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 07:33 112640 ----a-w- c:\windows\system32\smss.exe
2013-03-01 03:36 . 2013-04-10 07:33 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-02-15 06:08 . 2013-04-10 07:34 44032 ----a-w- c:\windows\system32\tsgqec.dll
2013-02-15 06:06 . 2013-04-10 07:34 3717632 ----a-w- c:\windows\system32\mstscax.dll
2013-02-15 06:02 . 2013-04-10 07:34 158720 ----a-w- c:\windows\system32\aaclient.dll
2013-02-15 04:37 . 2013-04-10 07:34 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll
2013-02-15 04:34 . 2013-04-10 07:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2013-02-15 03:25 . 2013-04-10 07:34 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll
2013-02-12 05:45 . 2013-04-05 11:52 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-04-05 11:52 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-04-05 11:52 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 05:45 . 2013-04-05 11:52 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 04:48 . 2013-04-05 11:52 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-04-05 11:52 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-02-12 04:12 . 2013-04-05 11:46 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{AD8AD957-B30E-4842-8253-BFBC5F7440F3}"= "c:\program files (x86)\virgintoolbar\virgintoolbarDx.dll" [BU]
.
[HKEY_CLASSES_ROOT\clsid\{ad8ad957-b30e-4842-8253-bfbc5f7440f3}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="c:\program files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-05-30 868352]
"Spotify Web Helper"="c:\users\Michaella\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-05-04 1105408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LoadFUJ02E3"="c:\program files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe" [2009-10-08 36712]
"IndicatorUtility"="c:\program files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2009-10-09 47976]
"UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"DeskUpdateNotifier"="c:\fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe" [2013-02-26 102968]
"ServiceManager.exe"="c:\program files (x86)\Virgin Media\Service Manager\ServiceManager.exe" [2011-11-16 10200376]
"DHSClient.exe"="c:\program files (x86)\Virgin Media\Digital Home Support\DHSClient.exe" [2011-03-23 2032952]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"RequireSignedAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HsdService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-07-08 35840]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-04-21 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2010-09-17 194640]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 FBDiskOptimizer;FBDiskOptimizer;c:\program files (x86)\FixBee\FBDefragSrv64.exe [2012-12-05 631664]
S2 HsdService;HsdService;c:\program files (x86)\Virgin Media\Digital Home Support\HsdService.exe [2011-03-23 1406264]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 PFNService;PFNService;c:\program files\Fujitsu\Plugfree NETWORK\PFNService.exe [2010-06-24 330240]
S2 PowerSavingUtilityService;PowerSavingUtilityService;c:\program files\Fujitsu\PSUtility\PSUService.exe [2009-07-30 63336]
S2 ServicepointService;ServicepointService;c:\program files (x86)\Virgin Media\Service Manager\ServicepointService.exe [2011-11-16 10310968]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-01 2314240]
S2 VFPRadioSupportService;Bluetooth Feature Support;c:\program files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [2009-12-24 145840]
S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\DRIVERS\FUJ02E3.sys [2006-11-01 7296]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-11-01 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-11-27 244736]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-04 346144]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 12:21]
.
2013-05-09 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoBackuped]
@="{7E5951A0-8683-432A-9483-5F43168D6A8C}"
[HKEY_CLASSES_ROOT\CLSID\{7E5951A0-8683-432A-9483-5F43168D6A8C}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SKIcoSelected]
@="{15054241-49B4-4FA6-B4C7-A0071F118110}"
[HKEY_CLASSES_ROOT\CLSID\{15054241-49B4-4FA6-B4C7-A0071F118110}]
2011-09-28 09:31 4304048 ----a-w- c:\program files\VirginMedia\V Stuff Backup\AGSIconOverlay64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-01-12 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-01-12 390680]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-01-12 410136]
"PfNet"="c:\program files\Fujitsu\Plugfree NETWORK\PfNet.exe" [2010-06-24 6310912]
"PSUTility"="c:\program files\Fujitsu\PSUtility\TrayManager.exe" [2009-07-30 188264]
"FDM7"="c:\program files\Fujitsu\FDM7\FdmDaemon.exe" [2009-11-26 164712]
"LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2009-10-15 157544]
"LoadBtnHnd"="c:\program files\Fujitsu\Application Panel\BtnHnd.exe" [2009-10-15 35176]
"CSRBIP"="c:\program files\CSR\Bluetooth Feature Pack 5.0\CSRBipPushResponder.exe" [2009-12-24 419752]
"Backup & Storage"="c:\program files\VirginMedia\V Stuff Backup\Backup & Storage.exe" [2011-09-28 17483952]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.co.uk/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
FF - ProfilePath - c:\users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\
FF - prefs.js: browser.search.defaulturl - 
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
WebBrowser-{687578B9-7132-4A7A-80E4-30EE31099E03} - (no file)
WebBrowser-{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1} - (no file)
AddRemove-virgintoolbar - c:\program files (x86)\virgintoolbar\uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DIB\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.bmp.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ICO\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.ico.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JFIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPE\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPEG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JPG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.jpg.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PNG\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.png.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TIFF\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.tif.15.4"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WDP\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLive.PhotoGallery.wdp.15.4"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-05-10 10:39:11
ComboFix-quarantined-files.txt 2013-05-10 09:39
ComboFix2.txt 2013-05-06 09:00
ComboFix3.txt 2013-05-05 08:08
ComboFix4.txt 2013-05-03 17:03
ComboFix5.txt 2013-05-10 09:23
.
Pre-Run: 332,254,949,376 bytes free
Post-Run: 331,955,412,992 bytes free
.
- - End Of File - - D9C97BE72F6C352F47CFBA60C5964E79


----------



## Mark1956 (May 7, 2011)

Ok, we finally got rid of the bad entries in Firefox, how well is the system running now?

Please run this and follow the instructions to find and post the log.


Click on *Start* and type *cmd* in the search box. Right click on *cmd* in the popup menu and select *Run as Administrator*.
Another box will open, at the Command Prompt, type *sfc /scannow* and press Enter. (Note the gap between the c and the /)
Let the check run to completion. *DO NOT* reboot the PC or close the *cmd* window.
Copy & Paste the following command at the Command Prompt and press Enter:

* findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >%userprofile%\Desktop\sfcdetails.txt*


This will place a file on your desktop called *sfcdetails.txt* which contains the results of the scan.
Copy and Paste the contents of the file into your next post.


----------



## ste08ball (Apr 12, 2013)

2013-05-11 10:45:35, Info CSI 00000009 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:35, Info CSI 0000000a [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:38, Info CSI 0000000c [SR] Verify complete
2013-05-11 10:45:39, Info CSI 0000000d [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:39, Info CSI 0000000e [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:41, Info CSI 00000010 [SR] Verify complete
2013-05-11 10:45:41, Info CSI 00000011 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:41, Info CSI 00000012 [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:43, Info CSI 00000014 [SR] Verify complete
2013-05-11 10:45:44, Info CSI 00000015 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:44, Info CSI 00000016 [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:46, Info CSI 00000018 [SR] Verify complete
2013-05-11 10:45:47, Info CSI 00000019 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:47, Info CSI 0000001a [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:49, Info CSI 0000001c [SR] Verify complete
2013-05-11 10:45:50, Info CSI 0000001d [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:50, Info CSI 0000001e [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:55, Info CSI 00000020 [SR] Verify complete
2013-05-11 10:45:55, Info CSI 00000021 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:55, Info CSI 00000022 [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:58, Info CSI 00000024 [SR] Verify complete
2013-05-11 10:45:59, Info CSI 00000025 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:59, Info CSI 00000026 [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:02, Info CSI 00000028 [SR] Verify complete
2013-05-11 10:46:03, Info CSI 00000029 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:03, Info CSI 0000002a [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:06, Info CSI 0000002c [SR] Verify complete
2013-05-11 10:46:07, Info CSI 0000002d [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:07, Info CSI 0000002e [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:12, Info CSI 00000030 [SR] Verify complete
2013-05-11 10:46:13, Info CSI 00000031 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:13, Info CSI 00000032 [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:16, Info CSI 00000034 [SR] Verify complete
2013-05-11 10:46:16, Info CSI 00000035 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:16, Info CSI 00000036 [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:19, Info CSI 00000038 [SR] Verify complete
2013-05-11 10:46:20, Info CSI 00000039 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:20, Info CSI 0000003a [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:29, Info CSI 0000003d [SR] Verify complete
2013-05-11 10:46:29, Info CSI 0000003e [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:29, Info CSI 0000003f [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:37, Info CSI 00000044 [SR] Verify complete
2013-05-11 10:46:38, Info CSI 00000045 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:38, Info CSI 00000046 [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:43, Info CSI 00000048 [SR] Verify complete
2013-05-11 10:46:43, Info CSI 00000049 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:43, Info CSI 0000004a [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:50, Info CSI 0000004d [SR] Verify complete
2013-05-11 10:46:50, Info CSI 0000004e [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:50, Info CSI 0000004f [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:58, Info CSI 0000005a [SR] Verify complete
2013-05-11 10:46:58, Info CSI 0000005b [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:58, Info CSI 0000005c [SR] Beginning Verify and Repair transaction
2013-05-11 10:47:11, Info CSI 00000078 [SR] Verify complete
2013-05-11 10:47:12, Info CSI 00000079 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:47:12, Info CSI 0000007a [SR] Beginning Verify and Repair transaction
2013-05-11 10:47:20, Info CSI 0000007c [SR] Verify complete
2013-05-11 10:47:20, Info CSI 0000007d [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:47:20, Info CSI 0000007e [SR] Beginning Verify and Repair transaction
2013-05-11 10:47:27, Info CSI 00000080 [SR] Verify complete
2013-05-11 10:47:27, Info CSI 00000081 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:47:27, Info CSI 00000082 [SR] Beginning Verify and Repair transaction
2013-05-11 10:47:34, Info CSI 00000084 [SR] Verify complete
2013-05-11 10:47:35, Info CSI 00000085 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:47:35, Info CSI 00000086 [SR] Beginning Verify and Repair transaction
2013-05-11 10:47:40, Info CSI 00000088 [SR] Verify complete
2013-05-11 10:47:40, Info CSI 00000089 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:47:40, Info CSI 0000008a [SR] Beginning Verify and Repair transaction
2013-05-11 10:47:51, Info CSI 0000008e [SR] Verify complete
2013-05-11 10:47:51, Info CSI 0000008f [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:47:51, Info CSI 00000090 [SR] Beginning Verify and Repair transaction
2013-05-11 10:48:03, Info CSI 000000b1 [SR] Verify complete
2013-05-11 10:48:03, Info CSI 000000b2 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:48:03, Info CSI 000000b3 [SR] Beginning Verify and Repair transaction
2013-05-11 10:48:20, Info CSI 000000b5 [SR] Verify complete
2013-05-11 10:48:20, Info CSI 000000b6 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:48:20, Info CSI 000000b7 [SR] Beginning Verify and Repair transaction
2013-05-11 10:48:37, Info CSI 000000bb [SR] Verify complete
2013-05-11 10:48:37, Info CSI 000000bc [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:48:37, Info CSI 000000bd [SR] Beginning Verify and Repair transaction
2013-05-11 10:48:41, Info CSI 000000bf [SR] Verify complete
2013-05-11 10:48:42, Info CSI 000000c0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:48:42, Info CSI 000000c1 [SR] Beginning Verify and Repair transaction
2013-05-11 10:48:45, Info CSI 000000c3 [SR] Verify complete
2013-05-11 10:48:45, Info CSI 000000c4 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:48:45, Info CSI 000000c5 [SR] Beginning Verify and Repair transaction
2013-05-11 10:48:49, Info CSI 000000c7 [SR] Verify complete
2013-05-11 10:48:50, Info CSI 000000c8 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:48:50, Info CSI 000000c9 [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:02, Info CSI 000000dc [SR] Verify complete
2013-05-11 10:49:02, Info CSI 000000dd [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:02, Info CSI 000000de [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:07, Info CSI 000000e0 [SR] Verify complete
2013-05-11 10:49:07, Info CSI 000000e1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:07, Info CSI 000000e2 [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:09, Info CSI 000000e4 [SR] Verify complete
2013-05-11 10:49:09, Info CSI 000000e5 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:09, Info CSI 000000e6 [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:15, Info CSI 000000e8 [SR] Verify complete
2013-05-11 10:49:16, Info CSI 000000e9 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:16, Info CSI 000000ea [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:19, Info CSI 000000ec [SR] Verify complete
2013-05-11 10:49:19, Info CSI 000000ed [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:19, Info CSI 000000ee [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:25, Info CSI 000000f0 [SR] Verify complete
2013-05-11 10:49:26, Info CSI 000000f1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:26, Info CSI 000000f2 [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:33, Info CSI 000000f3 [SR] Repairing corrupted file [ml:520{260},l:74{37}]"\??\C:\Windows\System32\wdi\perftrack"\[l:80{40}]"Microsoft-Windows-IE-HTMLRendering.ptxml" from store
2013-05-11 10:49:35, Info CSI 000000f6 [SR] Verify complete
2013-05-11 10:49:35, Info CSI 000000f7 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:35, Info CSI 000000f8 [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:46, Info CSI 000000fb [SR] Verify complete
2013-05-11 10:49:46, Info CSI 000000fc [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:46, Info CSI 000000fd [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:52, Info CSI 000000ff [SR] Verify complete
2013-05-11 10:49:52, Info CSI 00000100 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:52, Info CSI 00000101 [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:56, Info CSI 00000103 [SR] Verify complete
2013-05-11 10:49:56, Info CSI 00000104 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:56, Info CSI 00000105 [SR] Beginning Verify and Repair transaction
2013-05-11 10:50:07, Info CSI 00000107 [SR] Verify complete
2013-05-11 10:50:08, Info CSI 00000108 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:50:08, Info CSI 00000109 [SR] Beginning Verify and Repair transaction
2013-05-11 10:50:16, Info CSI 0000010b [SR] Verify complete
2013-05-11 10:50:17, Info CSI 0000010c [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:50:17, Info CSI 0000010d [SR] Beginning Verify and Repair transaction
2013-05-11 10:50:30, Info CSI 0000010f [SR] Verify complete
2013-05-11 10:50:30, Info CSI 00000110 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:50:30, Info CSI 00000111 [SR] Beginning Verify and Repair transaction
2013-05-11 10:50:45, Info CSI 00000129 [SR] Verify complete
2013-05-11 10:50:45, Info CSI 0000012a [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:50:45, Info CSI 0000012b [SR] Beginning Verify and Repair transaction
2013-05-11 10:50:53, Info CSI 0000012d [SR] Verify complete
2013-05-11 10:50:53, Info CSI 0000012e [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:50:53, Info CSI 0000012f [SR] Beginning Verify and Repair transaction
2013-05-11 10:51:18, Info CSI 00000131 [SR] Verify complete
2013-05-11 10:51:19, Info CSI 00000132 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:51:19, Info CSI 00000133 [SR] Beginning Verify and Repair transaction
2013-05-11 10:51:33, Info CSI 00000136 [SR] Verify complete
2013-05-11 10:51:34, Info CSI 00000137 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:51:34, Info CSI 00000138 [SR] Beginning Verify and Repair transaction
2013-05-11 10:51:49, Info CSI 0000013a [SR] Verify complete
2013-05-11 10:51:50, Info CSI 0000013b [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:51:50, Info CSI 0000013c [SR] Beginning Verify and Repair transaction
2013-05-11 10:51:58, Info CSI 0000013e [SR] Verify complete
2013-05-11 10:51:59, Info CSI 0000013f [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:51:59, Info CSI 00000140 [SR] Beginning Verify and Repair transaction
2013-05-11 10:52:07, Info CSI 00000142 [SR] Verify complete
2013-05-11 10:52:07, Info CSI 00000143 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:52:07, Info CSI 00000144 [SR] Beginning Verify and Repair transaction
2013-05-11 10:52:13, Info CSI 00000148 [SR] Verify complete
2013-05-11 10:52:14, Info CSI 00000149 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:52:14, Info CSI 0000014a [SR] Beginning Verify and Repair transaction
2013-05-11 10:52:19, Info CSI 0000014c [SR] Verify complete
2013-05-11 10:52:20, Info CSI 0000014d [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:52:20, Info CSI 0000014e [SR] Beginning Verify and Repair transaction
2013-05-11 10:52:42, Info CSI 00000150 [SR] Verify complete
2013-05-11 10:52:42, Info CSI 00000151 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:52:42, Info CSI 00000152 [SR] Beginning Verify and Repair transaction
2013-05-11 10:52:53, Info CSI 00000155 [SR] Verify complete
2013-05-11 10:52:53, Info CSI 00000156 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:52:53, Info CSI 00000157 [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:02, Info CSI 0000015a [SR] Verify complete
2013-05-11 10:53:02, Info CSI 0000015b [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:02, Info CSI 0000015c [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:10, Info CSI 0000015e [SR] Verify complete
2013-05-11 10:53:11, Info CSI 0000015f [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:11, Info CSI 00000160 [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:24, Info CSI 00000163 [SR] Verify complete
2013-05-11 10:53:25, Info CSI 00000164 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:25, Info CSI 00000165 [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:32, Info CSI 00000167 [SR] Verify complete
2013-05-11 10:53:33, Info CSI 00000168 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:33, Info CSI 00000169 [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:40, Info CSI 0000016b [SR] Verify complete
2013-05-11 10:53:40, Info CSI 0000016c [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:40, Info CSI 0000016d [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:48, Info CSI 0000016f [SR] Verify complete
2013-05-11 10:53:48, Info CSI 00000170 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:48, Info CSI 00000171 [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:58, Info CSI 00000174 [SR] Verify complete
2013-05-11 10:53:58, Info CSI 00000175 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:58, Info CSI 00000176 [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:05, Info CSI 00000178 [SR] Verify complete
2013-05-11 10:54:05, Info CSI 00000179 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:05, Info CSI 0000017a [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:12, Info CSI 0000017d [SR] Verify complete
2013-05-11 10:54:13, Info CSI 0000017e [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:13, Info CSI 0000017f [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:22, Info CSI 00000182 [SR] Verify complete
2013-05-11 10:54:23, Info CSI 00000183 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:23, Info CSI 00000184 [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:30, Info CSI 00000187 [SR] Verify complete
2013-05-11 10:54:30, Info CSI 00000188 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:30, Info CSI 00000189 [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:40, Info CSI 0000018b [SR] Verify complete
2013-05-11 10:54:40, Info CSI 0000018c [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:40, Info CSI 0000018d [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:50, Info CSI 00000190 [SR] Verify complete
2013-05-11 10:54:51, Info CSI 00000191 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:51, Info CSI 00000192 [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:59, Info CSI 00000194 [SR] Verify complete
2013-05-11 10:54:59, Info CSI 00000195 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:59, Info CSI 00000196 [SR] Beginning Verify and Repair transaction
2013-05-11 10:55:04, Info CSI 00000198 [SR] Verify complete
2013-05-11 10:55:04, Info CSI 00000199 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:55:04, Info CSI 0000019a [SR] Beginning Verify and Repair transaction
2013-05-11 10:55:11, Info CSI 0000019c [SR] Verify complete
2013-05-11 10:55:11, Info CSI 0000019d [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:55:11, Info CSI 0000019e [SR] Beginning Verify and Repair transaction
2013-05-11 10:55:19, Info CSI 000001a0 [SR] Verify complete
2013-05-11 10:55:19, Info CSI 000001a1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:55:19, Info CSI 000001a2 [SR] Beginning Verify and Repair transaction
2013-05-11 10:55:28, Info CSI 000001a4 [SR] Verify complete
2013-05-11 10:55:28, Info CSI 000001a5 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:55:28, Info CSI 000001a6 [SR] Beginning Verify and Repair transaction
2013-05-11 10:55:33, Info CSI 000001a8 [SR] Verify complete
2013-05-11 10:55:33, Info CSI 000001a9 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:55:33, Info CSI 000001aa [SR] Beginning Verify and Repair transaction
2013-05-11 10:55:42, Info CSI 000001ac [SR] Verify complete
2013-05-11 10:55:42, Info CSI 000001ad [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:55:42, Info CSI 000001ae [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:01, Info CSI 000001b0 [SR] Verify complete
2013-05-11 10:56:02, Info CSI 000001b1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:02, Info CSI 000001b2 [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:21, Info CSI 000001b4 [SR] Verify complete
2013-05-11 10:56:21, Info CSI 000001b5 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:21, Info CSI 000001b6 [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:29, Info CSI 000001b8 [SR] Verify complete
2013-05-11 10:56:29, Info CSI 000001b9 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:29, Info CSI 000001ba [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:33, Info CSI 000001bc [SR] Verify complete
2013-05-11 10:56:33, Info CSI 000001bd [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:33, Info CSI 000001be [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:37, Info CSI 000001c0 [SR] Verify complete
2013-05-11 10:56:37, Info CSI 000001c1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:37, Info CSI 000001c2 [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:42, Info CSI 000001c4 [SR] Verify complete
2013-05-11 10:56:42, Info CSI 000001c5 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:42, Info CSI 000001c6 [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:52, Info CSI 000001ce [SR] Verify complete
2013-05-11 10:56:52, Info CSI 000001cf [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:52, Info CSI 000001d0 [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:57, Info CSI 000001d2 [SR] Verify complete
2013-05-11 10:56:57, Info CSI 000001d3 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:57, Info CSI 000001d4 [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:01, Info CSI 000001d6 [SR] Verify complete
2013-05-11 10:57:01, Info CSI 000001d7 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:01, Info CSI 000001d8 [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:05, Info CSI 000001da [SR] Verify complete
2013-05-11 10:57:06, Info CSI 000001db [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:06, Info CSI 000001dc [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:12, Info CSI 000001de [SR] Verify complete
2013-05-11 10:57:12, Info CSI 000001df [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:12, Info CSI 000001e0 [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:22, Info CSI 000001e3 [SR] Verify complete
2013-05-11 10:57:22, Info CSI 000001e4 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:22, Info CSI 000001e5 [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:28, Info CSI 000001e7 [SR] Verify complete
2013-05-11 10:57:29, Info CSI 000001e8 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:29, Info CSI 000001e9 [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:30, Info CSI 000001eb [SR] Verify complete
2013-05-11 10:57:31, Info CSI 000001ec [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:31, Info CSI 000001ed [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:35, Info CSI 000001ef [SR] Verify complete
2013-05-11 10:57:36, Info CSI 000001f0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:36, Info CSI 000001f1 [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:46, Info CSI 000001f2 [SR] Repairing corrupted file [ml:76{38},l:74{37}]"\??\C:\Windows\SysWOW64\wdi\perftrack"\[l:38{19}]"wow64_ieframe.ptxml" from store
2013-05-11 10:57:50, Info CSI 000001f3 [SR] Repairing corrupted file [ml:76{38},l:74{37}]"\??\C:\Windows\SysWOW64\wdi\perftrack"\[l:92{46}]"wow64_Microsoft-Windows-IE-HTMLRendering.ptxml" from store
2013-05-11 10:57:53, Info CSI 000001f8 [SR] Verify complete
2013-05-11 10:57:54, Info CSI 000001f9 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:54, Info CSI 000001fa [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:03, Info CSI 000001ff [SR] Verify complete
2013-05-11 10:58:04, Info CSI 00000200 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:04, Info CSI 00000201 [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:17, Info CSI 00000204 [SR] Verify complete
2013-05-11 10:58:18, Info CSI 00000205 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:18, Info CSI 00000206 [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:27, Info CSI 00000211 [SR] Verify complete
2013-05-11 10:58:28, Info CSI 00000212 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:28, Info CSI 00000213 [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:37, Info CSI 00000219 [SR] Verify complete
2013-05-11 10:58:37, Info CSI 0000021a [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:37, Info CSI 0000021b [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:43, Info CSI 0000021d [SR] Verify complete
2013-05-11 10:58:44, Info CSI 0000021e [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:44, Info CSI 0000021f [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:48, Info CSI 00000223 [SR] Verify complete
2013-05-11 10:58:48, Info CSI 00000224 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:48, Info CSI 00000225 [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:55, Info CSI 0000022b [SR] Verify complete
2013-05-11 10:58:55, Info CSI 0000022c [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:55, Info CSI 0000022d [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:05, Info CSI 0000024e [SR] Verify complete
2013-05-11 10:59:05, Info CSI 0000024f [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:05, Info CSI 00000250 [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:13, Info CSI 00000252 [SR] Verify complete
2013-05-11 10:59:13, Info CSI 00000253 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:13, Info CSI 00000254 [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:18, Info CSI 00000256 [SR] Verify complete
2013-05-11 10:59:19, Info CSI 00000257 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:19, Info CSI 00000258 [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:25, Info CSI 00000266 [SR] Verify complete
2013-05-11 10:59:25, Info CSI 00000267 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:25, Info CSI 00000268 [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:37, Info CSI 0000026a [SR] Verify complete
2013-05-11 10:59:37, Info CSI 0000026b [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:37, Info CSI 0000026c [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:46, Info CSI 0000027a [SR] Verify complete
2013-05-11 10:59:47, Info CSI 0000027b [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:47, Info CSI 0000027c [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:52, Info CSI 0000027e [SR] Verify complete
2013-05-11 10:59:52, Info CSI 0000027f [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:52, Info CSI 00000280 [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:55, Info CSI 00000282 [SR] Verify complete
2013-05-11 10:59:56, Info CSI 00000283 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:56, Info CSI 00000284 [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:00, Info CSI 00000286 [SR] Verify complete
2013-05-11 11:00:00, Info CSI 00000287 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:00, Info CSI 00000288 [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:07, Info CSI 0000028b [SR] Verify complete
2013-05-11 11:00:08, Info CSI 0000028c [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:08, Info CSI 0000028d [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:13, Info CSI 0000028f [SR] Verify complete
2013-05-11 11:00:13, Info CSI 00000290 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:13, Info CSI 00000291 [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:15, Info CSI 00000293 [SR] Verify complete
2013-05-11 11:00:15, Info CSI 00000294 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:15, Info CSI 00000295 [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:22, Info CSI 00000297 [SR] Verify complete
2013-05-11 11:00:22, Info CSI 00000298 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:22, Info CSI 00000299 [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:28, Info CSI 0000029b [SR] Verify complete
2013-05-11 11:00:29, Info CSI 0000029c [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:29, Info CSI 0000029d [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:38, Info CSI 000002af [SR] Verify complete
2013-05-11 11:00:38, Info CSI 000002b0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:38, Info CSI 000002b1 [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:45, Info CSI 000002bb [SR] Verify complete
2013-05-11 11:00:46, Info CSI 000002bc [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:46, Info CSI 000002bd [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:08, Info CSI 000002bf [SR] Verify complete
2013-05-11 11:01:09, Info CSI 000002c0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:09, Info CSI 000002c1 [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:16, Info CSI 000002c3 [SR] Verify complete
2013-05-11 11:01:17, Info CSI 000002c4 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:17, Info CSI 000002c5 [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:21, Info CSI 000002c9 [SR] Verify complete
2013-05-11 11:01:22, Info CSI 000002ca [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:22, Info CSI 000002cb [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:26, Info CSI 000002cd [SR] Verify complete
2013-05-11 11:01:26, Info CSI 000002ce [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:26, Info CSI 000002cf [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:31, Info CSI 000002d1 [SR] Verify complete
2013-05-11 11:01:32, Info CSI 000002d2 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:32, Info CSI 000002d3 [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:38, Info CSI 000002d5 [SR] Verify complete
2013-05-11 11:01:39, Info CSI 000002d6 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:39, Info CSI 000002d7 [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:46, Info CSI 000002da [SR] Verify complete
2013-05-11 11:01:47, Info CSI 000002db [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:47, Info CSI 000002dc [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:51, Info CSI 000002de [SR] Verify complete
2013-05-11 11:01:51, Info CSI 000002df [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:51, Info CSI 000002e0 [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:57, Info CSI 000002e2 [SR] Verify complete
2013-05-11 11:01:58, Info CSI 000002e3 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:58, Info CSI 000002e4 [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:04, Info CSI 000002e6 [SR] Verify complete
2013-05-11 11:02:05, Info CSI 000002e7 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:02:05, Info CSI 000002e8 [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:14, Info CSI 000002eb [SR] Verify complete
2013-05-11 11:02:15, Info CSI 000002ec [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:02:15, Info CSI 000002ed [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:21, Info CSI 000002ef [SR] Verify complete
2013-05-11 11:02:21, Info CSI 000002f0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:02:21, Info CSI 000002f1 [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:27, Info CSI 000002f3 [SR] Verify complete
2013-05-11 11:02:28, Info CSI 000002f4 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:02:28, Info CSI 000002f5 [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:34, Info CSI 000002f7 [SR] Verify complete
2013-05-11 11:02:34, Info CSI 000002f8 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:02:34, Info CSI 000002f9 [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:42, Info CSI 000002fb [SR] Verify complete
2013-05-11 11:02:42, Info CSI 000002fc [SR] Verifying 26 (0x000000000000001a) components
2013-05-11 11:02:42, Info CSI 000002fd [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:44, Info CSI 000002ff [SR] Verify complete
2013-05-11 11:02:44, Info CSI 00000300 [SR] Repairing 3 components
2013-05-11 11:02:44, Info CSI 00000301 [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:48, Info CSI 00000302 [SR] Repairing corrupted file [ml:520{260},l:74{37}]"\??\C:\Windows\System32\wdi\perftrack"\[l:80{40}]"Microsoft-Windows-IE-HTMLRendering.ptxml" from store
2013-05-11 11:02:49, Info CSI 00000303 [SR] Repairing corrupted file [ml:76{38},l:74{37}]"\??\C:\Windows\SysWOW64\wdi\perftrack"\[l:92{46}]"wow64_Microsoft-Windows-IE-HTMLRendering.ptxml" from store
2013-05-11 11:02:50, Info CSI 00000304 [SR] Repairing corrupted file [ml:76{38},l:74{37}]"\??\C:\Windows\SysWOW64\wdi\perftrack"\[l:38{19}]"wow64_ieframe.ptxml" from store
2013-05-11 11:02:51, Info CSI 00000306 [SR] Repair complete
2013-05-11 11:02:51, Info CSI 00000307 [SR] Committing transaction
2013-05-11 11:02:51, Info CSI 0000030b [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction have been successfully repaired


----------



## Mark1956 (May 7, 2011)

The File Checker found some corrupted files and has repaired them, please reboot the system, run it again and post the new log.

You missed a question in my last post, please answer it.


----------



## ste08ball (Apr 12, 2013)

the computer is running a little slow
i did a mse scan as it said i havent done one for a while and the attachment is what popped up at the end so i selected them both and clicked send 
just about to do the last step again


----------



## ste08ball (Apr 12, 2013)

2013-05-11 10:45:35, Info CSI 00000009 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:35, Info CSI 0000000a [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:38, Info CSI 0000000c [SR] Verify complete
2013-05-11 10:45:39, Info CSI 0000000d [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:39, Info CSI 0000000e [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:41, Info CSI 00000010 [SR] Verify complete
2013-05-11 10:45:41, Info CSI 00000011 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:41, Info CSI 00000012 [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:43, Info CSI 00000014 [SR] Verify complete
2013-05-11 10:45:44, Info CSI 00000015 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:44, Info CSI 00000016 [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:46, Info CSI 00000018 [SR] Verify complete
2013-05-11 10:45:47, Info CSI 00000019 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:47, Info CSI 0000001a [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:49, Info CSI 0000001c [SR] Verify complete
2013-05-11 10:45:50, Info CSI 0000001d [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:50, Info CSI 0000001e [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:55, Info CSI 00000020 [SR] Verify complete
2013-05-11 10:45:55, Info CSI 00000021 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:55, Info CSI 00000022 [SR] Beginning Verify and Repair transaction
2013-05-11 10:45:58, Info CSI 00000024 [SR] Verify complete
2013-05-11 10:45:59, Info CSI 00000025 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:45:59, Info CSI 00000026 [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:02, Info CSI 00000028 [SR] Verify complete
2013-05-11 10:46:03, Info CSI 00000029 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:03, Info CSI 0000002a [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:06, Info CSI 0000002c [SR] Verify complete
2013-05-11 10:46:07, Info CSI 0000002d [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:07, Info CSI 0000002e [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:12, Info CSI 00000030 [SR] Verify complete
2013-05-11 10:46:13, Info CSI 00000031 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:13, Info CSI 00000032 [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:16, Info CSI 00000034 [SR] Verify complete
2013-05-11 10:46:16, Info CSI 00000035 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:16, Info CSI 00000036 [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:19, Info CSI 00000038 [SR] Verify complete
2013-05-11 10:46:20, Info CSI 00000039 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:20, Info CSI 0000003a [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:29, Info CSI 0000003d [SR] Verify complete
2013-05-11 10:46:29, Info CSI 0000003e [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:29, Info CSI 0000003f [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:37, Info CSI 00000044 [SR] Verify complete
2013-05-11 10:46:38, Info CSI 00000045 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:38, Info CSI 00000046 [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:43, Info CSI 00000048 [SR] Verify complete
2013-05-11 10:46:43, Info CSI 00000049 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:43, Info CSI 0000004a [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:50, Info CSI 0000004d [SR] Verify complete
2013-05-11 10:46:50, Info CSI 0000004e [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:50, Info CSI 0000004f [SR] Beginning Verify and Repair transaction
2013-05-11 10:46:58, Info CSI 0000005a [SR] Verify complete
2013-05-11 10:46:58, Info CSI 0000005b [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:46:58, Info CSI 0000005c [SR] Beginning Verify and Repair transaction
2013-05-11 10:47:11, Info CSI 00000078 [SR] Verify complete
2013-05-11 10:47:12, Info CSI 00000079 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:47:12, Info CSI 0000007a [SR] Beginning Verify and Repair transaction
2013-05-11 10:47:20, Info CSI 0000007c [SR] Verify complete
2013-05-11 10:47:20, Info CSI 0000007d [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:47:20, Info CSI 0000007e [SR] Beginning Verify and Repair transaction
2013-05-11 10:47:27, Info CSI 00000080 [SR] Verify complete
2013-05-11 10:47:27, Info CSI 00000081 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:47:27, Info CSI 00000082 [SR] Beginning Verify and Repair transaction
2013-05-11 10:47:34, Info CSI 00000084 [SR] Verify complete
2013-05-11 10:47:35, Info CSI 00000085 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:47:35, Info CSI 00000086 [SR] Beginning Verify and Repair transaction
2013-05-11 10:47:40, Info CSI 00000088 [SR] Verify complete
2013-05-11 10:47:40, Info CSI 00000089 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:47:40, Info CSI 0000008a [SR] Beginning Verify and Repair transaction
2013-05-11 10:47:51, Info CSI 0000008e [SR] Verify complete
2013-05-11 10:47:51, Info CSI 0000008f [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:47:51, Info CSI 00000090 [SR] Beginning Verify and Repair transaction
2013-05-11 10:48:03, Info CSI 000000b1 [SR] Verify complete
2013-05-11 10:48:03, Info CSI 000000b2 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:48:03, Info CSI 000000b3 [SR] Beginning Verify and Repair transaction
2013-05-11 10:48:20, Info CSI 000000b5 [SR] Verify complete
2013-05-11 10:48:20, Info CSI 000000b6 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:48:20, Info CSI 000000b7 [SR] Beginning Verify and Repair transaction
2013-05-11 10:48:37, Info CSI 000000bb [SR] Verify complete
2013-05-11 10:48:37, Info CSI 000000bc [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:48:37, Info CSI 000000bd [SR] Beginning Verify and Repair transaction
2013-05-11 10:48:41, Info CSI 000000bf [SR] Verify complete
2013-05-11 10:48:42, Info CSI 000000c0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:48:42, Info CSI 000000c1 [SR] Beginning Verify and Repair transaction
2013-05-11 10:48:45, Info CSI 000000c3 [SR] Verify complete
2013-05-11 10:48:45, Info CSI 000000c4 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:48:45, Info CSI 000000c5 [SR] Beginning Verify and Repair transaction
2013-05-11 10:48:49, Info CSI 000000c7 [SR] Verify complete
2013-05-11 10:48:50, Info CSI 000000c8 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:48:50, Info CSI 000000c9 [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:02, Info CSI 000000dc [SR] Verify complete
2013-05-11 10:49:02, Info CSI 000000dd [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:02, Info CSI 000000de [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:07, Info CSI 000000e0 [SR] Verify complete
2013-05-11 10:49:07, Info CSI 000000e1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:07, Info CSI 000000e2 [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:09, Info CSI 000000e4 [SR] Verify complete
2013-05-11 10:49:09, Info CSI 000000e5 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:09, Info CSI 000000e6 [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:15, Info CSI 000000e8 [SR] Verify complete
2013-05-11 10:49:16, Info CSI 000000e9 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:16, Info CSI 000000ea [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:19, Info CSI 000000ec [SR] Verify complete
2013-05-11 10:49:19, Info CSI 000000ed [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:19, Info CSI 000000ee [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:25, Info CSI 000000f0 [SR] Verify complete
2013-05-11 10:49:26, Info CSI 000000f1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:26, Info CSI 000000f2 [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:33, Info CSI 000000f3 [SR] Repairing corrupted file [ml:520{260},l:74{37}]"\??\C:\Windows\System32\wdi\perftrack"\[l:80{40}]"Microsoft-Windows-IE-HTMLRendering.ptxml" from store
2013-05-11 10:49:35, Info CSI 000000f6 [SR] Verify complete
2013-05-11 10:49:35, Info CSI 000000f7 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:35, Info CSI 000000f8 [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:46, Info CSI 000000fb [SR] Verify complete
2013-05-11 10:49:46, Info CSI 000000fc [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:46, Info CSI 000000fd [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:52, Info CSI 000000ff [SR] Verify complete
2013-05-11 10:49:52, Info CSI 00000100 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:52, Info CSI 00000101 [SR] Beginning Verify and Repair transaction
2013-05-11 10:49:56, Info CSI 00000103 [SR] Verify complete
2013-05-11 10:49:56, Info CSI 00000104 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:49:56, Info CSI 00000105 [SR] Beginning Verify and Repair transaction
2013-05-11 10:50:07, Info CSI 00000107 [SR] Verify complete
2013-05-11 10:50:08, Info CSI 00000108 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:50:08, Info CSI 00000109 [SR] Beginning Verify and Repair transaction
2013-05-11 10:50:16, Info CSI 0000010b [SR] Verify complete
2013-05-11 10:50:17, Info CSI 0000010c [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:50:17, Info CSI 0000010d [SR] Beginning Verify and Repair transaction
2013-05-11 10:50:30, Info CSI 0000010f [SR] Verify complete
2013-05-11 10:50:30, Info CSI 00000110 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:50:30, Info CSI 00000111 [SR] Beginning Verify and Repair transaction
2013-05-11 10:50:45, Info CSI 00000129 [SR] Verify complete
2013-05-11 10:50:45, Info CSI 0000012a [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:50:45, Info CSI 0000012b [SR] Beginning Verify and Repair transaction
2013-05-11 10:50:53, Info CSI 0000012d [SR] Verify complete
2013-05-11 10:50:53, Info CSI 0000012e [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:50:53, Info CSI 0000012f [SR] Beginning Verify and Repair transaction
2013-05-11 10:51:18, Info CSI 00000131 [SR] Verify complete
2013-05-11 10:51:19, Info CSI 00000132 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:51:19, Info CSI 00000133 [SR] Beginning Verify and Repair transaction
2013-05-11 10:51:33, Info CSI 00000136 [SR] Verify complete
2013-05-11 10:51:34, Info CSI 00000137 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:51:34, Info CSI 00000138 [SR] Beginning Verify and Repair transaction
2013-05-11 10:51:49, Info CSI 0000013a [SR] Verify complete
2013-05-11 10:51:50, Info CSI 0000013b [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:51:50, Info CSI 0000013c [SR] Beginning Verify and Repair transaction
2013-05-11 10:51:58, Info CSI 0000013e [SR] Verify complete
2013-05-11 10:51:59, Info CSI 0000013f [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:51:59, Info CSI 00000140 [SR] Beginning Verify and Repair transaction
2013-05-11 10:52:07, Info CSI 00000142 [SR] Verify complete
2013-05-11 10:52:07, Info CSI 00000143 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:52:07, Info CSI 00000144 [SR] Beginning Verify and Repair transaction
2013-05-11 10:52:13, Info CSI 00000148 [SR] Verify complete
2013-05-11 10:52:14, Info CSI 00000149 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:52:14, Info CSI 0000014a [SR] Beginning Verify and Repair transaction
2013-05-11 10:52:19, Info CSI 0000014c [SR] Verify complete
2013-05-11 10:52:20, Info CSI 0000014d [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:52:20, Info CSI 0000014e [SR] Beginning Verify and Repair transaction
2013-05-11 10:52:42, Info CSI 00000150 [SR] Verify complete
2013-05-11 10:52:42, Info CSI 00000151 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:52:42, Info CSI 00000152 [SR] Beginning Verify and Repair transaction
2013-05-11 10:52:53, Info CSI 00000155 [SR] Verify complete
2013-05-11 10:52:53, Info CSI 00000156 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:52:53, Info CSI 00000157 [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:02, Info CSI 0000015a [SR] Verify complete
2013-05-11 10:53:02, Info CSI 0000015b [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:02, Info CSI 0000015c [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:10, Info CSI 0000015e [SR] Verify complete
2013-05-11 10:53:11, Info CSI 0000015f [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:11, Info CSI 00000160 [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:24, Info CSI 00000163 [SR] Verify complete
2013-05-11 10:53:25, Info CSI 00000164 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:25, Info CSI 00000165 [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:32, Info CSI 00000167 [SR] Verify complete
2013-05-11 10:53:33, Info CSI 00000168 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:33, Info CSI 00000169 [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:40, Info CSI 0000016b [SR] Verify complete
2013-05-11 10:53:40, Info CSI 0000016c [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:40, Info CSI 0000016d [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:48, Info CSI 0000016f [SR] Verify complete
2013-05-11 10:53:48, Info CSI 00000170 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:48, Info CSI 00000171 [SR] Beginning Verify and Repair transaction
2013-05-11 10:53:58, Info CSI 00000174 [SR] Verify complete
2013-05-11 10:53:58, Info CSI 00000175 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:53:58, Info CSI 00000176 [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:05, Info CSI 00000178 [SR] Verify complete
2013-05-11 10:54:05, Info CSI 00000179 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:05, Info CSI 0000017a [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:12, Info CSI 0000017d [SR] Verify complete
2013-05-11 10:54:13, Info CSI 0000017e [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:13, Info CSI 0000017f [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:22, Info CSI 00000182 [SR] Verify complete
2013-05-11 10:54:23, Info CSI 00000183 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:23, Info CSI 00000184 [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:30, Info CSI 00000187 [SR] Verify complete
2013-05-11 10:54:30, Info CSI 00000188 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:30, Info CSI 00000189 [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:40, Info CSI 0000018b [SR] Verify complete
2013-05-11 10:54:40, Info CSI 0000018c [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:40, Info CSI 0000018d [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:50, Info CSI 00000190 [SR] Verify complete
2013-05-11 10:54:51, Info CSI 00000191 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:51, Info CSI 00000192 [SR] Beginning Verify and Repair transaction
2013-05-11 10:54:59, Info CSI 00000194 [SR] Verify complete
2013-05-11 10:54:59, Info CSI 00000195 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:54:59, Info CSI 00000196 [SR] Beginning Verify and Repair transaction
2013-05-11 10:55:04, Info CSI 00000198 [SR] Verify complete
2013-05-11 10:55:04, Info CSI 00000199 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:55:04, Info CSI 0000019a [SR] Beginning Verify and Repair transaction
2013-05-11 10:55:11, Info CSI 0000019c [SR] Verify complete
2013-05-11 10:55:11, Info CSI 0000019d [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:55:11, Info CSI 0000019e [SR] Beginning Verify and Repair transaction
2013-05-11 10:55:19, Info CSI 000001a0 [SR] Verify complete
2013-05-11 10:55:19, Info CSI 000001a1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:55:19, Info CSI 000001a2 [SR] Beginning Verify and Repair transaction
2013-05-11 10:55:28, Info CSI 000001a4 [SR] Verify complete
2013-05-11 10:55:28, Info CSI 000001a5 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:55:28, Info CSI 000001a6 [SR] Beginning Verify and Repair transaction
2013-05-11 10:55:33, Info CSI 000001a8 [SR] Verify complete
2013-05-11 10:55:33, Info CSI 000001a9 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:55:33, Info CSI 000001aa [SR] Beginning Verify and Repair transaction
2013-05-11 10:55:42, Info CSI 000001ac [SR] Verify complete
2013-05-11 10:55:42, Info CSI 000001ad [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:55:42, Info CSI 000001ae [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:01, Info CSI 000001b0 [SR] Verify complete
2013-05-11 10:56:02, Info CSI 000001b1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:02, Info CSI 000001b2 [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:21, Info CSI 000001b4 [SR] Verify complete
2013-05-11 10:56:21, Info CSI 000001b5 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:21, Info CSI 000001b6 [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:29, Info CSI 000001b8 [SR] Verify complete
2013-05-11 10:56:29, Info CSI 000001b9 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:29, Info CSI 000001ba [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:33, Info CSI 000001bc [SR] Verify complete
2013-05-11 10:56:33, Info CSI 000001bd [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:33, Info CSI 000001be [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:37, Info CSI 000001c0 [SR] Verify complete
2013-05-11 10:56:37, Info CSI 000001c1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:37, Info CSI 000001c2 [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:42, Info CSI 000001c4 [SR] Verify complete
2013-05-11 10:56:42, Info CSI 000001c5 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:42, Info CSI 000001c6 [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:52, Info CSI 000001ce [SR] Verify complete
2013-05-11 10:56:52, Info CSI 000001cf [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:52, Info CSI 000001d0 [SR] Beginning Verify and Repair transaction
2013-05-11 10:56:57, Info  CSI 000001d2 [SR] Verify complete
2013-05-11 10:56:57, Info CSI 000001d3 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:56:57, Info CSI 000001d4 [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:01, Info CSI 000001d6 [SR] Verify complete
2013-05-11 10:57:01, Info CSI 000001d7 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:01, Info CSI 000001d8 [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:05, Info CSI 000001da [SR] Verify complete
2013-05-11 10:57:06, Info CSI 000001db [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:06, Info CSI 000001dc [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:12, Info CSI 000001de [SR] Verify complete
2013-05-11 10:57:12, Info CSI 000001df [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:12, Info CSI 000001e0 [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:22, Info CSI 000001e3 [SR] Verify complete
2013-05-11 10:57:22, Info CSI 000001e4 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:22, Info CSI 000001e5 [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:28, Info CSI 000001e7 [SR] Verify complete
2013-05-11 10:57:29, Info CSI 000001e8 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:29, Info CSI 000001e9 [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:30, Info CSI 000001eb [SR] Verify complete
2013-05-11 10:57:31, Info CSI 000001ec [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:31, Info CSI 000001ed [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:35, Info CSI 000001ef [SR] Verify complete
2013-05-11 10:57:36, Info CSI 000001f0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:36, Info CSI 000001f1 [SR] Beginning Verify and Repair transaction
2013-05-11 10:57:46, Info CSI 000001f2 [SR] Repairing corrupted file [ml:76{38},l:74{37}]"\??\C:\Windows\SysWOW64\wdi\perftrack"\[l:38{19}]"wow64_ieframe.ptxml" from store
2013-05-11 10:57:50, Info CSI 000001f3 [SR] Repairing corrupted file [ml:76{38},l:74{37}]"\??\C:\Windows\SysWOW64\wdi\perftrack"\[l:92{46}]"wow64_Microsoft-Windows-IE-HTMLRendering.ptxml" from store
2013-05-11 10:57:53, Info CSI 000001f8 [SR] Verify complete
2013-05-11 10:57:54, Info CSI 000001f9 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:57:54, Info CSI 000001fa [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:03, Info CSI 000001ff [SR] Verify complete
2013-05-11 10:58:04, Info CSI 00000200 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:04, Info CSI 00000201 [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:17, Info CSI 00000204 [SR] Verify complete
2013-05-11 10:58:18, Info CSI 00000205 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:18, Info CSI 00000206 [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:27, Info CSI 00000211 [SR] Verify complete
2013-05-11 10:58:28, Info CSI 00000212 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:28, Info  CSI 00000213 [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:37, Info CSI 00000219 [SR] Verify complete
2013-05-11 10:58:37, Info CSI 0000021a [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:37, Info CSI 0000021b [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:43, Info CSI 0000021d [SR] Verify complete
2013-05-11 10:58:44, Info CSI 0000021e [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:44, Info CSI 0000021f [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:48, Info CSI 00000223 [SR] Verify complete
2013-05-11 10:58:48, Info CSI 00000224 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:48, Info CSI 00000225 [SR] Beginning Verify and Repair transaction
2013-05-11 10:58:55, Info CSI 0000022b [SR] Verify complete
2013-05-11 10:58:55, Info CSI 0000022c [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:58:55, Info CSI 0000022d [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:05, Info CSI 0000024e [SR] Verify complete
2013-05-11 10:59:05, Info CSI 0000024f [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:05, Info CSI 00000250 [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:13, Info CSI 00000252 [SR] Verify complete
2013-05-11 10:59:13, Info CSI 00000253 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:13, Info CSI 00000254 [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:18, Info CSI 00000256 [SR] Verify complete
2013-05-11 10:59:19, Info CSI 00000257 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:19, Info CSI 00000258 [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:25, Info CSI 00000266 [SR] Verify complete
2013-05-11 10:59:25, Info CSI 00000267 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:25, Info CSI 00000268 [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:37, Info CSI 0000026a [SR] Verify complete
2013-05-11 10:59:37, Info CSI 0000026b [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:37, Info CSI 0000026c [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:46, Info CSI 0000027a [SR] Verify complete
2013-05-11 10:59:47, Info CSI 0000027b [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:47, Info CSI 0000027c [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:52, Info CSI 0000027e [SR] Verify complete
2013-05-11 10:59:52, Info CSI 0000027f [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:52, Info CSI 00000280 [SR] Beginning Verify and Repair transaction
2013-05-11 10:59:55, Info CSI 00000282 [SR] Verify complete
2013-05-11 10:59:56, Info CSI 00000283 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 10:59:56, Info CSI 00000284 [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:00, Info CSI 00000286 [SR] Verify complete
2013-05-11 11:00:00, Info CSI 00000287 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:00, Info CSI 00000288 [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:07, Info CSI 0000028b [SR] Verify complete
2013-05-11 11:00:08, Info CSI 0000028c [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:08, Info CSI 0000028d [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:13, Info CSI 0000028f [SR] Verify complete
2013-05-11 11:00:13, Info CSI 00000290 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:13, Info CSI 00000291 [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:15, Info CSI 00000293 [SR] Verify complete
2013-05-11 11:00:15, Info CSI 00000294 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:15, Info CSI 00000295 [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:22, Info CSI 00000297 [SR] Verify complete
2013-05-11 11:00:22, Info CSI 00000298 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:22, Info CSI 00000299 [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:28, Info CSI 0000029b [SR] Verify complete
2013-05-11 11:00:29, Info CSI 0000029c [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:29, Info CSI 0000029d [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:38, Info CSI 000002af [SR] Verify complete
2013-05-11 11:00:38, Info CSI 000002b0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:38, Info CSI 000002b1 [SR] Beginning Verify and Repair transaction
2013-05-11 11:00:45, Info CSI 000002bb [SR] Verify complete
2013-05-11 11:00:46, Info CSI 000002bc [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:00:46, Info CSI 000002bd [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:08, Info CSI 000002bf [SR] Verify complete
2013-05-11 11:01:09, Info CSI 000002c0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:09, Info CSI 000002c1 [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:16, Info CSI 000002c3 [SR] Verify complete
2013-05-11 11:01:17, Info CSI 000002c4 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:17, Info CSI 000002c5 [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:21, Info CSI 000002c9 [SR] Verify complete
2013-05-11 11:01:22, Info CSI 000002ca [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:22, Info CSI 000002cb [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:26, Info CSI 000002cd [SR] Verify complete
2013-05-11 11:01:26, Info CSI 000002ce [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:26, Info CSI 000002cf [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:31, Info CSI 000002d1 [SR] Verify complete
2013-05-11 11:01:32, Info CSI 000002d2 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:32, Info CSI 000002d3 [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:38, Info CSI 000002d5 [SR] Verify complete
2013-05-11 11:01:39, Info CSI 000002d6 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:39, Info CSI 000002d7 [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:46, Info CSI 000002da [SR] Verify complete
2013-05-11 11:01:47, Info CSI 000002db [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:47, Info CSI 000002dc [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:51, Info CSI 000002de [SR] Verify complete
2013-05-11 11:01:51, Info CSI 000002df [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:51, Info CSI 000002e0 [SR] Beginning Verify and Repair transaction
2013-05-11 11:01:57, Info CSI 000002e2 [SR] Verify complete
2013-05-11 11:01:58, Info CSI 000002e3 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:01:58, Info CSI 000002e4 [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:04, Info CSI 000002e6 [SR] Verify complete
2013-05-11 11:02:05, Info CSI 000002e7 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:02:05, Info CSI 000002e8 [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:14, Info CSI 000002eb [SR] Verify complete
2013-05-11 11:02:15, Info CSI 000002ec [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:02:15, Info CSI 000002ed [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:21, Info CSI 000002ef [SR] Verify complete
2013-05-11 11:02:21, Info CSI 000002f0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:02:21, Info CSI 000002f1 [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:27, Info CSI 000002f3 [SR] Verify complete
2013-05-11 11:02:28, Info CSI 000002f4 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:02:28, Info CSI 000002f5 [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:34, Info CSI 000002f7 [SR] Verify complete
2013-05-11 11:02:34, Info CSI 000002f8 [SR] Verifying 100 (0x0000000000000064) components
2013-05-11 11:02:34, Info CSI 000002f9 [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:42, Info CSI 000002fb [SR] Verify complete
2013-05-11 11:02:42, Info CSI 000002fc [SR] Verifying 26 (0x000000000000001a) components
2013-05-11 11:02:42, Info CSI 000002fd [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:44, Info CSI 000002ff [SR] Verify complete
2013-05-11 11:02:44, Info CSI 00000300 [SR] Repairing 3 components
2013-05-11 11:02:44, Info CSI 00000301 [SR] Beginning Verify and Repair transaction
2013-05-11 11:02:48, Info CSI 00000302 [SR] Repairing corrupted file [ml:520{260},l:74{37}]"\??\C:\Windows\System32\wdi\perftrack"\[l:80{40}]"Microsoft-Windows-IE-HTMLRendering.ptxml" from store
2013-05-11 11:02:49, Info CSI 00000303 [SR] Repairing corrupted file [ml:76{38},l:74{37}]"\??\C:\Windows\SysWOW64\wdi\perftrack"\[l:92{46}]"wow64_Microsoft-Windows-IE-HTMLRendering.ptxml" from store
2013-05-11 11:02:50, Info CSI 00000304 [SR] Repairing corrupted file [ml:76{38},l:74{37}]"\??\C:\Windows\SysWOW64\wdi\perftrack"\[l:38{19}]"wow64_ieframe.ptxml" from store
2013-05-11 11:02:51, Info CSI 00000306 [SR] Repair complete
2013-05-11 11:02:51, Info CSI 00000307 [SR] Committing transaction
2013-05-11 11:02:51, Info CSI 0000030b [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction have been successfully repaired
2013-05-12 19:20:55, Info CSI 00000009 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:20:55, Info CSI 0000000a [SR] Beginning Verify and Repair transaction
2013-05-12 19:20:57, Info CSI 0000000c [SR] Verify complete
2013-05-12 19:20:58, Info CSI 0000000d [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:20:58, Info CSI 0000000e [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:00, Info CSI 00000010 [SR] Verify complete
2013-05-12 19:21:01, Info CSI 00000011 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:01, Info CSI 00000012 [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:02, Info CSI 00000014 [SR] Verify complete
2013-05-12 19:21:03, Info CSI 00000015 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:03, Info CSI 00000016 [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:05, Info CSI 00000018 [SR] Verify complete
2013-05-12 19:21:05, Info CSI 00000019 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:05, Info CSI 0000001a [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:08, Info CSI 0000001c [SR] Verify complete
2013-05-12 19:21:08, Info CSI 0000001d [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:08, Info CSI 0000001e [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:12, Info CSI 00000020 [SR] Verify complete
2013-05-12 19:21:13, Info CSI 00000021 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:13, Info CSI 00000022 [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:15, Info CSI 00000024 [SR] Verify complete
2013-05-12 19:21:16, Info CSI 00000025 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:16, Info CSI 00000026 [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:18, Info CSI 00000028 [SR] Verify complete
2013-05-12 19:21:19, Info CSI 00000029 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:19, Info CSI 0000002a [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:21, Info CSI 0000002c [SR] Verify complete
2013-05-12 19:21:22, Info CSI 0000002d [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:22, Info CSI 0000002e [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:26, Info CSI 00000030 [SR] Verify complete
2013-05-12 19:21:26, Info CSI 00000031 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:26, Info CSI 00000032 [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:29, Info CSI 00000034 [SR] Verify complete
2013-05-12 19:21:29, Info CSI 00000035 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:29, Info CSI 00000036 [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:32, Info CSI 00000038 [SR] Verify complete
2013-05-12 19:21:32, Info CSI 00000039 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:32, Info CSI 0000003a [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:39, Info  CSI 0000003d [SR] Verify complete
2013-05-12 19:21:39, Info CSI 0000003e [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:39, Info CSI 0000003f [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:46, Info CSI 00000044 [SR] Verify complete
2013-05-12 19:21:46, Info CSI 00000045 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:46, Info CSI 00000046 [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:51, Info CSI 00000048 [SR] Verify complete
2013-05-12 19:21:51, Info CSI 00000049 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:51, Info CSI 0000004a [SR] Beginning Verify and Repair transaction
2013-05-12 19:21:56, Info CSI 0000004d [SR] Verify complete
2013-05-12 19:21:56, Info CSI 0000004e [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:21:56, Info CSI 0000004f [SR] Beginning Verify and Repair transaction
2013-05-12 19:22:04, Info CSI 0000005a [SR] Verify complete
2013-05-12 19:22:04, Info CSI 0000005b [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:22:04, Info CSI 0000005c [SR] Beginning Verify and Repair transaction
2013-05-12 19:22:14, Info CSI 00000078 [SR] Verify complete
2013-05-12 19:22:15, Info CSI 00000079 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:22:15, Info CSI 0000007a [SR] Beginning Verify and Repair transaction
2013-05-12 19:22:22, Info CSI 0000007c [SR] Verify complete
2013-05-12 19:22:22, Info CSI 0000007d [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:22:22, Info CSI 0000007e [SR] Beginning Verify and Repair transaction
2013-05-12 19:22:28, Info CSI 00000080 [SR] Verify complete
2013-05-12 19:22:28, Info CSI 00000081 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:22:28, Info CSI 00000082 [SR] Beginning Verify and Repair transaction
2013-05-12 19:22:34, Info CSI 00000084 [SR] Verify complete
2013-05-12 19:22:34, Info CSI 00000085 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:22:34, Info CSI 00000086 [SR] Beginning Verify and Repair transaction
2013-05-12 19:22:39, Info CSI 00000088 [SR] Verify complete
2013-05-12 19:22:39, Info CSI 00000089 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:22:39, Info CSI 0000008a [SR] Beginning Verify and Repair transaction
2013-05-12 19:22:50, Info CSI 0000008e [SR] Verify complete
2013-05-12 19:22:50, Info CSI 0000008f [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:22:50, Info CSI 00000090 [SR] Beginning Verify and Repair transaction
2013-05-12 19:23:01, Info CSI 000000b1 [SR] Verify complete
2013-05-12 19:23:02, Info CSI 000000b2 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:23:02, Info CSI 000000b3 [SR] Beginning Verify and Repair transaction
2013-05-12 19:23:17, Info CSI 000000b5 [SR] Verify complete
2013-05-12 19:23:17, Info CSI 000000b6 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:23:17, Info CSI 000000b7 [SR] Beginning Verify and Repair transaction
2013-05-12 19:23:32, Info CSI 000000bb [SR] Verify complete
2013-05-12 19:23:32, Info CSI 000000bc [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:23:32, Info CSI 000000bd [SR] Beginning Verify and Repair transaction
2013-05-12 19:23:35, Info CSI 000000bf [SR] Verify complete
2013-05-12 19:23:36, Info CSI 000000c0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:23:36, Info CSI 000000c1 [SR] Beginning Verify and Repair transaction
2013-05-12 19:23:38, Info CSI 000000c3 [SR] Verify complete
2013-05-12 19:23:38, Info CSI 000000c4 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:23:38, Info CSI 000000c5 [SR] Beginning Verify and Repair transaction
2013-05-12 19:23:41, Info CSI 000000c7 [SR] Verify complete
2013-05-12 19:23:41, Info CSI 000000c8 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:23:41, Info CSI 000000c9 [SR] Beginning Verify and Repair transaction
2013-05-12 19:23:56, Info CSI 000000dc [SR] Verify complete
2013-05-12 19:23:56, Info CSI 000000dd [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:23:56, Info CSI 000000de [SR] Beginning Verify and Repair transaction
2013-05-12 19:23:59, Info CSI 000000e0 [SR] Verify complete
2013-05-12 19:23:59, Info CSI 000000e1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:23:59, Info CSI 000000e2 [SR] Beginning Verify and Repair transaction
2013-05-12 19:24:01, Info CSI 000000e4 [SR] Verify complete
2013-05-12 19:24:01, Info CSI 000000e5 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:24:01, Info CSI 000000e6 [SR] Beginning Verify and Repair transaction
2013-05-12 19:24:06, Info CSI 000000e8 [SR] Verify complete
2013-05-12 19:24:06, Info CSI 000000e9 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:24:06, Info CSI 000000ea [SR] Beginning Verify and Repair transaction
2013-05-12 19:24:09, Info CSI 000000ec [SR] Verify complete
2013-05-12 19:24:09, Info CSI 000000ed [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:24:09, Info CSI 000000ee [SR] Beginning Verify and Repair transaction
2013-05-12 19:24:15, Info CSI 000000f0 [SR] Verify complete
2013-05-12 19:24:16, Info CSI 000000f1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:24:16, Info CSI 000000f2 [SR] Beginning Verify and Repair transaction
2013-05-12 19:24:24, Info CSI 000000f5 [SR] Verify complete
2013-05-12 19:24:25, Info CSI 000000f6 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:24:25, Info CSI 000000f7 [SR] Beginning Verify and Repair transaction
2013-05-12 19:24:34, Info CSI 000000fa [SR] Verify complete
2013-05-12 19:24:35, Info CSI 000000fb [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:24:35, Info CSI 000000fc [SR] Beginning Verify and Repair transaction
2013-05-12 19:24:38, Info CSI 000000fe [SR] Verify complete
2013-05-12 19:24:39, Info CSI 000000ff [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:24:39, Info CSI 00000100 [SR] Beginning Verify and Repair transaction
2013-05-12 19:24:41, Info CSI 00000102 [SR] Verify complete
2013-05-12 19:24:42, Info  CSI 00000103 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:24:42, Info CSI 00000104 [SR] Beginning Verify and Repair transaction
2013-05-12 19:24:49, Info CSI 00000106 [SR] Verify complete
2013-05-12 19:24:49, Info CSI 00000107 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:24:49, Info CSI 00000108 [SR] Beginning Verify and Repair transaction
2013-05-12 19:24:56, Info CSI 0000010a [SR] Verify complete
2013-05-12 19:24:57, Info CSI 0000010b [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:24:57, Info CSI 0000010c [SR] Beginning Verify and Repair transaction
2013-05-12 19:25:03, Info CSI 0000010e [SR] Verify complete
2013-05-12 19:25:04, Info CSI 0000010f [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:25:04, Info CSI 00000110 [SR] Beginning Verify and Repair transaction
2013-05-12 19:25:21, Info CSI 00000128 [SR] Verify complete
2013-05-12 19:25:21, Info CSI 00000129 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:25:21, Info CSI 0000012a [SR] Beginning Verify and Repair transaction
2013-05-12 19:25:28, Info CSI 0000012c [SR] Verify complete
2013-05-12 19:25:29, Info CSI 0000012d [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:25:29, Info CSI 0000012e [SR] Beginning Verify and Repair transaction
2013-05-12 19:25:50, Info CSI 00000130 [SR] Verify complete
2013-05-12 19:25:50, Info CSI 00000131 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:25:50, Info CSI 00000132 [SR] Beginning Verify and Repair transaction
2013-05-12 19:26:00, Info CSI 00000135 [SR] Verify complete
2013-05-12 19:26:00, Info CSI 00000136 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:26:00, Info CSI 00000137 [SR] Beginning Verify and Repair transaction
2013-05-12 19:26:13, Info CSI 00000139 [SR] Verify complete
2013-05-12 19:26:14, Info CSI 0000013a [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:26:14, Info CSI 0000013b [SR] Beginning Verify and Repair transaction
2013-05-12 19:26:20, Info CSI 0000013d [SR] Verify complete
2013-05-12 19:26:21, Info CSI 0000013e [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:26:21, Info CSI 0000013f [SR] Beginning Verify and Repair transaction
2013-05-12 19:26:27, Info CSI 00000141 [SR] Verify complete
2013-05-12 19:26:28, Info CSI 00000142 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:26:28, Info CSI 00000143 [SR] Beginning Verify and Repair transaction
2013-05-12 19:26:33, Info CSI 00000147 [SR] Verify complete
2013-05-12 19:26:33, Info CSI 00000148 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:26:33, Info CSI 00000149 [SR] Beginning Verify and Repair transaction
2013-05-12 19:26:38, Info CSI 0000014b [SR] Verify complete
2013-05-12 19:26:38, Info CSI 0000014c [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:26:38, Info CSI 0000014d [SR] Beginning Verify and Repair transaction
2013-05-12 19:27:00, Info CSI 0000014f [SR] Verify complete
2013-05-12 19:27:01, Info CSI 00000150 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:27:01, Info CSI 00000151 [SR] Beginning Verify and Repair transaction
2013-05-12 19:27:10, Info CSI 00000154 [SR] Verify complete
2013-05-12 19:27:11, Info CSI 00000155 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:27:11, Info CSI 00000156 [SR] Beginning Verify and Repair transaction
2013-05-12 19:27:18, Info CSI 00000159 [SR] Verify complete
2013-05-12 19:27:19, Info CSI 0000015a [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:27:19, Info CSI 0000015b [SR] Beginning Verify and Repair transaction
2013-05-12 19:27:25, Info CSI 0000015d [SR] Verify complete
2013-05-12 19:27:26, Info CSI 0000015e [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:27:26, Info CSI 0000015f [SR] Beginning Verify and Repair transaction
2013-05-12 19:27:38, Info CSI 00000162 [SR] Verify complete
2013-05-12 19:27:38, Info CSI 00000163 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:27:38, Info CSI 00000164 [SR] Beginning Verify and Repair transaction
2013-05-12 19:27:45, Info CSI 00000166 [SR] Verify complete
2013-05-12 19:27:46, Info CSI 00000167 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:27:46, Info CSI 00000168 [SR] Beginning Verify and Repair transaction
2013-05-12 19:27:52, Info CSI 0000016a [SR] Verify complete
2013-05-12 19:27:52, Info CSI 0000016b [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:27:52, Info CSI 0000016c [SR] Beginning Verify and Repair transaction
2013-05-12 19:28:01, Info CSI 0000016e [SR] Verify complete
2013-05-12 19:28:02, Info CSI 0000016f [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:28:02, Info CSI 00000170 [SR] Beginning Verify and Repair transaction
2013-05-12 19:28:14, Info CSI 00000173 [SR] Verify complete
2013-05-12 19:28:15, Info CSI 00000174 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:28:15, Info CSI 00000175 [SR] Beginning Verify and Repair transaction
2013-05-12 19:28:23, Info CSI 00000177 [SR] Verify complete
2013-05-12 19:28:23, Info CSI 00000178 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:28:23, Info CSI 00000179 [SR] Beginning Verify and Repair transaction
2013-05-12 19:28:31, Info CSI 0000017c [SR] Verify complete
2013-05-12 19:28:31, Info CSI 0000017d [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:28:31, Info CSI 0000017e [SR] Beginning Verify and Repair transaction
2013-05-12 19:28:41, Info CSI 00000181 [SR] Verify complete
2013-05-12 19:28:41, Info CSI 00000182 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:28:41, Info CSI 00000183 [SR] Beginning Verify and Repair transaction
2013-05-12 19:28:46, Info CSI 00000186 [SR] Verify complete
2013-05-12 19:28:47, Info CSI 00000187 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:28:47, Info CSI 00000188 [SR] Beginning Verify and Repair transaction
2013-05-12 19:28:54, Info CSI 0000018a [SR] Verify complete
2013-05-12 19:28:54, Info CSI 0000018b [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:28:54, Info CSI 0000018c [SR] Beginning Verify and Repair transaction
2013-05-12 19:29:00, Info CSI 0000018f [SR] Verify complete
2013-05-12 19:29:00, Info CSI 00000190 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:29:00, Info CSI 00000191 [SR] Beginning Verify and Repair transaction
2013-05-12 19:29:05, Info CSI 00000193 [SR] Verify complete
2013-05-12 19:29:05, Info CSI 00000194 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:29:05, Info CSI 00000195 [SR] Beginning Verify and Repair transaction
2013-05-12 19:29:08, Info CSI 00000197 [SR] Verify complete
2013-05-12 19:29:09, Info CSI 00000198 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:29:09, Info CSI 00000199 [SR] Beginning Verify and Repair transaction
2013-05-12 19:29:12, Info CSI 0000019b [SR] Verify complete
2013-05-12 19:29:12, Info CSI 0000019c [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:29:12, Info CSI 0000019d [SR] Beginning Verify and Repair transaction
2013-05-12 19:29:18, Info CSI 0000019f [SR] Verify complete
2013-05-12 19:29:19, Info CSI 000001a0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:29:19, Info CSI 000001a1 [SR] Beginning Verify and Repair transaction
2013-05-12 19:29:24, Info CSI 000001a3 [SR] Verify complete
2013-05-12 19:29:24, Info CSI 000001a4 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:29:24, Info CSI 000001a5 [SR] Beginning Verify and Repair transaction
2013-05-12 19:29:28, Info CSI 000001a7 [SR] Verify complete
2013-05-12 19:29:28, Info CSI 000001a8 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:29:28, Info CSI 000001a9 [SR] Beginning Verify and Repair transaction
2013-05-12 19:29:34, Info CSI 000001ab [SR] Verify complete
2013-05-12 19:29:34, Info CSI 000001ac [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:29:34, Info CSI 000001ad [SR] Beginning Verify and Repair transaction
2013-05-12 19:29:47, Info CSI 000001af [SR] Verify complete
2013-05-12 19:29:48, Info CSI 000001b0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:29:48, Info CSI 000001b1 [SR] Beginning Verify and Repair transaction
2013-05-12 19:30:02, Info CSI 000001b3 [SR] Verify complete
2013-05-12 19:30:03, Info CSI 000001b4 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:30:03, Info CSI 000001b5 [SR] Beginning Verify and Repair transaction
2013-05-12 19:30:09, Info CSI 000001b7 [SR] Verify complete
2013-05-12 19:30:09, Info CSI 000001b8 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:30:09, Info CSI 000001b9 [SR] Beginning Verify and Repair transaction
2013-05-12 19:30:12, Info CSI 000001bb [SR] Verify complete
2013-05-12 19:30:12, Info CSI 000001bc [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:30:12, Info CSI 000001bd [SR] Beginning Verify and Repair transaction
2013-05-12 19:30:17, Info CSI 000001bf [SR] Verify complete
2013-05-12 19:30:17, Info CSI 000001c0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:30:17, Info CSI 000001c1 [SR] Beginning Verify and Repair transaction
2013-05-12 19:30:25, Info CSI 000001c3 [SR] Verify complete
2013-05-12 19:30:25, Info CSI 000001c4 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:30:25, Info CSI 000001c5 [SR] Beginning Verify and Repair transaction
2013-05-12 19:30:36, Info CSI 000001cd [SR] Verify complete
2013-05-12 19:30:36, Info CSI 000001ce [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:30:36, Info CSI 000001cf [SR] Beginning Verify and Repair transaction
2013-05-12 19:30:42, Info CSI 000001d1 [SR] Verify complete
2013-05-12 19:30:42, Info CSI 000001d2 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:30:42, Info CSI 000001d3 [SR] Beginning Verify and Repair transaction
2013-05-12 19:30:47, Info CSI 000001d5 [SR] Verify complete
2013-05-12 19:30:47, Info CSI 000001d6 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:30:47, Info CSI 000001d7 [SR] Beginning Verify and Repair transaction
2013-05-12 19:30:52, Info CSI 000001d9 [SR] Verify complete
2013-05-12 19:30:52, Info CSI 000001da [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:30:52, Info CSI 000001db [SR] Beginning Verify and Repair transaction
2013-05-12 19:30:59, Info CSI 000001dd [SR] Verify complete
2013-05-12 19:30:59, Info CSI 000001de [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:30:59, Info CSI 000001df [SR] Beginning Verify and Repair transaction
2013-05-12 19:31:06, Info CSI 000001e2 [SR] Verify complete
2013-05-12 19:31:07, Info CSI 000001e3 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:31:07, Info CSI 000001e4 [SR] Beginning Verify and Repair transaction
2013-05-12 19:31:12, Info CSI 000001e6 [SR] Verify complete
2013-05-12 19:31:13, Info CSI 000001e7 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:31:13, Info CSI 000001e8 [SR] Beginning Verify and Repair transaction
2013-05-12 19:31:13, Info CSI 000001ea [SR] Verify complete
2013-05-12 19:31:14, Info CSI 000001eb [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:31:14, Info CSI 000001ec [SR] Beginning Verify and Repair transaction
2013-05-12 19:31:18, Info CSI 000001ee [SR] Verify complete
2013-05-12 19:31:19, Info CSI 000001ef [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:31:19, Info CSI 000001f0 [SR] Beginning Verify and Repair transaction
2013-05-12 19:31:33, Info CSI 000001f5 [SR] Verify complete
2013-05-12 19:31:33, Info CSI 000001f6 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:31:33, Info CSI 000001f7 [SR] Beginning Verify and Repair transaction
2013-05-12 19:31:42, Info CSI 000001fc [SR] Verify complete
2013-05-12 19:31:42, Info CSI 000001fd [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:31:42, Info CSI 000001fe [SR] Beginning Verify and Repair transaction
2013-05-12 19:31:50, Info CSI 00000201 [SR] Verify complete
2013-05-12 19:31:51, Info CSI 00000202 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:31:51, Info CSI 00000203 [SR] Beginning Verify and Repair transaction
2013-05-12 19:31:58, Info CSI 0000020e [SR] Verify complete
2013-05-12 19:31:59, Info CSI 0000020f [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:31:59, Info CSI 00000210 [SR] Beginning Verify and Repair transaction
2013-05-12 19:32:06, Info CSI 00000216 [SR] Verify complete
2013-05-12 19:32:07, Info CSI 00000217 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:32:07, Info CSI 00000218 [SR] Beginning Verify and Repair transaction
2013-05-12 19:32:12, Info CSI 0000021a [SR] Verify complete
2013-05-12 19:32:12, Info CSI 0000021b [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:32:12, Info CSI 0000021c [SR] Beginning Verify and Repair transaction
2013-05-12 19:32:16, Info CSI 00000220 [SR] Verify complete
2013-05-12 19:32:17, Info CSI 00000221 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:32:17, Info CSI 00000222 [SR] Beginning Verify and Repair transaction
2013-05-12 19:32:22, Info CSI 00000228 [SR] Verify complete
2013-05-12 19:32:22, Info CSI 00000229 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:32:22, Info CSI 0000022a [SR] Beginning Verify and Repair transaction
2013-05-12 19:32:31, Info CSI 0000024b [SR] Verify complete
2013-05-12 19:32:32, Info CSI 0000024c [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:32:32, Info CSI 0000024d [SR] Beginning Verify and Repair transaction
2013-05-12 19:32:37, Info CSI 0000024f [SR] Verify complete
2013-05-12 19:32:37, Info CSI 00000250 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:32:37, Info CSI 00000251 [SR] Beginning Verify and Repair transaction
2013-05-12 19:32:41, Info CSI 00000253 [SR] Verify complete
2013-05-12 19:32:42, Info CSI 00000254 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:32:42, Info CSI 00000255 [SR] Beginning Verify and Repair transaction
2013-05-12 19:32:48, Info CSI 00000263 [SR] Verify complete
2013-05-12 19:32:48, Info CSI 00000264 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:32:48, Info CSI 00000265 [SR] Beginning Verify and Repair transaction
2013-05-12 19:32:58, Info CSI 00000267 [SR] Verify complete
2013-05-12 19:32:58, Info CSI 00000268 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:32:58, Info CSI 00000269 [SR] Beginning Verify and Repair transaction
2013-05-12 19:33:08, Info CSI 00000277 [SR] Verify complete
2013-05-12 19:33:08, Info CSI 00000278 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:33:08, Info CSI 00000279 [SR] Beginning Verify and Repair transaction
2013-05-12 19:33:13, Info CSI 0000027b [SR] Verify complete
2013-05-12 19:33:13, Info CSI 0000027c [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:33:13, Info CSI 0000027d [SR] Beginning Verify and Repair transaction
2013-05-12 19:33:16, Info CSI 0000027f [SR] Verify complete
2013-05-12 19:33:17, Info CSI 00000280 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:33:17, Info CSI 00000281 [SR] Beginning Verify and Repair transaction
2013-05-12 19:33:21, Info CSI 00000283 [SR] Verify complete
2013-05-12 19:33:21, Info CSI 00000284 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:33:21, Info CSI 00000285 [SR] Beginning Verify and Repair transaction
2013-05-12 19:33:27, Info CSI 00000288 [SR] Verify complete
2013-05-12 19:33:28, Info CSI 00000289 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:33:28, Info CSI 0000028a [SR] Beginning Verify and Repair transaction
2013-05-12 19:33:33, Info CSI 0000028c [SR] Verify complete
2013-05-12 19:33:34, Info CSI 0000028d [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:33:34, Info CSI 0000028e [SR] Beginning Verify and Repair transaction
2013-05-12 19:33:36, Info CSI 00000290 [SR] Verify complete
2013-05-12 19:33:36, Info CSI 00000291 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:33:36, Info CSI 00000292 [SR] Beginning Verify and Repair transaction
2013-05-12 19:33:43, Info CSI 00000294 [SR] Verify complete
2013-05-12 19:33:43, Info CSI 00000295 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:33:43, Info CSI 00000296 [SR] Beginning Verify and Repair transaction
2013-05-12 19:33:48, Info CSI 00000298 [SR] Verify complete
2013-05-12 19:33:49, Info CSI 00000299 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:33:49, Info CSI 0000029a [SR] Beginning Verify and Repair transaction
2013-05-12 19:33:59, Info CSI 000002ac [SR] Verify complete
2013-05-12 19:33:59, Info CSI 000002ad [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:33:59, Info CSI 000002ae [SR] Beginning Verify and Repair transaction
2013-05-12 19:34:07, Info CSI 000002b8 [SR] Verify complete
2013-05-12 19:34:07, Info CSI 000002b9 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:34:07, Info CSI 000002ba [SR] Beginning Verify and Repair transaction
2013-05-12 19:34:27, Info CSI 000002bc [SR] Verify complete
2013-05-12 19:34:27, Info CSI 000002bd [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:34:27, Info CSI 000002be [SR] Beginning Verify and Repair transaction
2013-05-12 19:34:32, Info CSI 000002c0 [SR] Verify complete
2013-05-12 19:34:32, Info CSI 000002c1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:34:32, Info CSI 000002c2 [SR] Beginning Verify and Repair transaction
2013-05-12 19:34:36, Info CSI 000002c6 [SR] Verify complete
2013-05-12 19:34:36, Info CSI 000002c7 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:34:36, Info CSI 000002c8 [SR] Beginning Verify and Repair transaction
2013-05-12 19:34:40, Info CSI 000002ca [SR] Verify complete
2013-05-12 19:34:40, Info CSI 000002cb [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:34:40, Info CSI 000002cc [SR] Beginning Verify and Repair transaction
2013-05-12 19:34:45, Info CSI 000002ce [SR] Verify complete
2013-05-12 19:34:45, Info CSI 000002cf [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:34:45, Info CSI 000002d0 [SR] Beginning Verify and Repair transaction
2013-05-12 19:34:51, Info CSI 000002d2 [SR] Verify complete
2013-05-12 19:34:52, Info CSI 000002d3 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:34:52, Info CSI 000002d4 [SR] Beginning Verify and Repair transaction
2013-05-12 19:34:57, Info CSI 000002d7 [SR] Verify complete
2013-05-12 19:34:57, Info CSI 000002d8 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:34:57, Info CSI 000002d9 [SR] Beginning Verify and Repair transaction
2013-05-12 19:35:01, Info CSI 000002db [SR] Verify complete
2013-05-12 19:35:01, Info CSI 000002dc [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:35:01, Info CSI 000002dd [SR] Beginning Verify and Repair transaction
2013-05-12 19:35:06, Info CSI 000002df [SR] Verify complete
2013-05-12 19:35:07, Info CSI 000002e0 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:35:07, Info CSI 000002e1 [SR] Beginning Verify and Repair transaction
2013-05-12 19:35:12, Info CSI 000002e3 [SR] Verify complete
2013-05-12 19:35:13, Info CSI 000002e4 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:35:13, Info CSI 000002e5 [SR] Beginning Verify and Repair transaction
2013-05-12 19:35:21, Info CSI 000002e8 [SR] Verify complete
2013-05-12 19:35:21, Info CSI 000002e9 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:35:21, Info CSI 000002ea [SR] Beginning Verify and Repair transaction
2013-05-12 19:35:25, Info CSI 000002ec [SR] Verify complete
2013-05-12 19:35:25, Info CSI 000002ed [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:35:25, Info CSI 000002ee [SR] Beginning Verify and Repair transaction
2013-05-12 19:35:31, Info CSI 000002f0 [SR] Verify complete
2013-05-12 19:35:31, Info CSI 000002f1 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:35:31, Info CSI 000002f2 [SR] Beginning Verify and Repair transaction
2013-05-12 19:35:36, Info CSI 000002f4 [SR] Verify complete
2013-05-12 19:35:36, Info CSI 000002f5 [SR] Verifying 100 (0x0000000000000064) components
2013-05-12 19:35:36, Info CSI 000002f6 [SR] Beginning Verify and Repair transaction
2013-05-12 19:35:42, Info CSI 000002f8 [SR] Verify complete
2013-05-12 19:35:42, Info CSI 000002f9 [SR] Verifying 26 (0x000000000000001a) components
2013-05-12 19:35:42, Info CSI 000002fa [SR] Beginning Verify and Repair transaction
2013-05-12 19:35:43, Info CSI 000002fc [SR] Verify complete
2013-05-12 19:35:43, Info CSI 000002fd [SR] Repairing 0 components
2013-05-12 19:35:43, Info CSI 000002fe [SR] Beginning Verify and Repair transaction
2013-05-12 19:35:43, Info CSI 00000300 [SR] Repair complete


----------



## Mark1956 (May 7, 2011)

Please do another scan with MSE make sure you select Full system scan not Quick and delete the files it found. Tell me if the scan finds anything else.

Then run the system for a while and let me know how well it is performing.


----------



## ste08ball (Apr 12, 2013)

just turned lap top on to find a scan i have never heard of called internet security 2013 pop up and start scanning however it just switched off aswell i have looked in control panel under programs its not there its only created a short cut from what i gather


----------



## Mark1956 (May 7, 2011)

Internet Security 2013 is a rogue program, the files that MSE found are related to it so please follow my earlier post.


----------



## ste08ball (Apr 12, 2013)

scans running action center is telling me that since laptops been switched on windows defender has stopped working 4 times


----------



## ste08ball (Apr 12, 2013)

ran the scan nothing found deleted the file system still little slow


----------



## Mark1956 (May 7, 2011)

Ok, please run RogueKiller and ADWCleaner again and post the new logs.

Please also run DDS again and post the new logs from that.


----------



## ste08ball (Apr 12, 2013)

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Michaella [Admin rights]
Mode : Remove -- Date : 05/13/2013 13:31:50
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 3 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : Internet Security (C:\Users\Michaella\AppData\Roaming\amsecure.exe) [x] -> DELETED
[TASK][SUSP PATH] EPUpdater : C:\Users\MICHAE~1\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe [x] -> DELETED
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> DELETED
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
ÿþ1
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK5076GSX +++++
--- User ---
[MBR] 6a7e11687ca14d7af9f10cfbe8203d17
[BSP] 10156bb398fe4131e44b5c8112c00ded : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 2049 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 4198400 | Size: 474889 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[2]_D_05132013_02d1331.txt >>
RKreport[1]_S_05132013_02d1328.txt ; RKreport[2]_D_05132013_02d1331.txt


----------



## ste08ball (Apr 12, 2013)

# AdwCleaner v2.300 - Logfile created 05/13/2013 at 13:34:54
# Updated 28/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Michaella - WILSON
# Boot Mode : Normal
# Running from : C:\Users\Michaella\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Folder Deleted : C:\Users\MICHAE~1\AppData\Local\Temp\AskSearch
***** [Registry] *****

***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16476
[OK] Registry is clean.
-\\ Mozilla Firefox v15.0 (en-US)
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js
[OK] File is clean.
File : C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\prefs.js
[OK] File is clean.
*************************
AdwCleaner[S10].txt - [1663 octets] - [30/04/2013 13:18:30]
AdwCleaner[S11].txt - [1673 octets] - [30/04/2013 16:42:00]
AdwCleaner[S12].txt - [1997 octets] - [05/05/2013 02:35:37]
AdwCleaner[S13].txt - [1040 octets] - [13/05/2013 13:34:54]
AdwCleaner[S1].txt - [21475 octets] - [14/04/2013 18:03:19]
AdwCleaner[S2].txt - [1182 octets] - [16/04/2013 02:32:01]
AdwCleaner[S3].txt - [5126 octets] - [17/04/2013 16:54:54]
AdwCleaner[S4].txt - [1302 octets] - [20/04/2013 16:55:31]
AdwCleaner[S5].txt - [406 octets] - [28/04/2013 22:01:51]
AdwCleaner[S6].txt - [10143 octets] - [29/04/2013 00:43:36]
AdwCleaner[S7].txt - [1530 octets] - [29/04/2013 01:30:40]
AdwCleaner[S8].txt - [1542 octets] - [29/04/2013 01:38:20]
AdwCleaner[S9].txt - [1602 octets] - [30/04/2013 09:43:47]
########## EOF - C:\AdwCleaner[S13].txt - [1642 octets] ##########


----------



## ste08ball (Apr 12, 2013)

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium 
Boot Device: \Device\HarddiskVolume1
Install Date: 19/04/2012 20:27:48
System Uptime: 13/05/2013 13:36:12 (1 hours ago)
.
Motherboard: FUJITSU | | FJNBB06
Processor: Intel(R) Pentium(R) CPU P6200 @ 2.13GHz | On Board | 917/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 464 GiB total, 307.496 GiB free.
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP130: 28/04/2013 12:59:27 - OTM Restore Point
RP131: 30/04/2013 09:33:23 - OTM Restore Point
RP132: 30/04/2013 16:37:14 - OTM Restore Point
RP133: 01/05/2013 19:12:23 - Windows Update
RP134: 03/05/2013 08:43:39 - ComboFix created restore point
RP135: 04/05/2013 10:58:26 - Installed Java 7 Update 21
RP136: 04/05/2013 13:24:47 - Removed Java 7 Update 21
RP137: 05/05/2013 16:04:55 - Windows Update
RP138: 07/05/2013 09:22:14 - OTM Restore Point
RP139: 09/05/2013 13:03:06 - Windows Update
RP140: 12/05/2013 18:59:25 - Removed Java 7 Update 13
RP141: 13/05/2013 08:55:41 - Windows Update
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9.5.2
Adobe Shockwave Player 11.6
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Backup & Storage v2.3.1.37683
Bluetooth Feature Pack 5.0
Bonjour
Compatibility Pack for the 2007 Office system
CyberLink YouCam
D3DX10
DeskUpdate
Dusk Till Dawn Poker
ESET Online Scanner v3
FixBee Disk Optimizer
FrostWire 5.5.1
Fujitsu Display Manager
Fujitsu Hotkey Utility
Fujitsu MobilityCenter Extension Utility
Fujitsu System Extension Utility
iCloud
Intel(R) Graphics Media Accelerator Driver
Intel(R) Management Engine Components
Internet TV for Windows Media Center
iTunes
Junk Mail filter update
LifeBook Application Panel
Malwarebytes Anti-Malware version 1.75.0.1300
Mesh Runtime
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Office 2010
Microsoft Office Click-to-Run 2010
Microsoft Office Starter 2010 - English
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Mozilla Firefox 15.0 (x86 en-US)
Mozilla Firefox 16.0.2 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
PKR
Plugfree NETWORK
Power Saving Utility
QuickTime
Radialpoint Security Advisor 2.5.19
Realtek High Definition Audio Driver
Realtek USB 2.0 Card Reader
RollerCoaster Tycoon 2
RollerCoaster Tycoon 3
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Spotify
Star Wars Empire at War
swMSM
Synaptics Pointing Device Driver
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
VC80CRTRedist - 8.0.50727.6195
Virgin Media Digital Home Support 2.1.27
Virgin Media Service Manager 4.1.16
Virgin Media Toolbar
Visual Studio 2010 x64 Redistributables
Visual Studio C++ 10.0 Runtime
VLC media player 1.1.11
War of the Ring(tm)
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
ZEN V Series Media Explorer
.
==== Event Viewer Messages From Past Week ========
.
12/05/2013 19:10:58, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D3DCB472-7261-43CE-924B-0704BD730D5F} and APPID {D3DCB472-7261-43CE-924B-0704BD730D5F} to the user Wilson\Michaella SID (S-1-5-21-3295424948-2256899820-3586588129-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
12/05/2013 19:10:58, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {145B4335-FE2A-4927-A040-7C35AD3180EF} and APPID {145B4335-FE2A-4927-A040-7C35AD3180EF} to the user Wilson\Michaella SID (S-1-5-21-3295424948-2256899820-3586588129-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
12/05/2013 02:34:45, Error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanClicker:ASX/Wimad.gen!H&threatid=2147629339 Name: TrojanClicker:ASX/Wimad.gen!H ID: 2147629339 Severity: Severe Category: Trojan Notifier Path: containerfile:_C:\Users\Michaella\FrostWire\Torrent Data\GI Joe Retaliation (2013) R6 XviD-MAXED\GI Joe Retaliation (2013) R6 XviD-MAXED.wmv;file:_C:\Users\Michaella\FrostWire\Torrent Data\GI Joe Retaliation (2013) R6 XviD-MAXED\GI Joe Retaliation (2013) R6 XviD-MAXED.wmv->(ASF_Script_Commands) Detection Origin: Local machine Detection Type: Generic Detection Source: Real-Time Protection User: NT AUTHORITY\SYSTEM Process Name: C:\Program Files (x86)\FrostWire 5\FrostWire.exe Action: Quarantine Action Status: No additional actions required Error Code: 0x80070020 Error description: The process cannot access the file because it is being used by another process. Signature Version: AV: 1.149.1759.0, AS: 1.149.1759.0, NIS: 101.4.0.0 Engine Version: AM: 1.1.9402.0, NIS: 2.1.9402.0
10/05/2013 10:35:42, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
10/05/2013 09:37:14, Error: Schannel [36888] - The following fatal alert was generated: 10. The internal error state is 10.
07/05/2013 09:22:05, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
.
==== End Of File ===========================


----------



## ste08ball (Apr 12, 2013)

DDS (Ver_2012-11-20.01) - NTFS_AMD64 
Internet Explorer: 9.0.8112.16476
Run by Michaella at 13:59:54 on 2013-05-13
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.3893.2442 [GMT 1:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Enabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\SysWOW64\CTsvcCDA.exe
C:\Program Files (x86)\FixBee\FBDefragSrv64.exe
C:\Program Files (x86)\Virgin Media\Digital Home Support\HsdService.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Fujitsu\Plugfree NETWORK\PFNService.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Fujitsu\PSUtility\PSUService.exe
C:\Program Files (x86)\Virgin Media\Service Manager\ServicepointService.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Fujitsu\PSUtility\TrayManager.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\CSR\Bluetooth Feature Pack 5.0\CSRBipPushResponder.exe
C:\Program Files\VirginMedia\V Stuff Backup\Backup & Storage.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Users\Michaella\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe
C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe
C:\Program Files (x86)\Virgin Media\Service Manager\ServiceManager.exe
C:\Program Files (x86)\Virgin Media\Digital Home Support\DHSClient.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
c:\Program Files\Microsoft Security Client\NisSrv.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Fujitsu\Application Panel\BtnHndHkb.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fujitsu\Plugfree NETWORK\PFNetDm.EXE
C:\Program Files\Fujitsu\Plugfree NETWORK\PFNTray.EXE
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
c:\Program Files\Microsoft Security Client\MpCmdRun.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.co.uk/
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: TmIEPlugInBHO Class: {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - 
BHO: TmBpIeBHO Class: {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - 
TB: Virgin Media Toolbar: {AD8AD957-B30E-4842-8253-BFBC5F7440F3} - 
uRun: [CTSyncU.exe] "C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe"
uRun: [Spotify Web Helper] "C:\Users\Michaella\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
mRun: [LoadFUJ02E3] C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe
mRun: [IndicatorUtility] C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
mRun: [UCam_Menu] "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\3.0"
mRun: [DeskUpdateNotifier] "c:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe"
mRun: [ServiceManager.exe] "C:\Program Files (x86)\Virgin Media\Service Manager\ServiceManager.exe" /AUTORUN
mRun: [DHSClient.exe] "C:\Program Files (x86)\Virgin Media\Digital Home Support\DHSClient.exe" /AUTORUN
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
TCP: NameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{BB46C47B-4835-48B9-8018-6A5BADCDB9B5} : DHCPNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{FD5BED68-72EB-4E0A-8CFF-F86355BE6E5D} : DHCPNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{FD5BED68-72EB-4E0A-8CFF-F86355BE6E5D}\15740313 : DHCPNameServer = 158.43.128.1 208.67.222.222 208.67.220.220
TCP: Interfaces\{FD5BED68-72EB-4E0A-8CFF-F86355BE6E5D}\244575966496 : DHCPNameServer = 10.80.64.57 192.168.22.22 192.168.22.23
TCP: Interfaces\{FD5BED68-72EB-4E0A-8CFF-F86355BE6E5D}\2445F40756E6A7F6E656D284 : DHCPNameServer = 10.80.64.57 192.168.22.22 192.168.22.23
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - 
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - 
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - 
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
x64-BHO: TmIEPlugInBHO Class: {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - 
x64-BHO: TmBpIeBHO Class: {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - 
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [PfNet] "C:\Program Files\Fujitsu\Plugfree NETWORK\PfNet.exe" /r
x64-Run: [PSUTility] C:\Program Files\Fujitsu\PSUtility\TrayManager.exe
x64-Run: [FDM7] C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe
x64-Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
x64-Run: [LoadBtnHnd] C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe
x64-Run: [CSRBIP] C:\Program Files\CSR\Bluetooth Feature Pack 5.0\CSRBipPushResponder.exe
x64-Run: [Backup & Storage] "C:\Program Files\VirginMedia\V Stuff Backup\Backup & Storage.exe"
x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
x64-Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - 
x64-Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - 
x64-Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\
FF - prefs.js: browser.search.defaulturl - 
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Virgin Media\Service Manager\nprpspa.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll
FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2013-1-20 230320]
R1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;C:\Windows\System32\drivers\tmlwf.sys [2012-4-20 194640]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]
R2 FBDiskOptimizer;FBDiskOptimizer;C:\Program Files (x86)\FixBee\FBDefragSrv64.exe [2013-4-10 631664]
R2 HsdService;HsdService;C:\Program Files (x86)\Virgin Media\Digital Home Support\HsdService.exe [2012-8-14 1406264]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-4-14 418376]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-4-14 701512]
R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2013-1-20 130008]
R2 PFNService;PFNService;C:\Program Files\Fujitsu\Plugfree NETWORK\PFNService.exe [2010-6-24 330240]
R2 PowerSavingUtilityService;PowerSavingUtilityService;C:\Program Files\Fujitsu\PSUtility\PSUService.exe [2009-7-30 63336]
R2 ServicepointService;ServicepointService;C:\Program Files (x86)\Virgin Media\Service Manager\ServicepointService.exe [2012-7-5 10310968]
R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]
R2 UNS;Intel(R) Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-4-19 2314240]
R2 VFPRadioSupportService;Bluetooth Feature Support;C:\Program Files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [2009-12-24 145840]
R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;C:\Windows\System32\drivers\fuj02e3.sys [2012-4-5 7296]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2011-5-5 56344]
R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2012-4-5 151936]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2012-4-5 244736]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-4-14 25928]
R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-1-27 379360]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-4-5 346144]
R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]
R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]
R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]
R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;C:\Windows\System32\drivers\BVRPMPR5a64.SYS [2012-4-19 35840]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-4-21 1255736]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== File Associations ===============
.
FileExt: .txt: Applications\msreader.exe - HKCR\Unknown\Shell=C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,OpenAs_RunDLL %1 [UserChoice] [default=openas]
.
=============== Created Last 30 ================
.
2013-05-13 12:59:52 76232 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{43C1039D-07A7-4E4A-A6F3-323B48F9A986}\offreg.dll
2013-05-13 07:57:00 9317456 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{43C1039D-07A7-4E4A-A6F3-323B48F9A986}\mpengine.dll
2013-05-11 13:40:37 9317456 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-05-10 12:03:30 -------- d-sh--w- C:\$RECYCLE.BIN
2013-05-07 11:01:23 -------- d-----w- C:\Users\Michaella\AppData\Local\Macromedia
2013-05-06 12:21:35 -------- d-----w- C:\Program Files (x86)\ESET
2013-05-04 12:28:21 81920 ----a-w- C:\Windows\eSellerateControl350.dll
2013-05-04 12:28:21 356352 ----a-w- C:\Windows\eSellerateEngine.dll
2013-05-04 12:28:21 274432 ----a-w- C:\Windows\SysWow64\ssleay32.dll
2013-05-04 12:28:21 1122304 ----a-w- C:\Windows\SysWow64\libeay32.dll
2013-05-04 09:59:41 -------- d-----w- C:\Users\Michaella\Incomplete
2013-05-04 09:55:47 -------- d-----w- C:\Users\Michaella\Shared
2013-05-04 09:55:47 -------- d-----w- C:\Users\Michaella\AppData\Roaming\LimeWire Music
2013-05-04 09:55:47 -------- d-----w- C:\ProgramData\LimeWire Music
2013-05-02 14:01:44 -------- d-----w- C:\Users\Michaella\AppData\Local\{1C01825E-E535-4ED5-96C8-D8D278AE0A96}
2013-05-02 07:07:58 98816 ----a-w- C:\Windows\sed.exe
2013-05-02 07:07:58 256000 ----a-w- C:\Windows\PEV.exe
2013-05-02 07:07:58 208896 ----a-w- C:\Windows\MBR.exe
2013-05-01 00:03:22 -------- d-----w- C:\Users\Michaella\AppData\Local\{875F088D-6027-4C7F-914C-15FC855D103C}
2013-04-29 16:46:29 -------- d-----w- C:\Windows\ERUNT
2013-04-29 16:46:23 -------- d-----w- C:\JRT
2013-04-28 12:02:22 -------- d-----w- C:\Windows\SysWow64\searchplugins
2013-04-28 12:02:22 -------- d-----w- C:\Windows\SysWow64\Extensions
2013-04-28 11:59:19 -------- d-----w- C:\_OTM
2013-04-27 22:23:10 905296 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{65B4CDE1-2AA7-4EB2-A309-4516ABDE28C5}\gapaengine.dll
2013-04-27 22:20:49 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client
2013-04-27 22:20:39 -------- d-----w- C:\Program Files\Microsoft Security Client
2013-04-27 16:57:05 76232 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\offreg.dll
2013-04-26 13:48:53 -------- d-----w- C:\_OTL
2013-04-26 13:29:57 -------- d-----w- C:\Users\Michaella\AppData\Local\Spotify
2013-04-26 13:29:38 -------- d-----w- C:\Users\Michaella\AppData\Roaming\Spotify
2013-04-26 11:19:55 -------- d-----w- C:\Users\Michaella\AppData\Roaming\BitTorrent
2013-04-26 09:28:50 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2013-04-26 09:28:50 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2013-04-26 09:28:50 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-04-26 09:28:50 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-04-26 09:28:49 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-04-26 09:28:49 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-04-26 09:28:49 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-04-26 07:53:10 9317456 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F8A69417-6B6D-4445-A10C-CF8E59075762}\mpengine.dll
2013-04-25 09:49:20 33240 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys
2013-04-25 09:48:51 -------- d-----w- C:\Program Files\iPod
2013-04-25 09:48:50 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-04-25 09:48:50 -------- d-----w- C:\Program Files\iTunes
2013-04-25 09:48:50 -------- d-----w- C:\Program Files (x86)\iTunes
2013-04-25 09:46:42 -------- d-----w- C:\Program Files\Bonjour
2013-04-25 09:46:42 -------- d-----w- C:\Program Files (x86)\Bonjour
2013-04-24 07:32:15 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys
2013-04-19 14:06:29 9317456 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2013-04-17 12:51:20 -------- d-----w- C:\Users\Michaella\AppData\Roaming\{90140011-0066-0409-0000-0000000FF1CE}
2013-04-17 12:51:07 -------- d-----w- C:\ProgramData\Virtualized Applications
2013-04-14 17:03:28 2399 ----a-w- C:\Windows\DeleteOnReboot.bat
2013-04-14 12:30:28 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
.
==================== Find3M ====================
.
2013-05-04 09:58:57 866720 ----a-w- C:\Windows\SysWow64\npdeployJava1.dll
2013-05-04 09:58:57 788896 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2013-05-02 15:29:56 278800 ------w- C:\Windows\System32\MpSigStub.exe
2013-04-05 12:21:51 693976 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-04-05 12:21:50 73432 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-03-19 06:04:06 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe
2013-03-19 05:46:56 43520 ----a-w- C:\Windows\System32\csrsrv.dll
2013-03-19 05:04:13 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04:10 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47:50 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll
2013-03-19 03:06:33 112640 ----a-w- C:\Windows\System32\smss.exe
2013-03-01 03:36:04 3153408 ----a-w- C:\Windows\System32\win32k.sys
2013-02-22 06:27:49 2312704 ----a-w- C:\Windows\System32\jscript9.dll
2013-02-22 06:20:51 1392128 ----a-w- C:\Windows\System32\wininet.dll
2013-02-22 06:19:37 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
2013-02-22 06:15:48 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
2013-02-22 06:15:23 599040 ----a-w- C:\Windows\System32\vbscript.dll
2013-02-22 06:12:41 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2013-02-22 03:46:00 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-02-22 03:38:00 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-02-22 03:37:50 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2013-02-22 03:34:17 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2013-02-22 03:34:03 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll
2013-02-22 03:31:46 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2013-02-15 06:08:40 44032 ----a-w- C:\Windows\System32\tsgqec.dll
2013-02-15 06:06:11 3717632 ----a-w- C:\Windows\System32\mstscax.dll
2013-02-15 06:02:26 158720 ----a-w- C:\Windows\System32\aaclient.dll
2013-02-15 04:37:10 3217408 ----a-w- C:\Windows\SysWow64\mstscax.dll
2013-02-15 04:34:10 131584 ----a-w- C:\Windows\SysWow64\aaclient.dll
2013-02-15 03:25:51 36864 ----a-w- C:\Windows\SysWow64\tsgqec.dll
.
============= FINISH: 14:00:55.01 ===============


----------



## Mark1956 (May 7, 2011)

Way back in post 54 I made this request:



> I also see *Frostwire* which a file sharing program. Downloading files from unknown sources is one of the easiest ways to get your PC infected, I would advise you to remove it, but if you insist on keeping it DO NOT use it again until we are finished.


 You appear to have ignored the request which has put a new infection on your system.


> 12/05/2013 02:34:45, Error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?link...tid=2147629339 Name: TrojanClicker:ASX/Wimad.gen!H ID: 2147629339 Severity: Severe Category: Trojan Notifier Path: containerfile:_C:\Users\Michaella\FrostWire\Torrent Data\GI Joe Retaliation (2013)


If I see any evidence of you using Frostwire or any other Torrent client before we are finished I will have to withdraw my assistance. Please do not run it again.

As the Movie download is infected we will have to remove it.

The ADWCleaner scan found one new item of Adware which it has removed. RogueKiller also found the same infection that MSE should have deleted so we need to run it again. I did not request that you use the Delete button with RogueKiller, please don't use it again unless requested.

Please reboot the system and then run RogueKiller again and post the log it produces.

=====================================================================

There is a driver left over from Trend Micro Internet Security that we need to remove using OTM. I have included the movie file in the script so you need not delete it manually.

Double click *OTM.exe* to start the tool.


*Copy* the text in the code box below to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose *Copy*):



```
:Processes
explorer.exe
:Services
tmlwf
:Files
C:\Windows\System32\drivers\tmlwf.sys
C:\Users\Michaella\FrostWire\Torrent Data\GI Joe Retaliation (2013)
:Commands
[createrestorepoint]
[emptyflash]
[emptytemp]
[resethosts]
[reboot]
```


 Return to OTM, right click in the *"Paste Instructions for Items to be Moved"* window (under the yellow bar) and choose *Paste*.
Click the red *Moveit!* button.
All your desktop icons will disappear as the scan begins. It should complete within a few minutes.
Once complete you may see a box appear asking you to Restart the system to complete the file removal, accept it and it will reboot.
Even if that box does not appear the system should reboot as the command is included in the script.
When the system has come back to the desktop a Notepad document will open, please copy and paste that into your next post.

-- Note: The logs are saved here: C:\_OTM\MovedFiles


----------



## ste08ball (Apr 12, 2013)

i have warned other half and uninstalled frostwire

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Michaella [Admin rights]
Mode : Scan -- Date : 05/13/2013 16:30:42
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 0 ¤¤¤
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
ÿþ1
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK5076GSX +++++
--- User ---
[MBR] 6a7e11687ca14d7af9f10cfbe8203d17
[BSP] 10156bb398fe4131e44b5c8112c00ded : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 2049 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 4198400 | Size: 474889 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[3]_S_05132013_02d1630.txt >>
RKreport[1]_S_05132013_02d1328.txt ; RKreport[2]_D_05132013_02d1331.txt ; RKreport[3]_S_05132013_02d1630.txt


----------



## ste08ball (Apr 12, 2013)

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
Service tmlwf stopped successfully!
Service tmlwf deleted successfully!
========== FILES ==========
File/Folder C:\Windows\System32\drivers\tmlwf.sys not found.
File/Folder C:\Users\Michaella\FrostWire\Torrent Data\GI Joe Retaliation (2013) not found.
========== COMMANDS ==========
Restore point Set: OTM Restore Point

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Journal

User: Mcx1-WILSON
->Flash cache emptied: 0 bytes

User: Michaella
->Flash cache emptied: 80812 bytes

User: Public

User: RegBack

User: systemprofile

User: TxR

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Journal
->Temp folder emptied: 0 bytes

User: Mcx1-WILSON
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1004028 bytes
->Flash cache emptied: 0 bytes

User: Michaella
->Temp folder emptied: 15813007 bytes
->Temporary Internet Files folder emptied: 332047685 bytes
->Java cache emptied: 875771 bytes
->FireFox cache emptied: 305895155 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: RegBack
->Temp folder emptied: 0 bytes

User: systemprofile
->Temp folder emptied: 0 bytes

User: TxR
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 75364 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 873242 bytes

Total Files Cleaned = 626.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTM by OldTimer - Version 3.1.21.0 log created on 05132013_163351
Files moved on Reboot...
C:\Users\Mcx1-WILSON\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TCARXWJH\getmdrcdCAXMO2KJ.xml moved successfully.
C:\Users\Michaella\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
Registry entries deleted on Reboot...

hope i havent missed anything


----------



## Mark1956 (May 7, 2011)

That is all good and the RogueKiller log is now clean. Is the system running any better?


----------



## ste08ball (Apr 12, 2013)

yes


----------



## Mark1956 (May 7, 2011)

Are there any remaining issues?


----------



## ste08ball (Apr 12, 2013)

fix bee is still on the system and wont delete thats the optimisation tool


----------



## Mark1956 (May 7, 2011)

Ok, we will have to do a search for related files.

Run SystemLook and copy this script into the window and click on Look.


```
:filefind
*fixbee*
:folderfind
*fixbee*
:regfind
fixbee
```


----------



## ste08ball (Apr 12, 2013)

SystemLook 30.07.11 by jpshortstuff
Log created at 10:47 on 14/05/2013 by Michaella
Administrator - Elevation successful
========== filefind ==========
Searching for "*fixbee*"
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FixBee Disk Optimizer\FixBee Disk Optimizer.lnk --a---- 2039 bytes [22:58 10/04/2013] [08:33 16/04/2013] 06B28A5EDE22A30EACE5A52570B03277
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FixBee Disk Optimizer\Uninstall FixBee Disk Optimizer.lnk --a---- 979 bytes [22:58 10/04/2013] [08:33 16/04/2013] D5A71DAB226A05EA8B1A96D133230262
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\FixBee Disk Optimizer\FixBee Disk Optimizer.lnk --a---- 2039 bytes [22:58 10/04/2013] [08:33 16/04/2013] 06B28A5EDE22A30EACE5A52570B03277
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\FixBee Disk Optimizer\Uninstall FixBee Disk Optimizer.lnk --a---- 979 bytes [22:58 10/04/2013] [08:33 16/04/2013] D5A71DAB226A05EA8B1A96D133230262
C:\Users\Michaella\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\FixBee Disk Optimizer.lnk --a---- 961 bytes [22:58 10/04/2013] [08:33 16/04/2013] 060C5C1596F3F12700F34EA950C5654F
========== folderfind ==========
Searching for "*fixbee*"
C:\Program Files (x86)\FixBee d------ [22:58 10/04/2013]
C:\ProgramData\FixBee d------ [22:59 10/04/2013]
C:\ProgramData\FixBee\FBDO\FixBee Disk Optimizer d------ [08:33 16/04/2013]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FixBee Disk Optimizer d------ [22:58 10/04/2013]
C:\Users\All Users\FixBee d------ [22:59 10/04/2013]
C:\Users\All Users\FixBee\FBDO\FixBee Disk Optimizer d------ [08:33 16/04/2013]
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\FixBee Disk Optimizer d------ [22:58 10/04/2013]
C:\Users\Michaella\AppData\LocalLow\fixbeetoolbargaw d------ [08:33 16/04/2013]
C:\Users\Michaella\AppData\Roaming\FixBee d------ [22:59 10/04/2013]
C:\Users\Michaella\AppData\Roaming\FixBee\FBDO\FixBee Disk Optimizer d------ [08:33 16/04/2013]
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\fixbeetoolbargaw d------ [08:33 16/04/2013]
========== regfind ==========
Searching for "fixbee"
[HKEY_CURRENT_USER\Software\FIXBEE]
[HKEY_CURRENT_USER\Software\FIXBEE\FBDO]
"InstalledPath"="C:\Program Files (x86)\FixBee"
[HKEY_CURRENT_USER\Software\FIXBEE\FBDO\FixBee Disk Optimizer]
[HKEY_CURRENT_USER\Software\FIXBEE\FBDO\FixBee Disk Optimizer\Disk Optimizer - FixBee Disk Optimizer]
[HKEY_CURRENT_USER\Software\FIXBEE\FBDO\FixBee Disk Optimizer\IgnoreList]
"*fixbee disk optimizer*"=""
[HKEY_CURRENT_USER\Software\fixbeetoolbargaw]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\FIXBEE]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FixBeeV1_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FixBeeV1_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1]
"Inno Setup: App Path"="C:\Program Files (x86)\FixBee"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1]
"InstallLocation"="C:\Program Files (x86)\FixBee\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1]
"Inno Setup: Icon Group"="FixBee Disk Optimizer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1]
"DisplayName"="FixBee Disk Optimizer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1]
"DisplayIcon"="C:\Program Files (x86)\FixBee\FBDO.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1]
"UninstallString"="C:\Program Files (x86)\FixBee\uninstall.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1]
"QuietUninstallString"=""C:\Program Files (x86)\FixBee\unins001.exe" /SILENT"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1]
"Publisher"="FixBee"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1]
"URLInfoAbout"="http://www.FixBee.com/"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1]
"HelpLink"="http://www.FixBee.com/"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1]
"URLUpdateInfo"="http://www.FixBee.com/"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FBDiskOptimizer]
"ImagePath"="C:\Program Files (x86)\FixBee\FBDefragSrv64.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\FBDiskOptimizer]
"ImagePath"="C:\Program Files (x86)\FixBee\FBDefragSrv64.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FBDiskOptimizer]
"ImagePath"="C:\Program Files (x86)\FixBee\FBDefragSrv64.exe"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\FIXBEE]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\FIXBEE\FBDO]
"InstalledPath"="C:\Program Files (x86)\FixBee"
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\FIXBEE\FBDO\FixBee Disk Optimizer]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\FIXBEE\FBDO\FixBee Disk Optimizer\Disk Optimizer - FixBee Disk Optimizer]
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\FIXBEE\FBDO\FixBee Disk Optimizer\IgnoreList]
"*fixbee disk optimizer*"=""
[HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\fixbeetoolbargaw]
-= EOF =-


----------



## Mark1956 (May 7, 2011)

Double click *OTM.exe* to start the tool.


*Copy* the text in the code box below to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose *Copy*):


```
:Processes
explorer.exe
:Services
FBDiskOptimizer
:Files
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FixBee Disk Optimizer
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\FixBee Disk Optimizer
C:\Users\Michaella\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\FixBee Disk Optimizer.lnk
C:\Program Files (x86)\FixBee
C:\ProgramData\FixBee
C:\Users\All Users\FixBee
C:\Users\Michaella\AppData\LocalLow\fixbeetoolbargaw
C:\Users\Michaella\AppData\Roaming\FixBee
C:\Users\Michaella\AppData\Roaming\FixBee\FBDO\FixBee Disk Optimizer
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\fixbeetoolbargaw
:Reg
[-HKEY_CURRENT_USER\Software\FIXBEE]
[-HKEY_CURRENT_USER\Software\fixbeetoolbargaw]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\FIXBEE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FixBeeV1_RASAPI32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FixBeeV1_RASMANCS]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FBDiskOptimizer]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\FBDiskOptimizer]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FBDiskOptimizer]
[-HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\FIXBEE]
[-HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\fixbeetoolbargaw]
:Commands
[createrestorepoint]
[emptyflash]
[emptytemp]
[resethosts]
[reboot]
```

 Return to OTM, right click in the *"Paste Instructions for Items to be Moved"* window (under the yellow bar) and choose *Paste*.
Click the red *Moveit!* button.
All your desktop icons will disappear as the scan begins. It should complete within a few minutes.
Once complete you may see a box appear asking you to Restart the system to complete the file removal, accept it and it will reboot.
Even if that box does not appear the system should reboot as the command is included in the script.
When the system has come back to the desktop a Notepad document will open, please copy and paste that into your next post.

-- Note: The logs are saved here: C:\_OTM\MovedFiles


----------



## Mark1956 (May 7, 2011)

Once you have completed the above instructions post the log and run the PC for a while, let me know if there are any other issues.


----------



## ste08ball (Apr 12, 2013)

i hope this is the right one im posting

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
Service FBDiskOptimizer stopped successfully!
Service FBDiskOptimizer deleted successfully!
========== FILES ==========
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FixBee Disk Optimizer folder moved successfully.
File/Folder C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\FixBee Disk Optimizer not found.
C:\Users\Michaella\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\FixBee Disk Optimizer.lnk moved successfully.
C:\Program Files (x86)\FixBee\DefragReport folder moved successfully.
C:\Program Files (x86)\FixBee folder moved successfully.
C:\ProgramData\FixBee\FBDO\FixBee Disk Optimizer\DefragReport folder moved successfully.
C:\ProgramData\FixBee\FBDO\FixBee Disk Optimizer folder moved successfully.
C:\ProgramData\FixBee\FBDO folder moved successfully.
C:\ProgramData\FixBee folder moved successfully.
File/Folder C:\Users\All Users\FixBee not found.
C:\Users\Michaella\AppData\LocalLow\fixbeetoolbargaw folder moved successfully.
C:\Users\Michaella\AppData\Roaming\FixBee\FBDO\FixBee Disk Optimizer folder moved successfully.
C:\Users\Michaella\AppData\Roaming\FixBee\FBDO folder moved successfully.
C:\Users\Michaella\AppData\Roaming\FixBee folder moved successfully.
File/Folder C:\Users\Michaella\AppData\Roaming\FixBee\FBDO\FixBee Disk Optimizer not found.
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\fixbeetoolbargaw\weather folder moved successfully.
C:\Users\Michaella\AppData\Roaming\Mozilla\Firefox\Profiles\gkzx4muu.default\fixbeetoolbargaw folder moved successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\Software\FIXBEE\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\fixbeetoolbargaw\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\FIXBEE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FixBeeV1_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\FixBeeV1_RASMANCS\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CA16B670-D9BD-4051-882A-B5AB057F7128}_is1\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FBDiskOptimizer\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\FBDiskOptimizer\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FBDiskOptimizer\ not found.
Registry key HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\FIXBEE\ not found.
Registry key HKEY_USERS\S-1-5-21-3295424948-2256899820-3586588129-1000\Software\fixbeetoolbargaw\ not found.
========== COMMANDS ==========
Restore point Set: OTM Restore Point

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Journal

User: Mcx1-WILSON
->Flash cache emptied: 0 bytes

User: Michaella
->Flash cache emptied: 12436 bytes

User: Public

User: RegBack

User: systemprofile

User: TxR

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Journal
->Temp folder emptied: 0 bytes

User: Mcx1-WILSON
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 240309 bytes
->Flash cache emptied: 0 bytes

User: Michaella
->Temp folder emptied: 5447114 bytes
->Temporary Internet Files folder emptied: 242103090 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 147711153 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: RegBack
->Temp folder emptied: 0 bytes

User: systemprofile
->Temp folder emptied: 0 bytes

User: TxR
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 22968 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 49621 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 377.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTM by OldTimer - Version 3.1.21.0 log created on 05142013_180017
Files moved on Reboot...
C:\Users\Michaella\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
Registry entries deleted on Reboot...


----------



## ste08ball (Apr 12, 2013)

system is running better


----------



## Mark1956 (May 7, 2011)

Ok, I think we can rap this up now and remove all the tools used.

To re-enable your CD Emulation drivers if you disabled them, double click *DeFogger.exe* to run the tool again.


The application window will appear.
Click the *Re-enable* button to re-enable your CD Emulation drivers.
Click *Yes* to continue.
A *'Finished!*' message will appear.
Click *OK*.
DeFogger will now ask to reboot the machine...click *OK*.

To uninstall ComboFix, press the *WINKEY + R* keys on your keyboard or click on Start







and type *Run* into the search box and hit *Enter*.
In the *Run* box type: *ComboFix /Uninstall* (Be sure to leave a space before the forward slash).











Click on *OK*.
If you encounter any problems using the switch from the Run dialog box, just rename ComboFix.exe to *Uninstall.exe*, then double-click on it to remove.
This will delete ComboFix's related folders/files, reset the clock settings, hide file extensions/system files, clear the System Restore cache to prevent possible reinfection and *create a new Restore point.*
When it has finished you will see a dialog box stating that _"ComboFix has been uninstalled". _
After that, you can delete the ComboFix.exe program from your computer (Desktop).

*Next*


Download *OTC* by OldTimer and save it to your *desktop.*
Double click







icon to start the program. 
If you are using Vista or Windows 7, please right-click and choose *Run as Administrator*
Then Click the big







button.
You will get a prompt saying "_Begin Cleanup Process_". Please select *Yes*.
Restart your computer when prompted.

-- Doing this will *remove* any specialized tools downloaded and used. If OTC does not delete itself, then delete the file manually when done.
-- Any leftover folders/files related to ComboFix or other tools which OTC did not remove can be deleted manually (right-click on it and choose delete).

*Please post back when this is complete and let me know if you have had any problems.*


----------



## ste08ball (Apr 12, 2013)

have done whats asked no problems it removed most i just deleted what was left hopeully got everything.
will you still be recomending a better firewall for me to use?


----------



## Mark1956 (May 7, 2011)

Yup, try this one: Comodo Free Firewall Click on the CONTINUE DOWNLOAD button and the download will start. Double click on the downloaded file when complete and it will install.

There is just one more check to do:

Download Security Check by screen317 from Here or Here.
Save it to your Desktop.
Double click SecurityCheck.exe (Vista or Windows 7 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.
A Notepad document should open automatically called checkup.txt; please Copy & Paste the contents of that document into your next reply.


----------



## ste08ball (Apr 12, 2013)

Results of screen317's Security Check version 0.99.63 
Windows 7 Service Pack 1 x64 (UAC is enabled) 
Internet Explorer 9 
*``````````````Antivirus/Firewall Check:``````````````* 
Windows Firewall Disabled! 
Microsoft Security Essentials 
Antivirus up to date! 
*`````````Anti-malware/Other Utilities Check:`````````* 
Malwarebytes Anti-Malware version 1.75.0.1300 
Adobe Flash Player 11.7.700.202 
Adobe Reader 9 *Adobe Reader out of Date!* 
Mozilla Firefox (15.0) 
*````````Process Check: objlist.exe by Laurent````````* 
Microsoft Security Essentials MSMpEng.exe 
Microsoft Security Essentials msseces.exe 
Malwarebytes Anti-Malware mbamservice.exe 
Malwarebytes Anti-Malware mbamgui.exe 
Comodo Firewall cmdagent.exe 
Malwarebytes' Anti-Malware mbamscheduler.exe 
*`````````````````System Health check`````````````````* 
Total Fragmentation on Drive C: 2% 
*````````````````````End of Log``````````````````````*


----------



## Mark1956 (May 7, 2011)

Al you need do is update Adobe Reader and I would also check Firefox. The scan hasn't shown it as out of date but it shows version 15, it should be on version 21.

Follow this guide to update Firefox and set it up for automatic updates. How to update Firefox

*Adobe*
Close any programs you may have running - especially your web browser.
Click on Start







> *Control Panel*, double-click on Programs and Features and uninstall the following Adobe entries:

*Adobe Reader 9*

*NOTE:* For *XP* click on







> *Control Panel*, double-click on *Add or Remove Programs* and continue as above.

Then go to this link Adobe Downloads and select the latest version to download and install. You will see this page below, click on the appropriate button for for the Adobe product that was just removed.










You will now see a page similar to this one:










All four Adobe products, Reader, Flash Player, Air and Shockwave Player are set by default to download the version for *Windows* Operating Systems and for *Internet Explorer* in *English*. If you are using a Macintosh, or you want to use the Adobe product with a different Browser or language you must click on the line (as indicated in the above image) to make further selections to meet your requirements.

As you will see in the above image the Adobe Reader is set for Windows 7, please click (as indicated) if you are using a different version of *Windows* to make further selections. All the other Adobe products are universal and you will only need to change the selection for different Browsers, Languages or for Macintosh.
NOTE: In all the downloads look out for any Add-ons like Google Toolbar, McAfee products, etc. and uncheck the box to exclude them. The above image shows the Google Toolbar being offered but this will change from time to time for other products.

Some additional instructions may appear for XP installations. In all cases save the download to your desktop, then close your browser and double click on the Adobe icon on your desktop to install it. If you have any problems installing, disconnect from the internet and disable your Anti Virus and any other security software, instructions for most AV's, etc. can be found here: How to disable security software.


----------



## ste08ball (Apr 12, 2013)

fire fox is now update you were right very out dated adobe reader updated aswell.


----------



## Mark1956 (May 7, 2011)

Ok, unless there is anything else we are done. I shall now mark this thread as Solved and leave you with some security advice, but please feel free to post back if you have any remaining issues or concerns.

There are many places where you will find security advice, but most are biased towards a particular item of software that they are trying to promote. I have given some unbiased advice below that should help keep you better protected. Unfortunately there is no "best protection", new Malware is being produced every minute of the day so it is a cat & mouse game for all security software vendors to keep up with the latest infections.

It has always been the case that what one Anti Virus program will detect another one will miss and vice versa. That being said, never be tempted to install more than one Anti Virus program thinking that will give you better protection as in fact the reverse is true. Two or more AV programs will (in most cases) conflict with each other, slow your system down and actually reduce your security level. Don't assume that your present Anti Virus is no good on the grounds that you got infected, if I have seen you are using a poor Anti Virus I will have advised you earlier in the thread. There are a lot of nasty infections out there waiting to jump onto a PC and with some of the newest infections there is very little that will block them. Fortunately there are those who dedicate their spare time, for little reward, in making the tools we use here to remove these infections. It is those people that we have to thank as without them a reinstall would often be the only way out.

*Some additional security measures.*
If your present security software does not include a third party Firewall or AntiSpyware.

Go Here for a selection of third party Firewalls.

Go Here or Here for Anti Spyware.

Malwarebytes free version (which you may have used during this thread) is worth having for regular scans of your system, always check for updates before using it. If you can afford the Malwarebytes Pro version it will provide even better protection with a full time active scanner. Never have more than one active anti virus, anti spyware or firewall running on your system as it can cause conflicts and slow down the PC. You can safely run the Pro version of *Malwarebytes* with any Anti Virus software.

WOT (Web OF Trust) Will warn you (in most cases) about dangerous web sites. (This is only available for use with Internet Explorer).

Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Attacks exploiting vulnerable programs and plug-ins are rarely blocked by traditional anti-virus and are therefore increasingly "popular"among criminals.

WinPatrol is a useful facility to have. *WinPatrol* takes snapshots of your critical system resources and alerts you to any changes that may occur without your knowledge. It can also be used to control all your *start up* programs.

Finally, make sure that Windows Update is turned on as many updates are to fix newly discovered security holes in the Windows Operating System. You should also make sure that any Java or Adobe products are kept up to date and any old versions are uninstalled. Never use Registry Cleaners as they can and do damage the systems registry and stay well clear of P2P file sharing sites as these are one of the best places to get your PC infected.


----------



## ste08ball (Apr 12, 2013)

thank you so much for your time and patients with me my laptop is working nicely now.

is there any download sites for films programs ect that are safer to use than frostwire or are they all as bad as one another as my other half likes downloading films. (even tho i think your last post answered this i thought id just ask)


----------



## Mark1956 (May 7, 2011)

You're most welcome.

Frostwire is only the software that allows you to download torrents from other PC's, whatever software you use you are still connecting to unknown sources, regardless of what site you get the torrents from, where there is always a risk of infecting your PC.

The only safe (and legal) way of downloading films, music, etc is to use a site where you have to pay for it.


----------

