# virus n error loading problem



## errorloading (Feb 4, 2011)

The following message keep coming up when I start my computer:
Kp Quicken Function.exe has encounter a problem and needs to close. We are sorry for the inconvenience.

Also the following error message appears:
Errorloading C:\WINDOWS\ojexiyayidad.dll

the specific module could not be found.

there are other unwanted website pops up as well.

Can u help me to fix it.

Thank you


----------



## emeraldnzl (Nov 3, 2007)

Hello errorloading,

Please download Farbar Recovery Scan Tool and save it to your desktop.

*Note*: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.


Double-click to run it. When the tool opens click *Yes* to disclaimer.
Press *Scan* button.
It will make a log (*FRST.txt*) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (*Addition.txt*). Please attach it to your reply.
*Next*

Download *OTL* to your desktop.

Double click on the OTL icon to run it. Make sure all other windows are closed to let it run uninterrupted.
 Click the *None* button at the top.
Under the Custom Scan box paste this in:

```
drivers32
baseservices
drives
%SYSTEMDRIVE%\*.exe
%PROGRAMFILES%\*.exe
%systemdrive%\$Recycle.Bin|@;true;true;true /fp
dir C:\ /S /A:L /C
CREATERESTOREPOINT
```

Click the *Run Scan* button. Do not change any settings unless otherwise told to do so. The scan won't take long.
When the scan completes, it will open two notepad windows. *OTL.Txt* and *Extras.Txt*. These are saved in the same location as OTL.
Please copy *(Edit->Select All, Edit->Copy)* the contents of these files, one at a time, and post it with your next reply.

*So when you return please post

FRST.txt
OTL.txt
Extras.txt
*


----------



## errorloading (Feb 4, 2011)

errorloading said:


> The following message keep coming up when I start my computer:
> Kp Quicken Function.exe has encounter a problem and needs to close. We are sorry for the inconvenience.
> 
> Also the following error message appears:
> ...


Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-05-2013 03
Ran by Vivian (administrator) on 24-05-2013 15:11:07
Running from C:\Documents and Settings\Vivian\My Documents\Downloads
Microsoft Windows XP Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(Funshion) C:\Documents and Settings\Vivian\funshion\funshiontools\FsSvr.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\McciCMService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(Radialpoint SafeCare Inc.) C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe
(Skype Technologies S.A.) C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
() C:\Documents and Settings\All Users\Application Data\BetterSoft\EasylifeGadget Updater\EasylifeGadget Updater.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(VER_COMPANY_NAME) C:\PROGRA~1\MYFUNC~2\bar\1.bin\5mbrmon.exe
(SAMSUNG ELECTRONICS) C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
((?)????) C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(AVG Secure Search) C:\Program Files\AVG SafeGuard toolbar\vprot.exe
(Sta) C:\Program Files\Wuji\197226\WJNews.exe
(Alcatel-Lucent) C:\Program Files\TELUS\McciTrayApp.exe
() C:\Program Files\kuping4\kuping_v4.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Dropbox, Inc.) C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe
(土豆网) C:\Program Files\Tudou\·é?ùTudou\TudouVa.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files\kuping4\KpQuickenFunction.exe
() C:\Program Files\kuping4\KpMini.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicator.exe
() C:\Program Files\kuping4\Kpmini.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Farbar) C:\Documents and Settings\Vivian\My Documents\Downloads\FRST.exe
(Microsoft Corporation) C:\WINDOWS\system32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [947152 2013-01-27] (Microsoft Corporation)
HKLM\...\Run: [MyFunCards Search Scope Monitor] "C:\PROGRA~1\MYFUNC~2\bar\1.bin\5msrchmn.exe" /m=2 /w /h [x]
HKLM\...\Run: [MyFunCards_5m Browser Plugin Loader] C:\PROGRA~1\MYFUNC~2\bar\1.bin\5mbrmon.exe [30096 2012-12-24] (VER_COMPANY_NAME)
HKLM\...\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe [126976 2006-07-21] (SAMSUNG ELECTRONICS)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2010-11-29] (Apple Inc.)
HKLM\...\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe [57344 2006-06-02] ((?)????)
HKLM\...\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [421160 2011-04-14] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [vProt] "C:\Program Files\AVG SafeGuard toolbar\vprot.exe" [1226928 2013-05-21] (AVG Secure Search)
HKLM\...\Run: [WJNews_197226] "C:\Program Files\Wuji\197226\WJNews.exe" -mini [679264 2013-03-13] (Sta)
HKLM\...\Run: [kuping] C:\Program Files\kuping4\kuping_v4.exe /start [1047224 2013-04-24] ()
HKLM\...\Run: [TELUS_McciTrayApp] "C:\Program Files\TELUS\McciTrayApp.exe" [1561088 2012-06-11] (Alcatel-Lucent)
HKLM Group Policy restriction on software: %HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache%OLK* <====== ATTENTION
HKLM\...\Winlogon: [System] 
Winlogon\Notify\!SASWinLogon: C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [X]
Winlogon\Notify\WgaLogon: WgaLogon.dll ()
HKCU\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [152872 2007-06-27] (Nero AG)
HKCU\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2010-03-08] (Google Inc.)
HKCU\...\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem [2215944 2010-10-18] (Sammsoft)
HKCU\...\Run: [SmileboxTray] "C:\Documents and Settings\Vivian\Application Data\Smilebox\SmileboxTray.exe" [x]
HKCU\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18642024 2013-02-28] (Skype Technologies S.A.)
HKCU\...\Run: [HP Photosmart 7520 series (NET)] "C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN2AU294Q705XX:NW" -scfn "HP Photosmart 7520 series (NET)" -AutoStart 1 [1818472 2012-05-08] (Hewlett-Packard Co.)
HKU\Administrator\...\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [x]
HKU\Chung-Yan\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Chung-Yan\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\Default User\...\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe" [x]
HKU\Guest\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Guest\...\Run: [msnmsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\Guest\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\Guest\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
HKU\Guest\...\Run: [Akuhaves] rundll32.exe "C:\WINDOWS\ojexiyayidad.dll",Startup [x]
HKU\Guest\...\Run: [Facebook Update] "C:\Documents and Settings\Guest\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [ 2012-07-11] (Facebook Inc.)
HKU\Karen\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Karen\...\Run: [msnmsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\Karen\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\philso\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\philso\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\philso\...\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\tso\...\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\tso\...\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [ 2008-04-14] (Microsoft Corporation)
HKU\tso\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\tso\...\Run: [Google Update] "C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c [ 2009-10-31] (Google Inc.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\酷屏.lnk
ShortcutTarget: 酷屏.lnk -> C:\Program Files\kuping4\kuping_v4.exe ()
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\???ˉiTudou.lnk
ShortcutTarget: ???ˉiTudou.lnk -> C:\Documents and Settings\Vivian\My Documents\iTudou\iTudou.exe (No File)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\???ˉ·é?ùíá?1.lnk
ShortcutTarget: ???ˉ·é?ùíá?1.lnk -> C:\Program Files\Tudou\·é?ùTudou\TudouVa.exe (土豆网)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\启动iTudou.lnk
ShortcutTarget: 启动iTudou.lnk -> C:\Documents and Settings\Vivian\My Documents\iTudou\iTudou.exe (No File)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\启动飞速土豆.lnk
ShortcutTarget: 启动飞速土豆.lnk -> C:\Program Files\Tudou\·é?ùTudou\TudouVa.exe (No File)
Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\???ˉ·é?ùíá?1.lnk
ShortcutTarget: ???ˉ·é?ùíá?1.lnk -> C:\Program Files\Tudou\·é?ùTudou\TudouVa.exe (土豆网)
Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\启动飞速土豆.lnk
ShortcutTarget: 启动飞速土豆.lnk -> C:\Program Files\Tudou\·é?ùTudou\TudouVa.exe (No File)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.easylifeapp.com/?pid=388&src=ie1&r=2013/05/15&hid=1597798053&lg=EN&cc=CA
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: uTorrentControl_v2 Toolbar - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTo2.dll (Conduit Ltd.)
URLSearchHook: (No Name) - {f4c28532-b9d0-4950-a2df-e83f9929242b} - No File
HKLM SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {01bd49d7-c76b-4310-8beb-14d7e5f322c6} URL = http://search.easylifeapp.com/?q={searchTerms}&pid=388&src=ie2&r=2013/05/15&hid=1597798053&lg=EN&cc=CA
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = 
SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = http://blekko.com/?source=c3348dd4&tbp=rbox&toolbarid=blekkotb&u=2012040396324E599227B38E1C688E02&q={searchTerms}
SearchScopes: HKCU - {4633EF93-D676-472f-A0FF-E1916B0B2E30} URL = http://www.baidu.com/s?tn=utf7_dg&wd={searchTerms}&ie=utf-8
SearchScopes: HKCU - {acbd5593-e5ee-4c15-b48f-1823ce819dec} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?p2=^ZU^fox000^^&ptb=33FED4C0-100D-451D-937D-35B3F3054D17&ind=2013020320&n=77fc40a0&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3220468
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll No File
BHO: Updater For Spam Free Search Bar - {20a0be68-8fd9-4539-8712-ce3d1c1fdfc6} - C:\Program Files\blekkotb\auxi\blekkoAu.dll (Visicom Media)
BHO: Spam Free Search Bar - {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files\blekkotb\blekkoDx.dll ()
BHO: TSToolbarBHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll No File
BHO: uTorrentControl_v2 Toolbar - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTo2.dll (Conduit Ltd.)
BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
BHO: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll No File
BHO: Search Assistant BHO - {c4b22c87-45ef-4f43-89f2-40db2078864e} - C:\Program Files\MyFunCards_5m\bar\1.bin\5mSrcAs.dll (MindSpark)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
BHO: SearchNewTab - {D7A4B15B-3AE6-6E8D-4CA8-F18D61607930} - C:\Documents and Settings\All Users\Application Data\SearchNewTab\5192f0ec9823e.dll ()
BHO: Toolbar BHO - {da71fd14-5f7b-46ae-b8b1-44074a38f331} - C:\PROGRA~1\MYFUNC~2\bar\1.bin\5mbar.dll (MindSpark)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Spam Free Search Bar - {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files\blekkotb\blekkoDx.dll ()
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll" No File
Toolbar: HKLM - uTorrentControl_v2 Toolbar - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTo2.dll (Conduit Ltd.)
Toolbar: HKLM - MyFunCards - {210f1b36-3b7f-41a4-b5da-3eb87f5a56c2} - C:\Program Files\MyFunCards_5m\bar\1.bin\5mbar.dll (MindSpark)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
Toolbar: HKCU -No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKCU -uTorrentControl_v2 Toolbar - {7473B6BD-4691-4744-A82B-7854EB3D70B6} - C:\Program Files\uTorrentControl_v2\prxtbuTo2.dll (Conduit Ltd.)
Toolbar: HKCU -MyFunCards - {210F1B36-3B7F-41A4-B5DA-3EB87F5A56C2} - C:\Program Files\MyFunCards_5m\bar\1.bin\5mbar.dll (MindSpark)
PDF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll No File
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll No File
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll No File
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll No File
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\15.2.0\ViProtocol.dll (AVG Secure Search)
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [77824 2008-05-13] (SuperAdBlocker.com)
Winsock: Catalog5 04 C:\Program Files\Bonjour\mdnsNSP.dll [245248] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 75.153.176.9

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default
FF SearchEngine: Google
FF Homepage: hxxp://www.hotmail.com
FF Keyword.URL: hxxp://search.easylifeapp.com/?pid=388&src=ff2&r=2013/05/15&hid=1597798053&lg=EN&cc=CA&l=1&q=
FF NetworkProxy: "user_pref("capability.principal.codebase.p124.subjectName", "");type", 2
FF NetworkProxy: "autoconfig_url", "http://127.0.0.1:9415/tudouva.pac"
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.2.0\\npsitesafety.dll (AVG Technologies)
FF Plugin: @baidu.com/npxbdsetup - C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @Motive.com/NpMotive,version=1.0 - C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF Plugin: @MyFunCards_5m.com/Plugin - C:\Program Files\MyFunCards_5m\bar\1.bin\NP5mStub.dll (MindSpark)
FF Plugin: @ncity3d.com/NCity3dPlayer - C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
FF Plugin: @radialpoint.com/SPA,version=1 - C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
FF Plugin: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 - C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Виявлення пристро?в Logitech - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\[email protected]
FF Extension: SearchNewTab - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\[email protected]
FF Extension: Latin Dictionary - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\[email protected]
FF Extension: Spam Free Search Bar - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\{00f12770-e60e-4dc6-9105-425bface7c73}
FF Extension: Garmin Communicator - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
FF Extension: Microsoft .NET Framework Assistant - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: uTorrentControl_v2 - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\{7473b6bd-4691-4744-a82b-7854eb3d70b6}
FF Extension: IE Tab - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
FF Extension: 5057cac7115c7 - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\[email protected]
FF Extension: personas - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\[email protected]

Chrome: 
=======
CHR Extension: (HP Product Detection Plugin) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aelbknmfcacjffmgnoaaonhgoghlmlkp\1.0.26.1_0
CHR Extension: (YouTube) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (uTorrentControl_v2) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda\2.3.19.11_0
CHR Extension: (Skype Click to Call) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0
CHR Extension: (Radialpoint SPD Extension) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj\1.0_0
CHR Extension: (SearchNewTab) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mikjhaicomkcabebhnddigcpmagnpiha\1
CHR Extension: (AVG SafeGuard toolbar) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0
CHR Extension: (Gmail) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

========================== Services (Whitelisted) =================

R2 FunshionSvr; C:\Documents and Settings\Vivian\funshion\funshiontools\FunshionSvr.dll [212616 2013-04-25] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
S2 MyFunCards_5mService; C:\PROGRA~1\MYFUNC~2\bar\1.bin\5mbarsvc.exe [42504 2012-12-24] (COMPANYVERS_NAME)
R2 ServicepointService; C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe [10294584 2012-03-09] (Radialpoint SafeCare Inc.)
R2 Skype C2C Service; C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3289208 2013-05-14] (Skype Technologies S.A.)
R2 vToolbarUpdater15.2.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe [1015984 2013-05-21] (AVG Secure Search)
S3 ALG; %SystemRoot%\System32\alg.exe [x]
S2 Amsp;

==================== Drivers (Whitelisted) ====================

R1 AmdK8; C:\Windows\System32\DRIVERS\AmdK8.sys [36864 2006-07-01] (Advanced Micro Devices)
R1 ASPI32; C:\Windows\System32\Drivers\ASPI32.sys [25244 1999-09-10] (Adaptec)
R1 avgtp; C:\WINDOWS\system32\drivers\avgtpx86.sys [37664 2013-05-21] (AVG Technologies)
S3 CCDECODE; C:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)
S3 DrvAgent32; C:\WINDOWS\system32\Drivers\DrvAgent32.sys [23456 2011-02-19] (Phoenix Technologies)
R1 FsVga; C:\Windows\System32\DRIVERS\fsvga.sys [12160 2004-08-04] (Microsoft Corporation)
R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [144384 2008-04-13] (Windows (R) Server 2003 DDK provider)
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2007-03-07] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2007-03-07] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2007-03-07] (HP)
R1 KPProtector; C:\Program Files\kuping4\KPProtector.sys [51864 2013-04-24] ()
R3 LgBttPort; C:\Windows\System32\DRIVERS\lgbtport.sys [12160 2009-09-29] (LG Electronics Inc.)
R3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbus.sys [10496 2009-09-29] (LG Electronics Inc.)
R3 LGVMODEM; C:\Windows\System32\DRIVERS\lgvmodem.sys [12928 2009-09-29] (LG Electronics Inc.)
R3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41888 2007-05-09] (Logitech Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
S3 MREMP50; C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [21248 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [20096 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))
S3 NABTSFEC; C:\Windows\System32\DRIVERS\NABTSFEC.sys [85248 2008-04-14] (Microsoft Corporation)
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
R3 NVENETFD; C:\Windows\System32\DRIVERS\NVENETFD.sys [54016 2008-01-28] (NVIDIA Corporation)
R0 nvgts; C:\Windows\System32\DRIVERS\nvgts.sys [132096 2008-01-25] (NVIDIA Corporation)
R3 nvnetbus; C:\Windows\System32\DRIVERS\nvnetbus.sys [22016 2008-01-28] (NVIDIA Corporation)
R3 PID_PEPI; C:\Windows\System32\DRIVERS\LV302V32.SYS [1276832 2007-05-09] (Logitech Inc.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12872 2010-02-17] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67656 2010-05-10] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SLIP; C:\Windows\System32\DRIVERS\SLIP.sys [11136 2008-04-14] (Microsoft Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-04-21] (Duplex Secure Ltd.)
S3 streamip; C:\Windows\System32\DRIVERS\StreamIP.sys [15232 2008-04-14] (Microsoft Corporation)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2013-03-15] ()
S3 usbbus; C:\Windows\System32\DRIVERS\lgusbbus.sys [13056 2010-01-21] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgusbdiag.sys [20864 2010-01-21] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgusbmodem.sys [24960 2010-01-21] (LG Electronics Inc.)
S3 WSTCODEC; C:\Windows\System32\DRIVERS\WSTCODEC.SYS [19200 2008-04-14] (Microsoft Corporation)
S4 Abiosdsk; No ImagePath
S4 abp480n5; No ImagePath
S4 adpu160m; No ImagePath
S4 Aha154x; No ImagePath
S4 aic78u2; No ImagePath
S4 aic78xx; No ImagePath
S4 AliIde; No ImagePath
S4 amsint; No ImagePath
S4 asc; No ImagePath
S4 asc3350p; No ImagePath
S4 asc3550; No ImagePath
S4 Atdisk; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S4 cd20xrnt; No ImagePath
S1 Changer; No ImagePath
S4 CmdIde; No ImagePath
S4 Cpqarray; No ImagePath
U4 dac2w2k; No ImagePath
S4 dac960nt; No ImagePath
S4 dpti2o; No ImagePath
S3 GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS [x]
S4 hpn; No ImagePath
S1 i2omgmt; No ImagePath
S4 i2omp; No ImagePath
S4 ini910u; No ImagePath
S4 IntelIde; No ImagePath
S2 KAVSafe; \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys [x]
S1 lbrtfdc; No ImagePath
S4 mraid35x; No ImagePath
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [x]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [x]
S1 PCIDump; No ImagePath
S3 PDCOMP; No ImagePath
S3 PDFRAME; No ImagePath
S3 PDRELI; No ImagePath
S3 PDRFRAME; No ImagePath
S3 pepifilter; system32\DRIVERS\lv302af.sys [x]
S4 perc2; No ImagePath
S4 perc2hib; No ImagePath
S3 PID_08A0; system32\DRIVERS\LV302AV.SYS [x]
S4 ql1080; No ImagePath
S4 Ql10wnt; No ImagePath
S4 ql12160; No ImagePath
S4 ql1240; No ImagePath
S4 ql1280; No ImagePath
S4 Simbad; No ImagePath
S4 Sparrow; No ImagePath
S4 symc810; No ImagePath
S4 symc8xx; No ImagePath
S4 sym_hi; No ImagePath
S4 sym_u3; No ImagePath
S4 TosIde; No ImagePath
S4 ultra; No ImagePath
S4 ViaIde; No ImagePath
S3 WDICA; No ImagePath

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-05-24 15:11 - 2013-05-24 15:11 - 00000000 ____D C:\FRST
2013-05-24 07:56 - 2013-05-24 07:58 - 01878604 ____A (Farbar) C:\Documents and Settings\Vivian\Desktop\FRST64.exe
2013-05-23 21:08 - 2013-05-23 21:08 - 00000000 ____D C:\Documents and Settings\pso\Application Data\Motive
2013-05-23 21:02 - 2013-05-23 21:02 - 00000000 ____D C:\Documents and Settings\pso\Application Data\AVG SafeGuard toolbar
2013-05-23 16:32 - 2013-05-23 16:32 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\PriceGong
2013-05-23 16:28 - 2013-05-23 16:28 - 00012994 ____A C:\Windows\KB2510531-IE8.log
2013-05-23 16:14 - 2013-05-23 16:14 - 00001820 ____A C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
2013-05-23 16:13 - 2013-05-23 16:26 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Motive
2013-05-23 16:13 - 2013-05-23 16:18 - 00000000 ____D C:\Program Files\Common Files\Motive
2013-05-23 16:13 - 2013-05-23 16:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Motive
2013-05-23 15:59 - 2013-05-23 15:59 - 00037114 ____A C:\Windows\KB2744842-IE8.log
2013-05-23 15:58 - 2013-05-23 15:59 - 00036950 ____A C:\Windows\KB2618444-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00030243 ____A C:\Windows\KB2598845-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00029602 ____A C:\Windows\KB2467659.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00000000 __HDC C:\Windows\$NtUninstallKB2467659$
2013-05-23 15:57 - 2013-05-23 16:01 - 00007281 ____A C:\Windows\spupdsvc.log
2013-05-23 15:57 - 2013-05-23 15:58 - 00037767 ____A C:\Windows\KB982381-IE8.log
2013-05-23 15:56 - 2013-05-23 15:57 - 00039585 ____A C:\Windows\ie8.log
2013-05-23 15:56 - 2013-05-23 15:57 - 00000000 __HDC C:\Windows\ie8
2013-05-23 15:51 - 2011-08-16 03:45 - 00006144 ____C (Microsoft Corporation) C:\Windows\System32\dllcache\iecompat.dll
2013-05-23 15:50 - 2013-05-23 15:50 - 00003774 ____A C:\Windows\KB951978.log
2013-05-23 15:45 - 2013-05-23 15:59 - 00140674 ____A C:\Windows\ie8_main.log
2013-05-23 15:45 - 2013-05-23 15:46 - 00035668 ____A C:\Windows\ie8Uninst.log
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\TELUS
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\Radialpoint
2013-05-23 14:16 - 2013-05-23 14:16 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\AVG SafeGuard toolbar
2013-05-22 22:06 - 2013-05-22 22:07 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\PriceGong
2013-05-22 22:06 - 2013-05-22 22:07 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\blekkotb
2013-05-22 22:06 - 2013-05-22 22:06 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\Application Data\uTorrentControl_v2
2013-05-22 22:06 - 2013-05-22 22:06 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\Application Data\Conduit
2013-05-22 22:05 - 2013-05-24 08:09 - 00000047 ____A C:\Documents and Settings\NetworkService\FunShion.ini
2013-05-21 18:32 - 2013-05-21 18:32 - 00000000 ____D C:\Documents and Settings\tso\Application Data\AVG SafeGuard toolbar
2013-05-21 10:25 - 2013-05-21 10:25 - 00000000 ____D C:\Windows\System32\cache
2013-05-20 04:26 - 2013-05-22 22:06 - 00000582 ____A C:\Windows\System32\funshion.ini
2013-05-16 13:07 - 2013-05-16 13:07 - 00000000 ____D C:\dbfecd5f7d2e63eac17b4786
2013-05-15 21:48 - 2013-05-23 15:59 - 00121115 ____A C:\Windows\KB2829530-IE8.log
2013-05-15 12:16 - 2013-05-23 16:29 - 00016442 ____A C:\Windows\KB2847204-IE8.log
2013-05-15 12:16 - 2013-05-15 12:17 - 00000000 ____D C:\78415340c7ea0ba5fa
2013-05-15 12:16 - 2013-05-15 12:16 - 00006960 ____A C:\Windows\KB2820197.log
2013-05-15 12:16 - 2013-05-15 12:16 - 00000000 __HDC C:\Windows\$NtUninstallKB2820197$
2013-05-15 12:11 - 2013-05-15 12:11 - 00000000 __HDC C:\Windows\$NtUninstallKB2829361$
2013-05-15 11:08 - 2013-05-15 12:11 - 00010405 ____A C:\Windows\KB2829361.log
2013-05-14 18:38 - 2013-05-24 15:00 - 00000630 ___AH C:\Windows\Tasks\schedule!1822287263.job
2013-05-14 18:38 - 2013-05-15 17:43 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\SearchNewTab
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Program Files\EasyLife
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\StarApp
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\BetterSoft
2013-05-14 18:37 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\InstallMate
2013-05-14 18:01 - 2013-05-14 18:00 - 00090112 ____A C:\Windows\Minidump\Mini051413-01.dmp
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Visan
2013-05-14 15:06 - 2013-05-24 07:25 - 00000492 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-05-14 14:58 - 2001-08-17 13:53 - 00006784 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\serscan.sys
2013-05-14 14:14 - 2013-05-14 15:16 - 00001742 ____A C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
2013-05-14 14:14 - 2013-05-14 14:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
2013-05-14 14:13 - 2013-05-21 14:13 - 00000462 ____A C:\Windows\Tasks\At3.job
2013-05-14 14:13 - 2013-05-21 14:00 - 00000462 ____A C:\Windows\Tasks\At4.job
2013-05-14 14:13 - 2013-05-19 10:10 - 00000462 ____A C:\Windows\Tasks\At1.job
2013-05-14 14:13 - 2013-05-15 20:40 - 00000462 ____A C:\Windows\Tasks\At2.job
2013-05-14 14:13 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Visan
2013-05-14 14:13 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP Photo Creations
2013-05-14 14:13 - 2013-05-14 14:14 - 00000000 ____D C:\Program Files\HP Photo Creations
2013-05-14 14:12 - 2013-05-14 14:12 - 00001993 ____A C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2013-05-14 14:12 - 00000925 ____A C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2012-05-08 17:23 - 02215784 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkinsBC11.exe
2013-05-14 14:12 - 2012-05-08 17:23 - 01961320 ____A (Hewlett-Packard Co.) C:\Windows\System32\HPScanTRDrv_PS7520.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00513384 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkstsBC11.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00495464 ____A (Hewlett-Packard) C:\Windows\System32\HPWia1_PS7520.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00267624 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkstsBC11LM.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00219496 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkcoiBC11.dll
2013-05-14 14:12 - 2012-05-08 14:03 - 00563048 ____N (Hewlett-Packard Co.) C:\Windows\System32\HPDiscoPMBC11.dll
2013-05-14 14:09 - 2013-05-14 14:09 - 00000057 ____A C:\Documents and Settings\All Users\Application Data\Ament.ini
2013-05-13 10:21 - 2013-05-13 10:21 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-05-09 10:41 - 2013-05-23 21:10 - 00000000 ____D C:\Documents and Settings\pso\Application Data\PriceGong
2013-05-06 08:43 - 2013-05-14 13:37 - 00000000 ____D C:\Documents and Settings\pso\Desktop\cari. cruise
2013-05-01 09:27 - 2013-05-24 15:05 - 00000306 ____A C:\Windows\Tasks\FSPlatform1.job
2013-04-24 21:55 - 2013-05-24 07:03 - 00000000 ____D C:\Documents and Settings\tso\Local Settings\Application Data\INISet
2013-04-24 21:45 - 2013-05-23 16:31 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\INISet
2013-04-24 18:26 - 2013-05-23 21:02 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\INISet
2013-04-24 17:17 - 2013-05-24 07:51 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\PriceGong
2013-04-24 17:11 - 2013-05-24 15:01 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\INISet
2013-04-24 17:10 - 2013-05-13 11:07 - 00000000 ____D C:\Program Files\kuping4
2013-04-24 17:10 - 2013-04-25 17:20 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\AIRPLAY
2013-04-24 17:10 - 2013-04-24 17:14 - 00000000 ____D C:\Program Files\Audio_Air
2013-04-24 17:02 - 2013-04-24 17:04 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\360safe
2013-04-24 16:59 - 2013-04-24 16:59 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\360Login
2013-04-24 16:57 - 2013-05-24 15:05 - 00000306 ____A C:\Windows\Tasks\FSPlatform.job
2013-04-24 16:57 - 2013-04-24 16:57 - 00000065 ____A C:\prefs.js
2013-04-24 16:56 - 2013-05-22 22:05 - 00000000 ____D C:\FunshionMedia
2013-04-24 16:56 - 2013-04-24 17:43 - 00000000 ____D C:\Program Files\Baofeng
2013-04-24 16:56 - 2013-04-24 17:16 - 00000000 ____D C:\Documents and Settings\Vivian\funshion
2013-04-24 16:56 - 2013-04-24 16:56 - 00000000 ____D C:\Program Files\Funshion Online
2013-04-24 16:55 - 2013-04-24 17:13 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Baidu
2013-04-24 16:55 - 2013-04-24 16:55 - 00000000 ____D C:\Program Files\baidu
2013-04-24 16:55 - 2013-04-24 16:55 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Baidu
2013-04-24 16:53 - 2013-04-24 16:53 - 00000000 ____D C:\Program Files\Wuji

==================== One Month Modified Files and Folders ========

2013-05-24 15:12 - 2010-03-08 15:18 - 00000880 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-05-24 15:11 - 2013-05-24 15:11 - 00000000 ____D C:\FRST
2013-05-24 15:11 - 2012-08-22 18:02 - 00032584 ____A C:\Windows\SchedLgU.Txt
2013-05-24 15:10 - 2013-02-27 23:29 - 00000384 ___AH C:\Windows\Tasks\Microsoft Antimalware Scheduled Scan.job
2013-05-24 15:08 - 2011-02-07 13:40 - 01831117 ____A C:\Windows\WindowsUpdate.log
2013-05-24 15:05 - 2013-05-01 09:27 - 00000306 ____A C:\Windows\Tasks\FSPlatform1.job
2013-05-24 15:05 - 2013-04-24 16:57 - 00000306 ____A C:\Windows\Tasks\FSPlatform.job
2013-05-24 15:03 - 2012-06-15 00:46 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\Dropbox
2013-05-24 15:03 - 2012-06-15 00:36 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Dropbox
2013-05-24 15:01 - 2013-04-24 17:11 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\INISet
2013-05-24 15:01 - 2010-07-29 05:30 - 00000000 ____D C:\Documents and Settings\Vivian\update
2013-05-24 15:00 - 2013-05-14 18:38 - 00000630 ___AH C:\Windows\Tasks\schedule!1822287263.job
2013-05-24 15:00 - 2012-08-22 18:02 - 00000159 ____A C:\Windows\wiadebug.log
2013-05-24 15:00 - 2012-08-22 18:02 - 00000049 ____A C:\Windows\wiaservc.log
2013-05-24 15:00 - 2010-03-08 15:18 - 00000876 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-05-24 15:00 - 2009-04-21 14:12 - 00000062 __ASH C:\Documents and Settings\Vivian\Local Settings\desktop.ini
2013-05-24 15:00 - 2009-04-21 14:12 - 00000062 __ASH C:\Documents and Settings\LocalService\Local Settings\desktop.ini
2013-05-24 15:00 - 2009-04-21 14:12 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-05-24 15:00 - 2009-04-21 14:11 - 00000062 __ASH C:\Documents and Settings\NetworkService\Local Settings\desktop.ini
2013-05-24 08:15 - 2009-10-31 06:36 - 00000970 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
2013-05-24 08:15 - 2009-04-21 14:12 - 00000278 __SHC C:\Documents and Settings\Vivian\ntuser.ini
2013-05-24 08:09 - 2013-05-22 22:05 - 00000047 ____A C:\Documents and Settings\NetworkService\FunShion.ini
2013-05-24 07:58 - 2013-05-24 07:56 - 01878604 ____A (Farbar) C:\Documents and Settings\Vivian\Desktop\FRST64.exe
2013-05-24 07:51 - 2013-04-24 17:17 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\PriceGong
2013-05-24 07:45 - 2012-07-07 00:29 - 00000536 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-05-24 07:34 - 2009-04-22 14:54 - 00000278 __ASH C:\Documents and Settings\tso\ntuser.ini
2013-05-24 07:25 - 2013-05-14 15:06 - 00000492 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-05-24 07:13 - 2012-08-19 13:01 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Radialpoint
2013-05-24 07:03 - 2013-04-24 21:55 - 00000000 ____D C:\Documents and Settings\tso\Local Settings\Application Data\INISet
2013-05-24 07:03 - 2010-07-29 10:07 - 00000000 ____D C:\Documents and Settings\tso\update
2013-05-24 07:03 - 2009-04-22 15:27 - 00000000 ____D C:\Documents and Settings\tso\Tracing
2013-05-24 07:03 - 2009-04-22 14:54 - 00000062 __ASH C:\Documents and Settings\tso\Local Settings\desktop.ini
2013-05-23 21:41 - 2010-07-29 05:13 - 00000278 _ASHC C:\Documents and Settings\pso\ntuser.ini
2013-05-23 21:10 - 2013-05-09 10:41 - 00000000 ____D C:\Documents and Settings\pso\Application Data\PriceGong
2013-05-23 21:10 - 2013-04-12 11:29 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-05-23 21:09 - 2013-02-25 22:52 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\uTorrentControl_v2
2013-05-23 21:08 - 2013-05-23 21:08 - 00000000 ____D C:\Documents and Settings\pso\Application Data\Motive
2013-05-23 21:02 - 2013-05-23 21:02 - 00000000 ____D C:\Documents and Settings\pso\Application Data\AVG SafeGuard toolbar
2013-05-23 21:02 - 2013-04-24 18:26 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\INISet
2013-05-23 21:02 - 2010-07-29 05:13 - 00000062 __ASH C:\Documents and Settings\pso\Local Settings\desktop.ini
2013-05-23 16:32 - 2013-05-23 16:32 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\PriceGong
2013-05-23 16:32 - 2012-09-23 22:48 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\uTorrentControl_v2
2013-05-23 16:32 - 2010-07-12 19:38 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\Google
2013-05-23 16:31 - 2013-04-24 21:45 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\INISet
2013-05-23 16:30 - 2009-08-31 16:21 - 00000062 __ASH C:\Documents and Settings\Guest\Local Settings\desktop.ini
2013-05-23 16:29 - 2013-05-15 12:16 - 00016442 ____A C:\Windows\KB2847204-IE8.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00232506 ____A C:\Windows\iis6.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00216397 ____A C:\Windows\FaxSetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00103460 ____A C:\Windows\ocgen.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00098699 ____A C:\Windows\tsoc.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00072333 ____A C:\Windows\comsetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00043670 ____A C:\Windows\ntdtcsetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00037905 ____A C:\Windows\netfxocm.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00014875 ____A C:\Windows\MedCtrOC.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00011881 ____A C:\Windows\ocmsn.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00010846 ____A C:\Windows\tabletoc.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00010815 ____A C:\Windows\msgsocm.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00001374 ____A C:\Windows\imsins.log
2013-05-23 16:28 - 2013-05-23 16:28 - 00012994 ____A C:\Windows\KB2510531-IE8.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00066126 ____A C:\Windows\msmqinst.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00049496 ____A C:\Windows\updspapi.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00001374 ____A C:\Windows\imsins.BAK
2013-05-23 16:26 - 2013-05-23 16:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Motive
2013-05-23 16:18 - 2013-05-23 16:13 - 00000000 ____D C:\Program Files\Common Files\Motive
2013-05-23 16:14 - 2013-05-23 16:14 - 00001820 ____A C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
2013-05-23 16:14 - 2013-05-23 16:13 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Motive
2013-05-23 16:14 - 2012-08-19 13:01 - 00000000 ____D C:\Program Files\TELUS
2013-05-23 16:10 - 2012-09-17 18:09 - 00000000 ____D C:\Program Files\uTorrentControl_v2
2013-05-23 16:10 - 2012-09-17 18:09 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\uTorrentControl_v2
2013-05-23 16:01 - 2013-05-23 15:57 - 00007281 ____A C:\Windows\spupdsvc.log
2013-05-23 16:00 - 2009-04-21 06:50 - 00000000 ____D C:\Windows\Help
2013-05-23 15:59 - 2013-05-23 15:59 - 00037114 ____A C:\Windows\KB2744842-IE8.log
2013-05-23 15:59 - 2013-05-23 15:58 - 00036950 ____A C:\Windows\KB2618444-IE8.log
2013-05-23 15:59 - 2013-05-23 15:45 - 00140674 ____A C:\Windows\ie8_main.log
2013-05-23 15:59 - 2013-05-15 21:48 - 00121115 ____A C:\Windows\KB2829530-IE8.log
2013-05-23 15:59 - 2009-04-21 14:28 - 00000000 ___HD C:\Windows\$hf_mig$
2013-05-23 15:58 - 2013-05-23 15:58 - 00030243 ____A C:\Windows\KB2598845-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00029602 ____A C:\Windows\KB2467659.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00000000 __HDC C:\Windows\$NtUninstallKB2467659$
2013-05-23 15:58 - 2013-05-23 15:57 - 00037767 ____A C:\Windows\KB982381-IE8.log
2013-05-23 15:57 - 2013-05-23 15:56 - 00039585 ____A C:\Windows\ie8.log
2013-05-23 15:57 - 2013-05-23 15:56 - 00000000 __HDC C:\Windows\ie8
2013-05-23 15:57 - 2009-04-21 06:50 - 00000000 ____D C:\Windows\Media
2013-05-23 15:50 - 2013-05-23 15:50 - 00003774 ____A C:\Windows\KB951978.log
2013-05-23 15:46 - 2013-05-23 15:45 - 00035668 ____A C:\Windows\ie8Uninst.log
2013-05-23 15:46 - 2009-06-11 23:45 - 00000000 ____D C:\Windows\ie8updates
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\TELUS
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\Radialpoint
2013-05-23 14:53 - 2012-04-30 07:57 - 00000990 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
2013-05-23 14:16 - 2013-05-23 14:16 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\AVG SafeGuard toolbar
2013-05-23 12:51 - 2011-03-14 21:50 - 00000000 ___RD C:\Program Files\Skype
2013-05-23 12:51 - 2009-04-23 20:57 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Skype
2013-05-22 22:07 - 2013-05-22 22:06 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\PriceGong
2013-05-22 22:07 - 2013-05-22 22:06 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\blekkotb
2013-05-22 22:06 - 2013-05-22 22:06 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\Application Data\uTorrentControl_v2
2013-05-22 22:06 - 2013-05-22 22:06 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\Application Data\Conduit
2013-05-22 22:06 - 2013-05-20 04:26 - 00000582 ____A C:\Windows\System32\funshion.ini
2013-05-22 22:05 - 2013-04-24 16:56 - 00000000 ____D C:\FunshionMedia
2013-05-21 18:32 - 2013-05-21 18:32 - 00000000 ____D C:\Documents and Settings\tso\Application Data\AVG SafeGuard toolbar
2013-05-21 14:13 - 2013-05-14 14:13 - 00000462 ____A C:\Windows\Tasks\At3.job
2013-05-21 14:00 - 2013-05-14 14:13 - 00000462 ____A C:\Windows\Tasks\At4.job
2013-05-21 10:25 - 2013-05-21 10:25 - 00000000 ____D C:\Windows\System32\cache
2013-05-21 10:25 - 2013-03-12 13:11 - 00037664 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx86.sys
2013-05-21 10:25 - 2013-03-12 13:11 - 00000000 ____D C:\Program Files\AVG SafeGuard toolbar
2013-05-21 10:25 - 2004-08-04 05:00 - 00013646 ____A C:\Windows\System32\wpa.dbl
2013-05-19 10:15 - 2009-10-31 06:36 - 00000918 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
2013-05-19 10:10 - 2013-05-14 14:13 - 00000462 ____A C:\Windows\Tasks\At1.job
2013-05-19 09:49 - 2009-10-13 00:07 - 00000000 ____D C:\Windows\Microsoft.NET
2013-05-18 17:44 - 2009-04-21 06:57 - 00577100 ___AC C:\Windows\System32\PerfStringBackup.INI
2013-05-16 13:07 - 2013-05-16 13:07 - 00000000 ____D C:\dbfecd5f7d2e63eac17b4786
2013-05-15 20:40 - 2013-05-14 14:13 - 00000462 ____A C:\Windows\Tasks\At2.job
2013-05-15 19:22 - 2010-12-30 13:31 - 00000000 ____D C:\Documents and Settings\pso\Desktop\2013 ALL DOCU old~new
2013-05-15 17:43 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\SearchNewTab
2013-05-15 12:21 - 2009-04-21 06:55 - 02176880 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 12:17 - 2013-05-15 12:16 - 00000000 ____D C:\78415340c7ea0ba5fa
2013-05-15 12:16 - 2013-05-15 12:16 - 00006960 ____A C:\Windows\KB2820197.log
2013-05-15 12:16 - 2013-05-15 12:16 - 00000000 __HDC C:\Windows\$NtUninstallKB2820197$
2013-05-15 12:12 - 2009-04-22 00:28 - 72607752 ___AC (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-15 12:11 - 2013-05-15 12:11 - 00000000 __HDC C:\Windows\$NtUninstallKB2829361$
2013-05-15 12:11 - 2013-05-15 11:08 - 00010405 ____A C:\Windows\KB2829361.log
2013-05-15 11:45 - 2012-07-07 00:29 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-05-15 11:45 - 2011-06-20 00:59 - 00071048 ___AC (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Program Files\EasyLife
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\StarApp
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\BetterSoft
2013-05-14 18:38 - 2013-05-14 18:37 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\InstallMate
2013-05-14 18:00 - 2013-05-14 18:01 - 00090112 ____A C:\Windows\Minidump\Mini051413-01.dmp
2013-05-14 16:11 - 2010-07-29 23:48 - 00023552 ___AC C:\Documents and Settings\pso\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-05-14 16:11 - 2009-04-21 15:08 - 00000069 ___AC C:\Windows\NeroDigital.ini
2013-05-14 15:30 - 2011-01-14 15:18 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\HP
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Visan
2013-05-14 15:16 - 2013-05-14 14:14 - 00001742 ____A C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
2013-05-14 15:16 - 2013-05-14 14:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Visan
2013-05-14 15:16 - 2013-05-14 14:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP Photo Creations
2013-05-14 14:58 - 2013-02-25 18:04 - 00280073 ____A C:\Windows\setupapi.log
2013-05-14 14:14 - 2013-05-14 14:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
2013-05-14 14:14 - 2013-05-14 14:13 - 00000000 ____D C:\Program Files\HP Photo Creations
2013-05-14 14:13 - 2011-03-05 17:24 - 00000000 ____D C:\Program Files\Coupons
2013-05-14 14:12 - 2013-05-14 14:12 - 00001993 ____A C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2013-05-14 14:12 - 00000925 ____A C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2010-06-21 10:52 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\HpUpdate
2013-05-14 14:12 - 2009-04-21 21:33 - 00000000 ____D C:\Program Files\HP
2013-05-14 14:11 - 2009-04-21 21:34 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP
2013-05-14 14:09 - 2013-05-14 14:09 - 00000057 ____A C:\Documents and Settings\All Users\Application Data\Ament.ini
2013-05-14 14:08 - 2009-05-22 00:03 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\HP
2013-05-14 13:37 - 2013-05-06 08:43 - 00000000 ____D C:\Documents and Settings\pso\Desktop\cari. cruise
2013-05-14 09:43 - 2011-07-23 17:53 - 00000000 ____D C:\Documents and Settings\pso\My Documents\pso's RECEIPT
2013-05-13 11:07 - 2013-04-24 17:10 - 00000000 ____D C:\Program Files\kuping4
2013-05-13 10:22 - 2009-04-23 20:58 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Skype
2013-05-13 10:21 - 2013-05-13 10:21 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-05-13 10:13 - 2009-05-26 10:38 - 00000000 ____D C:\Documents and Settings\tso\Application Data\Skype
2013-05-12 21:50 - 2010-09-28 19:14 - 00041472 _ASHC C:\Documents and Settings\pso\My Documents\Thumbs.db
2013-05-12 17:03 - 2010-11-13 13:45 - 00000000 ____D C:\Documents and Settings\pso\Application Data\U3
2013-05-12 10:24 - 2011-02-08 14:37 - 00000000 ____D C:\Documents and Settings\All Users\Documents\Shared Docu
2013-05-12 10:15 - 2009-04-22 14:56 - 00000000 ____D C:\Documents and Settings\tso\Application Data\Mozilla
2013-05-06 21:27 - 2009-03-08 04:41 - 06015488 ____C (Microsoft Corporation) C:\Windows\System32\dllcache\mshtml.dll
2013-05-06 21:27 - 2004-08-04 05:00 - 06015488 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-06 18:29 - 2009-05-02 10:05 - 00076576 ___AC C:\Documents and Settings\tso\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-05-06 09:40 - 2010-02-19 10:46 - 00076576 ___AC C:\Documents and Settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-05-02 08:28 - 2012-08-22 19:10 - 00238872 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2013-04-25 18:32 - 2009-04-22 00:16 - 00076576 ___AC C:\Documents and Settings\Vivian\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-04-25 18:21 - 2010-07-29 22:00 - 00076576 ___AC C:\Documents and Settings\pso\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-04-25 18:16 - 2012-08-25 06:12 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\TomTom
2013-04-25 18:15 - 2011-01-04 00:47 - 00000000 ____D C:\Program Files\Overture 4.0 繁體中文版
2013-04-25 17:20 - 2013-04-24 17:10 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\AIRPLAY
2013-04-24 17:43 - 2013-04-24 16:56 - 00000000 ____D C:\Program Files\Baofeng
2013-04-24 17:16 - 2013-04-24 16:56 - 00000000 ____D C:\Documents and Settings\Vivian\funshion
2013-04-24 17:16 - 2013-03-10 23:58 - 00001829 ____A C:\Documents and Settings\Vivian\funshion.ini
2013-04-24 17:14 - 2013-04-24 17:10 - 00000000 ____D C:\Program Files\Audio_Air
2013-04-24 17:13 - 2013-04-24 16:55 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Baidu
2013-04-24 17:11 - 2010-03-05 11:43 - 00000000 ____D C:\Program Files\360
2013-04-24 17:09 - 2010-01-15 21:40 - 00001692 ____A C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
2013-04-24 17:06 - 2013-04-15 11:10 - 00000000 ____D C:\Documents and Settings\Vivian\My Documents\Tax
2013-04-24 17:04 - 2013-04-24 17:02 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\360safe
2013-04-24 16:59 - 2013-04-24 16:59 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\360Login
2013-04-24 16:57 - 2013-04-24 16:57 - 00000065 ____A C:\prefs.js
2013-04-24 16:56 - 2013-04-24 16:56 - 00000000 ____D C:\Program Files\Funshion Online
2013-04-24 16:55 - 2013-04-24 16:55 - 00000000 ____D C:\Program Files\baidu
2013-04-24 16:55 - 2013-04-24 16:55 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Baidu
2013-04-24 16:53 - 2013-04-24 16:53 - 00000000 ____D C:\Program Files\Wuji

Other Malware:
===========
C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At4.job

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================
dditional scan result of Farbar Recovery Scan Tool (x86) Version: 24-05-2013 03
Ran by Vivian at 2013-05-24 15:12:53 Run:
Running from C:\Documents and Settings\Vivian\My Documents\Downloads
Boot Mode: Normal
==========================================================

==================== Installed Programs =======================

·é?ùíá?1 1.30 (Version: 1.30)
32 Bit HP CIO Components Installer (Version: 6.1.1)
Acrobat.com (Version: 1.6.65)
Adobe AIR (Version: 3.4.0.2710)
Adobe Anchor Service CS4 (Version: 2.0)
Adobe Bridge CS4 (Version: 3)
Adobe CMaps CS4 (Version: 2.0)
Adobe Color - Photoshop Specific CS4 (Version: 2.0)
Adobe Color EU Extra Settings CS4 (Version: 2.0)
Adobe Color JA Extra Settings CS4 (Version: 2.0)
Adobe Color NA Recommended Settings CS4 (Version: 2.0)
Adobe Color Video Profiles CS CS4 (Version: 2.0)
Adobe CSI CS4 (Version: 1)
Adobe Default Language CS4 (Version: 2.0)
Adobe Device Central CS4 (Version: 2)
Adobe Drive CS4 (Version: 1)
Adobe ExtendScript Toolkit CS4 (Version: 3.0.0)
Adobe Extension Manager CS4 (Version: 2.0)
Adobe Flash Player 10 ActiveX (Version: 10.0.22.87)
Adobe Flash Player 10 ActiveX (Version: 10.0.45.2)
Adobe Flash Player 11 Plugin (Version: 11.7.700.202)
Adobe Fonts All (Version: 2.0)
Adobe Linguistics CS4 (Version: 4.0.0)
Adobe Media Player (Version: 0.0.0)
Adobe Media Player (Version: 1.1)
Adobe Output Module (Version: 2.0)
Adobe PDF Library Files CS4 (Version: 9.0)
Adobe Photoshop CS4 (Version: 11.0)
Adobe Photoshop CS4 Support (Version: 11.0)
Adobe Reader X (10.1.6) (Version: 10.1.6)
Adobe Search for Help (Version: 1.0)
Adobe Service Manager Extension (Version: 1.0)
Adobe Setup (Version: 2.0)
Adobe Type Support CS4 (Version: 9.0)
Adobe Update Manager CS4 (Version: 6.0.0)
Adobe WinSoft Linguistics Plugin (Version: 1.1)
Adobe XMP Panels CS4 (Version: 2.0)
AdobeColorCommonSetCMYK (Version: 2.0)
AdobeColorCommonSetRGB (Version: 2.0)
Advanced Registry Optimizer (Version: 6.9)
AMD Processor Driver (Version: 1.3.2.0053)
Anti-phishing Domain Advisor (Version: 1.0.0.0)
Apple Application Support (Version: 1.5.1)
Apple Mobile Device Support (Version: 3.4.0.25)
Apple Software Update (Version: 2.1.2.120)
AVG SafeGuard toolbar (Version: 15.2.0.5)
Bing Bar (Version: 7.1.391.0)
Bonjour (Version: 2.0.5.0)
BufferChm (Version: 130.0.331.000)
Catalina Savings Printer (Version: 1.0.0)
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
Connect (Version: 1.0.0.1)
Copy (Version: 130.0.366.000)
Coupon Printer for Windows (Version: 5.0.0.0)
Destinations (Version: 130.0.0.0)
DeviceDiscovery (Version: 130.0.372.000)
DriverAgent by eSupport.com
Dropbox (Version: 2.0.16)
EasyLife Search 1.74
EasylifeGadget (Version: 1.0)
F4100_doccd (Version: 90.0.200.000)
Facebook Plug-In
Facebook Video Calling 1.2.0.287 (Version: 1.2.287)
Fun4IM
Google Chrome (Version: 27.0.1453.94)
Google Earth Plug-in (Version: 7.0.3.8542)
Google Talk Plugin (Version: 3.19.1.13088)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.4.3607.2246)
Google Update Helper (Version: 1.3.21.145)
GPBaseService2 (Version: 130.0.371.000)
High Definition Audio Driver Package - KB888111 (Version: 20040219.000000)
HiJackThis (Version: 1.0.0)
HP Customer Participation Program 13.0 (Version: 13.0)
HP Imaging Device Functions 13.0 (Version: 13.0)
HP Photo Creations (Version: 1.0.0.11502)
HP Photosmart 7520 series Basic Device Software (Version: 28.0.989.0)
HP Photosmart 7520 series Help (Version: 28.0.0)
HP Photosmart 7520 series Product Improvement Study (Version: 28.0.989.0)
HP Print Projects 1.0 (Version: 1.0)
HP Product Detection (Version: 11.14.0006)
HP Smart Web Printing 4.5 (Version: 4.5)
HP Solution Center 13.0 (Version: 13.0)
HP Update (Version: 5.003.003.001)
hpPrintProjects (Version: 130.0.303.000)
HPProductAssistant (Version: 130.0.371.000)
HPSSupply (Version: 130.0.371.000)
hpWLPGInstaller (Version: 130.0.303.000)
iTunes (Version: 10.2.2.12)
Java Auto Updater (Version: 2.0.2.4)
Junk Mail filter update (Version: 14.0.8117.416)
kuler (Version: 2.0)
Lame ACM MP3 Codec
LG Bluetooth Drivers (Version: 1.1)
LG MC USB U330 driver (Version: 1.0.0.0000)
LG USB Modem Drivers (Version: 4.9.7)
MarketResearch (Version: 130.0.374.000)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office Outlook Connector (Version: 12.0.6423.1000)
Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0)
Microsoft Security Client (Version: 4.2.0223.1)
Microsoft Security Essentials (Version: 4.2.223.1)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Mozilla Firefox 20.0.1 (x86 en-US) (Version: 20.0.1)
Mozilla Maintenance Service (Version: 20.0.1)
MSN
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MyFunCards Toolbar
Nero 7 Essentials (Version: 7.03.1084)
neroxml (Version: 1.0.0)
NVIDIA Drivers
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
PDF Settings CS4 (Version: 9.0)
PG Music Band-in-a-Box Mega Pak 2004
Photoshop Camera Raw (Version: 5.0)
Picasa 3 (Version: 3.9)
QuickTime (Version: 7.69.80.9)
Realtek High Definition Audio Driver (Version: 5.10.0.5605)
Safari (Version: 5.33.18.5)
Samsung Media Studio
SearchNewTab (Version: )
Segoe UI (Version: 14.0.4327.805)
Shop for HP Supplies (Version: 13.0)
Shutterfly Express Uploader (Version: 1.0.0)
Shutterfly Express Uploader (Version: 1.0.0.4)
Simple 1-2-3 Traditional Memories
Skype Click to Call (Version: 6.9.12585)
Skype? 6.3 (Version: 6.3.105)
Smart PDF Converter 6.3.0.480 (Version: 6.3.0.480)
SmartWebPrinting (Version: 130.0.373.000)
SolutionCenter (Version: 130.0.373.000)
Spam Free Search Bar (Version: 1.0.0.12)
Status (Version: 130.0.373.000)
Suite Shared Configuration CS4 (Version: 1.0)
SUPERAntiSpyware (Version: 4.48.1000)
TELUS security advisor 4.1.18 (Version: 4.1.18)
TELUS security services (Version: 10.0.41)
TELUS Support Centre
TrayApp (Version: 130.0.376.000)
Uninstall LG PC Suite III
UnloadSupport (Version: 9.0.0)
Update for Windows Internet Explorer 8 (KB2598845) (Version: 1)
Update for Windows XP (KB2141007) (Version: 1)
Update for Windows XP (KB2345886) (Version: 1)
Update for Windows XP (KB2467659) (Version: 1)
Update for Windows XP (KB2541763) (Version: 1)
Update for Windows XP (KB2607712) (Version: 1)
Update for Windows XP (KB2616676) (Version: 1)
Update for Windows XP (KB2641690) (Version: 1)
Update for Windows XP (KB2661254-v2) (Version: 2)
Update for Windows XP (KB2718704) (Version: 1)
Update for Windows XP (KB2736233) (Version: 1)
Update for Windows XP (KB2749655) (Version: 1)
Update for Windows XP (KB951978) (Version: 1)
Update for Windows XP (KB955759) (Version: 1)
Update for Windows XP (KB955839) (Version: 1)
Update for Windows XP (KB961503) (Version: 1)
Update for Windows XP (KB967715) (Version: 1)
Update for Windows XP (KB968389) (Version: 1)
Update for Windows XP (KB971029) (Version: 1)
Update for Windows XP (KB971737) (Version: 1)
Update for Windows XP (KB973687) (Version: 1)
Update for Windows XP (KB973815) (Version: 1)
uTorrentControl_v2 Toolbar (Version: 6.13.3.501)
vanBasco's Karaoke Player
Visual Studio C++ 10.0 Runtime (Version: 10.0.0)
VLC media player 1.0.5 (Version: 1.0.5)
WebFldrs XP (Version: 9.50.7523)
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray (Version: 1.0)
Windows Genuine Advantage Notifications (KB905474) (Version: 1.9.0040.0)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Live Call (Version: 14.0.8117.0416)
Windows Live Communications Platform (Version: 14.0.8117.416)
Windows Live Essentials (Version: 14.0.8117.0416)
Windows Live Essentials (Version: 14.0.8117.416)
Windows Live Mail (Version: 14.0.8117.0416)
Windows Live Messenger (Version: 14.0.8117.0416)
Windows Live Photo Gallery (Version: 14.0.8117.416)
Windows Live Sign-in Assistant (Version: 5.000.818.5)
Windows Live Sync (Version: 14.0.8117.416)
Windows Live Upload Tool (Version: 14.0.8014.1029)
Windows Live Writer (Version: 14.0.8117.0416)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 3 (Version: 20080414.031525)
WinRAR archiver
XviD MPEG-4 Video Codec (Version: XviD-1.0.3-20122004)
Yahoo! Toolbar
μTorrent (Version: 1.8.2)
μTorrent (Version: 3.2.0)

==================== Restore Points =========================

21-02-2013 17:43:51 Software Distribution Service 3.0
22-02-2013 20:20:18 Software Distribution Service 3.0
23-02-2013 20:27:40 Installed Driver Manager.
23-02-2013 20:31:11 Software Distribution Service 3.0
23-02-2013 20:35:15 Removed Driver Manager.
24-02-2013 21:25:05 Software Distribution Service 3.0
26-02-2013 00:54:05 Software Distribution Service 3.0
27-02-2013 20:13:40 Software Distribution Service 3.0
27-02-2013 22:24:45 Software Distribution Service 3.0
27-02-2013 22:34:51 Software Distribution Service 3.0
28-02-2013 06:19:00 Software Distribution Service 3.0
01-03-2013 00:37:31 Software Distribution Service 3.0
01-03-2013 18:36:17 Software Distribution Service 3.0
01-03-2013 23:53:48 Software Distribution Service 3.0
02-03-2013 18:10:29 Software Distribution Service 3.0
03-03-2013 17:38:04 Unsigned driver install
04-03-2013 01:06:53 Software Distribution Service 3.0
05-03-2013 02:20:46 System Checkpoint
05-03-2013 17:52:45 Software Distribution Service 3.0
06-03-2013 18:57:58 Software Distribution Service 3.0
07-03-2013 19:01:47 Software Distribution Service 3.0
08-03-2013 23:04:54 Software Distribution Service 3.0
10-03-2013 01:10:38 Software Distribution Service 3.0
11-03-2013 01:35:21 System Checkpoint
11-03-2013 17:43:07 Software Distribution Service 3.0
12-03-2013 20:00:13 Software Distribution Service 3.0
12-03-2013 20:14:23 SlimDrivers Installing Drivers
12-03-2013 20:20:21 SlimDrivers Installing Drivers
12-03-2013 20:23:44 SlimDrivers Installing Drivers
13-03-2013 21:56:50 Software Distribution Service 3.0
13-03-2013 22:15:42 Software Distribution Service 3.0
14-03-2013 17:32:49 Unsigned driver install
14-03-2013 17:37:03 Unsigned driver install
14-03-2013 17:53:17 Unsigned driver install
14-03-2013 18:14:14 Unsigned driver install
15-03-2013 00:59:25 Software Distribution Service 3.0
15-03-2013 16:53:29 Removed SlimDrivers
15-03-2013 17:05:05 Unsigned driver install
15-03-2013 17:06:33 Unsigned driver install
15-03-2013 17:18:38 Unsigned driver install
15-03-2013 17:20:45 Unsigned driver install
15-03-2013 17:42:10 Update to an unsigned driver
16-03-2013 19:27:51 Software Distribution Service 3.0
17-03-2013 22:58:49 Software Distribution Service 3.0
19-03-2013 03:26:03 Software Distribution Service 3.0
20-03-2013 21:13:37 Software Distribution Service 3.0
20-03-2013 21:32:43 Software Distribution Service 3.0
22-03-2013 16:58:05 Software Distribution Service 3.0
23-03-2013 22:11:08 Software Distribution Service 3.0
25-03-2013 00:27:38 Software Distribution Service 3.0
26-03-2013 02:32:45 Software Distribution Service 3.0
27-03-2013 03:16:09 System Checkpoint
27-03-2013 16:56:03 Software Distribution Service 3.0
28-03-2013 17:17:47 Software Distribution Service 3.0
28-03-2013 17:21:24 Installed Catalina Savings Printer.
29-03-2013 20:15:15 Software Distribution Service 3.0
30-03-2013 23:17:05 Software Distribution Service 3.0
31-03-2013 23:36:33 Software Distribution Service 3.0
02-04-2013 18:20:06 Software Distribution Service 3.0
04-04-2013 00:37:55 Software Distribution Service 3.0
05-04-2013 23:16:07 Software Distribution Service 3.0
07-04-2013 16:41:09 Software Distribution Service 3.0
08-04-2013 19:31:45 Software Distribution Service 3.0
09-04-2013 19:12:14 Software Distribution Service 3.0
09-04-2013 21:37:33 Software Distribution Service 3.0
11-04-2013 01:46:08 Software Distribution Service 3.0
12-04-2013 01:54:45 System Checkpoint
12-04-2013 18:21:03 Software Distribution Service 3.0
14-04-2013 02:35:50 Software Distribution Service 3.0
15-04-2013 02:38:30 System Checkpoint
15-04-2013 17:57:25 Software Distribution Service 3.0
15-04-2013 18:10:09 Installed GenuTax Standard.
16-04-2013 21:09:17 Software Distribution Service 3.0
18-04-2013 00:03:34 Software Distribution Service 3.0
19-04-2013 01:16:43 System Checkpoint
19-04-2013 17:14:10 Software Distribution Service 3.0
20-04-2013 18:14:25 Software Distribution Service 3.0
21-04-2013 22:25:39 Software Distribution Service 3.0
23-04-2013 00:29:53 Software Distribution Service 3.0
24-04-2013 16:53:04 Software Distribution Service 3.0
25-04-2013 00:06:53 Removed GenuTax Standard.
26-04-2013 00:16:24 Software Distribution Service 3.0
26-04-2013 01:15:18 已移除 Overture 4.0 繁體中文版
01-05-2013 16:27:11 Software Distribution Service 3.0
06-05-2013 05:11:57 Software Distribution Service 3.0
07-05-2013 05:17:11 System Checkpoint
08-05-2013 14:55:39 Software Distribution Service 3.0
09-05-2013 16:04:52 Software Distribution Service 3.0
10-05-2013 18:23:28 Software Distribution Service 3.0
11-05-2013 21:53:14 Software Distribution Service 3.0
13-05-2013 00:11:06 Software Distribution Service 3.0
14-05-2013 00:40:58 System Checkpoint
14-05-2013 02:49:30 Software Distribution Service 3.0
15-05-2013 18:10:01 Software Distribution Service 3.0
15-05-2013 19:11:30 Software Distribution Service 3.0
16-05-2013 04:44:00 Software Distribution Service 3.0
16-05-2013 19:11:29 Software Distribution Service 3.0
16-05-2013 20:07:18 Software Distribution Service 3.0
19-05-2013 00:38:25 Software Distribution Service 3.0
19-05-2013 16:56:00 Software Distribution Service 3.0
21-05-2013 17:36:01 Software Distribution Service 3.0
23-05-2013 01:36:07 Software Distribution Service 3.0
23-05-2013 22:57:10 Installed Windows Internet Explorer 8.
23-05-2013 22:57:51 Software Distribution Service 3.0
23-05-2013 23:28:22 Software Distribution Service 3.0
24-05-2013 04:14:24 Software Distribution Service 3.0

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (05/19/2013 10:05:23 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:11 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:04:59 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 . Error code = 0x80131f06

System errors:
=============
Error: (05/24/2013 03:02:10 PM) (Source: Service Control Manager) (User: )
Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
%%5

Error: (05/24/2013 03:00:46 PM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service failed to start due to the following error: 
%%2

Error: (05/24/2013 03:00:45 PM) (Source: Service Control Manager) (User: )
Description: The Amsp service failed to start due to the following error: 
%%3

Error: (05/24/2013 03:00:45 PM) (Source: Service Control Manager) (User: )
Description: The KAVSafe service failed to start due to the following error: 
%%2

Error: (05/24/2013 07:40:39 AM) (Source: Service Control Manager) (User: )
Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
%%5

Error: (05/24/2013 07:39:53 AM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service failed to start due to the following error: 
%%2

Error: (05/24/2013 07:39:51 AM) (Source: Service Control Manager) (User: )
Description: The Amsp service failed to start due to the following error: 
%%3

Error: (05/24/2013 07:39:51 AM) (Source: Service Control Manager) (User: )
Description: The KAVSafe service failed to start due to the following error: 
%%2

Error: (05/24/2013 07:35:23 AM) (Source: Service Control Manager) (User: )
Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
%%5

Error: (05/24/2013 07:03:21 AM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service failed to start due to the following error: 
%%2

Microsoft Office Sessions:
=========================
Error: (05/19/2013 10:05:23 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:11 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:04:59 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 . Error code = 0x80131f06 
System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35

==================== Memory info ===========================

Percentage of memory in use: 68%
Total physical RAM: 1983.29 MB
Available physical RAM: 626.28 MB
Total Pagefile: 3876.44 MB
Available Pagefile: 2631.27 MB
Total Virtual: 2047.88 MB
Available Virtual: 1958.12 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.75 GB) (Free:376.35 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-05-2013 03
Ran by Vivian at 2013-05-24 15:12:53 Run:
Running from C:\Documents and Settings\Vivian\My Documents\Downloads
Boot Mode: Normal
==========================================================

==================== Installed Programs =======================

·é?ùíá?1 1.30 (Version: 1.30)
32 Bit HP CIO Components Installer (Version: 6.1.1)
Acrobat.com (Version: 1.6.65)
Adobe AIR (Version: 3.4.0.2710)
Adobe Anchor Service CS4 (Version: 2.0)
Adobe Bridge CS4 (Version: 3)
Adobe CMaps CS4 (Version: 2.0)
Adobe Color - Photoshop Specific CS4 (Version: 2.0)
Adobe Color EU Extra Settings CS4 (Version: 2.0)
Adobe Color JA Extra Settings CS4 (Version: 2.0)
Adobe Color NA Recommended Settings CS4 (Version: 2.0)
Adobe Color Video Profiles CS CS4 (Version: 2.0)
Adobe CSI CS4 (Version: 1)
Adobe Default Language CS4 (Version: 2.0)
Adobe Device Central CS4 (Version: 2)
Adobe Drive CS4 (Version: 1)
Adobe ExtendScript Toolkit CS4 (Version: 3.0.0)
Adobe Extension Manager CS4 (Version: 2.0)
Adobe Flash Player 10 ActiveX (Version: 10.0.22.87)
Adobe Flash Player 10 ActiveX (Version: 10.0.45.2)
Adobe Flash Player 11 Plugin (Version: 11.7.700.202)
Adobe Fonts All (Version: 2.0)
Adobe Linguistics CS4 (Version: 4.0.0)
Adobe Media Player (Version: 0.0.0)
Adobe Media Player (Version: 1.1)
Adobe Output Module (Version: 2.0)
Adobe PDF Library Files CS4 (Version: 9.0)
Adobe Photoshop CS4 (Version: 11.0)
Adobe Photoshop CS4 Support (Version: 11.0)
Adobe Reader X (10.1.6) (Version: 10.1.6)
Adobe Search for Help (Version: 1.0)
Adobe Service Manager Extension (Version: 1.0)
Adobe Setup (Version: 2.0)
Adobe Type Support CS4 (Version: 9.0)
Adobe Update Manager CS4 (Version: 6.0.0)
Adobe WinSoft Linguistics Plugin (Version: 1.1)
Adobe XMP Panels CS4 (Version: 2.0)
AdobeColorCommonSetCMYK (Version: 2.0)
AdobeColorCommonSetRGB (Version: 2.0)
Advanced Registry Optimizer (Version: 6.9)
AMD Processor Driver (Version: 1.3.2.0053)
Anti-phishing Domain Advisor (Version: 1.0.0.0)
Apple Application Support (Version: 1.5.1)
Apple Mobile Device Support (Version: 3.4.0.25)
Apple Software Update (Version: 2.1.2.120)
AVG SafeGuard toolbar (Version: 15.2.0.5)
Bing Bar (Version: 7.1.391.0)
Bonjour (Version: 2.0.5.0)
BufferChm (Version: 130.0.331.000)
Catalina Savings Printer (Version: 1.0.0)
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
Connect (Version: 1.0.0.1)
Copy (Version: 130.0.366.000)
Coupon Printer for Windows (Version: 5.0.0.0)
Destinations (Version: 130.0.0.0)
DeviceDiscovery (Version: 130.0.372.000)
DriverAgent by eSupport.com
Dropbox (Version: 2.0.16)
EasyLife Search 1.74
EasylifeGadget (Version: 1.0)
F4100_doccd (Version: 90.0.200.000)
Facebook Plug-In
Facebook Video Calling 1.2.0.287 (Version: 1.2.287)
Fun4IM
Google Chrome (Version: 27.0.1453.94)
Google Earth Plug-in (Version: 7.0.3.8542)
Google Talk Plugin (Version: 3.19.1.13088)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.4.3607.2246)
Google Update Helper (Version: 1.3.21.145)
GPBaseService2 (Version: 130.0.371.000)
High Definition Audio Driver Package - KB888111 (Version: 20040219.000000)
HiJackThis (Version: 1.0.0)
HP Customer Participation Program 13.0 (Version: 13.0)
HP Imaging Device Functions 13.0 (Version: 13.0)
HP Photo Creations (Version: 1.0.0.11502)
HP Photosmart 7520 series Basic Device Software (Version: 28.0.989.0)
HP Photosmart 7520 series Help (Version: 28.0.0)
HP Photosmart 7520 series Product Improvement Study (Version: 28.0.989.0)
HP Print Projects 1.0 (Version: 1.0)
HP Product Detection (Version: 11.14.0006)
HP Smart Web Printing 4.5 (Version: 4.5)
HP Solution Center 13.0 (Version: 13.0)
HP Update (Version: 5.003.003.001)
hpPrintProjects (Version: 130.0.303.000)
HPProductAssistant (Version: 130.0.371.000)
HPSSupply (Version: 130.0.371.000)
hpWLPGInstaller (Version: 130.0.303.000)
iTunes (Version: 10.2.2.12)
Java Auto Updater (Version: 2.0.2.4)
Junk Mail filter update (Version: 14.0.8117.416)
kuler (Version: 2.0)
Lame ACM MP3 Codec
LG Bluetooth Drivers (Version: 1.1)
LG MC USB U330 driver (Version: 1.0.0.0000)
LG USB Modem Drivers (Version: 4.9.7)
MarketResearch (Version: 130.0.374.000)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office Outlook Connector (Version: 12.0.6423.1000)
Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0)
Microsoft Security Client (Version: 4.2.0223.1)
Microsoft Security Essentials (Version: 4.2.223.1)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Mozilla Firefox 20.0.1 (x86 en-US) (Version: 20.0.1)
Mozilla Maintenance Service (Version: 20.0.1)
MSN
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MyFunCards Toolbar
Nero 7 Essentials (Version: 7.03.1084)
neroxml (Version: 1.0.0)
NVIDIA Drivers
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
PDF Settings CS4 (Version: 9.0)
PG Music Band-in-a-Box Mega Pak 2004
Photoshop Camera Raw (Version: 5.0)
Picasa 3 (Version: 3.9)
QuickTime (Version: 7.69.80.9)
Realtek High Definition Audio Driver (Version: 5.10.0.5605)
Safari (Version: 5.33.18.5)
Samsung Media Studio
SearchNewTab (Version: )
Segoe UI (Version: 14.0.4327.805)
Shop for HP Supplies (Version: 13.0)
Shutterfly Express Uploader (Version: 1.0.0)
Shutterfly Express Uploader (Version: 1.0.0.4)
Simple 1-2-3 Traditional Memories
Skype Click to Call (Version: 6.9.12585)
Skype? 6.3 (Version: 6.3.105)
Smart PDF Converter 6.3.0.480 (Version: 6.3.0.480)
SmartWebPrinting (Version: 130.0.373.000)
SolutionCenter (Version: 130.0.373.000)
Spam Free Search Bar (Version: 1.0.0.12)
Status (Version: 130.0.373.000)
Suite Shared Configuration CS4 (Version: 1.0)
SUPERAntiSpyware (Version: 4.48.1000)
TELUS security advisor 4.1.18 (Version: 4.1.18)
TELUS security services (Version: 10.0.41)
TELUS Support Centre
TrayApp (Version: 130.0.376.000)
Uninstall LG PC Suite III
UnloadSupport (Version: 9.0.0)
Update for Windows Internet Explorer 8 (KB2598845) (Version: 1)
Update for Windows XP (KB2141007) (Version: 1)
Update for Windows XP (KB2345886) (Version: 1)
Update for Windows XP (KB2467659) (Version: 1)
Update for Windows XP (KB2541763) (Version: 1)
Update for Windows XP (KB2607712) (Version: 1)
Update for Windows XP (KB2616676) (Version: 1)
Update for Windows XP (KB2641690) (Version: 1)
Update for Windows XP (KB2661254-v2) (Version: 2)
Update for Windows XP (KB2718704) (Version: 1)
Update for Windows XP (KB2736233) (Version: 1)
Update for Windows XP (KB2749655) (Version: 1)
Update for Windows XP (KB951978) (Version: 1)
Update for Windows XP (KB955759) (Version: 1)
Update for Windows XP (KB955839) (Version: 1)
Update for Windows XP (KB961503) (Version: 1)
Update for Windows XP (KB967715) (Version: 1)
Update for Windows XP (KB968389) (Version: 1)
Update for Windows XP (KB971029) (Version: 1)
Update for Windows XP (KB971737) (Version: 1)
Update for Windows XP (KB973687) (Version: 1)
Update for Windows XP (KB973815) (Version: 1)
uTorrentControl_v2 Toolbar (Version: 6.13.3.501)
vanBasco's Karaoke Player
Visual Studio C++ 10.0 Runtime (Version: 10.0.0)
VLC media player 1.0.5 (Version: 1.0.5)
WebFldrs XP (Version: 9.50.7523)
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray (Version: 1.0)
Windows Genuine Advantage Notifications (KB905474) (Version: 1.9.0040.0)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Live Call (Version: 14.0.8117.0416)
Windows Live Communications Platform (Version: 14.0.8117.416)
Windows Live Essentials (Version: 14.0.8117.0416)
Windows Live Essentials (Version: 14.0.8117.416)
Windows Live Mail (Version: 14.0.8117.0416)
Windows Live Messenger (Version: 14.0.8117.0416)
Windows Live Photo Gallery (Version: 14.0.8117.416)
Windows Live Sign-in Assistant (Version: 5.000.818.5)
Windows Live Sync (Version: 14.0.8117.416)
Windows Live Upload Tool (Version: 14.0.8014.1029)
Windows Live Writer (Version: 14.0.8117.0416)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 3 (Version: 20080414.031525)
WinRAR archiver
XviD MPEG-4 Video Codec (Version: XviD-1.0.3-20122004)
Yahoo! Toolbar
μTorrent (Version: 1.8.2)
μTorrent (Version: 3.2.0)

==================== Restore Points =========================

21-02-2013 17:43:51 Software Distribution Service 3.0
22-02-2013 20:20:18 Software Distribution Service 3.0
23-02-2013 20:27:40 Installed Driver Manager.
23-02-2013 20:31:11 Software Distribution Service 3.0
23-02-2013 20:35:15 Removed Driver Manager.
24-02-2013 21:25:05 Software Distribution Service 3.0
26-02-2013 00:54:05 Software Distribution Service 3.0
27-02-2013 20:13:40 Software Distribution Service 3.0
27-02-2013 22:24:45 Software Distribution Service 3.0
27-02-2013 22:34:51 Software Distribution Service 3.0
28-02-2013 06:19:00 Software Distribution Service 3.0
01-03-2013 00:37:31 Software Distribution Service 3.0
01-03-2013 18:36:17 Software Distribution Service 3.0
01-03-2013 23:53:48 Software Distribution Service 3.0
02-03-2013 18:10:29 Software Distribution Service 3.0
03-03-2013 17:38:04 Unsigned driver install
04-03-2013 01:06:53 Software Distribution Service 3.0
05-03-2013 02:20:46 System Checkpoint
05-03-2013 17:52:45 Software Distribution Service 3.0
06-03-2013 18:57:58 Software Distribution Service 3.0
07-03-2013 19:01:47 Software Distribution Service 3.0
08-03-2013 23:04:54 Software Distribution Service 3.0
10-03-2013 01:10:38 Software Distribution Service 3.0
11-03-2013 01:35:21 System Checkpoint
11-03-2013 17:43:07 Software Distribution Service 3.0
12-03-2013 20:00:13 Software Distribution Service 3.0
12-03-2013 20:14:23 SlimDrivers Installing Drivers
12-03-2013 20:20:21 SlimDrivers Installing Drivers
12-03-2013 20:23:44 SlimDrivers Installing Drivers
13-03-2013 21:56:50 Software Distribution Service 3.0
13-03-2013 22:15:42 Software Distribution Service 3.0
14-03-2013 17:32:49 Unsigned driver install
14-03-2013 17:37:03 Unsigned driver install
14-03-2013 17:53:17 Unsigned driver install
14-03-2013 18:14:14 Unsigned driver install
15-03-2013 00:59:25 Software Distribution Service 3.0
15-03-2013 16:53:29 Removed SlimDrivers
15-03-2013 17:05:05 Unsigned driver install
15-03-2013 17:06:33 Unsigned driver install
15-03-2013 17:18:38 Unsigned driver install
15-03-2013 17:20:45 Unsigned driver install
15-03-2013 17:42:10 Update to an unsigned driver
16-03-2013 19:27:51 Software Distribution Service 3.0
17-03-2013 22:58:49 Software Distribution Service 3.0
19-03-2013 03:26:03 Software Distribution Service 3.0
20-03-2013 21:13:37 Software Distribution Service 3.0
20-03-2013 21:32:43 Software Distribution Service 3.0
22-03-2013 16:58:05 Software Distribution Service 3.0
23-03-2013 22:11:08 Software Distribution Service 3.0
25-03-2013 00:27:38 Software Distribution Service 3.0
26-03-2013 02:32:45 Software Distribution Service 3.0
27-03-2013 03:16:09 System Checkpoint
27-03-2013 16:56:03 Software Distribution Service 3.0
28-03-2013 17:17:47 Software Distribution Service 3.0
28-03-2013 17:21:24 Installed Catalina Savings Printer.
29-03-2013 20:15:15 Software Distribution Service 3.0
30-03-2013 23:17:05 Software Distribution Service 3.0
31-03-2013 23:36:33 Software Distribution Service 3.0
02-04-2013 18:20:06 Software Distribution Service 3.0
04-04-2013 00:37:55 Software Distribution Service 3.0
05-04-2013 23:16:07 Software Distribution Service 3.0
07-04-2013 16:41:09 Software Distribution Service 3.0
08-04-2013 19:31:45 Software Distribution Service 3.0
09-04-2013 19:12:14 Software Distribution Service 3.0
09-04-2013 21:37:33 Software Distribution Service 3.0
11-04-2013 01:46:08 Software Distribution Service 3.0
12-04-2013 01:54:45 System Checkpoint
12-04-2013 18:21:03 Software Distribution Service 3.0
14-04-2013 02:35:50 Software Distribution Service 3.0
15-04-2013 02:38:30 System Checkpoint
15-04-2013 17:57:25 Software Distribution Service 3.0
15-04-2013 18:10:09 Installed GenuTax Standard.
16-04-2013 21:09:17 Software Distribution Service 3.0
18-04-2013 00:03:34 Software Distribution Service 3.0
19-04-2013 01:16:43 System Checkpoint
19-04-2013 17:14:10 Software Distribution Service 3.0
20-04-2013 18:14:25 Software Distribution Service 3.0
21-04-2013 22:25:39 Software Distribution Service 3.0
23-04-2013 00:29:53 Software Distribution Service 3.0
24-04-2013 16:53:04 Software Distribution Service 3.0
25-04-2013 00:06:53 Removed GenuTax Standard.
26-04-2013 00:16:24 Software Distribution Service 3.0
26-04-2013 01:15:18 已移除 Overture 4.0 繁體中文版
01-05-2013 16:27:11 Software Distribution Service 3.0
06-05-2013 05:11:57 Software Distribution Service 3.0
07-05-2013 05:17:11 System Checkpoint
08-05-2013 14:55:39 Software Distribution Service 3.0
09-05-2013 16:04:52 Software Distribution Service 3.0
10-05-2013 18:23:28 Software Distribution Service 3.0
11-05-2013 21:53:14 Software Distribution Service 3.0
13-05-2013 00:11:06 Software Distribution Service 3.0
14-05-2013 00:40:58 System Checkpoint
14-05-2013 02:49:30 Software Distribution Service 3.0
15-05-2013 18:10:01 Software Distribution Service 3.0
15-05-2013 19:11:30 Software Distribution Service 3.0
16-05-2013 04:44:00 Software Distribution Service 3.0
16-05-2013 19:11:29 Software Distribution Service 3.0
16-05-2013 20:07:18 Software Distribution Service 3.0
19-05-2013 00:38:25 Software Distribution Service 3.0
19-05-2013 16:56:00 Software Distribution Service 3.0
21-05-2013 17:36:01 Software Distribution Service 3.0
23-05-2013 01:36:07 Software Distribution Service 3.0
23-05-2013 22:57:10 Installed Windows Internet Explorer 8.
23-05-2013 22:57:51 Software Distribution Service 3.0
23-05-2013 23:28:22 Software Distribution Service 3.0
24-05-2013 04:14:24 Software Distribution Service 3.0

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (05/19/2013 10:05:23 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:11 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:04:59 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 . Error code = 0x80131f06

System errors:
=============
Error: (05/24/2013 03:02:10 PM) (Source: Service Control Manager) (User: )
Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
%%5

Error: (05/24/2013 03:00:46 PM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service failed to start due to the following error: 
%%2

Error: (05/24/2013 03:00:45 PM) (Source: Service Control Manager) (User: )
Description: The Amsp service failed to start due to the following error: 
%%3

Error: (05/24/2013 03:00:45 PM) (Source: Service Control Manager) (User: )
Description: The KAVSafe service failed to start due to the following error: 
%%2

Error: (05/24/2013 07:40:39 AM) (Source: Service Control Manager) (User: )
Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
%%5

Error: (05/24/2013 07:39:53 AM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service failed to start due to the following error: 
%%2

Error: (05/24/2013 07:39:51 AM) (Source: Service Control Manager) (User: )
Description: The Amsp service failed to start due to the following error: 
%%3

Error: (05/24/2013 07:39:51 AM) (Source: Service Control Manager) (User: )
Description: The KAVSafe service failed to start due to the following error: 
%%2

Error: (05/24/2013 07:35:23 AM) (Source: Service Control Manager) (User: )
Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
%%5

Error: (05/24/2013 07:03:21 AM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service failed to start due to the following error: 
%%2

Microsoft Office Sessions:
=========================
Error: (05/19/2013 10:05:23 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:11 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:04:59 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 . Error code = 0x80131f06 
System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35

==================== Memory info ===========================

Percentage of memory in use: 68%
Total physical RAM: 1983.29 MB
Available physical RAM: 626.28 MB
Total Pagefile: 3876.44 MB
Available Pagefile: 2631.27 MB
Total Virtual: 2047.88 MB
Available Virtual: 1958.12 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.75 GB) (Free:376.35 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 466 GB) (Disk ID: C154C154)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================
OTL logfile created on: 5/24/2013 3:15:40 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Vivian\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 0.81 Gb Available Physical Memory | 42.01% Memory free
3.79 Gb Paging File | 2.77 Gb Available in Paging File | 73.26% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 376.34 Gb Free Space | 80.80% Space Free | Partition Type: NTFS

Computer Name: VIVIANSCOMPUTER | User Name: Vivian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: MSACM.LHACM - C:\WINDOWS\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm119 - C:\WINDOWS\System32\vdk32119.acm (Voxware)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MPG4 - C:\WINDOWS\System32\msscmc32.dll (Microsoft Corporation)
Drivers32: VIDC.TR20 - C:\WINDOWS\System32\tr2032.dll (The Duck Corporation)
Drivers32: VIDC.VDOM - C:\WINDOWS\System32\VDOWAVE.DRV (VDOnet LTD..)
Drivers32: vidc.vivo - C:\WINDOWS\System32\ivvideo.dll (Vivo Software)
Drivers32: VIDC.WMV3 - C:\WINDOWS\System32\wmv9vcm.dll (Microsoft Corporation)
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Custom Scans ==========

========== Base Services ==========
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\alg.exe -- (ALG)
SRV - [2008/04/14 05:42:12 | 000,006,656 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wuauserv.dll -- (wuauserv)
SRV - [2008/04/14 05:42:04 | 000,409,088 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\qmgr.dll -- (BITS)
SRV - [2012/07/06 06:58:51 | 000,078,336 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\system32\browser.dll -- (Browser)
SRV - [2008/04/14 05:41:52 | 000,062,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\cryptsvc.dll -- (CryptSvc)
SRV - [2008/04/14 05:41:52 | 000,126,976 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\dhcpcsvc.dll -- (Dhcp)
SRV - [2009/04/20 10:17:26 | 000,045,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\dnsrslvr.dll -- (Dnscache)
SRV - [2009/02/06 04:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\services.exe -- (Eventlog)
SRV - [2008/04/14 05:41:54 | 000,033,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\eapsvc.dll -- (EapHost)
SRV - [2009/07/27 16:17:41 | 000,135,168 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\shsvcs.dll -- (FastUserSwitchingCompatibility)
SRV - [2008/04/14 05:42:10 | 000,015,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\w3ssl.dll -- (HTTPFilter)
SRV - [2008/04/14 05:41:56 | 000,021,504 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\hidserv.dll -- (HidServ)
SRV - [2008/04/14 05:42:24 | 000,150,528 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\imapi.exe -- (ImapiService)
SRV - [2008/04/14 05:42:26 | 000,013,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\lsass.exe -- (PolicyAgent)
SRV - [2008/04/14 05:41:54 | 000,023,552 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\WINDOWS\system32\dmserver.dll -- (dmserver)
SRV - [2008/04/14 05:42:18 | 000,224,768 | ---- | M] (Microsoft Corp., Veritas Software) [On_Demand | Stopped] -- C:\WINDOWS\System32\dmadmin.exe -- (dmadmin)
SRV - [2008/04/14 05:42:18 | 000,005,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\dllhost.exe -- (SwPrv)
SRV - [2008/04/14 05:42:26 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\lsass.exe -- (Netlogon)
SRV - [2008/04/14 05:42:02 | 000,198,144 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\netman.dll -- (Netman)
SRV - [2008/06/20 09:02:47 | 000,245,248 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\mswsock.dll -- (Nla)
SRV - [2009/02/06 04:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\services.exe -- (PlugPlay)
SRV - [2010/08/17 06:17:06 | 000,058,880 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\spoolsv.exe -- (Spooler)
SRV - [2008/04/14 05:42:26 | 000,013,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\lsass.exe -- (ProtectedStorage)
SRV - [2008/04/14 05:42:04 | 000,088,576 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\rasauto.dll -- (RasAuto)
SRV - [2008/04/14 05:42:04 | 000,186,368 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\rasmans.dll -- (RasMan)
SRV - [2009/02/09 05:10:48 | 000,401,408 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\rpcss.dll -- (RpcSs)
SRV - [2008/04/14 05:42:04 | 000,435,200 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\ntmssvc.dll -- (NtmsSvc)
SRV - [2008/04/14 05:42:06 | 000,018,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\seclogon.dll -- (seclogon)
SRV - [2008/04/14 05:42:26 | 000,013,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\lsass.exe -- (SamSs)
SRV - [2008/04/14 05:42:12 | 000,080,896 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wscsvc.dll -- (wscsvc)
SRV - [2010/08/26 22:57:43 | 000,099,840 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\srvsvc.dll -- (lanmanserver)
SRV - [2009/07/27 16:17:41 | 000,135,168 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\shsvcs.dll -- (ShellHWDetection)
SRV - [2008/04/14 05:42:08 | 000,171,008 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\srsvc.dll -- (srservice)
SRV - [2008/04/14 05:42:06 | 000,192,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\schedsvc.dll -- (Schedule)
SRV - [2008/04/14 05:41:58 | 000,013,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\lmhsvc.dll -- (LmHosts)
SRV - [2008/04/14 05:42:08 | 000,249,856 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\tapisrv.dll -- (TapiSrv)
SRV - [2008/04/14 05:42:08 | 000,295,424 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\termsrv.dll -- (TermService)
SRV - [2009/07/27 16:17:41 | 000,135,168 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\shsvcs.dll -- (Themes)
SRV - [2008/04/14 05:42:40 | 000,289,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\vssvc.exe -- (VSS)
SRV - [2008/04/14 05:41:52 | 000,042,496 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\audiosrv.dll -- (AudioSrv)
SRV - [2008/04/14 05:41:56 | 000,331,264 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\ipnathlp.dll -- (SharedAccess)
SRV - [2008/04/14 05:42:10 | 000,333,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wiaservc.dll -- (stisvc)
SRV - [2008/04/14 05:42:30 | 000,078,848 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\msiexec.exe -- (MSIServer)
SRV - [2008/04/14 05:42:10 | 000,144,896 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wbem\wmisvc.dll -- (winmgmt)
SRV - [2009/02/09 05:10:48 | 000,617,472 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\advapi32.dll -- (Wmi)
SRV - [2008/04/14 05:41:54 | 000,132,096 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\dot3svc.dll -- (Dot3svc)
SRV - [2008/04/14 05:42:12 | 000,483,840 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wzcsvc.dll -- (WZCSVC)
SRV - [2009/06/09 23:14:49 | 000,132,096 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wkssvc.dll -- (lanmanworkstation)

========== Drive Information ==========

Physical Drives
---------------

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed\thard disk media
Interface type: IDE
Media Type: Fixed\thard disk media
Model: ST350041 0AS SCSI Disk Device
Partitions: 1
Status: OK
Status Info: 0

Partitions
---------------

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 466.00GB
Starting Offset: 32256
Hidden sectors: 0

< %SYSTEMDRIVE%\*.exe >

< %PROGRAMFILES%\*.exe >
[2013/02/27 15:27:29 | 020,546,152 | ---- | M] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2011/02/18 13:24:21 | 010,234,024 | ---- | M] ( ) -- C:\Program Files\fwinstall.exe
[2011/02/19 12:17:13 | 053,539,128 | ---- | M] (Logitech, Inc.) -- C:\Program Files\lws110_x64.exe

< %systemdrive%\$Recycle.Bin|@;true;true;true /fp >

< dir C:\ /S /A:L /C >
Volume in drive C has no label.
Volume Serial Number is E42C-8BFC

< End of report >


----------



## errorloading (Feb 4, 2011)

errorloading said:


> The following message keep coming up when I start my computer:
> Kp Quicken Function.exe has encounter a problem and needs to close. We are sorry for the inconvenience.
> 
> Also the following error message appears:
> ...


Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-05-2013 03
Ran by Vivian (administrator) on 24-05-2013 15:11:07
Running from C:\Documents and Settings\Vivian\My Documents\Downloads
Microsoft Windows XP Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(Funshion) C:\Documents and Settings\Vivian\funshion\funshiontools\FsSvr.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\McciCMService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(Radialpoint SafeCare Inc.) C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe
(Skype Technologies S.A.) C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
() C:\Documents and Settings\All Users\Application Data\BetterSoft\EasylifeGadget Updater\EasylifeGadget Updater.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(VER_COMPANY_NAME) C:\PROGRA~1\MYFUNC~2\bar\1.bin\5mbrmon.exe
(SAMSUNG ELECTRONICS) C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
((?)????) C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(AVG Secure Search) C:\Program Files\AVG SafeGuard toolbar\vprot.exe
(Sta) C:\Program Files\Wuji\197226\WJNews.exe
(Alcatel-Lucent) C:\Program Files\TELUS\McciTrayApp.exe
() C:\Program Files\kuping4\kuping_v4.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Dropbox, Inc.) C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe
(土豆网) C:\Program Files\Tudou\·é?ùTudou\TudouVa.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files\kuping4\KpQuickenFunction.exe
() C:\Program Files\kuping4\KpMini.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicator.exe
() C:\Program Files\kuping4\Kpmini.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Farbar) C:\Documents and Settings\Vivian\My Documents\Downloads\FRST.exe
(Microsoft Corporation) C:\WINDOWS\system32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [947152 2013-01-27] (Microsoft Corporation)
HKLM\...\Run: [MyFunCards Search Scope Monitor] "C:\PROGRA~1\MYFUNC~2\bar\1.bin\5msrchmn.exe" /m=2 /w /h [x]
HKLM\...\Run: [MyFunCards_5m Browser Plugin Loader] C:\PROGRA~1\MYFUNC~2\bar\1.bin\5mbrmon.exe [30096 2012-12-24] (VER_COMPANY_NAME)
HKLM\...\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe [126976 2006-07-21] (SAMSUNG ELECTRONICS)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2010-11-29] (Apple Inc.)
HKLM\...\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe [57344 2006-06-02] ((?)????)
HKLM\...\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [421160 2011-04-14] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [vProt] "C:\Program Files\AVG SafeGuard toolbar\vprot.exe" [1226928 2013-05-21] (AVG Secure Search)
HKLM\...\Run: [WJNews_197226] "C:\Program Files\Wuji\197226\WJNews.exe" -mini [679264 2013-03-13] (Sta)
HKLM\...\Run: [kuping] C:\Program Files\kuping4\kuping_v4.exe /start [1047224 2013-04-24] ()
HKLM\...\Run: [TELUS_McciTrayApp] "C:\Program Files\TELUS\McciTrayApp.exe" [1561088 2012-06-11] (Alcatel-Lucent)
HKLM Group Policy restriction on software: %HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache%OLK* <====== ATTENTION
HKLM\...\Winlogon: [System] 
Winlogon\Notify\!SASWinLogon: C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [X]
Winlogon\Notify\WgaLogon: WgaLogon.dll ()
HKCU\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [152872 2007-06-27] (Nero AG)
HKCU\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2010-03-08] (Google Inc.)
HKCU\...\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem [2215944 2010-10-18] (Sammsoft)
HKCU\...\Run: [SmileboxTray] "C:\Documents and Settings\Vivian\Application Data\Smilebox\SmileboxTray.exe" [x]
HKCU\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18642024 2013-02-28] (Skype Technologies S.A.)
HKCU\...\Run: [HP Photosmart 7520 series (NET)] "C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN2AU294Q705XX:NW" -scfn "HP Photosmart 7520 series (NET)" -AutoStart 1 [1818472 2012-05-08] (Hewlett-Packard Co.)
HKU\Administrator\...\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [x]
HKU\Chung-Yan\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Chung-Yan\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\Default User\...\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe" [x]
HKU\Guest\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Guest\...\Run: [msnmsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\Guest\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\Guest\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
HKU\Guest\...\Run: [Akuhaves] rundll32.exe "C:\WINDOWS\ojexiyayidad.dll",Startup [x]
HKU\Guest\...\Run: [Facebook Update] "C:\Documents and Settings\Guest\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [ 2012-07-11] (Facebook Inc.)
HKU\Karen\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Karen\...\Run: [msnmsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\Karen\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\philso\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\philso\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\philso\...\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\tso\...\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\tso\...\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [ 2008-04-14] (Microsoft Corporation)
HKU\tso\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\tso\...\Run: [Google Update] "C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c [ 2009-10-31] (Google Inc.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\酷屏.lnk
ShortcutTarget: 酷屏.lnk -> C:\Program Files\kuping4\kuping_v4.exe ()
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\???ˉiTudou.lnk
ShortcutTarget: ???ˉiTudou.lnk -> C:\Documents and Settings\Vivian\My Documents\iTudou\iTudou.exe (No File)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\???ˉ·é?ùíá?1.lnk
ShortcutTarget: ???ˉ·é?ùíá?1.lnk -> C:\Program Files\Tudou\·é?ùTudou\TudouVa.exe (土豆网)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\启动iTudou.lnk
ShortcutTarget: 启动iTudou.lnk -> C:\Documents and Settings\Vivian\My Documents\iTudou\iTudou.exe (No File)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\启动飞速土豆.lnk
ShortcutTarget: 启动飞速土豆.lnk -> C:\Program Files\Tudou\·é?ùTudou\TudouVa.exe (No File)
Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\???ˉ·é?ùíá?1.lnk
ShortcutTarget: ???ˉ·é?ùíá?1.lnk -> C:\Program Files\Tudou\·é?ùTudou\TudouVa.exe (土豆网)
Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\启动飞速土豆.lnk
ShortcutTarget: 启动飞速土豆.lnk -> C:\Program Files\Tudou\·é?ùTudou\TudouVa.exe (No File)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.easylifeapp.com/?pid=388&src=ie1&r=2013/05/15&hid=1597798053&lg=EN&cc=CA
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: uTorrentControl_v2 Toolbar - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTo2.dll (Conduit Ltd.)
URLSearchHook: (No Name) - {f4c28532-b9d0-4950-a2df-e83f9929242b} - No File
HKLM SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {01bd49d7-c76b-4310-8beb-14d7e5f322c6} URL = http://search.easylifeapp.com/?q={searchTerms}&pid=388&src=ie2&r=2013/05/15&hid=1597798053&lg=EN&cc=CA
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = 
SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = http://blekko.com/?source=c3348dd4&tbp=rbox&toolbarid=blekkotb&u=2012040396324E599227B38E1C688E02&q={searchTerms}
SearchScopes: HKCU - {4633EF93-D676-472f-A0FF-E1916B0B2E30} URL = http://www.baidu.com/s?tn=utf7_dg&wd={searchTerms}&ie=utf-8
SearchScopes: HKCU - {acbd5593-e5ee-4c15-b48f-1823ce819dec} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?p2=^ZU^fox000^^&ptb=33FED4C0-100D-451D-937D-35B3F3054D17&ind=2013020320&n=77fc40a0&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3220468
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll No File
BHO: Updater For Spam Free Search Bar - {20a0be68-8fd9-4539-8712-ce3d1c1fdfc6} - C:\Program Files\blekkotb\auxi\blekkoAu.dll (Visicom Media)
BHO: Spam Free Search Bar - {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files\blekkotb\blekkoDx.dll ()
BHO: TSToolbarBHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll No File
BHO: uTorrentControl_v2 Toolbar - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTo2.dll (Conduit Ltd.)
BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
BHO: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll No File
BHO: Search Assistant BHO - {c4b22c87-45ef-4f43-89f2-40db2078864e} - C:\Program Files\MyFunCards_5m\bar\1.bin\5mSrcAs.dll (MindSpark)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
BHO: SearchNewTab - {D7A4B15B-3AE6-6E8D-4CA8-F18D61607930} - C:\Documents and Settings\All Users\Application Data\SearchNewTab\5192f0ec9823e.dll ()
BHO: Toolbar BHO - {da71fd14-5f7b-46ae-b8b1-44074a38f331} - C:\PROGRA~1\MYFUNC~2\bar\1.bin\5mbar.dll (MindSpark)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Spam Free Search Bar - {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files\blekkotb\blekkoDx.dll ()
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll" No File
Toolbar: HKLM - uTorrentControl_v2 Toolbar - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTo2.dll (Conduit Ltd.)
Toolbar: HKLM - MyFunCards - {210f1b36-3b7f-41a4-b5da-3eb87f5a56c2} - C:\Program Files\MyFunCards_5m\bar\1.bin\5mbar.dll (MindSpark)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
Toolbar: HKCU -No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKCU -uTorrentControl_v2 Toolbar - {7473B6BD-4691-4744-A82B-7854EB3D70B6} - C:\Program Files\uTorrentControl_v2\prxtbuTo2.dll (Conduit Ltd.)
Toolbar: HKCU -MyFunCards - {210F1B36-3B7F-41A4-B5DA-3EB87F5A56C2} - C:\Program Files\MyFunCards_5m\bar\1.bin\5mbar.dll (MindSpark)
PDF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll No File
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll No File
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll No File
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll No File
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\15.2.0\ViProtocol.dll (AVG Secure Search)
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [77824 2008-05-13] (SuperAdBlocker.com)
Winsock: Catalog5 04 C:\Program Files\Bonjour\mdnsNSP.dll [245248] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 75.153.176.9

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default
FF SearchEngine: Google
FF Homepage: hxxp://www.hotmail.com
FF Keyword.URL: hxxp://search.easylifeapp.com/?pid=388&src=ff2&r=2013/05/15&hid=1597798053&lg=EN&cc=CA&l=1&q=
FF NetworkProxy: "user_pref("capability.principal.codebase.p124.subjectName", "");type", 2
FF NetworkProxy: "autoconfig_url", "http://127.0.0.1:9415/tudouva.pac"
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.2.0\\npsitesafety.dll (AVG Technologies)
FF Plugin: @baidu.com/npxbdsetup - C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @Motive.com/NpMotive,version=1.0 - C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF Plugin: @MyFunCards_5m.com/Plugin - C:\Program Files\MyFunCards_5m\bar\1.bin\NP5mStub.dll (MindSpark)
FF Plugin: @ncity3d.com/NCity3dPlayer - C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
FF Plugin: @radialpoint.com/SPA,version=1 - C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
FF Plugin: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 - C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Виявлення пристро?в Logitech - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\[email protected]
FF Extension: SearchNewTab - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\[email protected]
FF Extension: Latin Dictionary - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\[email protected]
FF Extension: Spam Free Search Bar - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\{00f12770-e60e-4dc6-9105-425bface7c73}
FF Extension: Garmin Communicator - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
FF Extension: Microsoft .NET Framework Assistant - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: uTorrentControl_v2 - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\{7473b6bd-4691-4744-a82b-7854eb3d70b6}
FF Extension: IE Tab - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
FF Extension: 5057cac7115c7 - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\[email protected]
FF Extension: personas - C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\Extensions\[email protected]

Chrome: 
=======
CHR Extension: (HP Product Detection Plugin) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aelbknmfcacjffmgnoaaonhgoghlmlkp\1.0.26.1_0
CHR Extension: (YouTube) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (uTorrentControl_v2) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda\2.3.19.11_0
CHR Extension: (Skype Click to Call) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0
CHR Extension: (Radialpoint SPD Extension) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj\1.0_0
CHR Extension: (SearchNewTab) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mikjhaicomkcabebhnddigcpmagnpiha\1
CHR Extension: (AVG SafeGuard toolbar) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0
CHR Extension: (Gmail) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

========================== Services (Whitelisted) =================

R2 FunshionSvr; C:\Documents and Settings\Vivian\funshion\funshiontools\FunshionSvr.dll [212616 2013-04-25] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
S2 MyFunCards_5mService; C:\PROGRA~1\MYFUNC~2\bar\1.bin\5mbarsvc.exe [42504 2012-12-24] (COMPANYVERS_NAME)
R2 ServicepointService; C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe [10294584 2012-03-09] (Radialpoint SafeCare Inc.)
R2 Skype C2C Service; C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3289208 2013-05-14] (Skype Technologies S.A.)
R2 vToolbarUpdater15.2.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe [1015984 2013-05-21] (AVG Secure Search)
S3 ALG; %SystemRoot%\System32\alg.exe [x]
S2 Amsp;

==================== Drivers (Whitelisted) ====================

R1 AmdK8; C:\Windows\System32\DRIVERS\AmdK8.sys [36864 2006-07-01] (Advanced Micro Devices)
R1 ASPI32; C:\Windows\System32\Drivers\ASPI32.sys [25244 1999-09-10] (Adaptec)
R1 avgtp; C:\WINDOWS\system32\drivers\avgtpx86.sys [37664 2013-05-21] (AVG Technologies)
S3 CCDECODE; C:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)
S3 DrvAgent32; C:\WINDOWS\system32\Drivers\DrvAgent32.sys [23456 2011-02-19] (Phoenix Technologies)
R1 FsVga; C:\Windows\System32\DRIVERS\fsvga.sys [12160 2004-08-04] (Microsoft Corporation)
R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [144384 2008-04-13] (Windows (R) Server 2003 DDK provider)
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2007-03-07] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2007-03-07] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2007-03-07] (HP)
R1 KPProtector; C:\Program Files\kuping4\KPProtector.sys [51864 2013-04-24] ()
R3 LgBttPort; C:\Windows\System32\DRIVERS\lgbtport.sys [12160 2009-09-29] (LG Electronics Inc.)
R3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbus.sys [10496 2009-09-29] (LG Electronics Inc.)
R3 LGVMODEM; C:\Windows\System32\DRIVERS\lgvmodem.sys [12928 2009-09-29] (LG Electronics Inc.)
R3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41888 2007-05-09] (Logitech Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
S3 MREMP50; C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [21248 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [20096 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))
S3 NABTSFEC; C:\Windows\System32\DRIVERS\NABTSFEC.sys [85248 2008-04-14] (Microsoft Corporation)
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
R3 NVENETFD; C:\Windows\System32\DRIVERS\NVENETFD.sys [54016 2008-01-28] (NVIDIA Corporation)
R0 nvgts; C:\Windows\System32\DRIVERS\nvgts.sys [132096 2008-01-25] (NVIDIA Corporation)
R3 nvnetbus; C:\Windows\System32\DRIVERS\nvnetbus.sys [22016 2008-01-28] (NVIDIA Corporation)
R3 PID_PEPI; C:\Windows\System32\DRIVERS\LV302V32.SYS [1276832 2007-05-09] (Logitech Inc.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12872 2010-02-17] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67656 2010-05-10] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SLIP; C:\Windows\System32\DRIVERS\SLIP.sys [11136 2008-04-14] (Microsoft Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-04-21] (Duplex Secure Ltd.)
S3 streamip; C:\Windows\System32\DRIVERS\StreamIP.sys [15232 2008-04-14] (Microsoft Corporation)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2013-03-15] ()
S3 usbbus; C:\Windows\System32\DRIVERS\lgusbbus.sys [13056 2010-01-21] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgusbdiag.sys [20864 2010-01-21] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgusbmodem.sys [24960 2010-01-21] (LG Electronics Inc.)
S3 WSTCODEC; C:\Windows\System32\DRIVERS\WSTCODEC.SYS [19200 2008-04-14] (Microsoft Corporation)
S4 Abiosdsk; No ImagePath
S4 abp480n5; No ImagePath
S4 adpu160m; No ImagePath
S4 Aha154x; No ImagePath
S4 aic78u2; No ImagePath
S4 aic78xx; No ImagePath
S4 AliIde; No ImagePath
S4 amsint; No ImagePath
S4 asc; No ImagePath
S4 asc3350p; No ImagePath
S4 asc3550; No ImagePath
S4 Atdisk; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S4 cd20xrnt; No ImagePath
S1 Changer; No ImagePath
S4 CmdIde; No ImagePath
S4 Cpqarray; No ImagePath
U4 dac2w2k; No ImagePath
S4 dac960nt; No ImagePath
S4 dpti2o; No ImagePath
S3 GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS [x]
S4 hpn; No ImagePath
S1 i2omgmt; No ImagePath
S4 i2omp; No ImagePath
S4 ini910u; No ImagePath
S4 IntelIde; No ImagePath
S2 KAVSafe; \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys [x]
S1 lbrtfdc; No ImagePath
S4 mraid35x; No ImagePath
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [x]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [x]
S1 PCIDump; No ImagePath
S3 PDCOMP; No ImagePath
S3 PDFRAME; No ImagePath
S3 PDRELI; No ImagePath
S3 PDRFRAME; No ImagePath
S3 pepifilter; system32\DRIVERS\lv302af.sys [x]
S4 perc2; No ImagePath
S4 perc2hib; No ImagePath
S3 PID_08A0; system32\DRIVERS\LV302AV.SYS [x]
S4 ql1080; No ImagePath
S4 Ql10wnt; No ImagePath
S4 ql12160; No ImagePath
S4 ql1240; No ImagePath
S4 ql1280; No ImagePath
S4 Simbad; No ImagePath
S4 Sparrow; No ImagePath
S4 symc810; No ImagePath
S4 symc8xx; No ImagePath
S4 sym_hi; No ImagePath
S4 sym_u3; No ImagePath
S4 TosIde; No ImagePath
S4 ultra; No ImagePath
S4 ViaIde; No ImagePath
S3 WDICA; No ImagePath

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-05-24 15:11 - 2013-05-24 15:11 - 00000000 ____D C:\FRST
2013-05-24 07:56 - 2013-05-24 07:58 - 01878604 ____A (Farbar) C:\Documents and Settings\Vivian\Desktop\FRST64.exe
2013-05-23 21:08 - 2013-05-23 21:08 - 00000000 ____D C:\Documents and Settings\pso\Application Data\Motive
2013-05-23 21:02 - 2013-05-23 21:02 - 00000000 ____D C:\Documents and Settings\pso\Application Data\AVG SafeGuard toolbar
2013-05-23 16:32 - 2013-05-23 16:32 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\PriceGong
2013-05-23 16:28 - 2013-05-23 16:28 - 00012994 ____A C:\Windows\KB2510531-IE8.log
2013-05-23 16:14 - 2013-05-23 16:14 - 00001820 ____A C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
2013-05-23 16:13 - 2013-05-23 16:26 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Motive
2013-05-23 16:13 - 2013-05-23 16:18 - 00000000 ____D C:\Program Files\Common Files\Motive
2013-05-23 16:13 - 2013-05-23 16:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Motive
2013-05-23 15:59 - 2013-05-23 15:59 - 00037114 ____A C:\Windows\KB2744842-IE8.log
2013-05-23 15:58 - 2013-05-23 15:59 - 00036950 ____A C:\Windows\KB2618444-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00030243 ____A C:\Windows\KB2598845-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00029602 ____A C:\Windows\KB2467659.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00000000 __HDC C:\Windows\$NtUninstallKB2467659$
2013-05-23 15:57 - 2013-05-23 16:01 - 00007281 ____A C:\Windows\spupdsvc.log
2013-05-23 15:57 - 2013-05-23 15:58 - 00037767 ____A C:\Windows\KB982381-IE8.log
2013-05-23 15:56 - 2013-05-23 15:57 - 00039585 ____A C:\Windows\ie8.log
2013-05-23 15:56 - 2013-05-23 15:57 - 00000000 __HDC C:\Windows\ie8
2013-05-23 15:51 - 2011-08-16 03:45 - 00006144 ____C (Microsoft Corporation) C:\Windows\System32\dllcache\iecompat.dll
2013-05-23 15:50 - 2013-05-23 15:50 - 00003774 ____A C:\Windows\KB951978.log
2013-05-23 15:45 - 2013-05-23 15:59 - 00140674 ____A C:\Windows\ie8_main.log
2013-05-23 15:45 - 2013-05-23 15:46 - 00035668 ____A C:\Windows\ie8Uninst.log
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\TELUS
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\Radialpoint
2013-05-23 14:16 - 2013-05-23 14:16 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\AVG SafeGuard toolbar
2013-05-22 22:06 - 2013-05-22 22:07 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\PriceGong
2013-05-22 22:06 - 2013-05-22 22:07 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\blekkotb
2013-05-22 22:06 - 2013-05-22 22:06 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\Application Data\uTorrentControl_v2
2013-05-22 22:06 - 2013-05-22 22:06 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\Application Data\Conduit
2013-05-22 22:05 - 2013-05-24 08:09 - 00000047 ____A C:\Documents and Settings\NetworkService\FunShion.ini
2013-05-21 18:32 - 2013-05-21 18:32 - 00000000 ____D C:\Documents and Settings\tso\Application Data\AVG SafeGuard toolbar
2013-05-21 10:25 - 2013-05-21 10:25 - 00000000 ____D C:\Windows\System32\cache
2013-05-20 04:26 - 2013-05-22 22:06 - 00000582 ____A C:\Windows\System32\funshion.ini
2013-05-16 13:07 - 2013-05-16 13:07 - 00000000 ____D C:\dbfecd5f7d2e63eac17b4786
2013-05-15 21:48 - 2013-05-23 15:59 - 00121115 ____A C:\Windows\KB2829530-IE8.log
2013-05-15 12:16 - 2013-05-23 16:29 - 00016442 ____A C:\Windows\KB2847204-IE8.log
2013-05-15 12:16 - 2013-05-15 12:17 - 00000000 ____D C:\78415340c7ea0ba5fa
2013-05-15 12:16 - 2013-05-15 12:16 - 00006960 ____A C:\Windows\KB2820197.log
2013-05-15 12:16 - 2013-05-15 12:16 - 00000000 __HDC C:\Windows\$NtUninstallKB2820197$
2013-05-15 12:11 - 2013-05-15 12:11 - 00000000 __HDC C:\Windows\$NtUninstallKB2829361$
2013-05-15 11:08 - 2013-05-15 12:11 - 00010405 ____A C:\Windows\KB2829361.log
2013-05-14 18:38 - 2013-05-24 15:00 - 00000630 ___AH C:\Windows\Tasks\schedule!1822287263.job
2013-05-14 18:38 - 2013-05-15 17:43 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\SearchNewTab
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Program Files\EasyLife
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\StarApp
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\BetterSoft
2013-05-14 18:37 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\InstallMate
2013-05-14 18:01 - 2013-05-14 18:00 - 00090112 ____A C:\Windows\Minidump\Mini051413-01.dmp
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Visan
2013-05-14 15:06 - 2013-05-24 07:25 - 00000492 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-05-14 14:58 - 2001-08-17 13:53 - 00006784 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\serscan.sys
2013-05-14 14:14 - 2013-05-14 15:16 - 00001742 ____A C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
2013-05-14 14:14 - 2013-05-14 14:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
2013-05-14 14:13 - 2013-05-21 14:13 - 00000462 ____A C:\Windows\Tasks\At3.job
2013-05-14 14:13 - 2013-05-21 14:00 - 00000462 ____A C:\Windows\Tasks\At4.job
2013-05-14 14:13 - 2013-05-19 10:10 - 00000462 ____A C:\Windows\Tasks\At1.job
2013-05-14 14:13 - 2013-05-15 20:40 - 00000462 ____A C:\Windows\Tasks\At2.job
2013-05-14 14:13 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Visan
2013-05-14 14:13 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP Photo Creations
2013-05-14 14:13 - 2013-05-14 14:14 - 00000000 ____D C:\Program Files\HP Photo Creations
2013-05-14 14:12 - 2013-05-14 14:12 - 00001993 ____A C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2013-05-14 14:12 - 00000925 ____A C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2012-05-08 17:23 - 02215784 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkinsBC11.exe
2013-05-14 14:12 - 2012-05-08 17:23 - 01961320 ____A (Hewlett-Packard Co.) C:\Windows\System32\HPScanTRDrv_PS7520.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00513384 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkstsBC11.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00495464 ____A (Hewlett-Packard) C:\Windows\System32\HPWia1_PS7520.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00267624 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkstsBC11LM.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00219496 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkcoiBC11.dll
2013-05-14 14:12 - 2012-05-08 14:03 - 00563048 ____N (Hewlett-Packard Co.) C:\Windows\System32\HPDiscoPMBC11.dll
2013-05-14 14:09 - 2013-05-14 14:09 - 00000057 ____A C:\Documents and Settings\All Users\Application Data\Ament.ini
2013-05-13 10:21 - 2013-05-13 10:21 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-05-09 10:41 - 2013-05-23 21:10 - 00000000 ____D C:\Documents and Settings\pso\Application Data\PriceGong
2013-05-06 08:43 - 2013-05-14 13:37 - 00000000 ____D C:\Documents and Settings\pso\Desktop\cari. cruise
2013-05-01 09:27 - 2013-05-24 15:05 - 00000306 ____A C:\Windows\Tasks\FSPlatform1.job
2013-04-24 21:55 - 2013-05-24 07:03 - 00000000 ____D C:\Documents and Settings\tso\Local Settings\Application Data\INISet
2013-04-24 21:45 - 2013-05-23 16:31 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\INISet
2013-04-24 18:26 - 2013-05-23 21:02 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\INISet
2013-04-24 17:17 - 2013-05-24 07:51 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\PriceGong
2013-04-24 17:11 - 2013-05-24 15:01 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\INISet
2013-04-24 17:10 - 2013-05-13 11:07 - 00000000 ____D C:\Program Files\kuping4
2013-04-24 17:10 - 2013-04-25 17:20 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\AIRPLAY
2013-04-24 17:10 - 2013-04-24 17:14 - 00000000 ____D C:\Program Files\Audio_Air
2013-04-24 17:02 - 2013-04-24 17:04 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\360safe
2013-04-24 16:59 - 2013-04-24 16:59 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\360Login
2013-04-24 16:57 - 2013-05-24 15:05 - 00000306 ____A C:\Windows\Tasks\FSPlatform.job
2013-04-24 16:57 - 2013-04-24 16:57 - 00000065 ____A C:\prefs.js
2013-04-24 16:56 - 2013-05-22 22:05 - 00000000 ____D C:\FunshionMedia
2013-04-24 16:56 - 2013-04-24 17:43 - 00000000 ____D C:\Program Files\Baofeng
2013-04-24 16:56 - 2013-04-24 17:16 - 00000000 ____D C:\Documents and Settings\Vivian\funshion
2013-04-24 16:56 - 2013-04-24 16:56 - 00000000 ____D C:\Program Files\Funshion Online
2013-04-24 16:55 - 2013-04-24 17:13 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Baidu
2013-04-24 16:55 - 2013-04-24 16:55 - 00000000 ____D C:\Program Files\baidu
2013-04-24 16:55 - 2013-04-24 16:55 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Baidu
2013-04-24 16:53 - 2013-04-24 16:53 - 00000000 ____D C:\Program Files\Wuji

==================== One Month Modified Files and Folders ========

2013-05-24 15:12 - 2010-03-08 15:18 - 00000880 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-05-24 15:11 - 2013-05-24 15:11 - 00000000 ____D C:\FRST
2013-05-24 15:11 - 2012-08-22 18:02 - 00032584 ____A C:\Windows\SchedLgU.Txt
2013-05-24 15:10 - 2013-02-27 23:29 - 00000384 ___AH C:\Windows\Tasks\Microsoft Antimalware Scheduled Scan.job
2013-05-24 15:08 - 2011-02-07 13:40 - 01831117 ____A C:\Windows\WindowsUpdate.log
2013-05-24 15:05 - 2013-05-01 09:27 - 00000306 ____A C:\Windows\Tasks\FSPlatform1.job
2013-05-24 15:05 - 2013-04-24 16:57 - 00000306 ____A C:\Windows\Tasks\FSPlatform.job
2013-05-24 15:03 - 2012-06-15 00:46 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\Dropbox
2013-05-24 15:03 - 2012-06-15 00:36 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Dropbox
2013-05-24 15:01 - 2013-04-24 17:11 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\INISet
2013-05-24 15:01 - 2010-07-29 05:30 - 00000000 ____D C:\Documents and Settings\Vivian\update
2013-05-24 15:00 - 2013-05-14 18:38 - 00000630 ___AH C:\Windows\Tasks\schedule!1822287263.job
2013-05-24 15:00 - 2012-08-22 18:02 - 00000159 ____A C:\Windows\wiadebug.log
2013-05-24 15:00 - 2012-08-22 18:02 - 00000049 ____A C:\Windows\wiaservc.log
2013-05-24 15:00 - 2010-03-08 15:18 - 00000876 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-05-24 15:00 - 2009-04-21 14:12 - 00000062 __ASH C:\Documents and Settings\Vivian\Local Settings\desktop.ini
2013-05-24 15:00 - 2009-04-21 14:12 - 00000062 __ASH C:\Documents and Settings\LocalService\Local Settings\desktop.ini
2013-05-24 15:00 - 2009-04-21 14:12 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-05-24 15:00 - 2009-04-21 14:11 - 00000062 __ASH C:\Documents and Settings\NetworkService\Local Settings\desktop.ini
2013-05-24 08:15 - 2009-10-31 06:36 - 00000970 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
2013-05-24 08:15 - 2009-04-21 14:12 - 00000278 __SHC C:\Documents and Settings\Vivian\ntuser.ini
2013-05-24 08:09 - 2013-05-22 22:05 - 00000047 ____A C:\Documents and Settings\NetworkService\FunShion.ini
2013-05-24 07:58 - 2013-05-24 07:56 - 01878604 ____A (Farbar) C:\Documents and Settings\Vivian\Desktop\FRST64.exe
2013-05-24 07:51 - 2013-04-24 17:17 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\PriceGong
2013-05-24 07:45 - 2012-07-07 00:29 - 00000536 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-05-24 07:34 - 2009-04-22 14:54 - 00000278 __ASH C:\Documents and Settings\tso\ntuser.ini
2013-05-24 07:25 - 2013-05-14 15:06 - 00000492 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-05-24 07:13 - 2012-08-19 13:01 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Radialpoint
2013-05-24 07:03 - 2013-04-24 21:55 - 00000000 ____D C:\Documents and Settings\tso\Local Settings\Application Data\INISet
2013-05-24 07:03 - 2010-07-29 10:07 - 00000000 ____D C:\Documents and Settings\tso\update
2013-05-24 07:03 - 2009-04-22 15:27 - 00000000 ____D C:\Documents and Settings\tso\Tracing
2013-05-24 07:03 - 2009-04-22 14:54 - 00000062 __ASH C:\Documents and Settings\tso\Local Settings\desktop.ini
2013-05-23 21:41 - 2010-07-29 05:13 - 00000278 _ASHC C:\Documents and Settings\pso\ntuser.ini
2013-05-23 21:10 - 2013-05-09 10:41 - 00000000 ____D C:\Documents and Settings\pso\Application Data\PriceGong
2013-05-23 21:10 - 2013-04-12 11:29 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-05-23 21:09 - 2013-02-25 22:52 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\uTorrentControl_v2
2013-05-23 21:08 - 2013-05-23 21:08 - 00000000 ____D C:\Documents and Settings\pso\Application Data\Motive
2013-05-23 21:02 - 2013-05-23 21:02 - 00000000 ____D C:\Documents and Settings\pso\Application Data\AVG SafeGuard toolbar
2013-05-23 21:02 - 2013-04-24 18:26 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\INISet
2013-05-23 21:02 - 2010-07-29 05:13 - 00000062 __ASH C:\Documents and Settings\pso\Local Settings\desktop.ini
2013-05-23 16:32 - 2013-05-23 16:32 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\PriceGong
2013-05-23 16:32 - 2012-09-23 22:48 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\uTorrentControl_v2
2013-05-23 16:32 - 2010-07-12 19:38 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\Google
2013-05-23 16:31 - 2013-04-24 21:45 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\INISet
2013-05-23 16:30 - 2009-08-31 16:21 - 00000062 __ASH C:\Documents and Settings\Guest\Local Settings\desktop.ini
2013-05-23 16:29 - 2013-05-15 12:16 - 00016442 ____A C:\Windows\KB2847204-IE8.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00232506 ____A C:\Windows\iis6.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00216397 ____A C:\Windows\FaxSetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00103460 ____A C:\Windows\ocgen.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00098699 ____A C:\Windows\tsoc.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00072333 ____A C:\Windows\comsetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00043670 ____A C:\Windows\ntdtcsetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00037905 ____A C:\Windows\netfxocm.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00014875 ____A C:\Windows\MedCtrOC.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00011881 ____A C:\Windows\ocmsn.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00010846 ____A C:\Windows\tabletoc.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00010815 ____A C:\Windows\msgsocm.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00001374 ____A C:\Windows\imsins.log
2013-05-23 16:28 - 2013-05-23 16:28 - 00012994 ____A C:\Windows\KB2510531-IE8.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00066126 ____A C:\Windows\msmqinst.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00049496 ____A C:\Windows\updspapi.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00001374 ____A C:\Windows\imsins.BAK
2013-05-23 16:26 - 2013-05-23 16:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Motive
2013-05-23 16:18 - 2013-05-23 16:13 - 00000000 ____D C:\Program Files\Common Files\Motive
2013-05-23 16:14 - 2013-05-23 16:14 - 00001820 ____A C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
2013-05-23 16:14 - 2013-05-23 16:13 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Motive
2013-05-23 16:14 - 2012-08-19 13:01 - 00000000 ____D C:\Program Files\TELUS
2013-05-23 16:10 - 2012-09-17 18:09 - 00000000 ____D C:\Program Files\uTorrentControl_v2
2013-05-23 16:10 - 2012-09-17 18:09 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\uTorrentControl_v2
2013-05-23 16:01 - 2013-05-23 15:57 - 00007281 ____A C:\Windows\spupdsvc.log
2013-05-23 16:00 - 2009-04-21 06:50 - 00000000 ____D C:\Windows\Help
2013-05-23 15:59 - 2013-05-23 15:59 - 00037114 ____A C:\Windows\KB2744842-IE8.log
2013-05-23 15:59 - 2013-05-23 15:58 - 00036950 ____A C:\Windows\KB2618444-IE8.log
2013-05-23 15:59 - 2013-05-23 15:45 - 00140674 ____A C:\Windows\ie8_main.log
2013-05-23 15:59 - 2013-05-15 21:48 - 00121115 ____A C:\Windows\KB2829530-IE8.log
2013-05-23 15:59 - 2009-04-21 14:28 - 00000000 ___HD C:\Windows\$hf_mig$
2013-05-23 15:58 - 2013-05-23 15:58 - 00030243 ____A C:\Windows\KB2598845-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00029602 ____A C:\Windows\KB2467659.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00000000 __HDC C:\Windows\$NtUninstallKB2467659$
2013-05-23 15:58 - 2013-05-23 15:57 - 00037767 ____A C:\Windows\KB982381-IE8.log
2013-05-23 15:57 - 2013-05-23 15:56 - 00039585 ____A C:\Windows\ie8.log
2013-05-23 15:57 - 2013-05-23 15:56 - 00000000 __HDC C:\Windows\ie8
2013-05-23 15:57 - 2009-04-21 06:50 - 00000000 ____D C:\Windows\Media
2013-05-23 15:50 - 2013-05-23 15:50 - 00003774 ____A C:\Windows\KB951978.log
2013-05-23 15:46 - 2013-05-23 15:45 - 00035668 ____A C:\Windows\ie8Uninst.log
2013-05-23 15:46 - 2009-06-11 23:45 - 00000000 ____D C:\Windows\ie8updates
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\TELUS
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\Radialpoint
2013-05-23 14:53 - 2012-04-30 07:57 - 00000990 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
2013-05-23 14:16 - 2013-05-23 14:16 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\AVG SafeGuard toolbar
2013-05-23 12:51 - 2011-03-14 21:50 - 00000000 ___RD C:\Program Files\Skype
2013-05-23 12:51 - 2009-04-23 20:57 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Skype
2013-05-22 22:07 - 2013-05-22 22:06 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\PriceGong
2013-05-22 22:07 - 2013-05-22 22:06 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\blekkotb
2013-05-22 22:06 - 2013-05-22 22:06 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\Application Data\uTorrentControl_v2
2013-05-22 22:06 - 2013-05-22 22:06 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\Application Data\Conduit
2013-05-22 22:06 - 2013-05-20 04:26 - 00000582 ____A C:\Windows\System32\funshion.ini
2013-05-22 22:05 - 2013-04-24 16:56 - 00000000 ____D C:\FunshionMedia
2013-05-21 18:32 - 2013-05-21 18:32 - 00000000 ____D C:\Documents and Settings\tso\Application Data\AVG SafeGuard toolbar
2013-05-21 14:13 - 2013-05-14 14:13 - 00000462 ____A C:\Windows\Tasks\At3.job
2013-05-21 14:00 - 2013-05-14 14:13 - 00000462 ____A C:\Windows\Tasks\At4.job
2013-05-21 10:25 - 2013-05-21 10:25 - 00000000 ____D C:\Windows\System32\cache
2013-05-21 10:25 - 2013-03-12 13:11 - 00037664 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx86.sys
2013-05-21 10:25 - 2013-03-12 13:11 - 00000000 ____D C:\Program Files\AVG SafeGuard toolbar
2013-05-21 10:25 - 2004-08-04 05:00 - 00013646 ____A C:\Windows\System32\wpa.dbl
2013-05-19 10:15 - 2009-10-31 06:36 - 00000918 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
2013-05-19 10:10 - 2013-05-14 14:13 - 00000462 ____A C:\Windows\Tasks\At1.job
2013-05-19 09:49 - 2009-10-13 00:07 - 00000000 ____D C:\Windows\Microsoft.NET
2013-05-18 17:44 - 2009-04-21 06:57 - 00577100 ___AC C:\Windows\System32\PerfStringBackup.INI
2013-05-16 13:07 - 2013-05-16 13:07 - 00000000 ____D C:\dbfecd5f7d2e63eac17b4786
2013-05-15 20:40 - 2013-05-14 14:13 - 00000462 ____A C:\Windows\Tasks\At2.job
2013-05-15 19:22 - 2010-12-30 13:31 - 00000000 ____D C:\Documents and Settings\pso\Desktop\2013 ALL DOCU old~new
2013-05-15 17:43 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\SearchNewTab
2013-05-15 12:21 - 2009-04-21 06:55 - 02176880 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 12:17 - 2013-05-15 12:16 - 00000000 ____D C:\78415340c7ea0ba5fa
2013-05-15 12:16 - 2013-05-15 12:16 - 00006960 ____A C:\Windows\KB2820197.log
2013-05-15 12:16 - 2013-05-15 12:16 - 00000000 __HDC C:\Windows\$NtUninstallKB2820197$
2013-05-15 12:12 - 2009-04-22 00:28 - 72607752 ___AC (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-15 12:11 - 2013-05-15 12:11 - 00000000 __HDC C:\Windows\$NtUninstallKB2829361$
2013-05-15 12:11 - 2013-05-15 11:08 - 00010405 ____A C:\Windows\KB2829361.log
2013-05-15 11:45 - 2012-07-07 00:29 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-05-15 11:45 - 2011-06-20 00:59 - 00071048 ___AC (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Program Files\EasyLife
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\StarApp
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\BetterSoft
2013-05-14 18:38 - 2013-05-14 18:37 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\InstallMate
2013-05-14 18:00 - 2013-05-14 18:01 - 00090112 ____A C:\Windows\Minidump\Mini051413-01.dmp
2013-05-14 16:11 - 2010-07-29 23:48 - 00023552 ___AC C:\Documents and Settings\pso\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-05-14 16:11 - 2009-04-21 15:08 - 00000069 ___AC C:\Windows\NeroDigital.ini
2013-05-14 15:30 - 2011-01-14 15:18 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\HP
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Visan
2013-05-14 15:16 - 2013-05-14 14:14 - 00001742 ____A C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
2013-05-14 15:16 - 2013-05-14 14:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Visan
2013-05-14 15:16 - 2013-05-14 14:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP Photo Creations
2013-05-14 14:58 - 2013-02-25 18:04 - 00280073 ____A C:\Windows\setupapi.log
2013-05-14 14:14 - 2013-05-14 14:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
2013-05-14 14:14 - 2013-05-14 14:13 - 00000000 ____D C:\Program Files\HP Photo Creations
2013-05-14 14:13 - 2011-03-05 17:24 - 00000000 ____D C:\Program Files\Coupons
2013-05-14 14:12 - 2013-05-14 14:12 - 00001993 ____A C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2013-05-14 14:12 - 00000925 ____A C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2010-06-21 10:52 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\HpUpdate
2013-05-14 14:12 - 2009-04-21 21:33 - 00000000 ____D C:\Program Files\HP
2013-05-14 14:11 - 2009-04-21 21:34 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP
2013-05-14 14:09 - 2013-05-14 14:09 - 00000057 ____A C:\Documents and Settings\All Users\Application Data\Ament.ini
2013-05-14 14:08 - 2009-05-22 00:03 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\HP
2013-05-14 13:37 - 2013-05-06 08:43 - 00000000 ____D C:\Documents and Settings\pso\Desktop\cari. cruise
2013-05-14 09:43 - 2011-07-23 17:53 - 00000000 ____D C:\Documents and Settings\pso\My Documents\pso's RECEIPT
2013-05-13 11:07 - 2013-04-24 17:10 - 00000000 ____D C:\Program Files\kuping4
2013-05-13 10:22 - 2009-04-23 20:58 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Skype
2013-05-13 10:21 - 2013-05-13 10:21 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-05-13 10:13 - 2009-05-26 10:38 - 00000000 ____D C:\Documents and Settings\tso\Application Data\Skype
2013-05-12 21:50 - 2010-09-28 19:14 - 00041472 _ASHC C:\Documents and Settings\pso\My Documents\Thumbs.db
2013-05-12 17:03 - 2010-11-13 13:45 - 00000000 ____D C:\Documents and Settings\pso\Application Data\U3
2013-05-12 10:24 - 2011-02-08 14:37 - 00000000 ____D C:\Documents and Settings\All Users\Documents\Shared Docu
2013-05-12 10:15 - 2009-04-22 14:56 - 00000000 ____D C:\Documents and Settings\tso\Application Data\Mozilla
2013-05-06 21:27 - 2009-03-08 04:41 - 06015488 ____C (Microsoft Corporation) C:\Windows\System32\dllcache\mshtml.dll
2013-05-06 21:27 - 2004-08-04 05:00 - 06015488 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-06 18:29 - 2009-05-02 10:05 - 00076576 ___AC C:\Documents and Settings\tso\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-05-06 09:40 - 2010-02-19 10:46 - 00076576 ___AC C:\Documents and Settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-05-02 08:28 - 2012-08-22 19:10 - 00238872 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2013-04-25 18:32 - 2009-04-22 00:16 - 00076576 ___AC C:\Documents and Settings\Vivian\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-04-25 18:21 - 2010-07-29 22:00 - 00076576 ___AC C:\Documents and Settings\pso\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-04-25 18:16 - 2012-08-25 06:12 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\TomTom
2013-04-25 18:15 - 2011-01-04 00:47 - 00000000 ____D C:\Program Files\Overture 4.0 繁體中文版
2013-04-25 17:20 - 2013-04-24 17:10 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\AIRPLAY
2013-04-24 17:43 - 2013-04-24 16:56 - 00000000 ____D C:\Program Files\Baofeng
2013-04-24 17:16 - 2013-04-24 16:56 - 00000000 ____D C:\Documents and Settings\Vivian\funshion
2013-04-24 17:16 - 2013-03-10 23:58 - 00001829 ____A C:\Documents and Settings\Vivian\funshion.ini
2013-04-24 17:14 - 2013-04-24 17:10 - 00000000 ____D C:\Program Files\Audio_Air
2013-04-24 17:13 - 2013-04-24 16:55 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Baidu
2013-04-24 17:11 - 2010-03-05 11:43 - 00000000 ____D C:\Program Files\360
2013-04-24 17:09 - 2010-01-15 21:40 - 00001692 ____A C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
2013-04-24 17:06 - 2013-04-15 11:10 - 00000000 ____D C:\Documents and Settings\Vivian\My Documents\Tax
2013-04-24 17:04 - 2013-04-24 17:02 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\360safe
2013-04-24 16:59 - 2013-04-24 16:59 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\360Login
2013-04-24 16:57 - 2013-04-24 16:57 - 00000065 ____A C:\prefs.js
2013-04-24 16:56 - 2013-04-24 16:56 - 00000000 ____D C:\Program Files\Funshion Online
2013-04-24 16:55 - 2013-04-24 16:55 - 00000000 ____D C:\Program Files\baidu
2013-04-24 16:55 - 2013-04-24 16:55 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Baidu
2013-04-24 16:53 - 2013-04-24 16:53 - 00000000 ____D C:\Program Files\Wuji

Other Malware:
===========
C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At4.job

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================
dditional scan result of Farbar Recovery Scan Tool (x86) Version: 24-05-2013 03
Ran by Vivian at 2013-05-24 15:12:53 Run:
Running from C:\Documents and Settings\Vivian\My Documents\Downloads
Boot Mode: Normal
==========================================================

==================== Installed Programs =======================

·é?ùíá?1 1.30 (Version: 1.30)
32 Bit HP CIO Components Installer (Version: 6.1.1)
Acrobat.com (Version: 1.6.65)
Adobe AIR (Version: 3.4.0.2710)
Adobe Anchor Service CS4 (Version: 2.0)
Adobe Bridge CS4 (Version: 3)
Adobe CMaps CS4 (Version: 2.0)
Adobe Color - Photoshop Specific CS4 (Version: 2.0)
Adobe Color EU Extra Settings CS4 (Version: 2.0)
Adobe Color JA Extra Settings CS4 (Version: 2.0)
Adobe Color NA Recommended Settings CS4 (Version: 2.0)
Adobe Color Video Profiles CS CS4 (Version: 2.0)
Adobe CSI CS4 (Version: 1)
Adobe Default Language CS4 (Version: 2.0)
Adobe Device Central CS4 (Version: 2)
Adobe Drive CS4 (Version: 1)
Adobe ExtendScript Toolkit CS4 (Version: 3.0.0)
Adobe Extension Manager CS4 (Version: 2.0)
Adobe Flash Player 10 ActiveX (Version: 10.0.22.87)
Adobe Flash Player 10 ActiveX (Version: 10.0.45.2)
Adobe Flash Player 11 Plugin (Version: 11.7.700.202)
Adobe Fonts All (Version: 2.0)
Adobe Linguistics CS4 (Version: 4.0.0)
Adobe Media Player (Version: 0.0.0)
Adobe Media Player (Version: 1.1)
Adobe Output Module (Version: 2.0)
Adobe PDF Library Files CS4 (Version: 9.0)
Adobe Photoshop CS4 (Version: 11.0)
Adobe Photoshop CS4 Support (Version: 11.0)
Adobe Reader X (10.1.6) (Version: 10.1.6)
Adobe Search for Help (Version: 1.0)
Adobe Service Manager Extension (Version: 1.0)
Adobe Setup (Version: 2.0)
Adobe Type Support CS4 (Version: 9.0)
Adobe Update Manager CS4 (Version: 6.0.0)
Adobe WinSoft Linguistics Plugin (Version: 1.1)
Adobe XMP Panels CS4 (Version: 2.0)
AdobeColorCommonSetCMYK (Version: 2.0)
AdobeColorCommonSetRGB (Version: 2.0)
Advanced Registry Optimizer (Version: 6.9)
AMD Processor Driver (Version: 1.3.2.0053)
Anti-phishing Domain Advisor (Version: 1.0.0.0)
Apple Application Support (Version: 1.5.1)
Apple Mobile Device Support (Version: 3.4.0.25)
Apple Software Update (Version: 2.1.2.120)
AVG SafeGuard toolbar (Version: 15.2.0.5)
Bing Bar (Version: 7.1.391.0)
Bonjour (Version: 2.0.5.0)
BufferChm (Version: 130.0.331.000)
Catalina Savings Printer (Version: 1.0.0)
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
Connect (Version: 1.0.0.1)
Copy (Version: 130.0.366.000)
Coupon Printer for Windows (Version: 5.0.0.0)
Destinations (Version: 130.0.0.0)
DeviceDiscovery (Version: 130.0.372.000)
DriverAgent by eSupport.com
Dropbox (Version: 2.0.16)
EasyLife Search 1.74
EasylifeGadget (Version: 1.0)
F4100_doccd (Version: 90.0.200.000)
Facebook Plug-In
Facebook Video Calling 1.2.0.287 (Version: 1.2.287)
Fun4IM
Google Chrome (Version: 27.0.1453.94)
Google Earth Plug-in (Version: 7.0.3.8542)
Google Talk Plugin (Version: 3.19.1.13088)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.4.3607.2246)
Google Update Helper (Version: 1.3.21.145)
GPBaseService2 (Version: 130.0.371.000)
High Definition Audio Driver Package - KB888111 (Version: 20040219.000000)
HiJackThis (Version: 1.0.0)
HP Customer Participation Program 13.0 (Version: 13.0)
HP Imaging Device Functions 13.0 (Version: 13.0)
HP Photo Creations (Version: 1.0.0.11502)
HP Photosmart 7520 series Basic Device Software (Version: 28.0.989.0)
HP Photosmart 7520 series Help (Version: 28.0.0)
HP Photosmart 7520 series Product Improvement Study (Version: 28.0.989.0)
HP Print Projects 1.0 (Version: 1.0)
HP Product Detection (Version: 11.14.0006)
HP Smart Web Printing 4.5 (Version: 4.5)
HP Solution Center 13.0 (Version: 13.0)
HP Update (Version: 5.003.003.001)
hpPrintProjects (Version: 130.0.303.000)
HPProductAssistant (Version: 130.0.371.000)
HPSSupply (Version: 130.0.371.000)
hpWLPGInstaller (Version: 130.0.303.000)
iTunes (Version: 10.2.2.12)
Java Auto Updater (Version: 2.0.2.4)
Junk Mail filter update (Version: 14.0.8117.416)
kuler (Version: 2.0)
Lame ACM MP3 Codec
LG Bluetooth Drivers (Version: 1.1)
LG MC USB U330 driver (Version: 1.0.0.0000)
LG USB Modem Drivers (Version: 4.9.7)
MarketResearch (Version: 130.0.374.000)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office Outlook Connector (Version: 12.0.6423.1000)
Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0)
Microsoft Security Client (Version: 4.2.0223.1)
Microsoft Security Essentials (Version: 4.2.223.1)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Mozilla Firefox 20.0.1 (x86 en-US) (Version: 20.0.1)
Mozilla Maintenance Service (Version: 20.0.1)
MSN
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MyFunCards Toolbar
Nero 7 Essentials (Version: 7.03.1084)
neroxml (Version: 1.0.0)
NVIDIA Drivers
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
PDF Settings CS4 (Version: 9.0)
PG Music Band-in-a-Box Mega Pak 2004
Photoshop Camera Raw (Version: 5.0)
Picasa 3 (Version: 3.9)
QuickTime (Version: 7.69.80.9)
Realtek High Definition Audio Driver (Version: 5.10.0.5605)
Safari (Version: 5.33.18.5)
Samsung Media Studio
SearchNewTab (Version: )
Segoe UI (Version: 14.0.4327.805)
Shop for HP Supplies (Version: 13.0)
Shutterfly Express Uploader (Version: 1.0.0)
Shutterfly Express Uploader (Version: 1.0.0.4)
Simple 1-2-3 Traditional Memories
Skype Click to Call (Version: 6.9.12585)
Skype? 6.3 (Version: 6.3.105)
Smart PDF Converter 6.3.0.480 (Version: 6.3.0.480)
SmartWebPrinting (Version: 130.0.373.000)
SolutionCenter (Version: 130.0.373.000)
Spam Free Search Bar (Version: 1.0.0.12)
Status (Version: 130.0.373.000)
Suite Shared Configuration CS4 (Version: 1.0)
SUPERAntiSpyware (Version: 4.48.1000)
TELUS security advisor 4.1.18 (Version: 4.1.18)
TELUS security services (Version: 10.0.41)
TELUS Support Centre
TrayApp (Version: 130.0.376.000)
Uninstall LG PC Suite III
UnloadSupport (Version: 9.0.0)
Update for Windows Internet Explorer 8 (KB2598845) (Version: 1)
Update for Windows XP (KB2141007) (Version: 1)
Update for Windows XP (KB2345886) (Version: 1)
Update for Windows XP (KB2467659) (Version: 1)
Update for Windows XP (KB2541763) (Version: 1)
Update for Windows XP (KB2607712) (Version: 1)
Update for Windows XP (KB2616676) (Version: 1)
Update for Windows XP (KB2641690) (Version: 1)
Update for Windows XP (KB2661254-v2) (Version: 2)
Update for Windows XP (KB2718704) (Version: 1)
Update for Windows XP (KB2736233) (Version: 1)
Update for Windows XP (KB2749655) (Version: 1)
Update for Windows XP (KB951978) (Version: 1)
Update for Windows XP (KB955759) (Version: 1)
Update for Windows XP (KB955839) (Version: 1)
Update for Windows XP (KB961503) (Version: 1)
Update for Windows XP (KB967715) (Version: 1)
Update for Windows XP (KB968389) (Version: 1)
Update for Windows XP (KB971029) (Version: 1)
Update for Windows XP (KB971737) (Version: 1)
Update for Windows XP (KB973687) (Version: 1)
Update for Windows XP (KB973815) (Version: 1)
uTorrentControl_v2 Toolbar (Version: 6.13.3.501)
vanBasco's Karaoke Player
Visual Studio C++ 10.0 Runtime (Version: 10.0.0)
VLC media player 1.0.5 (Version: 1.0.5)
WebFldrs XP (Version: 9.50.7523)
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray (Version: 1.0)
Windows Genuine Advantage Notifications (KB905474) (Version: 1.9.0040.0)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Live Call (Version: 14.0.8117.0416)
Windows Live Communications Platform (Version: 14.0.8117.416)
Windows Live Essentials (Version: 14.0.8117.0416)
Windows Live Essentials (Version: 14.0.8117.416)
Windows Live Mail (Version: 14.0.8117.0416)
Windows Live Messenger (Version: 14.0.8117.0416)
Windows Live Photo Gallery (Version: 14.0.8117.416)
Windows Live Sign-in Assistant (Version: 5.000.818.5)
Windows Live Sync (Version: 14.0.8117.416)
Windows Live Upload Tool (Version: 14.0.8014.1029)
Windows Live Writer (Version: 14.0.8117.0416)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 3 (Version: 20080414.031525)
WinRAR archiver
XviD MPEG-4 Video Codec (Version: XviD-1.0.3-20122004)
Yahoo! Toolbar
μTorrent (Version: 1.8.2)
μTorrent (Version: 3.2.0)

==================== Restore Points =========================

21-02-2013 17:43:51 Software Distribution Service 3.0
22-02-2013 20:20:18 Software Distribution Service 3.0
23-02-2013 20:27:40 Installed Driver Manager.
23-02-2013 20:31:11 Software Distribution Service 3.0
23-02-2013 20:35:15 Removed Driver Manager.
24-02-2013 21:25:05 Software Distribution Service 3.0
26-02-2013 00:54:05 Software Distribution Service 3.0
27-02-2013 20:13:40 Software Distribution Service 3.0
27-02-2013 22:24:45 Software Distribution Service 3.0
27-02-2013 22:34:51 Software Distribution Service 3.0
28-02-2013 06:19:00 Software Distribution Service 3.0
01-03-2013 00:37:31 Software Distribution Service 3.0
01-03-2013 18:36:17 Software Distribution Service 3.0
01-03-2013 23:53:48 Software Distribution Service 3.0
02-03-2013 18:10:29 Software Distribution Service 3.0
03-03-2013 17:38:04 Unsigned driver install
04-03-2013 01:06:53 Software Distribution Service 3.0
05-03-2013 02:20:46 System Checkpoint
05-03-2013 17:52:45 Software Distribution Service 3.0
06-03-2013 18:57:58 Software Distribution Service 3.0
07-03-2013 19:01:47 Software Distribution Service 3.0
08-03-2013 23:04:54 Software Distribution Service 3.0
10-03-2013 01:10:38 Software Distribution Service 3.0
11-03-2013 01:35:21 System Checkpoint
11-03-2013 17:43:07 Software Distribution Service 3.0
12-03-2013 20:00:13 Software Distribution Service 3.0
12-03-2013 20:14:23 SlimDrivers Installing Drivers
12-03-2013 20:20:21 SlimDrivers Installing Drivers
12-03-2013 20:23:44 SlimDrivers Installing Drivers
13-03-2013 21:56:50 Software Distribution Service 3.0
13-03-2013 22:15:42 Software Distribution Service 3.0
14-03-2013 17:32:49 Unsigned driver install
14-03-2013 17:37:03 Unsigned driver install
14-03-2013 17:53:17 Unsigned driver install
14-03-2013 18:14:14 Unsigned driver install
15-03-2013 00:59:25 Software Distribution Service 3.0
15-03-2013 16:53:29 Removed SlimDrivers
15-03-2013 17:05:05 Unsigned driver install
15-03-2013 17:06:33 Unsigned driver install
15-03-2013 17:18:38 Unsigned driver install
15-03-2013 17:20:45 Unsigned driver install
15-03-2013 17:42:10 Update to an unsigned driver
16-03-2013 19:27:51 Software Distribution Service 3.0
17-03-2013 22:58:49 Software Distribution Service 3.0
19-03-2013 03:26:03 Software Distribution Service 3.0
20-03-2013 21:13:37 Software Distribution Service 3.0
20-03-2013 21:32:43 Software Distribution Service 3.0
22-03-2013 16:58:05 Software Distribution Service 3.0
23-03-2013 22:11:08 Software Distribution Service 3.0
25-03-2013 00:27:38 Software Distribution Service 3.0
26-03-2013 02:32:45 Software Distribution Service 3.0
27-03-2013 03:16:09 System Checkpoint
27-03-2013 16:56:03 Software Distribution Service 3.0
28-03-2013 17:17:47 Software Distribution Service 3.0
28-03-2013 17:21:24 Installed Catalina Savings Printer.
29-03-2013 20:15:15 Software Distribution Service 3.0
30-03-2013 23:17:05 Software Distribution Service 3.0
31-03-2013 23:36:33 Software Distribution Service 3.0
02-04-2013 18:20:06 Software Distribution Service 3.0
04-04-2013 00:37:55 Software Distribution Service 3.0
05-04-2013 23:16:07 Software Distribution Service 3.0
07-04-2013 16:41:09 Software Distribution Service 3.0
08-04-2013 19:31:45 Software Distribution Service 3.0
09-04-2013 19:12:14 Software Distribution Service 3.0
09-04-2013 21:37:33 Software Distribution Service 3.0
11-04-2013 01:46:08 Software Distribution Service 3.0
12-04-2013 01:54:45 System Checkpoint
12-04-2013 18:21:03 Software Distribution Service 3.0
14-04-2013 02:35:50 Software Distribution Service 3.0
15-04-2013 02:38:30 System Checkpoint
15-04-2013 17:57:25 Software Distribution Service 3.0
15-04-2013 18:10:09 Installed GenuTax Standard.
16-04-2013 21:09:17 Software Distribution Service 3.0
18-04-2013 00:03:34 Software Distribution Service 3.0
19-04-2013 01:16:43 System Checkpoint
19-04-2013 17:14:10 Software Distribution Service 3.0
20-04-2013 18:14:25 Software Distribution Service 3.0
21-04-2013 22:25:39 Software Distribution Service 3.0
23-04-2013 00:29:53 Software Distribution Service 3.0
24-04-2013 16:53:04 Software Distribution Service 3.0
25-04-2013 00:06:53 Removed GenuTax Standard.
26-04-2013 00:16:24 Software Distribution Service 3.0
26-04-2013 01:15:18 已移除 Overture 4.0 繁體中文版
01-05-2013 16:27:11 Software Distribution Service 3.0
06-05-2013 05:11:57 Software Distribution Service 3.0
07-05-2013 05:17:11 System Checkpoint
08-05-2013 14:55:39 Software Distribution Service 3.0
09-05-2013 16:04:52 Software Distribution Service 3.0
10-05-2013 18:23:28 Software Distribution Service 3.0
11-05-2013 21:53:14 Software Distribution Service 3.0
13-05-2013 00:11:06 Software Distribution Service 3.0
14-05-2013 00:40:58 System Checkpoint
14-05-2013 02:49:30 Software Distribution Service 3.0
15-05-2013 18:10:01 Software Distribution Service 3.0
15-05-2013 19:11:30 Software Distribution Service 3.0
16-05-2013 04:44:00 Software Distribution Service 3.0
16-05-2013 19:11:29 Software Distribution Service 3.0
16-05-2013 20:07:18 Software Distribution Service 3.0
19-05-2013 00:38:25 Software Distribution Service 3.0
19-05-2013 16:56:00 Software Distribution Service 3.0
21-05-2013 17:36:01 Software Distribution Service 3.0
23-05-2013 01:36:07 Software Distribution Service 3.0
23-05-2013 22:57:10 Installed Windows Internet Explorer 8.
23-05-2013 22:57:51 Software Distribution Service 3.0
23-05-2013 23:28:22 Software Distribution Service 3.0
24-05-2013 04:14:24 Software Distribution Service 3.0

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (05/19/2013 10:05:23 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:11 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:04:59 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 . Error code = 0x80131f06

System errors:
=============
Error: (05/24/2013 03:02:10 PM) (Source: Service Control Manager) (User: )
Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
%%5

Error: (05/24/2013 03:00:46 PM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service failed to start due to the following error: 
%%2

Error: (05/24/2013 03:00:45 PM) (Source: Service Control Manager) (User: )
Description: The Amsp service failed to start due to the following error: 
%%3

Error: (05/24/2013 03:00:45 PM) (Source: Service Control Manager) (User: )
Description: The KAVSafe service failed to start due to the following error: 
%%2

Error: (05/24/2013 07:40:39 AM) (Source: Service Control Manager) (User: )
Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
%%5

Error: (05/24/2013 07:39:53 AM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service failed to start due to the following error: 
%%2

Error: (05/24/2013 07:39:51 AM) (Source: Service Control Manager) (User: )
Description: The Amsp service failed to start due to the following error: 
%%3

Error: (05/24/2013 07:39:51 AM) (Source: Service Control Manager) (User: )
Description: The KAVSafe service failed to start due to the following error: 
%%2

Error: (05/24/2013 07:35:23 AM) (Source: Service Control Manager) (User: )
Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
%%5

Error: (05/24/2013 07:03:21 AM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service failed to start due to the following error: 
%%2

Microsoft Office Sessions:
=========================
Error: (05/19/2013 10:05:23 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:11 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:04:59 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 . Error code = 0x80131f06 
System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35

==================== Memory info ===========================

Percentage of memory in use: 68%
Total physical RAM: 1983.29 MB
Available physical RAM: 626.28 MB
Total Pagefile: 3876.44 MB
Available Pagefile: 2631.27 MB
Total Virtual: 2047.88 MB
Available Virtual: 1958.12 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.75 GB) (Free:376.35 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-05-2013 03
Ran by Vivian at 2013-05-24 15:12:53 Run:
Running from C:\Documents and Settings\Vivian\My Documents\Downloads
Boot Mode: Normal
==========================================================

==================== Installed Programs =======================

·é?ùíá?1 1.30 (Version: 1.30)
32 Bit HP CIO Components Installer (Version: 6.1.1)
Acrobat.com (Version: 1.6.65)
Adobe AIR (Version: 3.4.0.2710)
Adobe Anchor Service CS4 (Version: 2.0)
Adobe Bridge CS4 (Version: 3)
Adobe CMaps CS4 (Version: 2.0)
Adobe Color - Photoshop Specific CS4 (Version: 2.0)
Adobe Color EU Extra Settings CS4 (Version: 2.0)
Adobe Color JA Extra Settings CS4 (Version: 2.0)
Adobe Color NA Recommended Settings CS4 (Version: 2.0)
Adobe Color Video Profiles CS CS4 (Version: 2.0)
Adobe CSI CS4 (Version: 1)
Adobe Default Language CS4 (Version: 2.0)
Adobe Device Central CS4 (Version: 2)
Adobe Drive CS4 (Version: 1)
Adobe ExtendScript Toolkit CS4 (Version: 3.0.0)
Adobe Extension Manager CS4 (Version: 2.0)
Adobe Flash Player 10 ActiveX (Version: 10.0.22.87)
Adobe Flash Player 10 ActiveX (Version: 10.0.45.2)
Adobe Flash Player 11 Plugin (Version: 11.7.700.202)
Adobe Fonts All (Version: 2.0)
Adobe Linguistics CS4 (Version: 4.0.0)
Adobe Media Player (Version: 0.0.0)
Adobe Media Player (Version: 1.1)
Adobe Output Module (Version: 2.0)
Adobe PDF Library Files CS4 (Version: 9.0)
Adobe Photoshop CS4 (Version: 11.0)
Adobe Photoshop CS4 Support (Version: 11.0)
Adobe Reader X (10.1.6) (Version: 10.1.6)
Adobe Search for Help (Version: 1.0)
Adobe Service Manager Extension (Version: 1.0)
Adobe Setup (Version: 2.0)
Adobe Type Support CS4 (Version: 9.0)
Adobe Update Manager CS4 (Version: 6.0.0)
Adobe WinSoft Linguistics Plugin (Version: 1.1)
Adobe XMP Panels CS4 (Version: 2.0)
AdobeColorCommonSetCMYK (Version: 2.0)
AdobeColorCommonSetRGB (Version: 2.0)
Advanced Registry Optimizer (Version: 6.9)
AMD Processor Driver (Version: 1.3.2.0053)
Anti-phishing Domain Advisor (Version: 1.0.0.0)
Apple Application Support (Version: 1.5.1)
Apple Mobile Device Support (Version: 3.4.0.25)
Apple Software Update (Version: 2.1.2.120)
AVG SafeGuard toolbar (Version: 15.2.0.5)
Bing Bar (Version: 7.1.391.0)
Bonjour (Version: 2.0.5.0)
BufferChm (Version: 130.0.331.000)
Catalina Savings Printer (Version: 1.0.0)
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
Connect (Version: 1.0.0.1)
Copy (Version: 130.0.366.000)
Coupon Printer for Windows (Version: 5.0.0.0)
Destinations (Version: 130.0.0.0)
DeviceDiscovery (Version: 130.0.372.000)
DriverAgent by eSupport.com
Dropbox (Version: 2.0.16)
EasyLife Search 1.74
EasylifeGadget (Version: 1.0)
F4100_doccd (Version: 90.0.200.000)
Facebook Plug-In
Facebook Video Calling 1.2.0.287 (Version: 1.2.287)
Fun4IM
Google Chrome (Version: 27.0.1453.94)
Google Earth Plug-in (Version: 7.0.3.8542)
Google Talk Plugin (Version: 3.19.1.13088)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.4.3607.2246)
Google Update Helper (Version: 1.3.21.145)
GPBaseService2 (Version: 130.0.371.000)
High Definition Audio Driver Package - KB888111 (Version: 20040219.000000)
HiJackThis (Version: 1.0.0)
HP Customer Participation Program 13.0 (Version: 13.0)
HP Imaging Device Functions 13.0 (Version: 13.0)
HP Photo Creations (Version: 1.0.0.11502)
HP Photosmart 7520 series Basic Device Software (Version: 28.0.989.0)
HP Photosmart 7520 series Help (Version: 28.0.0)
HP Photosmart 7520 series Product Improvement Study (Version: 28.0.989.0)
HP Print Projects 1.0 (Version: 1.0)
HP Product Detection (Version: 11.14.0006)
HP Smart Web Printing 4.5 (Version: 4.5)
HP Solution Center 13.0 (Version: 13.0)
HP Update (Version: 5.003.003.001)
hpPrintProjects (Version: 130.0.303.000)
HPProductAssistant (Version: 130.0.371.000)
HPSSupply (Version: 130.0.371.000)
hpWLPGInstaller (Version: 130.0.303.000)
iTunes (Version: 10.2.2.12)
Java Auto Updater (Version: 2.0.2.4)
Junk Mail filter update (Version: 14.0.8117.416)
kuler (Version: 2.0)
Lame ACM MP3 Codec
LG Bluetooth Drivers (Version: 1.1)
LG MC USB U330 driver (Version: 1.0.0.0000)
LG USB Modem Drivers (Version: 4.9.7)
MarketResearch (Version: 130.0.374.000)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office Outlook Connector (Version: 12.0.6423.1000)
Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0)
Microsoft Security Client (Version: 4.2.0223.1)
Microsoft Security Essentials (Version: 4.2.223.1)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Mozilla Firefox 20.0.1 (x86 en-US) (Version: 20.0.1)
Mozilla Maintenance Service (Version: 20.0.1)
MSN
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MyFunCards Toolbar
Nero 7 Essentials (Version: 7.03.1084)
neroxml (Version: 1.0.0)
NVIDIA Drivers
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
PDF Settings CS4 (Version: 9.0)
PG Music Band-in-a-Box Mega Pak 2004
Photoshop Camera Raw (Version: 5.0)
Picasa 3 (Version: 3.9)
QuickTime (Version: 7.69.80.9)
Realtek High Definition Audio Driver (Version: 5.10.0.5605)
Safari (Version: 5.33.18.5)
Samsung Media Studio
SearchNewTab (Version: )
Segoe UI (Version: 14.0.4327.805)
Shop for HP Supplies (Version: 13.0)
Shutterfly Express Uploader (Version: 1.0.0)
Shutterfly Express Uploader (Version: 1.0.0.4)
Simple 1-2-3 Traditional Memories
Skype Click to Call (Version: 6.9.12585)
Skype? 6.3 (Version: 6.3.105)
Smart PDF Converter 6.3.0.480 (Version: 6.3.0.480)
SmartWebPrinting (Version: 130.0.373.000)
SolutionCenter (Version: 130.0.373.000)
Spam Free Search Bar (Version: 1.0.0.12)
Status (Version: 130.0.373.000)
Suite Shared Configuration CS4 (Version: 1.0)
SUPERAntiSpyware (Version: 4.48.1000)
TELUS security advisor 4.1.18 (Version: 4.1.18)
TELUS security services (Version: 10.0.41)
TELUS Support Centre
TrayApp (Version: 130.0.376.000)
Uninstall LG PC Suite III
UnloadSupport (Version: 9.0.0)
Update for Windows Internet Explorer 8 (KB2598845) (Version: 1)
Update for Windows XP (KB2141007) (Version: 1)
Update for Windows XP (KB2345886) (Version: 1)
Update for Windows XP (KB2467659) (Version: 1)
Update for Windows XP (KB2541763) (Version: 1)
Update for Windows XP (KB2607712) (Version: 1)
Update for Windows XP (KB2616676) (Version: 1)
Update for Windows XP (KB2641690) (Version: 1)
Update for Windows XP (KB2661254-v2) (Version: 2)
Update for Windows XP (KB2718704) (Version: 1)
Update for Windows XP (KB2736233) (Version: 1)
Update for Windows XP (KB2749655) (Version: 1)
Update for Windows XP (KB951978) (Version: 1)
Update for Windows XP (KB955759) (Version: 1)
Update for Windows XP (KB955839) (Version: 1)
Update for Windows XP (KB961503) (Version: 1)
Update for Windows XP (KB967715) (Version: 1)
Update for Windows XP (KB968389) (Version: 1)
Update for Windows XP (KB971029) (Version: 1)
Update for Windows XP (KB971737) (Version: 1)
Update for Windows XP (KB973687) (Version: 1)
Update for Windows XP (KB973815) (Version: 1)
uTorrentControl_v2 Toolbar (Version: 6.13.3.501)
vanBasco's Karaoke Player
Visual Studio C++ 10.0 Runtime (Version: 10.0.0)
VLC media player 1.0.5 (Version: 1.0.5)
WebFldrs XP (Version: 9.50.7523)
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray (Version: 1.0)
Windows Genuine Advantage Notifications (KB905474) (Version: 1.9.0040.0)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Live Call (Version: 14.0.8117.0416)
Windows Live Communications Platform (Version: 14.0.8117.416)
Windows Live Essentials (Version: 14.0.8117.0416)
Windows Live Essentials (Version: 14.0.8117.416)
Windows Live Mail (Version: 14.0.8117.0416)
Windows Live Messenger (Version: 14.0.8117.0416)
Windows Live Photo Gallery (Version: 14.0.8117.416)
Windows Live Sign-in Assistant (Version: 5.000.818.5)
Windows Live Sync (Version: 14.0.8117.416)
Windows Live Upload Tool (Version: 14.0.8014.1029)
Windows Live Writer (Version: 14.0.8117.0416)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 3 (Version: 20080414.031525)
WinRAR archiver
XviD MPEG-4 Video Codec (Version: XviD-1.0.3-20122004)
Yahoo! Toolbar
μTorrent (Version: 1.8.2)
μTorrent (Version: 3.2.0)

==================== Restore Points =========================

21-02-2013 17:43:51 Software Distribution Service 3.0
22-02-2013 20:20:18 Software Distribution Service 3.0
23-02-2013 20:27:40 Installed Driver Manager.
23-02-2013 20:31:11 Software Distribution Service 3.0
23-02-2013 20:35:15 Removed Driver Manager.
24-02-2013 21:25:05 Software Distribution Service 3.0
26-02-2013 00:54:05 Software Distribution Service 3.0
27-02-2013 20:13:40 Software Distribution Service 3.0
27-02-2013 22:24:45 Software Distribution Service 3.0
27-02-2013 22:34:51 Software Distribution Service 3.0
28-02-2013 06:19:00 Software Distribution Service 3.0
01-03-2013 00:37:31 Software Distribution Service 3.0
01-03-2013 18:36:17 Software Distribution Service 3.0
01-03-2013 23:53:48 Software Distribution Service 3.0
02-03-2013 18:10:29 Software Distribution Service 3.0
03-03-2013 17:38:04 Unsigned driver install
04-03-2013 01:06:53 Software Distribution Service 3.0
05-03-2013 02:20:46 System Checkpoint
05-03-2013 17:52:45 Software Distribution Service 3.0
06-03-2013 18:57:58 Software Distribution Service 3.0
07-03-2013 19:01:47 Software Distribution Service 3.0
08-03-2013 23:04:54 Software Distribution Service 3.0
10-03-2013 01:10:38 Software Distribution Service 3.0
11-03-2013 01:35:21 System Checkpoint
11-03-2013 17:43:07 Software Distribution Service 3.0
12-03-2013 20:00:13 Software Distribution Service 3.0
12-03-2013 20:14:23 SlimDrivers Installing Drivers
12-03-2013 20:20:21 SlimDrivers Installing Drivers
12-03-2013 20:23:44 SlimDrivers Installing Drivers
13-03-2013 21:56:50 Software Distribution Service 3.0
13-03-2013 22:15:42 Software Distribution Service 3.0
14-03-2013 17:32:49 Unsigned driver install
14-03-2013 17:37:03 Unsigned driver install
14-03-2013 17:53:17 Unsigned driver install
14-03-2013 18:14:14 Unsigned driver install
15-03-2013 00:59:25 Software Distribution Service 3.0
15-03-2013 16:53:29 Removed SlimDrivers
15-03-2013 17:05:05 Unsigned driver install
15-03-2013 17:06:33 Unsigned driver install
15-03-2013 17:18:38 Unsigned driver install
15-03-2013 17:20:45 Unsigned driver install
15-03-2013 17:42:10 Update to an unsigned driver
16-03-2013 19:27:51 Software Distribution Service 3.0
17-03-2013 22:58:49 Software Distribution Service 3.0
19-03-2013 03:26:03 Software Distribution Service 3.0
20-03-2013 21:13:37 Software Distribution Service 3.0
20-03-2013 21:32:43 Software Distribution Service 3.0
22-03-2013 16:58:05 Software Distribution Service 3.0
23-03-2013 22:11:08 Software Distribution Service 3.0
25-03-2013 00:27:38 Software Distribution Service 3.0
26-03-2013 02:32:45 Software Distribution Service 3.0
27-03-2013 03:16:09 System Checkpoint
27-03-2013 16:56:03 Software Distribution Service 3.0
28-03-2013 17:17:47 Software Distribution Service 3.0
28-03-2013 17:21:24 Installed Catalina Savings Printer.
29-03-2013 20:15:15 Software Distribution Service 3.0
30-03-2013 23:17:05 Software Distribution Service 3.0
31-03-2013 23:36:33 Software Distribution Service 3.0
02-04-2013 18:20:06 Software Distribution Service 3.0
04-04-2013 00:37:55 Software Distribution Service 3.0
05-04-2013 23:16:07 Software Distribution Service 3.0
07-04-2013 16:41:09 Software Distribution Service 3.0
08-04-2013 19:31:45 Software Distribution Service 3.0
09-04-2013 19:12:14 Software Distribution Service 3.0
09-04-2013 21:37:33 Software Distribution Service 3.0
11-04-2013 01:46:08 Software Distribution Service 3.0
12-04-2013 01:54:45 System Checkpoint
12-04-2013 18:21:03 Software Distribution Service 3.0
14-04-2013 02:35:50 Software Distribution Service 3.0
15-04-2013 02:38:30 System Checkpoint
15-04-2013 17:57:25 Software Distribution Service 3.0
15-04-2013 18:10:09 Installed GenuTax Standard.
16-04-2013 21:09:17 Software Distribution Service 3.0
18-04-2013 00:03:34 Software Distribution Service 3.0
19-04-2013 01:16:43 System Checkpoint
19-04-2013 17:14:10 Software Distribution Service 3.0
20-04-2013 18:14:25 Software Distribution Service 3.0
21-04-2013 22:25:39 Software Distribution Service 3.0
23-04-2013 00:29:53 Software Distribution Service 3.0
24-04-2013 16:53:04 Software Distribution Service 3.0
25-04-2013 00:06:53 Removed GenuTax Standard.
26-04-2013 00:16:24 Software Distribution Service 3.0
26-04-2013 01:15:18 已移除 Overture 4.0 繁體中文版
01-05-2013 16:27:11 Software Distribution Service 3.0
06-05-2013 05:11:57 Software Distribution Service 3.0
07-05-2013 05:17:11 System Checkpoint
08-05-2013 14:55:39 Software Distribution Service 3.0
09-05-2013 16:04:52 Software Distribution Service 3.0
10-05-2013 18:23:28 Software Distribution Service 3.0
11-05-2013 21:53:14 Software Distribution Service 3.0
13-05-2013 00:11:06 Software Distribution Service 3.0
14-05-2013 00:40:58 System Checkpoint
14-05-2013 02:49:30 Software Distribution Service 3.0
15-05-2013 18:10:01 Software Distribution Service 3.0
15-05-2013 19:11:30 Software Distribution Service 3.0
16-05-2013 04:44:00 Software Distribution Service 3.0
16-05-2013 19:11:29 Software Distribution Service 3.0
16-05-2013 20:07:18 Software Distribution Service 3.0
19-05-2013 00:38:25 Software Distribution Service 3.0
19-05-2013 16:56:00 Software Distribution Service 3.0
21-05-2013 17:36:01 Software Distribution Service 3.0
23-05-2013 01:36:07 Software Distribution Service 3.0
23-05-2013 22:57:10 Installed Windows Internet Explorer 8.
23-05-2013 22:57:51 Software Distribution Service 3.0
23-05-2013 23:28:22 Software Distribution Service 3.0
24-05-2013 04:14:24 Software Distribution Service 3.0

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (05/19/2013 10:05:23 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:11 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06

Error: (05/19/2013 10:04:59 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 . Error code = 0x80131f06

System errors:
=============
Error: (05/24/2013 03:02:10 PM) (Source: Service Control Manager) (User: )
Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
%%5

Error: (05/24/2013 03:00:46 PM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service failed to start due to the following error: 
%%2

Error: (05/24/2013 03:00:45 PM) (Source: Service Control Manager) (User: )
Description: The Amsp service failed to start due to the following error: 
%%3

Error: (05/24/2013 03:00:45 PM) (Source: Service Control Manager) (User: )
Description: The KAVSafe service failed to start due to the following error: 
%%2

Error: (05/24/2013 07:40:39 AM) (Source: Service Control Manager) (User: )
Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
%%5

Error: (05/24/2013 07:39:53 AM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service failed to start due to the following error: 
%%2

Error: (05/24/2013 07:39:51 AM) (Source: Service Control Manager) (User: )
Description: The Amsp service failed to start due to the following error: 
%%3

Error: (05/24/2013 07:39:51 AM) (Source: Service Control Manager) (User: )
Description: The KAVSafe service failed to start due to the following error: 
%%2

Error: (05/24/2013 07:35:23 AM) (Source: Service Control Manager) (User: )
Description: The ScRegSetValueExW call failed for DeleteFlag with the following error: 
%%5

Error: (05/24/2013 07:03:21 AM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service failed to start due to the following error: 
%%2

Microsoft Office Sessions:
=========================
Error: (05/19/2013 10:05:23 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System.Data.SqlXml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:22 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:11 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a . Error code = 0x80131f06 
System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:05:10 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80131f06 
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (05/19/2013 10:04:59 AM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 . Error code = 0x80131f06 
System.ServiceModel.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35

==================== Memory info ===========================

Percentage of memory in use: 68%
Total physical RAM: 1983.29 MB
Available physical RAM: 626.28 MB
Total Pagefile: 3876.44 MB
Available Pagefile: 2631.27 MB
Total Virtual: 2047.88 MB
Available Virtual: 1958.12 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.75 GB) (Free:376.35 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 466 GB) (Disk ID: C154C154)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================
OTL logfile created on: 5/24/2013 3:15:40 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Vivian\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 0.81 Gb Available Physical Memory | 42.01% Memory free
3.79 Gb Paging File | 2.77 Gb Available in Paging File | 73.26% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 376.34 Gb Free Space | 80.80% Space Free | Partition Type: NTFS

Computer Name: VIVIANSCOMPUTER | User Name: Vivian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: MSACM.LHACM - C:\WINDOWS\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm119 - C:\WINDOWS\System32\vdk32119.acm (Voxware)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MPG4 - C:\WINDOWS\System32\msscmc32.dll (Microsoft Corporation)
Drivers32: VIDC.TR20 - C:\WINDOWS\System32\tr2032.dll (The Duck Corporation)
Drivers32: VIDC.VDOM - C:\WINDOWS\System32\VDOWAVE.DRV (VDOnet LTD..)
Drivers32: vidc.vivo - C:\WINDOWS\System32\ivvideo.dll (Vivo Software)
Drivers32: VIDC.WMV3 - C:\WINDOWS\System32\wmv9vcm.dll (Microsoft Corporation)
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Custom Scans ==========

========== Base Services ==========
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\alg.exe -- (ALG)
SRV - [2008/04/14 05:42:12 | 000,006,656 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wuauserv.dll -- (wuauserv)
SRV - [2008/04/14 05:42:04 | 000,409,088 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\qmgr.dll -- (BITS)
SRV - [2012/07/06 06:58:51 | 000,078,336 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\system32\browser.dll -- (Browser)
SRV - [2008/04/14 05:41:52 | 000,062,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\cryptsvc.dll -- (CryptSvc)
SRV - [2008/04/14 05:41:52 | 000,126,976 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\dhcpcsvc.dll -- (Dhcp)
SRV - [2009/04/20 10:17:26 | 000,045,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\dnsrslvr.dll -- (Dnscache)
SRV - [2009/02/06 04:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\services.exe -- (Eventlog)
SRV - [2008/04/14 05:41:54 | 000,033,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\eapsvc.dll -- (EapHost)
SRV - [2009/07/27 16:17:41 | 000,135,168 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\shsvcs.dll -- (FastUserSwitchingCompatibility)
SRV - [2008/04/14 05:42:10 | 000,015,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\w3ssl.dll -- (HTTPFilter)
SRV - [2008/04/14 05:41:56 | 000,021,504 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\hidserv.dll -- (HidServ)
SRV - [2008/04/14 05:42:24 | 000,150,528 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\imapi.exe -- (ImapiService)
SRV - [2008/04/14 05:42:26 | 000,013,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\lsass.exe -- (PolicyAgent)
SRV - [2008/04/14 05:41:54 | 000,023,552 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\WINDOWS\system32\dmserver.dll -- (dmserver)
SRV - [2008/04/14 05:42:18 | 000,224,768 | ---- | M] (Microsoft Corp., Veritas Software) [On_Demand | Stopped] -- C:\WINDOWS\System32\dmadmin.exe -- (dmadmin)
SRV - [2008/04/14 05:42:18 | 000,005,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\dllhost.exe -- (SwPrv)
SRV - [2008/04/14 05:42:26 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\lsass.exe -- (Netlogon)
SRV - [2008/04/14 05:42:02 | 000,198,144 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\netman.dll -- (Netman)
SRV - [2008/06/20 09:02:47 | 000,245,248 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\mswsock.dll -- (Nla)
SRV - [2009/02/06 04:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\services.exe -- (PlugPlay)
SRV - [2010/08/17 06:17:06 | 000,058,880 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\spoolsv.exe -- (Spooler)
SRV - [2008/04/14 05:42:26 | 000,013,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\lsass.exe -- (ProtectedStorage)
SRV - [2008/04/14 05:42:04 | 000,088,576 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\rasauto.dll -- (RasAuto)
SRV - [2008/04/14 05:42:04 | 000,186,368 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\rasmans.dll -- (RasMan)
SRV - [2009/02/09 05:10:48 | 000,401,408 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\rpcss.dll -- (RpcSs)
SRV - [2008/04/14 05:42:04 | 000,435,200 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\ntmssvc.dll -- (NtmsSvc)
SRV - [2008/04/14 05:42:06 | 000,018,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\seclogon.dll -- (seclogon)
SRV - [2008/04/14 05:42:26 | 000,013,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\lsass.exe -- (SamSs)
SRV - [2008/04/14 05:42:12 | 000,080,896 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wscsvc.dll -- (wscsvc)
SRV - [2010/08/26 22:57:43 | 000,099,840 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\srvsvc.dll -- (lanmanserver)
SRV - [2009/07/27 16:17:41 | 000,135,168 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\shsvcs.dll -- (ShellHWDetection)
SRV - [2008/04/14 05:42:08 | 000,171,008 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\srsvc.dll -- (srservice)
SRV - [2008/04/14 05:42:06 | 000,192,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\schedsvc.dll -- (Schedule)
SRV - [2008/04/14 05:41:58 | 000,013,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\lmhsvc.dll -- (LmHosts)
SRV - [2008/04/14 05:42:08 | 000,249,856 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\tapisrv.dll -- (TapiSrv)
SRV - [2008/04/14 05:42:08 | 000,295,424 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\system32\termsrv.dll -- (TermService)
SRV - [2009/07/27 16:17:41 | 000,135,168 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\shsvcs.dll -- (Themes)
SRV - [2008/04/14 05:42:40 | 000,289,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\vssvc.exe -- (VSS)
SRV - [2008/04/14 05:41:52 | 000,042,496 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\audiosrv.dll -- (AudioSrv)
SRV - [2008/04/14 05:41:56 | 000,331,264 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\ipnathlp.dll -- (SharedAccess)
SRV - [2008/04/14 05:42:10 | 000,333,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wiaservc.dll -- (stisvc)
SRV - [2008/04/14 05:42:30 | 000,078,848 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\msiexec.exe -- (MSIServer)
SRV - [2008/04/14 05:42:10 | 000,144,896 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wbem\wmisvc.dll -- (winmgmt)
SRV - [2009/02/09 05:10:48 | 000,617,472 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\advapi32.dll -- (Wmi)
SRV - [2008/04/14 05:41:54 | 000,132,096 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\dot3svc.dll -- (Dot3svc)
SRV - [2008/04/14 05:42:12 | 000,483,840 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wzcsvc.dll -- (WZCSVC)
SRV - [2009/06/09 23:14:49 | 000,132,096 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\wkssvc.dll -- (lanmanworkstation)

========== Drive Information ==========

Physical Drives
---------------

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed\thard disk media
Interface type: IDE
Media Type: Fixed\thard disk media
Model: ST350041 0AS SCSI Disk Device
Partitions: 1
Status: OK
Status Info: 0

Partitions
---------------

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 466.00GB
Starting Offset: 32256
Hidden sectors: 0

< %SYSTEMDRIVE%\*.exe >

< %PROGRAMFILES%\*.exe >
[2013/02/27 15:27:29 | 020,546,152 | ---- | M] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2011/02/18 13:24:21 | 010,234,024 | ---- | M] ( ) -- C:\Program Files\fwinstall.exe
[2011/02/19 12:17:13 | 053,539,128 | ---- | M] (Logitech, Inc.) -- C:\Program Files\lws110_x64.exe

< %systemdrive%\$Recycle.Bin|@;true;true;true /fp >

< dir C:\ /S /A:L /C >
Volume in drive C has no label.
Volume Serial Number is E42C-8BFC

< End of report >


----------



## emeraldnzl (Nov 3, 2007)

Download attached *fixlist.txt* file and save it to the Desktop.

*NOTE.* It's important that both files, *FRST* and *fixlist.txt *are in the same location or the fix will not work.

*NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system*

Run *FRST/FRST64* and press the *Fix* button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

*Next*

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right click JRT.exe and "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.
*After that*


Close all windows and open *OTL* again. 
Click *Run Scan* and let the program run uninterrupted
It will produce a log for you. Post the log here.
*Note*: If the log doesn't appear where you saved OTL when you downloaded it, then a copy of the OTL log is saved in a text file at

:\_OTL\MovedFiles
in most cases this will be C:\_OTL\MovedFiles
*When you return please post
Fixlog.txt
JRT.txt
OTL.txt
*


----------



## errorloading (Feb 4, 2011)

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 24-05-2013 03
Ran by Vivian at 2013-05-25 15:21:50 Run:1
Running from C:\Documents and Settings\Vivian\My Documents\Downloads
Boot Mode: Normal

==============================================

C:\Program Files\MarkAny\ContentSafer\MAAgent.exe => Moved successfully.
C:\Program Files\kuping4\kuping_v4.exe => Moved successfully.
C:\Program Files\kuping4\kuping_v4.exe not found.
C:\Program Files\Tudou\烽?鵗udou\TudouVa.exe => File/Directory not found.
C:\Windows\Tasks\At1.job => Moved successfully.
C:\Windows\Tasks\At2.job => Moved successfully.
C:\Windows\Tasks\At3.job => Moved successfully.
C:\Windows\Tasks\At4.job => Moved successfully.

The system needs a manual reboot.

==== End of Fixlog ====

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Microsoft Windows XP x86
Ran by Vivian on 05/25/2013 Sat at 15:41:59.17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

Successfully stopped: [Service] funshionsvr 
Successfully deleted: [Service] funshionsvr 
Successfully stopped: [Service] myfuncards_5mservice 
Successfully deleted: [Service] myfuncards_5mservice

~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\myfuncards search scope monitor
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\myfuncards_5m browser plugin loader
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL
Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440}

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\baidu
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\baidu
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\bandoo
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\pricegong
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\smartbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\sprotector
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\menuext\&search
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\appid\scripthelper.exe
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\appid\viprotocol.dll
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\products\a28b4d68debaa244eb686953b7074fef
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\protocols\handler\viprotocol
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\classes\Toolbar.CT3220468
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{4633EF93-D676-472f-A0FF-E1916B0B2E30}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{acbd5593-e5ee-4c15-b48f-1823ce819dec}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{20A0BE68-8FD9-4539-8712-CE3D1C1FDFC6}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C4B22C87-45EF-4F43-89F2-40DB2078864E}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DA71FD14-5F7B-46AE-B8B1-44074A38F331}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E} 
Successfully deleted: [Registry Key] "hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\9d4f5849367142e4685ed8c25e44c5ed" 
Successfully deleted: [Registry Key] "hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\products\a28b4d68debaa244eb686953b7074fef"

~~~ Files

Successfully deleted: [File] "C:\Program Files\mozilla firefox\plugins\npcouponprinter.dll"
Successfully deleted: [File] "C:\Program Files\mozilla firefox\plugins\npmozcouponprinter.dll"
Successfully deleted: [File] "C:\WINDOWS\system32\funshion.ini"
Successfully deleted: [File] "C:\Documents and Settings\Vivian\funshion.ini"
Successfully deleted: [File] "C:\WINDOWS\couponprinter.ocx"

~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\anti-phishing domain advisor"
Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\baidu"
Failed to delete: [Folder] "C:\Documents and Settings\All Users\application data\bettersoft"
Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\fun4im"
Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\installmate"
Successfully deleted: [Folder] "C:\Documents and Settings\Vivian\Application Data\baidu"
Successfully deleted: [Folder] "C:\Documents and Settings\Vivian\Application Data\blekkotb"
Successfully deleted: [Folder] "C:\Documents and Settings\Vivian\Application Data\pricegong"
Successfully deleted: [Folder] "C:\Documents and Settings\Vivian\Local Settings\Application Data\blekkotb"
Successfully deleted: [Folder] "C:\Documents and Settings\Vivian\Local Settings\Application Data\conduit"
Successfully deleted: [Folder] "C:\Documents and Settings\Vivian\Local Settings\Application Data\utorrentcontrol_v2"
Successfully deleted: [Folder] "C:\Program Files\baidu"
Successfully deleted: [Folder] "C:\Program Files\blekkotb"
Successfully deleted: [Folder] "C:\Program Files\conduit"
Successfully deleted: [Folder] "C:\Program Files\coupons"
Successfully deleted: [Folder] "C:\Program Files\fun4im"
Successfully deleted: [Folder] "C:\Program Files\funshion online"
Successfully deleted: [Folder] "C:\Program Files\myfuncards_5m"
Successfully deleted: [Folder] "C:\Program Files\utorrentcontrol_v2"
Failed to delete: [Folder] "C:\Documents and Settings\Vivian\funshion"
Successfully deleted: [Folder] "C:\Program Files\ask.com"

~~~ FireFox

Successfully deleted: [File] "C:\Program Files\Mozilla Firefox\searchplugins\blekkotb.xml"
Successfully deleted: [File] C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\user.js
Successfully deleted: [File] "C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\extensions\[email protected]" 
Successfully deleted: [Folder] C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\smartbar
Successfully deleted: [Folder] C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\extensions\{00F12770-E60E-4DC6-9105-425BFACE7C73}
Successfully deleted: [Folder] C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\extensions\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\[email protected]_5m.com
Successfully deleted the following from C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\prefs.js

user_pref("CT3220468.embeddedsData", "[{\"appId\":\"129813684258939747\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"get
user_pref("CT3220468.isPerformedSmartBarTransition", "true");
user_pref("CT3220468.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit.com/?ctid=CT3220468&octid=CT3220468&SearchSource=69&CUI=UN3281221684610029
user_pref("CT3220468.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9wcmljZWdvbmcuY29uZHVpdGFwcHMuY29tL01BTS92MS9odG1sX2NvbXAuaHRtbCIsIm9wdGlvbnN
user_pref("CT3220468.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiMjE1Xy0xIiwiaXNUZXN0IjpmYWxzZSwiaXNXZWxjb21lRXhwZXJp
user_pref("CT3220468.mam_gk_settings1.6.0.1.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiMjE1Xy0xIiwiaXNUZXN0IjpmYWxzZSwiaXNXZWxjb21lRXhwZXJp
user_pref("CT3220468.search.searchAppId", "129813684258939747");
user_pref("CT3220468.search.searchCount", "2");
user_pref("CT3220468.smartbar.CTID", "CT3220468");
user_pref("CT3220468.smartbar.Uninstall", "0");
user_pref("CT3220468.smartbar.toolbarName", "uTorrentControl_v2 ");
user_pref("browser.startup.homepage", "hxxp://mysearch.avg.com/?cid={75845DC5-2FA8-4D2F-8139-DB74C5925FA1}&mid=2a886f6ebd5347d39e5fd16d67cda10b-46c6454c2414415d7d2d2b57f0e699c
user_pref("extensions.5057cac711666.scode", "(function(){try{if('aol.com,mail.google.com,premiumreports.info,search.babylon.com,search.gboxapp.com'.indexOf(window.self.locatio
user_pref("extensions.BabylonToolbar.prtkDS", 0);
user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
user_pref("smartBar.searchInNewTabOwner", "CT3220468");
user_pref("smartbar.machineId", "BKBBBYBW4EQQKOZDOLIZ8RBYKRWMAR33ZB34P7JGCNYTEQTYDIMNONBN4LAJ+8N7Z8G3G517VEMPS+N0JSX23G");
user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
user_pref("sweetim.toolbar.previous.keyword.URL", "");
user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
user_pref("sweetim.toolbar.searchguard.enable", "");
Emptied folder: C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\minidumps [18 files]

~~~ Chrome

Successfully deleted: [Folder] C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05/25/2013 Sat at 15:45:13.95
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
OTL logfile created on: 5/25/2013 3:50:23 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Vivian\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 51.76% Memory free
3.79 Gb Paging File | 3.01 Gb Available in Paging File | 79.39% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 376.25 Gb Free Space | 80.78% Space Free | Partition Type: NTFS

Computer Name: VIVIANSCOMPUTER | User Name: Vivian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/05/24 15:13:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Vivian\My Documents\Downloads\OTL.exe
PRC - [2013/05/22 22:44:09 | 000,825,808 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2013/05/21 10:25:31 | 001,015,984 | ---- | M] (AVG Secure Search) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe
PRC - [2013/05/17 07:55:38 | 028,711,576 | ---- | M] (Dropbox, Inc.) -- C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2013/05/14 13:26:12 | 003,289,208 | ---- | M] (Skype Technologies S.A.) -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2013/04/25 00:23:26 | 000,335,496 | ---- | M] (Funshion) -- C:\Documents and Settings\Vivian\funshion\funshiontools\FsSvr.exe
PRC - [2013/03/13 23:37:56 | 000,679,264 | ---- | M] (Sta) -- C:\Program Files\Wuji\197226\WJNews.exe
PRC - [2013/01/27 12:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/01/27 12:11:06 | 000,947,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2013/01/23 12:58:25 | 000,348,160 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\BetterSoft\EasylifeGadget Updater\EasylifeGadget Updater.exe
PRC - [2012/06/11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE
PRC - [2012/06/11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE
PRC - [2012/06/11 12:22:18 | 001,561,088 | ---- | M] (Alcatel-Lucent) -- C:\Program Files\TELUS\McciTrayApp.exe
PRC - [2012/05/08 14:05:58 | 001,818,472 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe
PRC - [2012/03/09 11:33:12 | 010,294,584 | ---- | M] (Radialpoint SafeCare Inc.) -- C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe
PRC - [2009/10/12 11:19:46 | 001,323,008 | ---- | M] (土豆网) -- C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/14 05:42:16 | 000,389,120 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\cmd.exe
PRC - [2008/04/14 05:42:16 | 000,027,648 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\conime.exe
PRC - [2007/06/27 19:04:00 | 001,213,736 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007/06/27 19:03:40 | 000,152,872 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2006/07/21 09:32:58 | 000,126,976 | ---- | M] (SAMSUNG ELECTRONICS) -- C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe

========== Modules (No Company Name) ==========

MOD - [2013/05/22 22:44:07 | 000,393,168 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppgooglenaclpluginchrome.dll
MOD - [2013/05/22 22:44:06 | 013,136,336 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll
MOD - [2013/05/22 22:43:59 | 004,051,408 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll
MOD - [2013/05/22 22:43:03 | 001,597,392 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.94\ffmpegsumo.dll
MOD - [2013/04/26 19:06:12 | 000,461,312 | ---- | M] () -- C:\WINDOWS\system32\config\systemprofile\funshion\funshionTools\gma.dll
MOD - [2013/04/25 00:20:20 | 000,389,256 | ---- | M] () -- C:\Documents and Settings\Vivian\funshion\funshiontools\LuaInterface_mt.dll
MOD - [2013/03/13 13:48:52 | 024,978,944 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\libcef.dll
MOD - [2013/01/23 12:58:25 | 000,348,160 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\BetterSoft\EasylifeGadget Updater\EasylifeGadget Updater.exe
MOD - [2012/11/13 16:32:50 | 003,558,400 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\wxmsw28uh_vc.dll
MOD - [2012/09/29 09:09:26 | 000,558,133 | ---- | M] () -- C:\WINDOWS\system32\sqlite3.dll
MOD - [2010/03/15 16:57:20 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2009/02/12 05:30:02 | 000,190,976 | ---- | M] () -- C:\WINDOWS\system32\WgaLogon.dll
MOD - [2008/04/14 05:42:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/14 05:41:52 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (Amsp)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\alg.exe -- (ALG)
SRV - [2013/05/21 10:25:31 | 001,015,984 | ---- | M] (AVG Secure Search) [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe -- (vToolbarUpdater15.2.0)
SRV - [2013/05/15 11:45:17 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/14 13:26:12 | 003,289,208 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2013/04/12 11:30:03 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/01/27 12:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/06/11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE -- (BBUpdate)
SRV - [2012/06/11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE -- (BBSvc)
SRV - [2012/03/09 11:33:12 | 010,294,584 | ---- | M] (Radialpoint SafeCare Inc.) [Auto | Running] -- C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe -- (ServicepointService)
SRV - [2009/04/22 00:07:30 | 000,655,624 | ---- | M] (Acresso Software Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\LV302AV.SYS -- (PID_08A0)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lv302af.sys -- (pepifilter)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS -- (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS -- (MREMPR5)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\KAVSafe.sys -- (KAVSafe)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- D:\INSTALL\GMSIPCI.SYS -- (GMSIPCI)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2013/05/21 10:25:32 | 000,037,664 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp)
DRV - [2013/04/24 17:10:42 | 000,051,864 | ---- | M] () [File_System | System | Running] -- C:\Program Files\kuping4\KPProtector.sys -- (KPProtector)
DRV - [2013/03/15 09:42:47 | 000,013,464 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SWDUMon.sys -- (SWDUMon)
DRV - [2012/06/11 12:12:08 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2012/06/11 12:12:06 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2011/02/19 11:34:44 | 000,023,456 | ---- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DrvAgent32.sys -- (DrvAgent32)
DRV - [2010/05/10 11:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 11:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2010/01/21 01:59:58 | 000,020,864 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2010/01/21 01:59:56 | 000,024,960 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2010/01/21 01:59:56 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2009/09/29 08:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009/09/29 08:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009/09/29 08:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2009/04/21 15:10:32 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2008/04/17 01:33:26 | 004,707,328 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [2008/02/15 00:15:26 | 000,014,336 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008/01/28 21:37:48 | 000,022,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2008/01/28 21:37:46 | 000,054,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2008/01/25 05:01:06 | 000,132,096 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nvgts.sys -- (nvgts)
DRV - [2007/05/09 22:51:34 | 000,041,888 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/05/09 22:47:00 | 001,276,832 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI)
DRV - [2006/07/01 22:39:40 | 000,036,864 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004/08/04 05:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)
DRV - [1999/09/10 12:06:00 | 000,025,244 | ---- | M] (Adaptec) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (ASPI32)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.easylifeapp.com/?pid=388&src=ie1&r=2013/05/15&hid=1597798053&lg=EN&cc=CA
IE - HKCU\..\URLSearchHook: {7473b6bd-4691-4744-a82b-7854eb3d70b6} - SOFTWARE\Classes\CLSID\{7473b6bd-4691-4744-a82b-7854eb3d70b6}\InprocServer32 File not found
IE - HKCU\..\URLSearchHook: {f4c28532-b9d0-4950-a2df-e83f9929242b} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {7F0B9B44-4BE5-4459-BBC9-06CE908433D4}
IE - HKCU\..\SearchScopes\{01bd49d7-c76b-4310-8beb-14d7e5f322c6}: "URL" = http://search.easylifeapp.com/?q={searchTerms}&pid=388&src=ie2&r=2013/05/15&hid=1597798053&lg=EN&cc=CA
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{7F0B9B44-4BE5-4459-BBC9-06CE908433D4}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}&rlz=1I7SUNC_enCA370
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = http://127.0.0.1:9415/tudouva.pac

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@baidu.com/npxbdsetup: C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@MyFunCards_5m.com/Plugin: C:\Program Files\MyFunCards_5m\bar\1.bin\NP5mStub.dll File not found
FF - HKLM\Software\MozillaPlugins\@ncity3d.com/NCity3dPlayer: C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll ( )

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22181a4d-af90-4ca3-a569-faed9118d6bc}: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013/02/18 15:26:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\Hewlett-Packard\SmartPrint\QPExtension [2013/05/14 14:14:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/14 14:13:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/25 15:42:25 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013/02/18 15:26:15 | 000,000,000 | ---D | M]

[2009/04/22 00:37:07 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Extensions
[2013/05/25 15:44:33 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions
[2012/11/29 19:06:48 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2010/06/02 22:18:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/05/13 10:44:10 | 000,000,000 | ---D | M] (IE Tab) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2011/08/10 09:42:39 | 000,000,000 | ---D | M] (Разпознаване на устройство Logitech) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2013/05/14 18:38:26 | 000,000,000 | ---D | M] (SearchNewTab) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2012/01/26 22:24:32 | 000,000,000 | ---D | M] (Latin Dictionary) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2013/05/01 10:37:34 | 000,346,768 | ---- | M] () (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2013/05/14 18:38:02 | 000,000,581 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\searchplugins\EasyLife.xml
[2013/04/12 11:29:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/05/23 12:51:33 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/01 09:17:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/05/23 12:51:33 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\VIVIAN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\IG45U6WY.DEFAULT\EXTENSIONS\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
[2013/04/12 11:30:04 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/11/12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2009/05/07 14:22:10 | 000,196,096 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\npvgsplayer.dll
[2012/09/07 17:36:50 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013/05/25 15:07:32 | 000,003,725 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\safeguard-secure-search.xml
[2013/02/19 16:30:45 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = http://mysearch.avg.com/search?cid={75845DC5-2FA8-4D2F-8139-DB74C5925FA1}&mid=2a886f6ebd5347d39e5fd16d67cda10b-46c6454c2414415d7d2d2b57f0e699c1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = http://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR - homepage: http://mysearch.avg.com/?cid={75845DC5-2FA8-4D2F-8139-DB74C5925FA1}&mid=2a886f6ebd5347d39e5fd16d67cda10b-46c6454c2414415d7d2d2b57f0e699c1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=hp
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: VGS player plugin for Firefox (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npvgsplayer.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: NCity3D plugin for firefox (Enabled) = C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: HP Product Detection Plugin = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aelbknmfcacjffmgnoaaonhgoghlmlkp\1.0.26.1_0\
CHR - Extension: YouTube = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Skype Click to Call = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0\
CHR - Extension: Radialpoint SPD Extension = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj\1.0_0\
CHR - Extension: SearchNewTab = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mikjhaicomkcabebhnddigcpmagnpiha\1\
CHR - Extension: AVG SafeGuard toolbar = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\
CHR - Extension: Gmail = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2012/08/22 18:10:11 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll File not found
O2 - BHO: (Spam Free Search Bar) - {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files\blekkotb\blekkoDx.dll File not found
O2 - BHO: (TSToolbarBHO) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll File not found
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll File not found
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (SearchNewTab) - {D7A4B15B-3AE6-6E8D-4CA8-F18D61607930} - C:\Documents and Settings\All Users\Application Data\SearchNewTab\5192f0ec9823e.dll ()
O3 - HKLM\..\Toolbar: (MyFunCards) - {210f1b36-3b7f-41a4-b5da-3eb87f5a56c2} - C:\Program Files\MyFunCards_5m\bar\1.bin\5mbar.dll File not found
O3 - HKLM\..\Toolbar: (Spam Free Search Bar) - {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files\blekkotb\blekkoDx.dll File not found
O3 - HKLM\..\Toolbar: (uTorrentControl_v2 Toolbar) - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTo2.dll File not found
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (MyFunCards) - {210F1B36-3B7F-41A4-B5DA-3EB87F5A56C2} - C:\Program Files\MyFunCards_5m\bar\1.bin\5mbar.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentControl_v2 Toolbar) - {7473B6BD-4691-4744-A82B-7854EB3D70B6} - C:\Program Files\uTorrentControl_v2\prxtbuTo2.dll File not found
O4 - HKLM..\Run: [kuping] C:\Program Files\kuping4\kuping_v4.exe /start File not found
O4 - HKLM..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe File not found
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe (SAMSUNG ELECTRONICS)
O4 - HKLM..\Run: [TELUS_McciTrayApp] C:\Program Files\TELUS\McciTrayApp.exe (Alcatel-Lucent)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG SafeGuard toolbar\vprot.exe (AVG Secure Search)
O4 - HKLM..\Run: [WJNews_197226] C:\Program Files\Wuji\197226\WJNews.exe (Sta)
O4 - HKCU..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe (Sammsoft)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [HP Photosmart 7520 series (NET)] C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - HKCU..\Run: [SmileboxTray] "C:\Documents and Settings\Vivian\Application Data\Smilebox\SmileboxTray.exe" File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\酷屏.lnk = File not found
O4 - Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Æô¶¯·ÉËÙÍÁ¶¹.lnk = File not found
O4 - Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\启动飞速土豆.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Value error. File not found
O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: 显示或隐藏 HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - Reg Error: Value error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 75.153.176.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F5D8976E-2CE8-46E0-BC66-A161DBFBDA3F}: DhcpNameServer = 192.168.1.254 75.153.176.9
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll File not found
O18 - Protocol\Handler\tmtb {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll File not found
O18 - Protocol\Handler\tmtbim {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - C:\WINDOWS\System32\WgaLogon.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\Vivian\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Vivian\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/21 14:09:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/25 15:28:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2013/05/25 15:27:58 | 000,000,000 | ---D | C] -- C:\JRT
[2013/05/24 15:11:02 | 000,000,000 | ---D | C] -- C:\FRST
[2013/05/23 16:14:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\TELUS
[2013/05/23 16:13:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Motive
[2013/05/23 16:13:25 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Motive
[2013/05/23 16:13:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Motive
[2013/05/23 15:56:55 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2013/05/22 22:06:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\PriceGong
[2013/05/22 22:06:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Conduit
[2013/05/22 22:06:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\uTorrentControl_v2
[2013/05/22 22:06:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\blekkotb
[2013/05/22 22:06:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\HPAppData
[2013/05/21 10:25:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\cache
[2013/05/16 13:07:21 | 000,000,000 | ---D | C] -- C:\dbfecd5f7d2e63eac17b4786
[2013/05/15 12:16:59 | 000,000,000 | ---D | C] -- C:\78415340c7ea0ba5fa
[2013/05/14 18:38:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\StarApp
[2013/05/14 18:38:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\BetterSoft
[2013/05/14 18:38:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SearchNewTab
[2013/05/14 18:38:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SearchNewTab
[2013/05/14 18:38:02 | 000,000,000 | ---D | C] -- C:\Program Files\EasyLife
[2013/05/14 15:16:36 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
[2013/05/14 15:16:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Visan
[2013/05/14 14:14:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Visan
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Program Files\HP Photo Creations
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HP Photo Creations
[2013/05/14 14:12:33 | 000,563,048 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPDiscoPMBC11.dll
[2013/05/14 14:12:28 | 001,961,320 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPScanTRDrv_PS7520.dll
[2013/05/14 14:12:28 | 000,495,464 | ---- | C] (Hewlett-Packard) -- C:\WINDOWS\System32\HPWia1_PS7520.dll
[2013/05/14 14:12:25 | 002,215,784 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkinsBC11.exe
[2013/05/14 14:12:25 | 000,513,384 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkstsBC11.dll
[2013/05/14 14:12:25 | 000,267,624 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkstsBC11LM.dll
[2013/05/14 14:12:25 | 000,219,496 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkcoiBC11.dll
[2013/05/13 10:21:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype
[2013/05/13 10:21:56 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2013/02/27 15:27:19 | 020,546,152 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2011/02/19 12:10:12 | 053,539,128 | ---- | C] (Logitech, Inc.) -- C:\Program Files\lws110_x64.exe
[2010/04/08 21:41:02 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Vivian\Application Data\pcouffin.sys
[1 C:\Documents and Settings\Vivian\Desktop\*.tmp files -> C:\Documents and Settings\Vivian\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/25 15:45:00 | 000,000,536 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/05/25 15:41:53 | 000,000,605 | ---- | M] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\启动飞速土豆.lnk
[2013/05/25 15:41:22 | 000,000,876 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/25 15:41:22 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\FSPlatform.job
[2013/05/25 15:41:21 | 000,000,630 | -H-- | M] () -- C:\WINDOWS\tasks\schedule!1822287263.job
[2013/05/25 15:40:57 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013/05/25 15:35:55 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\FSPlatform1.job
[2013/05/25 15:30:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/05/25 15:29:40 | 000,000,492 | ---- | M] () -- C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/05/25 15:15:00 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
[2013/05/25 15:11:14 | 000,000,880 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/23 16:28:52 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/05/23 16:14:53 | 000,001,820 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
[2013/05/23 16:05:37 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/05/23 14:53:00 | 000,000,990 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
[2013/05/21 10:25:32 | 000,037,664 | ---- | M] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/05/21 10:25:16 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/05/19 10:15:00 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
[2013/05/18 17:45:01 | 000,001,029 | ---- | M] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
[2013/05/18 17:44:55 | 000,487,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/05/18 17:44:55 | 000,080,730 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/05/15 12:21:15 | 002,176,880 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/05/15 11:45:17 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/05/15 11:45:17 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/05/14 16:11:50 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2013/05/14 15:16:25 | 000,001,742 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
[2013/05/14 14:12:31 | 000,001,993 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
[2013/05/14 14:12:31 | 000,000,925 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
[2013/05/14 14:09:27 | 000,000,057 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2013/05/06 21:27:31 | 006,015,488 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2013/05/02 08:28:50 | 000,238,872 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe
[1 C:\Documents and Settings\Vivian\Desktop\*.tmp files -> C:\Documents and Settings\Vivian\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/23 16:14:53 | 000,001,820 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
[2013/05/14 18:38:15 | 000,000,630 | -H-- | C] () -- C:\WINDOWS\tasks\schedule!1822287263.job
[2013/05/14 15:06:45 | 000,000,492 | ---- | C] () -- C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/05/14 14:14:01 | 000,001,742 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
[2013/05/14 14:12:31 | 000,001,993 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
[2013/05/14 14:12:31 | 000,000,925 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
[2013/05/14 14:09:27 | 000,000,057 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2013/05/01 09:27:57 | 000,000,306 | ---- | C] () -- C:\WINDOWS\tasks\FSPlatform1.job
[2013/05/01 09:24:06 | 000,001,029 | ---- | C] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
[2013/03/14 12:14:24 | 000,000,010 | ---- | C] () -- C:\Documents and Settings\Vivian\1pt1
[2013/03/14 11:58:22 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2013/03/14 11:58:22 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2013/03/14 11:58:22 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2013/03/12 13:19:15 | 002,816,504 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data
[2013/03/12 13:07:22 | 000,013,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\SWDUMon.sys
[2013/02/18 15:22:04 | 000,172,332 | ---- | C] () -- C:\WINDOWS\hpoins37.dat
[2013/02/18 15:22:04 | 000,000,632 | ---- | C] () -- C:\WINDOWS\hpomdl37.dat
[2013/02/03 17:52:51 | 000,172,332 | ---- | C] () -- C:\WINDOWS\hpoins37.dat.temp
[2013/02/03 17:52:51 | 000,000,632 | ---- | C] () -- C:\WINDOWS\hpomdl37.dat.temp
[2012/09/29 09:09:43 | 000,558,133 | ---- | C] () -- C:\WINDOWS\System32\sqlite3.dll
[2012/08/22 17:45:35 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/08/22 17:45:35 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/08/22 17:45:35 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/08/22 17:45:35 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/08/22 17:45:35 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/08/19 12:55:46 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\inst.exe
[2012/02/15 11:22:34 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/19 11:12:05 | 000,014,336 | ---- | C] () -- C:\Documents and Settings\Vivian\SMS.db
[2011/04/20 09:42:28 | 000,001,022 | ---- | C] () -- C:\Documents and Settings\Vivian\tudouproxy.inf
[2011/02/18 14:21:08 | 000,738,189 | ---- | C] () -- C:\Program Files\wot-20100908-fx+sm.xpi
[2011/02/18 13:24:21 | 010,234,024 | ---- | C] ( ) -- C:\Program Files\fwinstall.exe
[2010/09/13 09:10:26 | 000,000,112 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\5FG7121.dat
[2010/04/08 21:41:20 | 000,000,671 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\vso_ts_preview.xml
[2010/04/08 21:41:02 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\pcouffin.cat
[2010/04/08 21:41:02 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\pcouffin.inf
[2009/05/31 10:07:54 | 000,000,098 | ---- | C] () -- C:\Documents and Settings\Vivian\default.pls
[2009/04/21 15:08:37 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\Vivian\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/21 14:08:43 | 000,001,572 | ---- | C] () -- C:\Program Files\Disk Defragmenter.lnk

========== ZeroAccess Check ==========

[2009/10/13 00:08:14 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 05:42:06 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 05:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 05:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Files - Unicode (All) ==========
[2010/07/29 05:23:59 | 000,000,776 | ---- | M] ()(C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\???ˉ·é?ùíá?1.lnk) -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Æô¶¯·ÉËÙÍÁ¶¹.lnk
[2010/01/01 23:01:07 | 000,000,776 | ---- | C] ()(C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\???ˉ·é?ùíá?1.lnk) -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Æô¶¯·ÉËÙÍÁ¶¹.lnk

========== Alternate Data Streams ==========

@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C31F31E6

< End of report >


----------



## errorloading (Feb 4, 2011)

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 24-05-2013 03
Ran by Vivian at 2013-05-25 15:21:50 Run:1
Running from C:\Documents and Settings\Vivian\My Documents\Downloads
Boot Mode: Normal

==============================================

C:\Program Files\MarkAny\ContentSafer\MAAgent.exe => Moved successfully.
C:\Program Files\kuping4\kuping_v4.exe => Moved successfully.
C:\Program Files\kuping4\kuping_v4.exe not found.
C:\Program Files\Tudou\烽?鵗udou\TudouVa.exe => File/Directory not found.
C:\Windows\Tasks\At1.job => Moved successfully.
C:\Windows\Tasks\At2.job => Moved successfully.
C:\Windows\Tasks\At3.job => Moved successfully.
C:\Windows\Tasks\At4.job => Moved successfully.

The system needs a manual reboot.

==== End of Fixlog ====

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Microsoft Windows XP x86
Ran by Vivian on 05/25/2013 Sat at 15:41:59.17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

Successfully stopped: [Service] funshionsvr 
Successfully deleted: [Service] funshionsvr 
Successfully stopped: [Service] myfuncards_5mservice 
Successfully deleted: [Service] myfuncards_5mservice

~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\myfuncards search scope monitor
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\myfuncards_5m browser plugin loader
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL
Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440}

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\baidu
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\baidu
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\bandoo
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\pricegong
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\smartbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\sprotector
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\menuext\&search
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\appid\scripthelper.exe
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\appid\viprotocol.dll
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\products\a28b4d68debaa244eb686953b7074fef
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\protocols\handler\viprotocol
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\classes\Toolbar.CT3220468
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{4633EF93-D676-472f-A0FF-E1916B0B2E30}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{acbd5593-e5ee-4c15-b48f-1823ce819dec}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{20A0BE68-8FD9-4539-8712-CE3D1C1FDFC6}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C4B22C87-45EF-4F43-89F2-40DB2078864E}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DA71FD14-5F7B-46AE-B8B1-44074A38F331}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E} 
Successfully deleted: [Registry Key] "hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\9d4f5849367142e4685ed8c25e44c5ed" 
Successfully deleted: [Registry Key] "hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\products\a28b4d68debaa244eb686953b7074fef"

~~~ Files

Successfully deleted: [File] "C:\Program Files\mozilla firefox\plugins\npcouponprinter.dll"
Successfully deleted: [File] "C:\Program Files\mozilla firefox\plugins\npmozcouponprinter.dll"
Successfully deleted: [File] "C:\WINDOWS\system32\funshion.ini"
Successfully deleted: [File] "C:\Documents and Settings\Vivian\funshion.ini"
Successfully deleted: [File] "C:\WINDOWS\couponprinter.ocx"

~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\anti-phishing domain advisor"
Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\baidu"
Failed to delete: [Folder] "C:\Documents and Settings\All Users\application data\bettersoft"
Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\fun4im"
Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\installmate"
Successfully deleted: [Folder] "C:\Documents and Settings\Vivian\Application Data\baidu"
Successfully deleted: [Folder] "C:\Documents and Settings\Vivian\Application Data\blekkotb"
Successfully deleted: [Folder] "C:\Documents and Settings\Vivian\Application Data\pricegong"
Successfully deleted: [Folder] "C:\Documents and Settings\Vivian\Local Settings\Application Data\blekkotb"
Successfully deleted: [Folder] "C:\Documents and Settings\Vivian\Local Settings\Application Data\conduit"
Successfully deleted: [Folder] "C:\Documents and Settings\Vivian\Local Settings\Application Data\utorrentcontrol_v2"
Successfully deleted: [Folder] "C:\Program Files\baidu"
Successfully deleted: [Folder] "C:\Program Files\blekkotb"
Successfully deleted: [Folder] "C:\Program Files\conduit"
Successfully deleted: [Folder] "C:\Program Files\coupons"
Successfully deleted: [Folder] "C:\Program Files\fun4im"
Successfully deleted: [Folder] "C:\Program Files\funshion online"
Successfully deleted: [Folder] "C:\Program Files\myfuncards_5m"
Successfully deleted: [Folder] "C:\Program Files\utorrentcontrol_v2"
Failed to delete: [Folder] "C:\Documents and Settings\Vivian\funshion"
Successfully deleted: [Folder] "C:\Program Files\ask.com"

~~~ FireFox

Successfully deleted: [File] "C:\Program Files\Mozilla Firefox\searchplugins\blekkotb.xml"
Successfully deleted: [File] C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\user.js
Successfully deleted: [File] "C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\extensions\[email protected]" 
Successfully deleted: [Folder] C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\smartbar
Successfully deleted: [Folder] C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\extensions\{00F12770-E60E-4DC6-9105-425BFACE7C73}
Successfully deleted: [Folder] C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\extensions\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\[email protected]_5m.com
Successfully deleted the following from C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\prefs.js

user_pref("CT3220468.embeddedsData", "[{\"appId\":\"129813684258939747\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"get
user_pref("CT3220468.isPerformedSmartBarTransition", "true");
user_pref("CT3220468.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit.com/?ctid=CT3220468&octid=CT3220468&SearchSource=69&CUI=UN3281221684610029
user_pref("CT3220468.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9wcmljZWdvbmcuY29uZHVpdGFwcHMuY29tL01BTS92MS9odG1sX2NvbXAuaHRtbCIsIm9wdGlvbnN
user_pref("CT3220468.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiMjE1Xy0xIiwiaXNUZXN0IjpmYWxzZSwiaXNXZWxjb21lRXhwZXJp
user_pref("CT3220468.mam_gk_settings1.6.0.1.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiMjE1Xy0xIiwiaXNUZXN0IjpmYWxzZSwiaXNXZWxjb21lRXhwZXJp
user_pref("CT3220468.search.searchAppId", "129813684258939747");
user_pref("CT3220468.search.searchCount", "2");
user_pref("CT3220468.smartbar.CTID", "CT3220468");
user_pref("CT3220468.smartbar.Uninstall", "0");
user_pref("CT3220468.smartbar.toolbarName", "uTorrentControl_v2 ");
user_pref("browser.startup.homepage", "hxxp://mysearch.avg.com/?cid={75845DC5-2FA8-4D2F-8139-DB74C5925FA1}&mid=2a886f6ebd5347d39e5fd16d67cda10b-46c6454c2414415d7d2d2b57f0e699c
user_pref("extensions.5057cac711666.scode", "(function(){try{if('aol.com,mail.google.com,premiumreports.info,search.babylon.com,search.gboxapp.com'.indexOf(window.self.locatio
user_pref("extensions.BabylonToolbar.prtkDS", 0);
user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
user_pref("smartBar.searchInNewTabOwner", "CT3220468");
user_pref("smartbar.machineId", "BKBBBYBW4EQQKOZDOLIZ8RBYKRWMAR33ZB34P7JGCNYTEQTYDIMNONBN4LAJ+8N7Z8G3G517VEMPS+N0JSX23G");
user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
user_pref("sweetim.toolbar.previous.keyword.URL", "");
user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
user_pref("sweetim.toolbar.searchguard.enable", "");
Emptied folder: C:\Documents and Settings\Vivian\Application Data\mozilla\firefox\profiles\ig45u6wy.default\minidumps [18 files]

~~~ Chrome

Successfully deleted: [Folder] C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05/25/2013 Sat at 15:45:13.95
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
OTL logfile created on: 5/25/2013 3:50:23 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Vivian\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 51.76% Memory free
3.79 Gb Paging File | 3.01 Gb Available in Paging File | 79.39% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 376.25 Gb Free Space | 80.78% Space Free | Partition Type: NTFS

Computer Name: VIVIANSCOMPUTER | User Name: Vivian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/05/24 15:13:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Vivian\My Documents\Downloads\OTL.exe
PRC - [2013/05/22 22:44:09 | 000,825,808 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2013/05/21 10:25:31 | 001,015,984 | ---- | M] (AVG Secure Search) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe
PRC - [2013/05/17 07:55:38 | 028,711,576 | ---- | M] (Dropbox, Inc.) -- C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2013/05/14 13:26:12 | 003,289,208 | ---- | M] (Skype Technologies S.A.) -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2013/04/25 00:23:26 | 000,335,496 | ---- | M] (Funshion) -- C:\Documents and Settings\Vivian\funshion\funshiontools\FsSvr.exe
PRC - [2013/03/13 23:37:56 | 000,679,264 | ---- | M] (Sta) -- C:\Program Files\Wuji\197226\WJNews.exe
PRC - [2013/01/27 12:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/01/27 12:11:06 | 000,947,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2013/01/23 12:58:25 | 000,348,160 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\BetterSoft\EasylifeGadget Updater\EasylifeGadget Updater.exe
PRC - [2012/06/11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE
PRC - [2012/06/11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE
PRC - [2012/06/11 12:22:18 | 001,561,088 | ---- | M] (Alcatel-Lucent) -- C:\Program Files\TELUS\McciTrayApp.exe
PRC - [2012/05/08 14:05:58 | 001,818,472 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe
PRC - [2012/03/09 11:33:12 | 010,294,584 | ---- | M] (Radialpoint SafeCare Inc.) -- C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe
PRC - [2009/10/12 11:19:46 | 001,323,008 | ---- | M] (土豆网) -- C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/14 05:42:16 | 000,389,120 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\cmd.exe
PRC - [2008/04/14 05:42:16 | 000,027,648 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\conime.exe
PRC - [2007/06/27 19:04:00 | 001,213,736 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007/06/27 19:03:40 | 000,152,872 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2006/07/21 09:32:58 | 000,126,976 | ---- | M] (SAMSUNG ELECTRONICS) -- C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe

========== Modules (No Company Name) ==========

MOD - [2013/05/22 22:44:07 | 000,393,168 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppgooglenaclpluginchrome.dll
MOD - [2013/05/22 22:44:06 | 013,136,336 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll
MOD - [2013/05/22 22:43:59 | 004,051,408 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll
MOD - [2013/05/22 22:43:03 | 001,597,392 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\27.0.1453.94\ffmpegsumo.dll
MOD - [2013/04/26 19:06:12 | 000,461,312 | ---- | M] () -- C:\WINDOWS\system32\config\systemprofile\funshion\funshionTools\gma.dll
MOD - [2013/04/25 00:20:20 | 000,389,256 | ---- | M] () -- C:\Documents and Settings\Vivian\funshion\funshiontools\LuaInterface_mt.dll
MOD - [2013/03/13 13:48:52 | 024,978,944 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\libcef.dll
MOD - [2013/01/23 12:58:25 | 000,348,160 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\BetterSoft\EasylifeGadget Updater\EasylifeGadget Updater.exe
MOD - [2012/11/13 16:32:50 | 003,558,400 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\wxmsw28uh_vc.dll
MOD - [2012/09/29 09:09:26 | 000,558,133 | ---- | M] () -- C:\WINDOWS\system32\sqlite3.dll
MOD - [2010/03/15 16:57:20 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2009/02/12 05:30:02 | 000,190,976 | ---- | M] () -- C:\WINDOWS\system32\WgaLogon.dll
MOD - [2008/04/14 05:42:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/14 05:41:52 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (Amsp)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\alg.exe -- (ALG)
SRV - [2013/05/21 10:25:31 | 001,015,984 | ---- | M] (AVG Secure Search) [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe -- (vToolbarUpdater15.2.0)
SRV - [2013/05/15 11:45:17 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/14 13:26:12 | 003,289,208 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2013/04/12 11:30:03 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/01/27 12:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/06/11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE -- (BBUpdate)
SRV - [2012/06/11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE -- (BBSvc)
SRV - [2012/03/09 11:33:12 | 010,294,584 | ---- | M] (Radialpoint SafeCare Inc.) [Auto | Running] -- C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe -- (ServicepointService)
SRV - [2009/04/22 00:07:30 | 000,655,624 | ---- | M] (Acresso Software Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\LV302AV.SYS -- (PID_08A0)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lv302af.sys -- (pepifilter)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS -- (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS -- (MREMPR5)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\KAVSafe.sys -- (KAVSafe)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- D:\INSTALL\GMSIPCI.SYS -- (GMSIPCI)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2013/05/21 10:25:32 | 000,037,664 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp)
DRV - [2013/04/24 17:10:42 | 000,051,864 | ---- | M] () [File_System | System | Running] -- C:\Program Files\kuping4\KPProtector.sys -- (KPProtector)
DRV - [2013/03/15 09:42:47 | 000,013,464 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SWDUMon.sys -- (SWDUMon)
DRV - [2012/06/11 12:12:08 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2012/06/11 12:12:06 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2011/02/19 11:34:44 | 000,023,456 | ---- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DrvAgent32.sys -- (DrvAgent32)
DRV - [2010/05/10 11:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 11:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2010/01/21 01:59:58 | 000,020,864 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2010/01/21 01:59:56 | 000,024,960 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2010/01/21 01:59:56 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2009/09/29 08:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009/09/29 08:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009/09/29 08:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2009/04/21 15:10:32 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2008/04/17 01:33:26 | 004,707,328 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [2008/02/15 00:15:26 | 000,014,336 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008/01/28 21:37:48 | 000,022,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2008/01/28 21:37:46 | 000,054,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2008/01/25 05:01:06 | 000,132,096 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nvgts.sys -- (nvgts)
DRV - [2007/05/09 22:51:34 | 000,041,888 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/05/09 22:47:00 | 001,276,832 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI)
DRV - [2006/07/01 22:39:40 | 000,036,864 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004/08/04 05:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)
DRV - [1999/09/10 12:06:00 | 000,025,244 | ---- | M] (Adaptec) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (ASPI32)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.easylifeapp.com/?pid=388&src=ie1&r=2013/05/15&hid=1597798053&lg=EN&cc=CA
IE - HKCU\..\URLSearchHook: {7473b6bd-4691-4744-a82b-7854eb3d70b6} - SOFTWARE\Classes\CLSID\{7473b6bd-4691-4744-a82b-7854eb3d70b6}\InprocServer32 File not found
IE - HKCU\..\URLSearchHook: {f4c28532-b9d0-4950-a2df-e83f9929242b} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {7F0B9B44-4BE5-4459-BBC9-06CE908433D4}
IE - HKCU\..\SearchScopes\{01bd49d7-c76b-4310-8beb-14d7e5f322c6}: "URL" = http://search.easylifeapp.com/?q={searchTerms}&pid=388&src=ie2&r=2013/05/15&hid=1597798053&lg=EN&cc=CA
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{7F0B9B44-4BE5-4459-BBC9-06CE908433D4}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}&rlz=1I7SUNC_enCA370
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = http://127.0.0.1:9415/tudouva.pac

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@baidu.com/npxbdsetup: C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@MyFunCards_5m.com/Plugin: C:\Program Files\MyFunCards_5m\bar\1.bin\NP5mStub.dll File not found
FF - HKLM\Software\MozillaPlugins\@ncity3d.com/NCity3dPlayer: C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll ( )

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22181a4d-af90-4ca3-a569-faed9118d6bc}: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013/02/18 15:26:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\Hewlett-Packard\SmartPrint\QPExtension [2013/05/14 14:14:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/14 14:13:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/25 15:42:25 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013/02/18 15:26:15 | 000,000,000 | ---D | M]

[2009/04/22 00:37:07 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Extensions
[2013/05/25 15:44:33 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions
[2012/11/29 19:06:48 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2010/06/02 22:18:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/05/13 10:44:10 | 000,000,000 | ---D | M] (IE Tab) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2011/08/10 09:42:39 | 000,000,000 | ---D | M] (Разпознаване на устройство Logitech) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2013/05/14 18:38:26 | 000,000,000 | ---D | M] (SearchNewTab) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2012/01/26 22:24:32 | 000,000,000 | ---D | M] (Latin Dictionary) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2013/05/01 10:37:34 | 000,346,768 | ---- | M] () (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2013/05/14 18:38:02 | 000,000,581 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\searchplugins\EasyLife.xml
[2013/04/12 11:29:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/05/23 12:51:33 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/01 09:17:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/05/23 12:51:33 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\VIVIAN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\IG45U6WY.DEFAULT\EXTENSIONS\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
[2013/04/12 11:30:04 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/11/12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2009/05/07 14:22:10 | 000,196,096 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\npvgsplayer.dll
[2012/09/07 17:36:50 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013/05/25 15:07:32 | 000,003,725 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\safeguard-secure-search.xml
[2013/02/19 16:30:45 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = http://mysearch.avg.com/search?cid={75845DC5-2FA8-4D2F-8139-DB74C5925FA1}&mid=2a886f6ebd5347d39e5fd16d67cda10b-46c6454c2414415d7d2d2b57f0e699c1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = http://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR - homepage: http://mysearch.avg.com/?cid={75845DC5-2FA8-4D2F-8139-DB74C5925FA1}&mid=2a886f6ebd5347d39e5fd16d67cda10b-46c6454c2414415d7d2d2b57f0e699c1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=hp
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: VGS player plugin for Firefox (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npvgsplayer.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: NCity3D plugin for firefox (Enabled) = C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: HP Product Detection Plugin = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aelbknmfcacjffmgnoaaonhgoghlmlkp\1.0.26.1_0\
CHR - Extension: YouTube = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Skype Click to Call = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0\
CHR - Extension: Radialpoint SPD Extension = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj\1.0_0\
CHR - Extension: SearchNewTab = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mikjhaicomkcabebhnddigcpmagnpiha\1\
CHR - Extension: AVG SafeGuard toolbar = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\
CHR - Extension: Gmail = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2012/08/22 18:10:11 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll File not found
O2 - BHO: (Spam Free Search Bar) - {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files\blekkotb\blekkoDx.dll File not found
O2 - BHO: (TSToolbarBHO) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll File not found
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll File not found
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (SearchNewTab) - {D7A4B15B-3AE6-6E8D-4CA8-F18D61607930} - C:\Documents and Settings\All Users\Application Data\SearchNewTab\5192f0ec9823e.dll ()
O3 - HKLM\..\Toolbar: (MyFunCards) - {210f1b36-3b7f-41a4-b5da-3eb87f5a56c2} - C:\Program Files\MyFunCards_5m\bar\1.bin\5mbar.dll File not found
O3 - HKLM\..\Toolbar: (Spam Free Search Bar) - {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files\blekkotb\blekkoDx.dll File not found
O3 - HKLM\..\Toolbar: (uTorrentControl_v2 Toolbar) - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTo2.dll File not found
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (MyFunCards) - {210F1B36-3B7F-41A4-B5DA-3EB87F5A56C2} - C:\Program Files\MyFunCards_5m\bar\1.bin\5mbar.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentControl_v2 Toolbar) - {7473B6BD-4691-4744-A82B-7854EB3D70B6} - C:\Program Files\uTorrentControl_v2\prxtbuTo2.dll File not found
O4 - HKLM..\Run: [kuping] C:\Program Files\kuping4\kuping_v4.exe /start File not found
O4 - HKLM..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe File not found
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe (SAMSUNG ELECTRONICS)
O4 - HKLM..\Run: [TELUS_McciTrayApp] C:\Program Files\TELUS\McciTrayApp.exe (Alcatel-Lucent)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG SafeGuard toolbar\vprot.exe (AVG Secure Search)
O4 - HKLM..\Run: [WJNews_197226] C:\Program Files\Wuji\197226\WJNews.exe (Sta)
O4 - HKCU..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe (Sammsoft)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [HP Photosmart 7520 series (NET)] C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - HKCU..\Run: [SmileboxTray] "C:\Documents and Settings\Vivian\Application Data\Smilebox\SmileboxTray.exe" File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\酷屏.lnk = File not found
O4 - Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Æô¶¯·ÉËÙÍÁ¶¹.lnk = File not found
O4 - Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\启动飞速土豆.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Value error. File not found
O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: 显示或隐藏 HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - Reg Error: Value error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 75.153.176.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F5D8976E-2CE8-46E0-BC66-A161DBFBDA3F}: DhcpNameServer = 192.168.1.254 75.153.176.9
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll File not found
O18 - Protocol\Handler\tmtb {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll File not found
O18 - Protocol\Handler\tmtbim {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - C:\WINDOWS\System32\WgaLogon.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\Vivian\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Vivian\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/21 14:09:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/25 15:28:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2013/05/25 15:27:58 | 000,000,000 | ---D | C] -- C:\JRT
[2013/05/24 15:11:02 | 000,000,000 | ---D | C] -- C:\FRST
[2013/05/23 16:14:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\TELUS
[2013/05/23 16:13:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Motive
[2013/05/23 16:13:25 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Motive
[2013/05/23 16:13:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Motive
[2013/05/23 15:56:55 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2013/05/22 22:06:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\PriceGong
[2013/05/22 22:06:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Conduit
[2013/05/22 22:06:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\uTorrentControl_v2
[2013/05/22 22:06:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\blekkotb
[2013/05/22 22:06:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\HPAppData
[2013/05/21 10:25:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\cache
[2013/05/16 13:07:21 | 000,000,000 | ---D | C] -- C:\dbfecd5f7d2e63eac17b4786
[2013/05/15 12:16:59 | 000,000,000 | ---D | C] -- C:\78415340c7ea0ba5fa
[2013/05/14 18:38:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\StarApp
[2013/05/14 18:38:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\BetterSoft
[2013/05/14 18:38:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SearchNewTab
[2013/05/14 18:38:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SearchNewTab
[2013/05/14 18:38:02 | 000,000,000 | ---D | C] -- C:\Program Files\EasyLife
[2013/05/14 15:16:36 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
[2013/05/14 15:16:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Visan
[2013/05/14 14:14:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Visan
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Program Files\HP Photo Creations
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HP Photo Creations
[2013/05/14 14:12:33 | 000,563,048 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPDiscoPMBC11.dll
[2013/05/14 14:12:28 | 001,961,320 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPScanTRDrv_PS7520.dll
[2013/05/14 14:12:28 | 000,495,464 | ---- | C] (Hewlett-Packard) -- C:\WINDOWS\System32\HPWia1_PS7520.dll
[2013/05/14 14:12:25 | 002,215,784 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkinsBC11.exe
[2013/05/14 14:12:25 | 000,513,384 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkstsBC11.dll
[2013/05/14 14:12:25 | 000,267,624 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkstsBC11LM.dll
[2013/05/14 14:12:25 | 000,219,496 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkcoiBC11.dll
[2013/05/13 10:21:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype
[2013/05/13 10:21:56 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2013/02/27 15:27:19 | 020,546,152 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2011/02/19 12:10:12 | 053,539,128 | ---- | C] (Logitech, Inc.) -- C:\Program Files\lws110_x64.exe
[2010/04/08 21:41:02 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Vivian\Application Data\pcouffin.sys
[1 C:\Documents and Settings\Vivian\Desktop\*.tmp files -> C:\Documents and Settings\Vivian\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/25 15:45:00 | 000,000,536 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/05/25 15:41:53 | 000,000,605 | ---- | M] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\启动飞速土豆.lnk
[2013/05/25 15:41:22 | 000,000,876 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/25 15:41:22 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\FSPlatform.job
[2013/05/25 15:41:21 | 000,000,630 | -H-- | M] () -- C:\WINDOWS\tasks\schedule!1822287263.job
[2013/05/25 15:40:57 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013/05/25 15:35:55 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\FSPlatform1.job
[2013/05/25 15:30:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/05/25 15:29:40 | 000,000,492 | ---- | M] () -- C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/05/25 15:15:00 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
[2013/05/25 15:11:14 | 000,000,880 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/23 16:28:52 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/05/23 16:14:53 | 000,001,820 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
[2013/05/23 16:05:37 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/05/23 14:53:00 | 000,000,990 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
[2013/05/21 10:25:32 | 000,037,664 | ---- | M] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/05/21 10:25:16 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/05/19 10:15:00 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
[2013/05/18 17:45:01 | 000,001,029 | ---- | M] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
[2013/05/18 17:44:55 | 000,487,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/05/18 17:44:55 | 000,080,730 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/05/15 12:21:15 | 002,176,880 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/05/15 11:45:17 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/05/15 11:45:17 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/05/14 16:11:50 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2013/05/14 15:16:25 | 000,001,742 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
[2013/05/14 14:12:31 | 000,001,993 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
[2013/05/14 14:12:31 | 000,000,925 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
[2013/05/14 14:09:27 | 000,000,057 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2013/05/06 21:27:31 | 006,015,488 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2013/05/02 08:28:50 | 000,238,872 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe
[1 C:\Documents and Settings\Vivian\Desktop\*.tmp files -> C:\Documents and Settings\Vivian\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/23 16:14:53 | 000,001,820 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
[2013/05/14 18:38:15 | 000,000,630 | -H-- | C] () -- C:\WINDOWS\tasks\schedule!1822287263.job
[2013/05/14 15:06:45 | 000,000,492 | ---- | C] () -- C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/05/14 14:14:01 | 000,001,742 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
[2013/05/14 14:12:31 | 000,001,993 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
[2013/05/14 14:12:31 | 000,000,925 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
[2013/05/14 14:09:27 | 000,000,057 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2013/05/01 09:27:57 | 000,000,306 | ---- | C] () -- C:\WINDOWS\tasks\FSPlatform1.job
[2013/05/01 09:24:06 | 000,001,029 | ---- | C] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
[2013/03/14 12:14:24 | 000,000,010 | ---- | C] () -- C:\Documents and Settings\Vivian\1pt1
[2013/03/14 11:58:22 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2013/03/14 11:58:22 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2013/03/14 11:58:22 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2013/03/12 13:19:15 | 002,816,504 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data
[2013/03/12 13:07:22 | 000,013,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\SWDUMon.sys
[2013/02/18 15:22:04 | 000,172,332 | ---- | C] () -- C:\WINDOWS\hpoins37.dat
[2013/02/18 15:22:04 | 000,000,632 | ---- | C] () -- C:\WINDOWS\hpomdl37.dat
[2013/02/03 17:52:51 | 000,172,332 | ---- | C] () -- C:\WINDOWS\hpoins37.dat.temp
[2013/02/03 17:52:51 | 000,000,632 | ---- | C] () -- C:\WINDOWS\hpomdl37.dat.temp
[2012/09/29 09:09:43 | 000,558,133 | ---- | C] () -- C:\WINDOWS\System32\sqlite3.dll
[2012/08/22 17:45:35 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/08/22 17:45:35 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/08/22 17:45:35 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/08/22 17:45:35 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/08/22 17:45:35 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/08/19 12:55:46 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\inst.exe
[2012/02/15 11:22:34 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/19 11:12:05 | 000,014,336 | ---- | C] () -- C:\Documents and Settings\Vivian\SMS.db
[2011/04/20 09:42:28 | 000,001,022 | ---- | C] () -- C:\Documents and Settings\Vivian\tudouproxy.inf
[2011/02/18 14:21:08 | 000,738,189 | ---- | C] () -- C:\Program Files\wot-20100908-fx+sm.xpi
[2011/02/18 13:24:21 | 010,234,024 | ---- | C] ( ) -- C:\Program Files\fwinstall.exe
[2010/09/13 09:10:26 | 000,000,112 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\5FG7121.dat
[2010/04/08 21:41:20 | 000,000,671 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\vso_ts_preview.xml
[2010/04/08 21:41:02 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\pcouffin.cat
[2010/04/08 21:41:02 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\pcouffin.inf
[2009/05/31 10:07:54 | 000,000,098 | ---- | C] () -- C:\Documents and Settings\Vivian\default.pls
[2009/04/21 15:08:37 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\Vivian\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/21 14:08:43 | 000,001,572 | ---- | C] () -- C:\Program Files\Disk Defragmenter.lnk

========== ZeroAccess Check ==========

[2009/10/13 00:08:14 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 05:42:06 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 05:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 05:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Files - Unicode (All) ==========
[2010/07/29 05:23:59 | 000,000,776 | ---- | M] ()(C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\???ˉ·é?ùíá?1.lnk) -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Æô¶¯·ÉËÙÍÁ¶¹.lnk
[2010/01/01 23:01:07 | 000,000,776 | ---- | C] ()(C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\???ˉ·é?ùíá?1.lnk) -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Æô¶¯·ÉËÙÍÁ¶¹.lnk

========== Alternate Data Streams ==========

@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C31F31E6

< End of report >


----------



## emeraldnzl (Nov 3, 2007)

Please run OTL.exe


Under the *Custom Scans/Fixes* box at the bottom, copy and paste the content of the quote box below:



> :OTL
> PRC - [2013/03/13 23:37:56 | 000,679,264 | ---- | M] (Sta) -- C:\Program Files\Wuji\197226\WJNews.exe
> PRC - [2013/01/23 12:58:25 | 000,348,160 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\BetterSoft\EasylifeGadget Updater\EasylifeGadget Updater.exe
> PRC - [2009/10/12 11:19:46 | 001,323,008 | ---- | M] (???) -- C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe
> ...



Then click the *Run Fix* button at the top
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply.The log is saved in the same location as OTL.
*After that*

Please run a free online scan with the *ESET Online Scanner*

*Vista / Win7 users: *Right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select *Run as Administrator*.

*Note: This scan works with Internet Explorer or Mozilla FireFox.*

If using* Mozilla Firefox* you will need to download *esetsmartinstaller_enu.exe* when prompted then double click on it to install.


Click the green ESET Online Scanner box
Tick the box next to *YES, I accept the Terms of Use*
then click on: *Start*
You may see a panel towards the top of the screen telling you the website wants to install an addon... click and allow it to install. If your firewall asks whether you want to allow installation, say yes.
 Make sure that the option *Scan archives *is checked.
 Now click on *Advanced Settings* and select the following:
*Scan for potentially unwanted applications*
* Scan for potentially unsafe applications*
* Enable Anti-Stealth Technology*

 Click on *Start*
 The virus signature database will begin to download. *Be patient* this make take some time depending on the speed of your Internet Connection.
 When completed the *Online Scan* will begin automatically. The scan may take several hours.
 *Do not touch either the Mouse or keyboard* during the scan otherwise it may stall.
 When completed select *Uninstall application on close*, *make sure you copy the logfile first!*
 Then click on: *Finish*
 Use *notepad* to open the logfile located at *C:\Program Files (x86)\ESET\ESET Online Scanner\log.txt.*
 *Copy *and *paste* that log *as a reply* to this topic.
*When you return please post
OTL.txt
Results of ESET scan and tell me how your machine is now*


----------



## errorloading (Feb 4, 2011)

All processes killed
========== OTL ==========
No active process named WJNews.exe was found!
No active process named EasylifeGadget Updater.exe was found!
No active process named TudouVa.exe was found!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{7473b6bd-4691-4744-a82b-7854eb3d70b6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473b6bd-4691-4744-a82b-7854eb3d70b6}\ deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{f4c28532-b9d0-4950-a2df-e83f9929242b} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f4c28532-b9d0-4950-a2df-e83f9929242b}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{01bd49d7-c76b-4310-8beb-14d7e5f322c6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01bd49d7-c76b-4310-8beb-14d7e5f322c6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7F0B9B44-4BE5-4459-BBC9-06CE908433D4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F0B9B44-4BE5-4459-BBC9-06CE908433D4}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\AutoConfigURL deleted successfully.
C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]\content folder moved successfully.
C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected] folder moved successfully.
C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\searchplugins\EasyLife.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{26c9e18c-3717-4be1-a225-04e4471f5b6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26c9e18c-3717-4be1-a225-04e4471f5b6e}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{210f1b36-3b7f-41a4-b5da-3eb87f5a56c2} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{210f1b36-3b7f-41a4-b5da-3eb87f5a56c2}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{26c9e18c-3717-4be1-a225-04e4471f5b6e} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26c9e18c-3717-4be1-a225-04e4471f5b6e}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7473b6bd-4691-4744-a82b-7854eb3d70b6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473b6bd-4691-4744-a82b-7854eb3d70b6}\ not found.
File C:\Program Files\uTorrentControl_v2\prxtbuTo2.dll File not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{95B7759C-8C7F-4BF1-B163-73684A933233} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{210F1B36-3B7F-41A4-B5DA-3EB87F5A56C2} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{210F1B36-3B7F-41A4-B5DA-3EB87F5A56C2}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7473B6BD-4691-4744-A82B-7854EB3D70B6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7473B6BD-4691-4744-A82B-7854EB3D70B6}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\kuping deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\MAAgent deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\??.lnk moved successfully.
C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Æô¶¯·ÉËÙÍÁ¶¹.lnk moved successfully.
C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\??????.lnk moved successfully.
========== FILES ==========
C:\Program Files\Wuji\197226\icon folder moved successfully.
C:\Program Files\Wuji\197226 folder moved successfully.
C:\Program Files\Wuji folder moved successfully.
C:\Documents and Settings\All Users\Application Data\BetterSoft\EasylifeGadget Updater folder moved successfully.
C:\Documents and Settings\All Users\Application Data\BetterSoft folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\update folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\export folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\downloadinfo folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\7576402 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\50963100 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\49354911 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\49152939 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\48927845 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\46108689 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\4607392 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\46004299 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\45961723 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\45783656 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\45704199 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\45410373 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\44546316 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\44061431 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\43997947 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\43993213 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\43989882 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\43921530 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\42517750 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\40351648 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\40349993 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\37622470 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\37006846 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\37006815 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\37006784 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\36987948 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\36386367 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\36340702 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\36303949 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\36100079 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\35916389 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\35915171 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\3541896 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\35397181 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\35396441 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\35393582 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\35391892 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\35391790 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\35386569 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\35380005 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\35034351 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\34861963 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\34861608 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\34508934 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\34508424 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\34161437 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\34159992 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\33813400 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\33466366 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\33269771 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\32757184 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\32441999 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\31562151 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\31409768 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\31364871 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\31364630 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\30891356 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\21973312 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\21796382 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\21795136 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\15373973 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\13823626 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\13351537 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1227324336 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1226844473 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1223092165 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1223091631 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1223091017 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1151032186 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1149544240 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1149335170 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1149308820 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1149218260 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1147501453 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1147501440 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1146621539 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1145994719 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1145962636 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1145182260 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1144113254 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1130524903 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1127324335 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download\1115371871 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou\download folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\tudou folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\Skin\Prog\Prog_4 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\Skin\Prog\Prog_3 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\Skin\Prog\Prog_2 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\Skin\Prog folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\Skin\Pop\Pop_4 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\Skin\Pop\Pop_3 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\Skin\Pop\Pop_2 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\Skin\Pop folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\Skin\Mini\Mini_4 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\Skin\Mini\Mini_3 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\Skin\Mini\Mini_2 folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\Skin\Mini folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\Skin folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou\ad folder moved successfully.
C:\Program Files\Tudou\·ÉËÙTudou folder moved successfully.
C:\Program Files\Tudou folder moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Vivian\My Documents\Downloads\cmd.bat deleted successfully.
C:\Documents and Settings\Vivian\My Documents\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Chung-Yan
->Temp folder emptied: 296469 bytes
->Temporary Internet Files folder emptied: 448358 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 116483283 bytes
->Flash cache emptied: 4839 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56504 bytes

User: Guest
->Temp folder emptied: 29836978 bytes
->Temporary Internet Files folder emptied: 55562636 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 1158157465 bytes
->Google Chrome cache emptied: 355299177 bytes
->Flash cache emptied: 69738 bytes

User: Karen
->Temp folder emptied: 1317152 bytes
->Temporary Internet Files folder emptied: 143427 bytes
->FireFox cache emptied: 99536708 bytes
->Flash cache emptied: 506 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 7246645 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 2163740 bytes
->Temporary Internet Files folder emptied: 3785955 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: philso
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: pso
->Temp folder emptied: 100696839 bytes
->Temporary Internet Files folder emptied: 42977399 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 70401674 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 57065 bytes

User: tso
->Temp folder emptied: 12932679 bytes
->Temporary Internet Files folder emptied: 21040060 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 65844422 bytes
->Google Chrome cache emptied: 108670258 bytes
->Flash cache emptied: 789 bytes

User: Vivian
->Temp folder emptied: 107571718 bytes
->Temporary Internet Files folder emptied: 149282813 bytes
->Java cache emptied: 118545 bytes
->FireFox cache emptied: 73286334 bytes
->Google Chrome cache emptied: 145458905 bytes
->Flash cache emptied: 57195 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 42914694 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 488478928 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 7116586 bytes
RecycleBin emptied: 3574850879 bytes

Total Files Cleaned = 6,525.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 05252013_184704
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...

C:\Documents and Settings\All Users\Application Data\SearchNewTab\5192f0ec9823e.dll a variant of Win32/Adware.MultiPlug.I application cleaned by deleting (after the next restart) - quarantined
C:\Documents and Settings\tso\My Documents\Downloads\iLividSetupV1.exe Win32/Toolbar.SearchSuite application cleaned by deleting - quarantined
C:\Documents and Settings\tso\My Documents\Downloads\setup(1).exe Win32/Adware.Bundlore application cleaned by deleting - quarantined
C:\Documents and Settings\tso\My Documents\Downloads\setup.exe Win32/Adware.Bundlore application cleaned by deleting - quarantined
C:\Documents and Settings\tso\My Documents\Downloads\VideoPerformerSetup(1).exe a variant of Win32/InstallBrain.L application cleaned by deleting - quarantined
C:\Documents and Settings\tso\My Documents\Downloads\VideoPerformerSetup.exe a variant of Win32/InstallBrain.L application cleaned by deleting - quarantined
C:\Documents and Settings\tso\My Documents\Downloads\video_downloader(1).exe Win32/Adware.Bundlore application cleaned by deleting - quarantined
C:\Documents and Settings\tso\My Documents\Downloads\video_downloader(2).exe Win32/Adware.Bundlore application cleaned by deleting - quarantined
C:\Documents and Settings\tso\My Documents\Downloads\video_downloader.exe Win32/Adware.Bundlore application cleaned by deleting - quarantined
C:\Documents and Settings\tso\My Documents\Downloads\youkuclient_setup.exe a variant of Win32/Hao123.A application cleaned by deleting - quarantined
C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mikjhaicomkcabebhnddigcpmagnpiha\1\5192f0ec97ff75.70743428.js Win32/Adware.MultiPlug.H application cleaned by deleting - quarantined
C:\Documents and Settings\Vivian\My Documents\Downloads\7525.setup.exe Win32/InstalleRex.J application cleaned by deleting - quarantined
C:\Documents and Settings\Vivian\My Documents\Downloads\cnet2_doc2pdf_setup_exe.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined
C:\Documents and Settings\Vivian\My Documents\Downloads\speedupmypc.exe Win32/SpeedUpMyPC application cleaned by deleting - quarantined
C:\Documents and Settings\Vivian\Start Menu\Programs\Downloads\ARO2010_bt.exe a variant of Win32/Bundled.Toolbar.Ask application cleaned by deleting - quarantined
C:\Documents and Settings\Vivian\Start Menu\Programs\Downloads\gusetup.exe a variant of Win32/Bundled.Toolbar.Ask application cleaned by deleting - quarantined
C:\Program Files\EasyLife\sprotector.dll a variant of Win32/SProtector.A application cleaned by deleting - quarantined
C:\System Volume Information\_restore{F6B8AF62-5D30-432E-B286-E52F1C27AF8B}\RP230\A0142118.exe a variant of Win32/Toolbar.MyWebSearch.R application cleaned by deleting - quarantined
C:\System Volume Information\_restore{F6B8AF62-5D30-432E-B286-E52F1C27AF8B}\RP246\A0144490.exe a variant of Win32/Hao123.A application cleaned by deleting - quarantined
C:\System Volume Information\_restore{F6B8AF62-5D30-432E-B286-E52F1C27AF8B}\RP273\A0159593.dll a variant of Win32/Toolbar.MyWebSearch.A application cleaned by deleting - quarantined
C:\System Volume Information\_restore{F6B8AF62-5D30-432E-B286-E52F1C27AF8B}\RP273\A0159599.dll probably a variant of Win32/Toolbar.MyWebSearch.B application cleaned by deleting - quarantined
C:\System Volume Information\_restore{F6B8AF62-5D30-432E-B286-E52F1C27AF8B}\RP273\A0159602.dll probably a variant of Win32/Toolbar.MyWebSearch.P application cleaned by deleting - quarantined
C:\System Volume Information\_restore{F6B8AF62-5D30-432E-B286-E52F1C27AF8B}\RP273\A0159607.dll probably a variant of Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\System Volume Information\_restore{F6B8AF62-5D30-432E-B286-E52F1C27AF8B}\RP273\A0159613.dll a variant of Win32/Toolbar.MyWebSearch.P application cleaned by deleting - quarantined
C:\System Volume Information\_restore{F6B8AF62-5D30-432E-B286-E52F1C27AF8B}\RP273\A0159625.DLL probably a variant of Win32/Toolbar.MyWebSearch.F application cleaned by deleting - quarantined
C:\_OTL\MovedFiles\05252013_184704\C_Documents and Settings\All Users\Application Data\BetterSoft\EasylifeGadget Updater\EasylifeGadget Updater.exe Win32/GenUpdater application cleaned by deleting - quarantined
C:\_OTL\MovedFiles\05252013_184704\C_Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]\content\bg.js Win32/Adware.MultiPlug.H application cleaned by deleting - quarantined


----------



## errorloading (Feb 4, 2011)

all my problems r fixed, but when I use internet explorer to start up. the following website popup:

88488.com

I am not sure if it is defaulted.

Also is it better for me to remove the other search engines - firefox and google which cause me all the troubles, n just keep internet explorer 7.

The starting page defaulted to Chinese (when I type) and I have to switch to English. If there anything I can do to start everything in English instead.

Thank you very much for your assistance and quick response.


----------



## errorloading (Feb 4, 2011)

Please advise if there is any security program I can download to protect my computer from any possible virus. Last time, someone suggested PC Tool n it works pretty well. Is there any new program I can use.

Thank you


----------



## emeraldnzl (Nov 3, 2007)

> Please advise if there is any security program I can download to protect my computer from any possible virus. Last time, someone suggested PC Tool n it works pretty well. Is there any new program I can use.


We can look at this after we have finished cleaning your machine.



> all my problems r fixed, but when I use internet explorer to start up. the following website popup:
> 
> 88488.com


and



> The starting page defaulted to Chinese (when I type)


Hmm... looks like we still have some work to do.

Please go to Control Panel > Add or Remove Programs and uninstall these programs if they are still in the list:

*·é?ùíá?1 1.30 (Version: 1.30)
EasyLife Search 1.74
EasylifeGadget (Version: 1.0)
Fun4IM
MyFunCards Toolbar
SearchNewTab (Version: )
VLC media player 1.0.5 (Version: 1.0.5)*

*After that*

Please download AdwCleaner from here to your desktop

Click on the green downward facing arrow on the right to commence download.
Run AdwCleaner and select Delete










Once done it will ask to reboot, allow this.

On reboot a log will be produced please post that back here.

*Finally in this post*


Close all windows and open *OTL* again. 
Click *Run Scan* and let the program run uninterrupted
It will produce a log for you. Post the log here.
*Note*: If the log doesn't appear where you saved OTL when you downloaded it, then a copy of the OTL log is saved in a text file at

:\_OTL\MovedFiles
in most cases this will be C:\_OTL\MovedFiles

*When you return please post
AdwCleaner log
OTL.txt
*


----------



## errorloading (Feb 4, 2011)

# AdwCleaner v2.301 - Logfile created 05/26/2013 at 17:40:19
# Updated 16/05/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Vivian - VIVIANSCOMPUTER
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Vivian\Local Settings\Temporary Internet Files\Content.IE5\ET298A18\AdwCleaner[1].exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Deleted on reboot : C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mikjhaicomkcabebhnddigcpmagnpiha
Deleted on reboot : C:\Program Files\Common Files\AVG Secure Search
File Deleted : C:\Documents and Settings\pso\Application Data\Mozilla\Firefox\Profiles\9mp1r9r5.default\searchplugins\my-web-search.xml
File Deleted : C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_apps.conduit.com_0.localstorage
File Deleted : C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_apps.conduit.com_0.localstorage-journal
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lmpsei6b.default\blekkotb
Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lmpsei6b.default\extensions\[email protected]_5m.com
Folder Deleted : C:\Documents and Settings\All Users\Application Data\SearchNewTab
Folder Deleted : C:\Documents and Settings\Chung-Yan\Application Data\blekkotb
Folder Deleted : C:\Documents and Settings\Chung-Yan\Application Data\Mozilla\Firefox\Profiles\0izvf1wi.default-1354498040859\extensions\[email protected]_5m.com
Folder Deleted : C:\Documents and Settings\Chung-Yan\Local Settings\Application Data\blekkotb
Folder Deleted : C:\Documents and Settings\Karen\Application Data\blekkotb
Folder Deleted : C:\Documents and Settings\Karen\Application Data\Mozilla\Firefox\Profiles\mxiyqag7.default\blekkotb
Folder Deleted : C:\Documents and Settings\Karen\Application Data\Mozilla\Firefox\Profiles\mxiyqag7.default\extensions\[email protected]_5m.com
Folder Deleted : C:\Documents and Settings\Karen\Local Settings\Application Data\blekkotb
Folder Deleted : C:\Documents and Settings\NetworkService\Application Data\blekkotb
Folder Deleted : C:\Documents and Settings\NetworkService\Application Data\PriceGong
Folder Deleted : C:\Documents and Settings\NetworkService\Local Settings\Application Data\Conduit
Folder Deleted : C:\Documents and Settings\NetworkService\Local Settings\Application Data\uTorrentControl_v2
Folder Deleted : C:\Documents and Settings\philso\Application Data\Mozilla\Firefox\Profiles\vdnj4b33.default\blekkotb
Folder Deleted : C:\Documents and Settings\pso\Application Data\blekkotb
Folder Deleted : C:\Documents and Settings\pso\Application Data\Mozilla\Firefox\Profiles\9mp1r9r5.default\blekkotb
Folder Deleted : C:\Documents and Settings\pso\Application Data\Mozilla\Firefox\Profiles\9mp1r9r5.default\extensions\[email protected]_5m.com
Folder Deleted : C:\Documents and Settings\pso\Application Data\MyFunCards_5m
Folder Deleted : C:\Documents and Settings\pso\Application Data\PriceGong
Folder Deleted : C:\Documents and Settings\pso\Local Settings\Application Data\blekkotb
Folder Deleted : C:\Documents and Settings\pso\Local Settings\Application Data\Conduit
Folder Deleted : C:\Documents and Settings\pso\Local Settings\Application Data\uTorrentControl_v2
Folder Deleted : C:\Documents and Settings\tso\Application Data\blekkotb
Folder Deleted : C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\blekkotb
Folder Deleted : C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\[email protected]_5m.com
Folder Deleted : C:\Documents and Settings\tso\Local Settings\Application Data\blekkotb
Folder Deleted : C:\Documents and Settings\tso\Local Settings\Application Data\Conduit
Folder Deleted : C:\Documents and Settings\tso\Local Settings\Application Data\uTorrentControl_v2
Folder Deleted : C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\blekkotb
Folder Deleted : C:\Documents and Settings\Vivian\Local Settings\Application Data\PackageAware
***** [Registry] *****
Key Deleted : HKCU\Software\AppDataLow\Software\blekkotb
Key Deleted : HKCU\Software\blekkotb
Key Deleted : HKCU\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\Headlight
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{20A0BE68-8FD9-4539-8712-CE3D1C1FDFC6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{26C9E18C-3717-4BE1-A225-04E4471F5B6E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C4B22C87-45EF-4F43-89F2-40DB2078864E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D7A4B15B-3AE6-6E8D-4CA8-F18D61607930}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DA71FD14-5F7B-46AE-B8B1-44074A38F331}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{20A0BE68-8FD9-4539-8712-CE3D1C1FDFC6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{26C9E18C-3717-4BE1-A225-04E4471F5B6E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{537F4F0B-3542-4C7D-A3E5-CF121482696C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C4B22C87-45EF-4F43-89F2-40DB2078864E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D7A4B15B-3AE6-6E8D-4CA8-F18D61607930}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DA71FD14-5F7B-46AE-B8B1-44074A38F331}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\TENCENT
Key Deleted : HKCU\Software\uTorrentControl_v2
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Toolbar
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\Software\Bandoo
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{13119113-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{20A0BE68-8FD9-4539-8712-CE3D1C1FDFC6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{33119133-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4ADBABBD-E1CA-4F11-BD01-73B0B6E4B5BA}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{537F4F0B-3542-4C7D-A3E5-CF121482696C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C4B22C87-45EF-4F43-89F2-40DB2078864E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DA71FD14-5F7B-46AE-B8B1-44074A38F331}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\Software\Classes\Installer\Features\90C64EA18BA25EE488BF80DCF07F2FFD
Key Deleted : HKLM\Software\Classes\Installer\Products\90C64EA18BA25EE488BF80DCF07F2FFD
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0194532A-A99C-4337-937E-2A452C8957BE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{03119103-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{00F12770-E60E-4DC6-9105-425BFACE7C73}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{077898E4-1F07-4309-BFBA-F746DA947993}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7FF99715-3016-4381-84CE-E4E4C9673020}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C2447F2F-EE75-44F5-BBFB-BE88CF670C69}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Anti-phishing Domain Advisor
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\blekkotb
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\uTorrentControl_v2 Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{537F4F0B-3542-4C7D-A3E5-CF121482696C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\90C64EA18BA25EE488BF80DCF07F2FFD
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-phishing Domain Advisor
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\blekkotb
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentControl_v2 Toolbar
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\Software\SP Global
Key Deleted : HKLM\Software\SProtector
Key Deleted : HKLM\Software\uTorrentControl_v2
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
***** [Internet Browsers] *****
-\\ Internet Explorer v8.0.6001.18702
[OK] Registry is clean.
-\\ Mozilla Firefox v20.0.1 (en-US)
File : C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\prefs.js
[OK] File is clean.
File : C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\prefs.js
Deleted : user_pref("aol_toolbar.default.homepage.check", false);
Deleted : user_pref("aol_toolbar.default.search.check", false);
Deleted : user_pref("browser.search.selectedEngine", "Blekko");
Deleted : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Deleted : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Deleted : user_pref("keyword.URL", "hxxp://www.searchqu.com/web?src=ffb&systemid=402&q=");
Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Deleted : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Deleted : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Deleted : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Deleted : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Deleted : user_pref("sweetim.toolbar.searchguard.enable", "");
File : C:\Documents and Settings\Chung-Yan\Application Data\Mozilla\Firefox\Profiles\0izvf1wi.default-1354498040859\prefs.js
[OK] File is clean.
File : C:\Documents and Settings\Karen\Application Data\Mozilla\Firefox\Profiles\mxiyqag7.default\prefs.js
Deleted : user_pref("browser.search.selectedEngine", "Blekko");
Deleted : user_pref("browser.startup.homepage", "hxxp://blekko.com?source=c3348dd4&tbp=homepage&toolba[...]
File : C:\Documents and Settings\philso\Application Data\Mozilla\Firefox\Profiles\vdnj4b33.default\prefs.js
Deleted : user_pref("browser.search.selectedEngine", "Blekko");
Deleted : user_pref("browser.startup.homepage", "hxxp://blekko.com?source=c3348dd4&tbp=homepage&toolba[...]
File : C:\Documents and Settings\pso\Application Data\Mozilla\Firefox\Profiles\9mp1r9r5.default\prefs.js
Deleted : user_pref("aol_toolbar.default.homepage.check", false);
Deleted : user_pref("aol_toolbar.default.search.check", false);
Deleted : user_pref("browser.search.defaultenginename", "My Web Search");
Deleted : user_pref("browser.search.selectedEngine", "My Web Search");
Deleted : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Deleted : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Deleted : user_pref("extensions.mywebsearch.prevDefaultEngine", "Google");
Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
Deleted : user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://www.searchqu.com/web?src=ffb&systemid=402&q="[...]
Deleted : user_pref("extensions.mywebsearch.prevSelectedEngine", "Blekko");
Deleted : user_pref("extensions.toolbar.mindspark._5mMembers_.homepage", "hxxp://home.mywebsearch.com/index.jh[...]
Deleted : user_pref("keyword.URL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=33FED4C0[...]
Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Deleted : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Deleted : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Deleted : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Deleted : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Deleted : user_pref("sweetim.toolbar.searchguard.enable", "");
File : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lmpsei6b.default\prefs.js
Deleted : user_pref("browser.search.selectedEngine", "Blekko");
Deleted : user_pref("browser.startup.homepage", "hxxp://blekko.com?source=c3348dd4&tbp=homepage&toolba[...]
-\\ Google Chrome v27.0.1453.94
File : C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
File : C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
File : C:\Documents and Settings\pso\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
*************************
AdwCleaner[S1].txt - [17261 octets] - [26/05/2013 17:40:19]
########## EOF - C:\AdwCleaner[S1].txt - [17322 octets] ##########

OTL logfile created on: 5/26/2013 5:47:48 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Vivian\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 0.97 Gb Available Physical Memory | 49.93% Memory free
3.79 Gb Paging File | 2.98 Gb Available in Paging File | 78.67% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 382.83 Gb Free Space | 82.20% Space Free | Partition Type: NTFS

Computer Name: VIVIANSCOMPUTER | User Name: Vivian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/05/24 15:13:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Vivian\My Documents\Downloads\OTL.exe
PRC - [2013/05/23 11:10:52 | 028,712,088 | ---- | M] (Dropbox, Inc.) -- C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2013/05/21 10:25:31 | 001,015,984 | ---- | M] (AVG Secure Search) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe
PRC - [2013/05/14 13:26:12 | 003,289,208 | ---- | M] (Skype Technologies S.A.) -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2013/04/25 00:23:26 | 000,335,496 | ---- | M] (Funshion) -- C:\Documents and Settings\Vivian\funshion\funshiontools\FsSvr.exe
PRC - [2013/01/27 12:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/01/27 12:11:06 | 000,947,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/06/11 16:22:16 | 000,425,040 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BingBar.exe
PRC - [2012/06/11 16:22:16 | 000,267,856 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BingApp.exe
PRC - [2012/06/11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE
PRC - [2012/06/11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE
PRC - [2012/06/11 16:22:16 | 000,141,904 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\bingsurrogate.exe
PRC - [2012/06/11 12:22:18 | 001,561,088 | ---- | M] (Alcatel-Lucent) -- C:\Program Files\TELUS\McciTrayApp.exe
PRC - [2012/05/08 14:05:58 | 001,818,472 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe
PRC - [2012/03/09 11:33:12 | 010,294,584 | ---- | M] (Radialpoint SafeCare Inc.) -- C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/14 05:42:16 | 000,027,648 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\conime.exe
PRC - [2007/06/27 19:04:00 | 001,213,736 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007/06/27 19:03:40 | 000,152,872 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2006/07/21 09:32:58 | 000,126,976 | ---- | M] (SAMSUNG ELECTRONICS) -- C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe

========== Modules (No Company Name) ==========

MOD - [2013/04/25 00:20:20 | 000,389,256 | ---- | M] () -- C:\Documents and Settings\Vivian\funshion\funshiontools\LuaInterface_mt.dll
MOD - [2013/03/13 13:48:52 | 024,978,944 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\libcef.dll
MOD - [2012/11/13 16:32:50 | 003,558,400 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\wxmsw28uh_vc.dll
MOD - [2010/03/15 16:57:20 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2009/02/12 05:30:02 | 000,190,976 | ---- | M] () -- C:\WINDOWS\system32\WgaLogon.dll
MOD - [2008/04/14 05:42:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/14 05:41:52 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (Amsp)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\alg.exe -- (ALG)
SRV - [2013/05/21 10:25:31 | 001,015,984 | ---- | M] (AVG Secure Search) [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe -- (vToolbarUpdater15.2.0)
SRV - [2013/05/15 11:45:17 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/14 13:26:12 | 003,289,208 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2013/04/12 11:30:03 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/01/27 12:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/06/11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE -- (BBUpdate)
SRV - [2012/06/11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE -- (BBSvc)
SRV - [2012/03/09 11:33:12 | 010,294,584 | ---- | M] (Radialpoint SafeCare Inc.) [Auto | Running] -- C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe -- (ServicepointService)
SRV - [2009/04/22 00:07:30 | 000,655,624 | ---- | M] (Acresso Software Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\LV302AV.SYS -- (PID_08A0)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lv302af.sys -- (pepifilter)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS -- (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS -- (MREMPR5)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\KAVSafe.sys -- (KAVSafe)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- D:\INSTALL\GMSIPCI.SYS -- (GMSIPCI)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2013/05/21 10:25:32 | 000,037,664 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp)
DRV - [2013/04/24 17:10:42 | 000,051,864 | ---- | M] () [File_System | System | Running] -- C:\Program Files\kuping4\KPProtector.sys -- (KPProtector)
DRV - [2013/03/15 09:42:47 | 000,013,464 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SWDUMon.sys -- (SWDUMon)
DRV - [2012/06/11 12:12:08 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2012/06/11 12:12:06 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2011/02/19 11:34:44 | 000,023,456 | ---- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DrvAgent32.sys -- (DrvAgent32)
DRV - [2010/05/10 11:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 11:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2010/01/21 01:59:58 | 000,020,864 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2010/01/21 01:59:56 | 000,024,960 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2010/01/21 01:59:56 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2009/09/29 08:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009/09/29 08:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009/09/29 08:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2009/04/21 15:10:32 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2008/04/17 01:33:26 | 004,707,328 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [2008/02/15 00:15:26 | 000,014,336 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008/01/28 21:37:48 | 000,022,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2008/01/28 21:37:46 | 000,054,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2008/01/25 05:01:06 | 000,132,096 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nvgts.sys -- (nvgts)
DRV - [2007/05/09 22:51:34 | 000,041,888 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/05/09 22:47:00 | 001,276,832 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI)
DRV - [2006/07/01 22:39:40 | 000,036,864 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004/08/04 05:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)
DRV - [1999/09/10 12:06:00 | 000,025,244 | ---- | M] (Adaptec) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (ASPI32)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sea...putEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?rd=1&ucc=CA&dcc=CA&opt=0&ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 28 2E 5F C5 B5 59 CE 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local

========== FireFox ==========

FF - prefs.js..capability.principal.codebase.p124.subjectName: ""user_pref("network.proxy.type", 2);
FF - prefs.js..network.proxy.autoconfig_url: "http://127.0.0.1:9415/tudouva.pac"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@baidu.com/npxbdsetup: C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@MyFunCards_5m.com/Plugin: C:\Program Files\MyFunCards_5m\bar\1.bin\NP5mStub.dll File not found
FF - HKLM\Software\MozillaPlugins\@ncity3d.com/NCity3dPlayer: C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll ( )

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22181a4d-af90-4ca3-a569-faed9118d6bc}: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013/02/18 15:26:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\Hewlett-Packard\SmartPrint\QPExtension [2013/05/14 14:14:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/14 14:13:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/25 15:42:25 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013/02/18 15:26:15 | 000,000,000 | ---D | M]

[2009/04/22 00:37:07 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Extensions
[2013/05/25 15:44:33 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions
[2012/11/29 19:06:48 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2010/06/02 22:18:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/05/13 10:44:10 | 000,000,000 | ---D | M] (IE Tab) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2011/08/10 09:42:39 | 000,000,000 | ---D | M] (Разпознаване на устройство Logitech) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2012/01/26 22:24:32 | 000,000,000 | ---D | M] (Latin Dictionary) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2013/05/01 10:37:34 | 000,346,768 | ---- | M] () (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2013/04/12 11:29:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/05/23 12:51:33 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/01 09:17:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/05/23 12:51:33 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/26 16:01:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\extensions
[2013/05/26 16:00:19 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\updated\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/26 16:00:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions
[2013/05/26 16:00:18 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/26 16:01:06 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\VIVIAN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\IG45U6WY.DEFAULT\EXTENSIONS\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
[2013/04/12 11:30:04 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/11/12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2009/05/07 14:22:10 | 000,196,096 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\npvgsplayer.dll
[2012/09/07 17:36:50 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013/05/25 15:07:32 | 000,003,725 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\safeguard-secure-search.xml
[2013/02/19 16:30:45 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = http://mysearch.avg.com/search?cid=...1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = http://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR - homepage: http://mysearch.avg.com/?cid={75845...1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=hp
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: VGS player plugin for Firefox (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npvgsplayer.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: NCity3D plugin for firefox (Enabled) = C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\tso\Application Data\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\tso\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: VGS player plugin for Firefox (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npvgsplayer.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Documents and Settings\tso\Application Data\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: NCity3D plugin for firefox (Enabled) = C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: HP Product Detection Plugin = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aelbknmfcacjffmgnoaaonhgoghlmlkp\1.0.26.1_0\
CHR - Extension: YouTube = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Skype Click to Call = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0\
CHR - Extension: Radialpoint SPD Extension = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj\1.0_0\
CHR - Extension: AVG SafeGuard toolbar = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\
CHR - Extension: Gmail = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2012/08/22 18:10:11 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll File not found
O2 - BHO: (TSToolbarBHO) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll File not found
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll File not found
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe (SAMSUNG ELECTRONICS)
O4 - HKLM..\Run: [TELUS_McciTrayApp] C:\Program Files\TELUS\McciTrayApp.exe (Alcatel-Lucent)
O4 - HKLM..\Run: [WJNews_197226] "C:\Program Files\Wuji\197226\WJNews.exe" -mini File not found
O4 - HKCU..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe (Sammsoft)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [HP Photosmart 7520 series (NET)] C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - HKCU..\Run: [SmileboxTray] "C:\Documents and Settings\Vivian\Application Data\Smilebox\SmileboxTray.exe" File not found
O4 - Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Value error. File not found
O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: 显示或隐藏 HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - Reg Error: Value error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 75.153.176.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F5D8976E-2CE8-46E0-BC66-A161DBFBDA3F}: DhcpNameServer = 192.168.1.254 75.153.176.9
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll File not found
O18 - Protocol\Handler\tmtb {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll File not found
O18 - Protocol\Handler\tmtbim {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - C:\WINDOWS\System32\WgaLogon.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\Vivian\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Vivian\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/21 14:09:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/25 19:13:07 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2013/05/25 18:47:04 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/05/25 17:15:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly_files
[2013/05/25 15:28:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2013/05/25 15:27:58 | 000,000,000 | ---D | C] -- C:\JRT
[2013/05/24 15:11:02 | 000,000,000 | ---D | C] -- C:\FRST
[2013/05/23 16:14:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\TELUS
[2013/05/23 16:13:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Motive
[2013/05/23 16:13:25 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Motive
[2013/05/23 16:13:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Motive
[2013/05/23 15:56:55 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2013/05/22 22:06:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\HPAppData
[2013/05/21 10:25:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\cache
[2013/05/16 13:07:21 | 000,000,000 | ---D | C] -- C:\dbfecd5f7d2e63eac17b4786
[2013/05/15 12:16:59 | 000,000,000 | ---D | C] -- C:\78415340c7ea0ba5fa
[2013/05/14 18:38:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\StarApp
[2013/05/14 15:16:36 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
[2013/05/14 15:16:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Visan
[2013/05/14 14:14:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Visan
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Program Files\HP Photo Creations
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HP Photo Creations
[2013/05/14 14:12:33 | 000,563,048 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPDiscoPMBC11.dll
[2013/05/14 14:12:28 | 001,961,320 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPScanTRDrv_PS7520.dll
[2013/05/14 14:12:28 | 000,495,464 | ---- | C] (Hewlett-Packard) -- C:\WINDOWS\System32\HPWia1_PS7520.dll
[2013/05/14 14:12:25 | 002,215,784 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkinsBC11.exe
[2013/05/14 14:12:25 | 000,513,384 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkstsBC11.dll
[2013/05/14 14:12:25 | 000,267,624 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkstsBC11LM.dll
[2013/05/14 14:12:25 | 000,219,496 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkcoiBC11.dll
[2013/05/13 10:21:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype
[2013/05/13 10:21:56 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2013/02/27 15:27:19 | 020,546,152 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2011/02/19 12:10:12 | 053,539,128 | ---- | C] (Logitech, Inc.) -- C:\Program Files\lws110_x64.exe
[2010/04/08 21:41:02 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Vivian\Application Data\pcouffin.sys
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Vivian\Desktop\*.tmp files -> C:\Documents and Settings\Vivian\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/26 17:54:22 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013/05/26 17:53:00 | 000,000,990 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
[2013/05/26 17:49:22 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\FSPlatform1.job
[2013/05/26 17:49:22 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\FSPlatform.job
[2013/05/26 17:45:17 | 000,000,536 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/05/26 17:44:36 | 000,000,876 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/26 17:44:35 | 000,000,630 | -H-- | M] () -- C:\WINDOWS\tasks\schedule!1822287263.job
[2013/05/26 17:44:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/05/26 17:39:41 | 000,000,492 | ---- | M] () -- C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/05/26 17:15:00 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
[2013/05/26 17:11:00 | 000,000,880 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/26 05:53:00 | 000,000,968 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
[2013/05/25 18:40:09 | 000,001,029 | ---- | M] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
[2013/05/25 17:15:50 | 000,069,658 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
[2013/05/23 16:28:52 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/05/23 16:14:53 | 000,001,820 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
[2013/05/23 16:05:37 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/05/21 10:25:32 | 000,037,664 | ---- | M] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/05/21 10:25:16 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/05/19 10:15:00 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
[2013/05/18 17:44:55 | 000,487,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/05/18 17:44:55 | 000,080,730 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/05/15 12:21:15 | 002,176,880 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/05/15 11:45:17 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/05/15 11:45:17 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/05/14 16:11:50 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2013/05/14 15:16:25 | 000,001,742 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
[2013/05/14 14:12:31 | 000,001,993 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
[2013/05/14 14:12:31 | 000,000,925 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
[2013/05/14 14:09:27 | 000,000,057 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2013/05/06 21:27:31 | 006,015,488 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2013/05/02 08:28:50 | 000,238,872 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Vivian\Desktop\*.tmp files -> C:\Documents and Settings\Vivian\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/25 17:15:50 | 000,069,658 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
[2013/05/23 16:14:53 | 000,001,820 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
[2013/05/14 18:38:15 | 000,000,630 | -H-- | C] () -- C:\WINDOWS\tasks\schedule!1822287263.job
[2013/05/14 15:06:45 | 000,000,492 | ---- | C] () -- C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/05/14 14:14:01 | 000,001,742 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
[2013/05/14 14:12:31 | 000,001,993 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
[2013/05/14 14:12:31 | 000,000,925 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
[2013/05/14 14:09:27 | 000,000,057 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2013/05/01 09:27:57 | 000,000,306 | ---- | C] () -- C:\WINDOWS\tasks\FSPlatform1.job
[2013/05/01 09:24:06 | 000,001,029 | ---- | C] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
[2013/03/14 12:14:24 | 000,000,010 | ---- | C] () -- C:\Documents and Settings\Vivian\1pt1
[2013/03/14 11:58:22 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2013/03/14 11:58:22 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2013/03/14 11:58:22 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2013/03/12 13:19:15 | 002,816,504 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data
[2013/03/12 13:07:22 | 000,013,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\SWDUMon.sys
[2013/02/18 15:22:04 | 000,172,332 | ---- | C] () -- C:\WINDOWS\hpoins37.dat
[2013/02/18 15:22:04 | 000,000,632 | ---- | C] () -- C:\WINDOWS\hpomdl37.dat
[2013/02/03 17:52:51 | 000,172,332 | ---- | C] () -- C:\WINDOWS\hpoins37.dat.temp
[2013/02/03 17:52:51 | 000,000,632 | ---- | C] () -- C:\WINDOWS\hpomdl37.dat.temp
[2012/09/29 09:09:43 | 000,558,133 | ---- | C] () -- C:\WINDOWS\System32\sqlite3.dll
[2012/08/22 17:45:35 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/08/22 17:45:35 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/08/22 17:45:35 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/08/22 17:45:35 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/08/22 17:45:35 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/08/19 12:55:46 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\inst.exe
[2012/02/15 11:22:34 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/19 11:12:05 | 000,014,336 | ---- | C] () -- C:\Documents and Settings\Vivian\SMS.db
[2011/04/20 09:42:28 | 000,001,022 | ---- | C] () -- C:\Documents and Settings\Vivian\tudouproxy.inf
[2011/02/18 14:21:08 | 000,738,189 | ---- | C] () -- C:\Program Files\wot-20100908-fx+sm.xpi
[2011/02/18 13:24:21 | 010,234,024 | ---- | C] ( ) -- C:\Program Files\fwinstall.exe
[2010/09/13 09:10:26 | 000,000,112 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\5FG7121.dat
[2010/04/08 21:41:20 | 000,000,671 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\vso_ts_preview.xml
[2010/04/08 21:41:02 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\pcouffin.cat
[2010/04/08 21:41:02 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\pcouffin.inf
[2009/05/31 10:07:54 | 000,000,098 | ---- | C] () -- C:\Documents and Settings\Vivian\default.pls
[2009/04/21 15:08:37 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\Vivian\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/21 14:08:43 | 000,001,572 | ---- | C] () -- C:\Program Files\Disk Defragmenter.lnk

========== ZeroAccess Check ==========

[2009/10/13 00:08:14 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 05:42:06 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 05:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 05:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Alternate Data Streams ==========

@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C31F31E6
< End of report >


----------



## emeraldnzl (Nov 3, 2007)

Please run OTL.exe


Under the *Custom Scans/Fixes* box at the bottom, copy and paste the content of the quote box below:



> :OTL
> PRC - [2013/05/21 10:25:31 | 001,015,984 | ---- | M] (AVG Secure Search) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0
> PRC - [2013/04/25 00:23:26 | 000,335,496 | ---- | M] (Funshion) -- C:\Documents and Settings\Vivian\funshion\funshiontools\FsSvr.exe
> IE - HKLM\..\SearchScopes,DefaultScope =
> ...



Then click the *Run Fix* button at the top
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply.The log is saved in the same location as OTL.
*After that*


Close all windows and open *OTL* again. 
Click *Run Scan* and let the program run uninterrupted
It will produce a log for you. Post the log here.
*Note*: If the log doesn't appear where you saved OTL when you downloaded it, then a copy of the OTL log is saved in a text file at

*Finally in this post*

Please run the MGA Diagnostic Tool and post back the report it produces:

Download *MGADiag* to your desktop.
Double-click on MGADiag.exe to launch the program
Click "Continue"
Ensure that the "Windows" tab is selected (it should be by default).
Click the "Copy" button to copy the MGA Diagnostic Report to the Windows clipboard.
Paste the MGA Diagnostic Report back here in your next reply.
*When you return please post
OTL fix.txt
OTL .txt
MGA diagnostic report
*


----------



## errorloading (Feb 4, 2011)

All processes killed
========== OTL ==========
No active process named 15.2.0 was found!
No active process named FsSvr.exe was found!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Prefs.js: ""user_pref("network.proxy.type", 2); removed from capability.principal.codebase.p124.subjectName
Prefs.js: "http://127.0.0.1:9415/tudouva.pac" removed from network.proxy.autoconfig_url
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@MyFunCards_5m.com/Plugin\ not found.
File C:\Program Files\mozilla firefox\searchplugins\safeguard-secure-search.xml not found.
Use Chrome's Settings page to remove the default_search_provider items.
Use Chrome's Settings page to remove the default_search_provider items.
Use Chrome's Settings page to remove the default_search_provider items.
Use Chrome's Settings page to change the HomePage.
========== FILES ==========
File\Folder C:\Program Files\Common Files\AVG Secure Search not found.
File\Folder C:\Documents and Settings\Vivian\funshion not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Chung-Yan
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Karen
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33611 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 15560 bytes
->Temporary Internet Files folder emptied: 929231 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: philso
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: pso
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: tso
->Temp folder emptied: 8380 bytes
->Temporary Internet Files folder emptied: 10658747 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 434 bytes

User: Vivian
->Temp folder emptied: 408175 bytes
->Temporary Internet Files folder emptied: 11872112 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 21117843 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 1163 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 36404 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 180 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 43.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 05272013_142910
Files\Folders moved on Reboot...
C:\Documents and Settings\Vivian\Local Settings\Temporary Internet Files\Content.IE5\Z1E37TDV\1099556-virus-n-error-loading-problem[1].html moved successfully.
C:\Documents and Settings\Vivian\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...

OTL logfile created on: 5/27/2013 9:08:44 AM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Vivian\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 0.99 Gb Available Physical Memory | 51.04% Memory free
3.79 Gb Paging File | 3.02 Gb Available in Paging File | 79.70% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 382.87 Gb Free Space | 82.20% Space Free | Partition Type: NTFS

Computer Name: VIVIANSCOMPUTER | User Name: Vivian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/05/24 15:13:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Vivian\My Documents\Downloads\OTL.exe
PRC - [2013/05/23 11:10:52 | 028,712,088 | ---- | M] (Dropbox, Inc.) -- C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2013/05/14 13:26:12 | 003,289,208 | ---- | M] (Skype Technologies S.A.) -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2013/01/27 12:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/01/27 12:11:06 | 000,947,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/06/11 16:22:16 | 000,425,040 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BingBar.exe
PRC - [2012/06/11 16:22:16 | 000,267,856 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BingApp.exe
PRC - [2012/06/11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE
PRC - [2012/06/11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE
PRC - [2012/06/11 16:22:16 | 000,141,904 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\bingsurrogate.exe
PRC - [2012/06/11 12:22:18 | 001,561,088 | ---- | M] (Alcatel-Lucent) -- C:\Program Files\TELUS\McciTrayApp.exe
PRC - [2012/05/08 14:05:58 | 001,818,472 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe
PRC - [2012/03/09 11:33:12 | 010,294,584 | ---- | M] (Radialpoint SafeCare Inc.) -- C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/06/27 19:04:00 | 001,213,736 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007/06/27 19:03:40 | 000,152,872 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2006/07/21 09:32:58 | 000,126,976 | ---- | M] (SAMSUNG ELECTRONICS) -- C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe

========== Modules (No Company Name) ==========

MOD - [2013/03/13 13:48:52 | 024,978,944 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\libcef.dll
MOD - [2012/11/13 16:32:50 | 003,558,400 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\wxmsw28uh_vc.dll
MOD - [2010/03/15 16:57:20 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2009/02/12 05:30:02 | 000,190,976 | ---- | M] () -- C:\WINDOWS\system32\WgaLogon.dll
MOD - [2008/04/14 05:42:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/14 05:41:52 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe -- (vToolbarUpdater15.2.0)
SRV - File not found [Auto | Stopped] -- -- (Amsp)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\alg.exe -- (ALG)
SRV - [2013/05/15 11:45:17 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/14 13:26:12 | 003,289,208 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2013/04/12 11:30:03 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/01/27 12:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/06/11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE -- (BBUpdate)
SRV - [2012/06/11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE -- (BBSvc)
SRV - [2012/03/09 11:33:12 | 010,294,584 | ---- | M] (Radialpoint SafeCare Inc.) [Auto | Running] -- C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe -- (ServicepointService)
SRV - [2009/04/22 00:07:30 | 000,655,624 | ---- | M] (Acresso Software Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\LV302AV.SYS -- (PID_08A0)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lv302af.sys -- (pepifilter)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS -- (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS -- (MREMPR5)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\KAVSafe.sys -- (KAVSafe)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- D:\INSTALL\GMSIPCI.SYS -- (GMSIPCI)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2013/05/21 10:25:32 | 000,037,664 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp)
DRV - [2013/04/24 17:10:42 | 000,051,864 | ---- | M] () [File_System | System | Running] -- C:\Program Files\kuping4\KPProtector.sys -- (KPProtector)
DRV - [2013/03/15 09:42:47 | 000,013,464 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SWDUMon.sys -- (SWDUMon)
DRV - [2012/06/11 12:12:08 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2012/06/11 12:12:06 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2011/02/19 11:34:44 | 000,023,456 | ---- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DrvAgent32.sys -- (DrvAgent32)
DRV - [2010/05/10 11:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 11:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2010/01/21 01:59:58 | 000,020,864 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2010/01/21 01:59:56 | 000,024,960 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2010/01/21 01:59:56 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2009/09/29 08:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009/09/29 08:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009/09/29 08:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2009/04/21 15:10:32 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2008/04/17 01:33:26 | 004,707,328 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [2008/02/15 00:15:26 | 000,014,336 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008/01/28 21:37:48 | 000,022,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2008/01/28 21:37:46 | 000,054,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2008/01/25 05:01:06 | 000,132,096 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nvgts.sys -- (nvgts)
DRV - [2007/05/09 22:51:34 | 000,041,888 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/05/09 22:47:00 | 001,276,832 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI)
DRV - [2006/07/01 22:39:40 | 000,036,864 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004/08/04 05:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)
DRV - [1999/09/10 12:06:00 | 000,025,244 | ---- | M] (Adaptec) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (ASPI32)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?rd=1&ucc=CA&dcc=CA&opt=0&ocid=iehp&tc=3
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 48 7D 90 C2 F3 5A CE 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local

========== FireFox ==========

FF - prefs.js..capability.principal.codebase.p124.subjectName: ""user_pref("network.proxy.type", 2);
FF - prefs.js..network.proxy.autoconfig_url: ""
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@baidu.com/npxbdsetup: C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@ncity3d.com/NCity3dPlayer: C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll ( )

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22181a4d-af90-4ca3-a569-faed9118d6bc}: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013/02/18 15:26:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\Hewlett-Packard\SmartPrint\QPExtension [2013/05/14 14:14:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/14 14:13:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/25 15:42:25 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013/02/18 15:26:15 | 000,000,000 | ---D | M]

[2009/04/22 00:37:07 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Extensions
[2013/05/25 15:44:33 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions
[2012/11/29 19:06:48 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2010/06/02 22:18:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/05/13 10:44:10 | 000,000,000 | ---D | M] (IE Tab) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2011/08/10 09:42:39 | 000,000,000 | ---D | M] (Разпознаване на устройство Logitech) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2012/01/26 22:24:32 | 000,000,000 | ---D | M] (Latin Dictionary) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2013/05/01 10:37:34 | 000,346,768 | ---- | M] () (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\ig45u6wy.default\extensions\[email protected]
[2013/04/12 11:29:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/05/23 12:51:33 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/01 09:17:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/05/23 12:51:33 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/26 16:01:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\extensions
[2013/05/26 16:00:19 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\updated\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/26 16:00:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions
[2013/05/26 16:00:18 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/26 16:01:06 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\VIVIAN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\IG45U6WY.DEFAULT\EXTENSIONS\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
[2013/04/12 11:30:04 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/11/12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2009/05/07 14:22:10 | 000,196,096 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\npvgsplayer.dll
[2012/09/07 17:36:50 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013/02/19 16:30:45 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = http://mysearch.avg.com/search?cid=...1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = http://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR - homepage: http://mysearch.avg.com/?cid={75845...1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=hp
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: VGS player plugin for Firefox (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npvgsplayer.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: NCity3D plugin for firefox (Enabled) = C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\tso\Application Data\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\tso\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: VGS player plugin for Firefox (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npvgsplayer.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Documents and Settings\tso\Application Data\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: NCity3D plugin for firefox (Enabled) = C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: HP Product Detection Plugin = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aelbknmfcacjffmgnoaaonhgoghlmlkp\1.0.26.1_0\
CHR - Extension: YouTube = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Skype Click to Call = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0\
CHR - Extension: Radialpoint SPD Extension = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj\1.0_0\
CHR - Extension: AVG SafeGuard toolbar = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\
CHR - Extension: Gmail = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2012/08/22 18:10:11 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll File not found
O2 - BHO: (TSToolbarBHO) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll File not found
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll File not found
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe (SAMSUNG ELECTRONICS)
O4 - HKLM..\Run: [TELUS_McciTrayApp] C:\Program Files\TELUS\McciTrayApp.exe (Alcatel-Lucent)
O4 - HKLM..\Run: [WJNews_197226] "C:\Program Files\Wuji\197226\WJNews.exe" -mini File not found
O4 - HKCU..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe (Sammsoft)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [HP Photosmart 7520 series (NET)] C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - HKCU..\Run: [SmileboxTray] "C:\Documents and Settings\Vivian\Application Data\Smilebox\SmileboxTray.exe" File not found
O4 - Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Value error. File not found
O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: 显示或隐藏 HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - Reg Error: Value error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 75.153.176.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F5D8976E-2CE8-46E0-BC66-A161DBFBDA3F}: DhcpNameServer = 192.168.1.254 75.153.176.9
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll File not found
O18 - Protocol\Handler\tmtb {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll File not found
O18 - Protocol\Handler\tmtbim {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - C:\WINDOWS\System32\WgaLogon.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\Vivian\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Vivian\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/21 14:09:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/25 19:13:07 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2013/05/25 18:47:04 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/05/25 17:15:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly_files
[2013/05/25 15:28:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2013/05/25 15:27:58 | 000,000,000 | ---D | C] -- C:\JRT
[2013/05/24 15:11:02 | 000,000,000 | ---D | C] -- C:\FRST
[2013/05/23 16:14:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\TELUS
[2013/05/23 16:13:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Motive
[2013/05/23 16:13:25 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Motive
[2013/05/23 16:13:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Motive
[2013/05/23 15:56:55 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2013/05/22 22:06:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\HPAppData
[2013/05/21 10:25:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\cache
[2013/05/16 13:07:21 | 000,000,000 | ---D | C] -- C:\dbfecd5f7d2e63eac17b4786
[2013/05/15 12:16:59 | 000,000,000 | ---D | C] -- C:\78415340c7ea0ba5fa
[2013/05/14 18:38:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\StarApp
[2013/05/14 15:16:36 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
[2013/05/14 15:16:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Visan
[2013/05/14 14:14:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Visan
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Program Files\HP Photo Creations
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HP Photo Creations
[2013/05/14 14:12:33 | 000,563,048 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPDiscoPMBC11.dll
[2013/05/14 14:12:28 | 001,961,320 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPScanTRDrv_PS7520.dll
[2013/05/14 14:12:28 | 000,495,464 | ---- | C] (Hewlett-Packard) -- C:\WINDOWS\System32\HPWia1_PS7520.dll
[2013/05/14 14:12:25 | 002,215,784 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkinsBC11.exe
[2013/05/14 14:12:25 | 000,513,384 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkstsBC11.dll
[2013/05/14 14:12:25 | 000,267,624 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkstsBC11LM.dll
[2013/05/14 14:12:25 | 000,219,496 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkcoiBC11.dll
[2013/05/13 10:21:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype
[2013/05/13 10:21:56 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2013/02/27 15:27:19 | 020,546,152 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2011/02/19 12:10:12 | 053,539,128 | ---- | C] (Logitech, Inc.) -- C:\Program Files\lws110_x64.exe
[2010/04/08 21:41:02 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Vivian\Application Data\pcouffin.sys
[1 C:\Documents and Settings\Vivian\Desktop\*.tmp files -> C:\Documents and Settings\Vivian\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/27 09:15:00 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
[2013/05/27 09:11:58 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013/05/27 09:11:01 | 000,000,880 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/27 09:02:07 | 000,000,876 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/27 09:02:07 | 000,000,630 | -H-- | M] () -- C:\WINDOWS\tasks\schedule!1822287263.job
[2013/05/27 09:02:07 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\FSPlatform.job
[2013/05/27 09:01:56 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\FSPlatform1.job
[2013/05/27 09:01:54 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/05/27 08:53:00 | 000,000,990 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
[2013/05/26 17:45:17 | 000,000,536 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/05/26 17:39:41 | 000,000,492 | ---- | M] () -- C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/05/26 05:53:00 | 000,000,968 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
[2013/05/25 18:40:09 | 000,001,029 | ---- | M] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
[2013/05/25 17:15:50 | 000,069,658 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
[2013/05/23 16:28:52 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/05/23 16:14:53 | 000,001,820 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
[2013/05/23 16:05:37 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/05/21 10:25:32 | 000,037,664 | ---- | M] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/05/21 10:25:16 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/05/19 10:15:00 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
[2013/05/18 17:44:55 | 000,487,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/05/18 17:44:55 | 000,080,730 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/05/15 12:21:15 | 002,176,880 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/05/15 11:45:17 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/05/15 11:45:17 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/05/14 16:11:50 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2013/05/14 15:16:25 | 000,001,742 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
[2013/05/14 14:12:31 | 000,001,993 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
[2013/05/14 14:12:31 | 000,000,925 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
[2013/05/14 14:09:27 | 000,000,057 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2013/05/06 21:27:31 | 006,015,488 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2013/05/02 08:28:50 | 000,238,872 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe
[1 C:\Documents and Settings\Vivian\Desktop\*.tmp files -> C:\Documents and Settings\Vivian\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/25 17:15:50 | 000,069,658 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
[2013/05/23 16:14:53 | 000,001,820 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
[2013/05/14 18:38:15 | 000,000,630 | -H-- | C] () -- C:\WINDOWS\tasks\schedule!1822287263.job
[2013/05/14 15:06:45 | 000,000,492 | ---- | C] () -- C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/05/14 14:14:01 | 000,001,742 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
[2013/05/14 14:12:31 | 000,001,993 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
[2013/05/14 14:12:31 | 000,000,925 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
[2013/05/14 14:09:27 | 000,000,057 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2013/05/01 09:27:57 | 000,000,306 | ---- | C] () -- C:\WINDOWS\tasks\FSPlatform1.job
[2013/05/01 09:24:06 | 000,001,029 | ---- | C] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
[2013/03/14 12:14:24 | 000,000,010 | ---- | C] () -- C:\Documents and Settings\Vivian\1pt1
[2013/03/14 11:58:22 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2013/03/14 11:58:22 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2013/03/14 11:58:22 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2013/03/12 13:19:15 | 002,816,504 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data
[2013/03/12 13:07:22 | 000,013,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\SWDUMon.sys
[2013/02/18 15:22:04 | 000,172,332 | ---- | C] () -- C:\WINDOWS\hpoins37.dat
[2013/02/18 15:22:04 | 000,000,632 | ---- | C] () -- C:\WINDOWS\hpomdl37.dat
[2013/02/03 17:52:51 | 000,172,332 | ---- | C] () -- C:\WINDOWS\hpoins37.dat.temp
[2013/02/03 17:52:51 | 000,000,632 | ---- | C] () -- C:\WINDOWS\hpomdl37.dat.temp
[2012/09/29 09:09:43 | 000,558,133 | ---- | C] () -- C:\WINDOWS\System32\sqlite3.dll
[2012/08/22 17:45:35 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/08/22 17:45:35 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/08/22 17:45:35 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/08/22 17:45:35 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/08/22 17:45:35 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/08/19 12:55:46 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\inst.exe
[2012/02/15 11:22:34 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/19 11:12:05 | 000,014,336 | ---- | C] () -- C:\Documents and Settings\Vivian\SMS.db
[2011/04/20 09:42:28 | 000,001,022 | ---- | C] () -- C:\Documents and Settings\Vivian\tudouproxy.inf
[2011/02/18 14:21:08 | 000,738,189 | ---- | C] () -- C:\Program Files\wot-20100908-fx+sm.xpi
[2011/02/18 13:24:21 | 010,234,024 | ---- | C] ( ) -- C:\Program Files\fwinstall.exe
[2010/09/13 09:10:26 | 000,000,112 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\5FG7121.dat
[2010/04/08 21:41:20 | 000,000,671 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\vso_ts_preview.xml
[2010/04/08 21:41:02 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\pcouffin.cat
[2010/04/08 21:41:02 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\pcouffin.inf
[2009/05/31 10:07:54 | 000,000,098 | ---- | C] () -- C:\Documents and Settings\Vivian\default.pls
[2009/04/21 15:08:37 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\Vivian\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/21 14:08:43 | 000,001,572 | ---- | C] () -- C:\Program Files\Disk Defragmenter.lnk

========== ZeroAccess Check ==========

[2009/10/13 00:08:14 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 05:42:06 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 05:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 05:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Alternate Data Streams ==========

@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C31F31E6
< End of report >
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Status: Validation Control not Installed
Validation Code: 0
Cached Validation Code: N/A
Windows Product Key: *****-*****-HCVMQ-22HVT-YVCCJ
Windows Product Key Hash: eQiMvj1ova/54jWZjIbruHeIeD4=
Windows Product ID: 76487-OEM-2248633-34511
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 5.1.2600.2.00010100.3.0.pro
ID: {871F4434-9C74-492E-BBFE-EAD43D4B8584}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: N/A
Architecture: N/A
Build lab: N/A
TTS Error: N/A
Validation Diagnostic: 025D1FF3-230-1
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A
Version: N/A
Windows XP Notifications Data-->
Cached Result: 8
File Exists: Yes
Version: 1.9.9.1
WgaTray.exe Signed By: N/A, hr = 0x80004005
WgaLogon.dll Signed By: N/A, hr = 0x80004005
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: 2.0.48.0
OGAExec.exe Signed By: Microsoft
OGAAddin.dll Signed By: Microsoft
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Professional Edition 2003 - 100 Genuine
OGA Version: Registered, 2.0.48.0
Signed By: Microsoft
Office Diagnostics: 025D1FF3-230-1
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\WINDOWS\system32\winlogon.exe[5.1.2600.5512], Hr = 0x800b0100
File Mismatch: C:\WINDOWS\system32\licdll.dll[5.1.2600.5512], Hr = 0x800b0100
File Mismatch: C:\WINDOWS\system32\ntdll.dll[5.1.2600.6055], Hr = 0x800b0100
File Mismatch: C:\WINDOWS\system32\advapi32.dll[5.1.2600.5755], Hr = 0x800b0100
File Mismatch: C:\WINDOWS\system32\setupapi.dll[5.1.2600.5512], Hr = 0x800b0100
File Mismatch: C:\WINDOWS\system32\oembios.bin[Hr = 0x800b0003]
File Mismatch: C:\WINDOWS\system32\oembios.dat[Hr = 0x800b0003]
File Mismatch: C:\WINDOWS\system32\oembios.sig[Hr = 0x800b0003]
File Mismatch: C:\WINDOWS\system32\syssetup.dll[5.1.2600.5512], Hr = 0x800b0100
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{871F4434-9C74-492E-BBFE-EAD43D4B8584}</UGUID><Version>1.9.0027.0</Version><OS>5.1.2600.2.00010100.3.0.pro</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-YVCCJ</PKey><PID>76487-OEM-2248633-34511</PID><PIDType>3</PIDType><SID>S-1-5-21-1454471165-1788223648-725345543</SID><SYSTEM><Manufacturer>MSI</Manufacturer><Model>MS-7309</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V9.4</Version><SMBIOSVersion major="2" minor="5"/><Date>20090217000000.000000+000</Date></BIOS><HWID>54763FF701848078</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification><File Name="WgaTray.exe" Version="1.9.9.1"/><File Name="WgaLogon.dll" Version="1.9.9.1"/><File Name="OGAAddin.dll" Version="2.0.48.0"/></GANotification></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90110409-6000-11D3-8CFE-0150048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>B4731799DF39D00</Val><Hash>TE2IkmLeZINNu18+rAJgSV4jzMk=</Hash><Pid>73931-640-1790864-57406</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="100"/><App Id="16" Version="11" Result="100"/><App Id="18" Version="11" Result="100"/><App Id="19" Version="11" Result="100"/><App Id="1A" Version="11" Result="100"/><App Id="1B" Version="11" Result="100"/><App Id="44" Version="11" Result="100"/></Applications></Office></Software></GenuineResults> 
Licensing Data-->
N/A
Windows Activation Technologies-->
N/A
HWID Data-->
N/A
OEM Activation 1.0 Data-->
BIOS string matches: no
Marker string from BIOS: N/A
Marker string from OEMBIOS.DAT: N/A, hr = 0x80004005
OEM Activation 2.0 Data-->
N/A


----------



## emeraldnzl (Nov 3, 2007)

> Also is it better for me to remove the other search engines - firefox and google which cause me all the troubles, n just keep internet explorer 7.


If you don't use them then just uninstall them.

Personally I like Firefox and other people like Google Chrome.

*If you want to be certain Firefox is clean then follow these instructions:*

You need to remove your Firefox profile data and settings. Before we do this we want to backup your bookmarks.

To back up your bookmarks:

In Firefox go to *History > Show all History > Import and Backup *(toolbar along the top) > Export HTML... and save it to your desktop.

Later when you re-install FF you can reverse the process and *Import HTML*... when the Wizard comes up just import the HTML file you had saved earlier.

*Next*

Go to the link below for instructions on how to remove Firefox:

http://kb.mozillazine.org/Uninstall_firefox

Look under the heading *On Windows*

Follow the instructions there _On Windows XP _ and in particular follow this instruction - see the bolded part:

Starting in Firefox 3, the uninstaller includes the option, *"Remove my Firefox personal data and customizations"*. This will also remove your Firefox user profile data (bookmarks, passwords, cookies, extensions, preferences, etc.).

If the uninstall fails, as it may in some cases, continue on with the rest of the uninstall instructions.

Once you have remove Firefox entirely then download a new copy and re-install. After that, follow the instruction above to import your bookmarks back.

Firefox may be downloaded from *here*.



> starting page defaulted to Chinese


Is this still happening? Tell me when you come back.

*Now*

Please run a free online scan with the *ESET Online Scanner*

*Vista / Win7 users: *Right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select *Run as Administrator*.

*Note: This scan works with Internet Explorer or Mozilla FireFox.*

If using* Mozilla Firefox* you will need to download *esetsmartinstaller_enu.exe* when prompted then double click on it to install.


Click the green ESET Online Scanner box
Tick the box next to *YES, I accept the Terms of Use*
then click on: *Start*
You may see a panel towards the top of the screen telling you the website wants to install an addon... click and allow it to install. If your firewall asks whether you want to allow installation, say yes.
 Make sure that the option *Scan archives *is checked.
 Now click on *Advanced Settings* and select the following:
*Scan for potentially unwanted applications*
* Scan for potentially unsafe applications*
* Enable Anti-Stealth Technology*

 Click on *Start*
 The virus signature database will begin to download. *Be patient* this make take some time depending on the speed of your Internet Connection.
 When completed the *Online Scan* will begin automatically. The scan may take several hours.
 *Do not touch either the Mouse or keyboard* during the scan otherwise it may stall.
 When completed select *Uninstall application on close*, *make sure you copy the logfile first!*
 Then click on: *Finish*
 Use *notepad* to open the logfile located at *C:\Program Files (x86)\ESET\ESET Online Scanner\log.txt.*
 *Copy *and *paste* that log *as a reply* to this topic and *tell me how your machine is now*.


----------



## errorloading (Feb 4, 2011)

[email protected] as CAB hook log:
OnlineScanner.ocx - registred OK
# version=8
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=091d88e90cd85f4eb2e3aba398aa88e4
# engine=13939
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-28 06:37:57
# local_time=2013-05-28 11:37:57 (-0800, Pacific Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=5892 16777213 88 94 6812306 10957133 0 0
# scanned=160129
# found=1
# cleaned=1
# scan_time=9525
sh=6C5F221B49AD2693D21EE0528FE6286A410D7517 ft=1 fh=fdf8e68f729f4ef4 vn="a variant of Win32/Adware.MultiPlug.I application (cleaned by deleting - quarantined)" ac=C fn="C:\System Volume Information\_restore{F6B8AF62-5D30-432E-B286-E52F1C27AF8B}\RP273\A0160746.dll"

I hv uninstalled FireFox and clean it, then reinstall it. It seems to be working fine & the default typing in Chinese is gone.

Thank you very much for your help.

I hv learned a lot fm u.


----------



## errorloading (Feb 4, 2011)

Hi,
I just discover the default typing in Chinese is still on. I hv to switch to English every time I stype something.

Thank you,


----------



## emeraldnzl (Nov 3, 2007)

> I just discover the default typing in Chinese is still on.


Hmm... I think your default operating system language might be set to chinese.

Go to the link below and click on the link Set the default input language in Windows XP

http://office.microsoft.com/en-nz/e...ffice-programs-HA010356057.aspx#_Toc310590335

Come back and tell me how it went.

After that, all going well, we will clear away the tools we have been using.


----------



## errorloading (Feb 4, 2011)

it works. Thanks.

Lastly, pls advise if there is any security software that I can use to protect my computer?


----------



## emeraldnzl (Nov 3, 2007)

Hello again errorloading,



> Lastly, pls advise if there is any security software that I can use to protect my computer?


I noticed that you asked that earlier. Your logs show that you have Microsoft Security Essentials running on your computer. Is it not working or are you asking for additional security?

In any event here are some thoughts.

Here are three good antivirus free for personal use:
*Avast*
*Microsoft Security Essentials*
*AVIRA* _Note: AVIRA free comes with adware that promotes their paid for version each time it updates. A small price to pay for an excellant anti-virus program_
Here are two good firewalls free for personal use:


*OnLine-Armour*
*Agnitum - Outpost free*

Microsoft Security Essentials together with Windows Firewall (which comes with Windows) is probably a good choice for the run of the mill user. This because it is light on resources, it is unobtrusive (it works away in the background without interrupting) and you don't have to be an expert. Firewalls have a habit of flagging suspicious files and asking the user to decide whether to accept the file or not. Often the run of the mill user has no idea about what a particular file does and just says no to everything... down the track they wonder why programs they use regularly suddenly stop working or maybe they try and download something they frequently downloaded in the past but now find they can't.

_*Note*: Do not use more than one anti-virus or firewall. Running two or more real-time anti-virus, anti-spyware and firewall monitors at the same time can cause a conflict. That conflict can result in slow computer performance, error messages, crashes of the programs or other types of failure. You will very likely end up with little or no protection.

*Also*


These free for home use malware scanners which you can choose from. You can update and run say weekly to help with prevention of malware.

*Malwarebytes* 
*SuperAntiSpyWare*

Note: If you install SuperAntiSpyWare take care to uncheck any boxes that indicate installation of other programs or utilities. Last time I checked SuperAntiSpyWare installed Google Chrome even if you unchecked the box (that in my opinion is foistware) so if you install it make sure you uninstall Google Chrome afterwards.

Be aware that all security programs will effect the running of your computer so opting for lightweight options will slow your machine less.

_
*Now*

I think your machines is good to go now.

We have a couple of last steps to perform and then you're all set.


Double-click *OTL.exe* to run it. (Vista users, please right click on *OTL.exe* and select "Run as an *Administrator*")
Click on the *CleanUp!* button
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose *Yes.*
Any other tools remaining may be deleted.

*Step 2*

Next, we need to clean your restore points and set a new one:

*Reset and Re-enable your System Restore* to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs from changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)
*1. Turn off System Restore.*
On the Desktop, right-click *My Computer*.
Click *Properties*.
Click the *System Restore* tab.
Check *Turn off System Restore*.
Click *Apply*, and then click *OK*.
*2. Restart your computer.*

*3. Turn ON System Restore.*
On the Desktop, right-click *My Computer*.
Click *Properties*.
Click the *System Restore* tab.
UN-Check *Turn off System Restore*.
Click *Apply*, and then click *OK*.

*System Restore will now be active again.*
-------------------------------------------------------------------------------------------------------------------

*A reminder:* Remember to (re-install if uninstalled during cleaning) update and turn back on any anti-malware programs you may have turned off during the cleaning process.
-------------------------------------------------------------------------------------------------------------------

*Here are some things that I think are worth having a look at if you don't already know about them:*

---------------------------------------------------------------------------------------------------------------------

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article Strong passwords: How to create and use them.

----------------------------------------------------------------------------------------------------------------------

Regularly check that your Java is up to date. Older versions are vunerable to malicious attack.


Download Java for Windows

Reboot your computer. 
You also need to unininstall older versions of Java.

 Click *Start* > *Control Panel* > *Add or Remove Programs*
 Remove all Java updates except the latest one you have just installed.
--------------------------------------------------------------------------------------------------------------------

To help protect your computer in the future:




If you do not already have automatic updates set then it is recommended that you do set Windows to check, download and install your updates automatically.

* Click *Start > Control Panel > System and Security > Windows Update*
* Under Windows Update click on Turn automatic updating on or off
* Check items shown to ensure you receive updates automatically. Click *OK*.

Be aware of what emails you open and websites you visit.

Go here for some good advice about how to prevent infection.

A fun way to check your online safety literacy.

*Quiz - getsafeonline*

Have a safe and happy computing day!


----------



## errorloading (Feb 4, 2011)

I just log in as the guest user & found that the error loading msg still shows up:
Errorloading C:\WINDOWS\ojexijaidad.dll

The specific module could not be found

All the other users' login are fine.


----------



## emeraldnzl (Nov 3, 2007)

Hmm... that is different to the first one. Check them, you will see that they are different spelling.

*Do this*

Please download *SystemLook* from one of the links below and save it to your Desktop.
*Download Mirror #1
Download Mirror #2*

Double-click *SystemLook.exe* to run it.
Copy the content of the following codebox into the main textfield:

```
:file
ojexijaidad.dll

:regfind
ojexijaidad.dll
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found at on your Desktop entitled *SystemLook.txt*


----------



## errorloading (Feb 4, 2011)

SystemLook 30.07.11 by jpshortstuff
Log created at 07:05 on 30/05/2013 by Vivian
Administrator - Elevation successful
========== file ==========
ojexiyayidad.dll - Unable to find/read file.
========== regfind ==========
Searching for "ojexiyayidad.dll"
No data found.
-= EOF =-


----------



## emeraldnzl (Nov 3, 2007)

Confirms that that bad file is gone but it seems there is some startup program still looking for it.

Let's see what we can find.


Download *OTL* to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath *Output* at the top change it to *Minimal Output*.
Under the *Standard Registry* box change it to *All*.
Check the boxes beside *LOP Check* and *Purity Check*.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. *OTL.Txt* and *Extras.Txt*. These are saved in the same location as OTL.
Please copy *(Edit->Select All, Edit->Copy)* the contents of these files, one at a time, and post it with your next reply.


----------



## errorloading (Feb 4, 2011)

OTL logfile created on: 5/31/2013 8:29:40 AM - Run 5
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Vivian\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 1.04 Gb Available Physical Memory | 53.47% Memory free
3.79 Gb Paging File | 3.06 Gb Available in Paging File | 80.75% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 383.06 Gb Free Space | 82.25% Space Free | Partition Type: NTFS

Computer Name: VIVIANSCOMPUTER | User Name: Vivian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Vivian\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingBar.exe (Microsoft Corporation.)
PRC - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingApp.exe (Microsoft Corporation.)
PRC - C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE (Microsoft Corporation.)
PRC - C:\Program Files\Microsoft\BingBar\7.1.391.0\bingsurrogate.exe (Microsoft Corporation.)
PRC - C:\Program Files\TELUS\McciTrayApp.exe (Alcatel-Lucent)
PRC - C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe (Radialpoint SafeCare Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe (SAMSUNG ELECTRONICS)

========== Modules (No Company Name) ==========

MOD - C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\libcef.dll ()
MOD - C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\wxmsw28uh_vc.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\WINDOWS\system32\WgaLogon.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\system32\devenum.dll ()

========== Services (SafeList) ==========

SRV - (vToolbarUpdater15.2.0) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe File not found
SRV - (Amsp) -- File not found
SRV - (ALG) -- C:\WINDOWS\System32\alg.exe File not found
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Skype C2C Service) -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (BBUpdate) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE (Microsoft Corporation.)
SRV - (BBSvc) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE (Microsoft Corporation.)
SRV - (ServicepointService) -- C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe (Radialpoint SafeCare Inc.)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDICA) -- File not found
DRV - (PID_08A0) -- system32\DRIVERS\LV302AV.SYS File not found
DRV - (pepifilter) -- system32\DRIVERS\lv302af.sys File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (MRENDIS5) -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS File not found
DRV - (MREMPR5) -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS File not found
DRV - (lbrtfdc) -- File not found
DRV - (KAVSafe) -- C:\WINDOWS\system32\Drivers\KAVSafe.sys File not found
DRV - (i2omgmt) -- File not found
DRV - (GMSIPCI) -- D:\INSTALL\GMSIPCI.SYS File not found
DRV - (Changer) -- File not found
DRV - (catchme) -- C:\ComboFix\catchme.sys File not found
DRV - (avgtp) -- C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (KPProtector) -- C:\Program Files\kuping4\KPProtector.sys ()
DRV - (SWDUMon) -- C:\WINDOWS\system32\drivers\SWDUMon.sys ()
DRV - (MREMP50) -- C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) -- C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (DrvAgent32) -- C:\WINDOWS\system32\drivers\DrvAgent32.sys (Phoenix Technologies)
DRV - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (UsbDiag) -- C:\WINDOWS\system32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (USBModem) -- C:\WINDOWS\system32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (usbbus) -- C:\WINDOWS\system32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (LgBttPort) -- C:\WINDOWS\system32\drivers\lgbtport.sys (LG Electronics Inc.)
DRV - (LGVMODEM) -- C:\WINDOWS\system32\drivers\lgvmodem.sys (LG Electronics Inc.)
DRV - (lgbusenum) -- C:\WINDOWS\system32\drivers\lgbtbus.sys (LG Electronics Inc.)
DRV - (sptd) -- C:\WINDOWS\system32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (nvsmu) -- C:\WINDOWS\system32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (nvnetbus) -- C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (nvgts) -- C:\WINDOWS\system32\drivers\nvgts.sys (NVIDIA Corporation)
DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) -- C:\WINDOWS\system32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (FsVga) -- C:\WINDOWS\system32\drivers\fsvga.sys (Microsoft Corporation)
DRV - (ASPI32) -- C:\WINDOWS\System32\drivers\ASPI32.SYS (Adaptec)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?rd=1&ucc=CA&dcc=CA&opt=0&ocid=iehp&tc=9
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = CE D0 EC 9F 21 5B CE 01 [binary data]
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@baidu.com/npxbdsetup: C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@ncity3d.com/NCity3dPlayer: C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll ( )

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/10/18 08:13:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22181a4d-af90-4ca3-a569-faed9118d6bc}: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013/02/18 15:26:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\Hewlett-Packard\SmartPrint\QPExtension [2013/05/14 14:14:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/26 16:01:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/26 16:00:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013/02/18 15:26:15 | 000,000,000 | ---D | M]

[2013/05/28 12:01:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Extensions
[2013/05/26 16:01:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/05/26 16:00:19 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/26 16:00:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/05/26 16:00:18 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/28 12:00:20 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2010/11/12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2007/03/22 19:23:30 | 000,017,248 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL
[2013/02/15 15:31:23 | 000,186,432 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll
[2009/05/07 14:22:10 | 000,196,096 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\npvgsplayer.dll
[2013/05/25 15:07:32 | 000,003,725 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\safeguard-secure-search.xml

========== Chrome ==========

CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = http://mysearch.avg.com/search?cid=...1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = http://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR - homepage: http://mysearch.avg.com/?cid={75845...1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=hp
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: VGS player plugin for Firefox (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npvgsplayer.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: NCity3D plugin for firefox (Enabled) = C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\tso\Application Data\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\tso\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: VGS player plugin for Firefox (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npvgsplayer.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Documents and Settings\tso\Application Data\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: NCity3D plugin for firefox (Enabled) = C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: HP Product Detection Plugin = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aelbknmfcacjffmgnoaaonhgoghlmlkp\1.0.26.1_0\
CHR - Extension: YouTube = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Skype Click to Call = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0\
CHR - Extension: Radialpoint SPD Extension = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj\1.0_0\
CHR - Extension: AVG SafeGuard toolbar = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\
CHR - Extension: Gmail = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2012/08/22 18:10:11 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll File not found
O2 - BHO: (TSToolbarBHO) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll File not found
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll File not found
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe (SAMSUNG ELECTRONICS)
O4 - HKLM..\Run: [TELUS_McciTrayApp] C:\Program Files\TELUS\McciTrayApp.exe (Alcatel-Lucent)
O4 - HKLM..\Run: [WJNews_197226] "C:\Program Files\Wuji\197226\WJNews.exe" -mini File not found
O4 - HKCU..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe (Sammsoft)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKCU..\Run: [HP Photosmart 7520 series (NET)] C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - HKCU..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKCU..\Run: [SmileboxTray] "C:\Documents and Settings\Vivian\Application Data\Smilebox\SmileboxTray.exe" File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Value error. File not found
O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: 显示或隐藏 HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - Reg Error: Value error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 75.153.176.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F5D8976E-2CE8-46E0-BC66-A161DBFBDA3F}: DhcpNameServer = 192.168.1.254 75.153.176.9
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll File not found
O18 - Protocol\Handler\tmtb {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll File not found
O18 - Protocol\Handler\tmtbim {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll File not found
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\crypt32chain: DllName - (crypt32.dll) - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - (cryptnet.dll) - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - (cscdll.dll) - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - (%SystemRoot%\System32\dimsntfy.dll) - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - (sclgntfy.dll) - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - (WlNotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - C:\WINDOWS\System32\WgaLogon.dll ()
O20 - Winlogon\Notify\wlballoon: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Vivian\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Vivian\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/21 14:09:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/31 07:46:56 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Vivian\Desktop\OTL.exe
[2013/05/28 12:00:40 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2013/05/28 08:53:41 | 021,289,608 | ---- | C] (Mozilla) -- C:\Documents and Settings\Vivian\Desktop\Firefox Setup 21.0.exe
[2013/05/27 12:43:03 | 002,031,992 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Vivian\Desktop\MGADiag.exe
[2013/05/26 16:00:17 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/05/25 19:13:07 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2013/05/25 18:47:04 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/05/25 17:15:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly_files
[2013/05/25 15:28:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2013/05/25 15:27:58 | 000,000,000 | ---D | C] -- C:\JRT
[2013/05/24 15:11:02 | 000,000,000 | ---D | C] -- C:\FRST
[2013/05/23 16:14:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\TELUS
[2013/05/23 16:13:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Motive
[2013/05/23 16:13:25 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Motive
[2013/05/23 16:13:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Motive
[2013/05/23 15:56:55 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2013/05/22 22:06:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\HPAppData
[2013/05/21 10:25:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\cache
[2013/05/16 13:07:21 | 000,000,000 | ---D | C] -- C:\dbfecd5f7d2e63eac17b4786
[2013/05/15 12:16:59 | 000,000,000 | ---D | C] -- C:\78415340c7ea0ba5fa
[2013/05/14 18:38:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\StarApp
[2013/05/14 15:16:36 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
[2013/05/14 15:16:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Visan
[2013/05/14 14:14:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Visan
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Program Files\HP Photo Creations
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HP Photo Creations
[2013/05/14 14:12:33 | 000,563,048 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPDiscoPMBC11.dll
[2013/05/14 14:12:28 | 001,961,320 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPScanTRDrv_PS7520.dll
[2013/05/14 14:12:28 | 000,495,464 | ---- | C] (Hewlett-Packard) -- C:\WINDOWS\System32\HPWia1_PS7520.dll
[2013/05/14 14:12:25 | 002,215,784 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkinsBC11.exe
[2013/05/14 14:12:25 | 000,513,384 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkstsBC11.dll
[2013/05/14 14:12:25 | 000,267,624 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkstsBC11LM.dll
[2013/05/14 14:12:25 | 000,219,496 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkcoiBC11.dll
[2013/05/13 10:21:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype
[2013/05/13 10:21:56 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2013/02/27 15:27:19 | 020,546,152 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2011/02/19 12:10:12 | 053,539,128 | ---- | C] (Logitech, Inc.) -- C:\Program Files\lws110_x64.exe
[2010/04/08 21:41:02 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Vivian\Application Data\pcouffin.sys
[1 C:\Documents and Settings\Vivian\Desktop\*.tmp files -> C:\Documents and Settings\Vivian\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/31 08:26:06 | 000,000,492 | ---- | M] () -- C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/05/31 08:15:00 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
[2013/05/31 08:11:00 | 000,000,880 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/31 08:07:33 | 000,134,363 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\otl.extra.CLP
[2013/05/31 07:51:23 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013/05/31 07:50:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Vivian\Desktop\OTL.exe
[2013/05/31 07:46:40 | 000,001,029 | ---- | M] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
[2013/05/31 07:45:00 | 000,000,536 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/05/31 07:42:09 | 000,000,876 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/31 07:42:09 | 000,000,630 | -H-- | M] () -- C:\WINDOWS\tasks\schedule!1822287263.job
[2013/05/31 07:42:09 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\FSPlatform.job
[2013/05/31 07:41:21 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\FSPlatform1.job
[2013/05/31 07:41:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/05/30 11:53:00 | 000,000,990 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
[2013/05/30 07:04:01 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\SystemLook.exe
[2013/05/28 12:00:41 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/05/28 12:00:41 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2013/05/28 11:59:06 | 021,289,608 | ---- | M] (Mozilla) -- C:\Documents and Settings\Vivian\Desktop\Firefox Setup 21.0.exe
[2013/05/28 10:15:00 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
[2013/05/28 08:00:03 | 000,266,888 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\bookmarks.html
[2013/05/27 14:59:36 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/05/27 14:59:33 | 002,031,992 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Vivian\Desktop\MGADiag.exe
[2013/05/27 14:45:24 | 000,100,743 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\MGDiag.CLP
[2013/05/27 11:48:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/05/26 05:53:00 | 000,000,968 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
[2013/05/25 17:15:50 | 000,069,658 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
[2013/05/23 16:28:52 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/05/23 16:14:53 | 000,001,820 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
[2013/05/23 16:05:37 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/05/21 10:25:32 | 000,037,664 | ---- | M] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/05/18 17:44:55 | 000,487,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/05/18 17:44:55 | 000,080,730 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/05/15 12:21:15 | 002,176,880 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/05/15 11:45:17 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/05/15 11:45:17 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/05/14 16:11:50 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2013/05/14 15:16:25 | 000,001,742 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
[2013/05/14 14:12:31 | 000,001,993 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
[2013/05/14 14:12:31 | 000,000,925 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
[2013/05/14 14:09:27 | 000,000,057 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2013/05/06 21:27:31 | 006,015,488 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2013/05/02 08:28:50 | 000,238,872 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe
[1 C:\Documents and Settings\Vivian\Desktop\*.tmp files -> C:\Documents and Settings\Vivian\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/31 08:07:33 | 000,134,363 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\otl.extra.CLP
[2013/05/31 07:46:40 | 000,001,029 | ---- | C] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
[2013/05/30 07:03:54 | 000,139,264 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\SystemLook.exe
[2013/05/28 12:00:41 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/05/28 12:00:41 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2013/05/28 12:00:41 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2013/05/28 08:00:02 | 000,266,888 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\bookmarks.html
[2013/05/27 14:40:57 | 000,100,743 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\MGDiag.CLP
[2013/05/25 17:15:50 | 000,069,658 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
[2013/05/23 16:14:53 | 000,001,820 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
[2013/05/14 18:38:15 | 000,000,630 | -H-- | C] () -- C:\WINDOWS\tasks\schedule!1822287263.job
[2013/05/14 15:06:45 | 000,000,492 | ---- | C] () -- C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/05/14 14:14:01 | 000,001,742 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
[2013/05/14 14:12:31 | 000,001,993 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
[2013/05/14 14:12:31 | 000,000,925 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
[2013/05/14 14:09:27 | 000,000,057 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2013/05/01 09:27:57 | 000,000,306 | ---- | C] () -- C:\WINDOWS\tasks\FSPlatform1.job
[2013/03/14 12:14:24 | 000,000,010 | ---- | C] () -- C:\Documents and Settings\Vivian\1pt1
[2013/03/14 11:58:22 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2013/03/14 11:58:22 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2013/03/14 11:58:22 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2013/03/12 13:19:15 | 002,816,504 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data
[2013/03/12 13:07:22 | 000,013,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\SWDUMon.sys
[2013/02/18 15:22:04 | 000,172,332 | ---- | C] () -- C:\WINDOWS\hpoins37.dat
[2013/02/18 15:22:04 | 000,000,632 | ---- | C] () -- C:\WINDOWS\hpomdl37.dat
[2013/02/03 17:52:51 | 000,172,332 | ---- | C] () -- C:\WINDOWS\hpoins37.dat.temp
[2013/02/03 17:52:51 | 000,000,632 | ---- | C] () -- C:\WINDOWS\hpomdl37.dat.temp
[2012/09/29 09:09:43 | 000,558,133 | ---- | C] () -- C:\WINDOWS\System32\sqlite3.dll
[2012/08/22 17:45:35 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/08/22 17:45:35 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/08/22 17:45:35 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/08/22 17:45:35 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/08/22 17:45:35 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/08/19 12:55:46 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\inst.exe
[2012/02/15 11:22:34 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/19 11:12:05 | 000,014,336 | ---- | C] () -- C:\Documents and Settings\Vivian\SMS.db
[2011/04/20 09:42:28 | 000,001,022 | ---- | C] () -- C:\Documents and Settings\Vivian\tudouproxy.inf
[2011/02/18 14:21:08 | 000,738,189 | ---- | C] () -- C:\Program Files\wot-20100908-fx+sm.xpi
[2011/02/18 13:24:21 | 010,234,024 | ---- | C] ( ) -- C:\Program Files\fwinstall.exe
[2010/09/13 09:10:26 | 000,000,112 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\5FG7121.dat
[2010/04/08 21:41:20 | 000,000,671 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\vso_ts_preview.xml
[2010/04/08 21:41:02 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\pcouffin.cat
[2010/04/08 21:41:02 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\pcouffin.inf
[2009/05/31 10:07:54 | 000,000,098 | ---- | C] () -- C:\Documents and Settings\Vivian\default.pls
[2009/04/21 15:08:37 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\Vivian\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/21 14:08:43 | 000,001,572 | ---- | C] () -- C:\Program Files\Disk Defragmenter.lnk

========== ZeroAccess Check ==========

[2009/10/13 00:08:14 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 05:42:06 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 05:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 05:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013/04/24 17:04:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\360safe
[2012/08/22 18:54:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2013/03/12 13:11:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar
[2013/03/12 13:11:15 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2009/04/21 15:26:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2010/07/29 05:27:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\kingsoft
[2010/01/01 03:05:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2013/05/31 08:27:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Radialpoint
[2010/01/01 03:06:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
[2013/05/14 18:38:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\StarApp
[2012/08/22 16:25:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TELUS
[2013/03/14 11:49:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2013/05/14 15:16:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Visan
[2010/04/09 08:20:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\vsosdk
[2010/05/09 14:09:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2013/04/24 16:59:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\360Login
[2010/04/25 08:27:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\3M
[2013/04/25 17:20:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\AIRPLAY
[2013/03/12 13:11:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\AVG SafeGuard toolbar
[2011/02/10 17:29:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/07/19 17:38:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\com.Shutterfly.ExpressUploader
[2009/04/21 15:27:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\DAEMON Tools
[2013/02/20 10:33:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\DAEMON Tools Lite
[2009/04/21 15:27:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\DAEMON Tools Pro
[2013/05/31 07:47:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Dropbox
[2010/06/20 15:58:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Facebook
[2010/06/29 22:51:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\FreeAudioPack
[2010/06/29 22:56:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\FreeCDRipper
[2011/07/26 22:41:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\GARMIN
[2011/01/04 00:48:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Geniesoft
[2010/04/25 08:44:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\GetRightToGo
[2010/09/03 09:59:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\LG Electronics
[2010/10/13 22:18:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\MxBoost
[2013/03/14 11:51:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\PCToolsFirewallPlus
[2010/06/02 22:17:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\PIPI
[2012/08/19 13:01:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Radialpoint
[2011/02/05 15:20:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Sammsoft
[2012/03/29 11:38:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Smart PDF Converter
[2013/01/19 09:18:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Smilebox
[2012/08/19 13:01:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\TELUS
[2013/03/12 13:56:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\uTorrent
[2013/05/14 15:16:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Visan
[2013/02/20 10:33:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Vso
[2010/09/03 09:59:47 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Vivian\Application Data\{D94BA408-F110-488B-A65E-3AE7945F79E6}

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C31F31E6
< End of report >
OTL logfile created on: 5/31/2013 11:17:10 AM - Run 6
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Vivian\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 1.10 Gb Available Physical Memory | 57.03% Memory free
3.79 Gb Paging File | 3.13 Gb Available in Paging File | 82.65% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 383.88 Gb Free Space | 82.42% Space Free | Partition Type: NTFS

Computer Name: VIVIANSCOMPUTER | User Name: Vivian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Vivian\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingBar.exe (Microsoft Corporation.)
PRC - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingApp.exe (Microsoft Corporation.)
PRC - C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE (Microsoft Corporation.)
PRC - C:\Program Files\Microsoft\BingBar\7.1.391.0\bingsurrogate.exe (Microsoft Corporation.)
PRC - C:\Program Files\TELUS\McciTrayApp.exe (Alcatel-Lucent)
PRC - C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicator.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe (Radialpoint SafeCare Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe (SAMSUNG ELECTRONICS)

========== Modules (No Company Name) ==========

MOD - C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\libcef.dll ()
MOD - C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\wxmsw28uh_vc.dll ()
MOD - C:\Program Files\Smart PDF Converter\ExplorerExt.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\WINDOWS\system32\WgaLogon.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\system32\devenum.dll ()

========== Services (SafeList) ==========

SRV - (vToolbarUpdater15.2.0) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe File not found
SRV - (Amsp) -- File not found
SRV - (ALG) -- C:\WINDOWS\System32\alg.exe File not found
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Skype C2C Service) -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (BBUpdate) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE (Microsoft Corporation.)
SRV - (BBSvc) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE (Microsoft Corporation.)
SRV - (ServicepointService) -- C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe (Radialpoint SafeCare Inc.)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDICA) -- File not found
DRV - (PID_08A0) -- system32\DRIVERS\LV302AV.SYS File not found
DRV - (pepifilter) -- system32\DRIVERS\lv302af.sys File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (MRENDIS5) -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS File not found
DRV - (MREMPR5) -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS File not found
DRV - (lbrtfdc) -- File not found
DRV - (KAVSafe) -- C:\WINDOWS\system32\Drivers\KAVSafe.sys File not found
DRV - (i2omgmt) -- File not found
DRV - (GMSIPCI) -- D:\INSTALL\GMSIPCI.SYS File not found
DRV - (Changer) -- File not found
DRV - (catchme) -- C:\ComboFix\catchme.sys File not found
DRV - (avgtp) -- C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (KPProtector) -- C:\Program Files\kuping4\KPProtector.sys ()
DRV - (SWDUMon) -- C:\WINDOWS\system32\drivers\SWDUMon.sys ()
DRV - (MREMP50) -- C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) -- C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (DrvAgent32) -- C:\WINDOWS\system32\drivers\DrvAgent32.sys (Phoenix Technologies)
DRV - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (UsbDiag) -- C:\WINDOWS\system32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (USBModem) -- C:\WINDOWS\system32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (usbbus) -- C:\WINDOWS\system32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (LgBttPort) -- C:\WINDOWS\system32\drivers\lgbtport.sys (LG Electronics Inc.)
DRV - (LGVMODEM) -- C:\WINDOWS\system32\drivers\lgvmodem.sys (LG Electronics Inc.)
DRV - (lgbusenum) -- C:\WINDOWS\system32\drivers\lgbtbus.sys (LG Electronics Inc.)
DRV - (sptd) -- C:\WINDOWS\system32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (nvsmu) -- C:\WINDOWS\system32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (nvnetbus) -- C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (nvgts) -- C:\WINDOWS\system32\drivers\nvgts.sys (NVIDIA Corporation)
DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) -- C:\WINDOWS\system32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (FsVga) -- C:\WINDOWS\system32\drivers\fsvga.sys (Microsoft Corporation)
DRV - (ASPI32) -- C:\WINDOWS\System32\drivers\ASPI32.SYS (Adaptec)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?rd=1&ucc=CA&dcc=CA&opt=0&ocid=iehp&tc=9
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = CE D0 EC 9F 21 5B CE 01 [binary data]
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@baidu.com/npxbdsetup: C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@ncity3d.com/NCity3dPlayer: C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll ( )

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/10/18 08:13:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22181a4d-af90-4ca3-a569-faed9118d6bc}: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013/02/18 15:26:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[email protected]: C:\Program Files\Hewlett-Packard\SmartPrint\QPExtension [2013/05/14 14:14:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/26 16:01:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/26 16:00:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013/02/18 15:26:15 | 000,000,000 | ---D | M]

[2013/05/28 12:01:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Vivian\Application Data\Mozilla\Extensions
[2013/05/26 16:01:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/05/26 16:00:19 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/26 16:00:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/05/26 16:00:18 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/05/28 12:00:20 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2010/11/12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2007/03/22 19:23:30 | 000,017,248 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL
[2013/02/15 15:31:23 | 000,186,432 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll
[2013/03/20 14:10:00 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll
[2009/05/07 14:22:10 | 000,196,096 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\npvgsplayer.dll
[2013/05/25 15:07:32 | 000,003,725 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\safeguard-secure-search.xml

========== Chrome ==========

CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = http://mysearch.avg.com/search?cid=...1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = http://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: VGS player plugin for Firefox (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npvgsplayer.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: RocketLife Secure Plug-In Layer (Enabled) = C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: NCity3D plugin for firefox (Enabled) = C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll
CHR - plugin: Motive Plugin (Enabled) = C:\Program Files\Common Files\Motive\npMotive.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: TELUS security advisor (Enabled) = C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: BaiduSetUp Plugin (Enabled) = C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Skype Click to Call = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0\
CHR - Extension: Radialpoint SPD Extension = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj\1.0_0\
CHR - Extension: AVG SafeGuard toolbar = C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\

O1 HOSTS File: ([2012/08/22 18:10:11 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll File not found
O2 - BHO: (TSToolbarBHO) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll File not found
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll File not found
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe (SAMSUNG ELECTRONICS)
O4 - HKLM..\Run: [TELUS_McciTrayApp] C:\Program Files\TELUS\McciTrayApp.exe (Alcatel-Lucent)
O4 - HKLM..\Run: [WJNews_197226] "C:\Program Files\Wuji\197226\WJNews.exe" -mini File not found
O4 - HKCU..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe (Sammsoft)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKCU..\Run: [HP Photosmart 7520 series (NET)] C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - HKCU..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKCU..\Run: [SmileboxTray] "C:\Documents and Settings\Vivian\Application Data\Smilebox\SmileboxTray.exe" File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Value error. File not found
O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\SmartPrint\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: 显示或隐藏 HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - Reg Error: Value error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 75.153.176.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F5D8976E-2CE8-46E0-BC66-A161DBFBDA3F}: DhcpNameServer = 192.168.1.254 75.153.176.9
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll File not found
O18 - Protocol\Handler\tmtb {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll File not found
O18 - Protocol\Handler\tmtbim {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll File not found
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\crypt32chain: DllName - (crypt32.dll) - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - (cryptnet.dll) - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - (cscdll.dll) - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - (%SystemRoot%\System32\dimsntfy.dll) - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - (sclgntfy.dll) - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - (WlNotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - C:\WINDOWS\System32\WgaLogon.dll ()
O20 - Winlogon\Notify\wlballoon: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Vivian\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Vivian\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/21 14:09:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/31 07:46:56 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Vivian\Desktop\OTL.exe
[2013/05/28 12:00:40 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2013/05/28 08:53:41 | 021,289,608 | ---- | C] (Mozilla) -- C:\Documents and Settings\Vivian\Desktop\Firefox Setup 21.0.exe
[2013/05/27 12:43:03 | 002,031,992 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Vivian\Desktop\MGADiag.exe
[2013/05/26 16:00:17 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/05/25 19:13:07 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2013/05/25 18:47:04 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/05/25 17:15:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly_files
[2013/05/25 15:28:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2013/05/25 15:27:58 | 000,000,000 | ---D | C] -- C:\JRT
[2013/05/24 15:11:02 | 000,000,000 | ---D | C] -- C:\FRST
[2013/05/23 16:14:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\TELUS
[2013/05/23 16:13:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Motive
[2013/05/23 16:13:25 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Motive
[2013/05/23 16:13:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Motive
[2013/05/23 15:56:55 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2013/05/22 22:06:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\HPAppData
[2013/05/21 10:25:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\cache
[2013/05/16 13:07:21 | 000,000,000 | ---D | C] -- C:\dbfecd5f7d2e63eac17b4786
[2013/05/15 12:16:59 | 000,000,000 | ---D | C] -- C:\78415340c7ea0ba5fa
[2013/05/14 18:38:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\StarApp
[2013/05/14 15:16:36 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
[2013/05/14 15:16:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Visan
[2013/05/14 14:14:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Visan
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Program Files\HP Photo Creations
[2013/05/14 14:13:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HP Photo Creations
[2013/05/14 14:12:33 | 000,563,048 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPDiscoPMBC11.dll
[2013/05/14 14:12:28 | 001,961,320 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPScanTRDrv_PS7520.dll
[2013/05/14 14:12:28 | 000,495,464 | ---- | C] (Hewlett-Packard) -- C:\WINDOWS\System32\HPWia1_PS7520.dll
[2013/05/14 14:12:25 | 002,215,784 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkinsBC11.exe
[2013/05/14 14:12:25 | 000,513,384 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkstsBC11.dll
[2013/05/14 14:12:25 | 000,267,624 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkstsBC11LM.dll
[2013/05/14 14:12:25 | 000,219,496 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkcoiBC11.dll
[2013/05/13 10:21:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype
[2013/05/13 10:21:56 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2013/02/27 15:27:19 | 020,546,152 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2011/02/19 12:10:12 | 053,539,128 | ---- | C] (Logitech, Inc.) -- C:\Program Files\lws110_x64.exe
[2010/04/08 21:41:02 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Vivian\Application Data\pcouffin.sys
[1 C:\Documents and Settings\Vivian\Desktop\*.tmp files -> C:\Documents and Settings\Vivian\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/31 11:15:00 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
[2013/05/31 11:11:00 | 000,000,880 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/31 11:07:25 | 000,000,876 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/31 11:07:24 | 000,000,630 | -H-- | M] () -- C:\WINDOWS\tasks\schedule!1822287263.job
[2013/05/31 11:07:24 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\FSPlatform.job
[2013/05/31 10:45:15 | 000,000,536 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/05/31 10:41:26 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013/05/31 10:31:20 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\FSPlatform1.job
[2013/05/31 10:31:18 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/05/31 10:25:00 | 000,000,492 | ---- | M] () -- C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/05/31 10:15:00 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
[2013/05/31 08:53:00 | 000,000,990 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
[2013/05/31 08:07:33 | 000,134,363 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\otl.extra.CLP
[2013/05/31 07:50:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Vivian\Desktop\OTL.exe
[2013/05/31 07:46:40 | 000,001,029 | ---- | M] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
[2013/05/30 07:04:01 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\SystemLook.exe
[2013/05/28 12:00:41 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/05/28 12:00:41 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2013/05/28 11:59:06 | 021,289,608 | ---- | M] (Mozilla) -- C:\Documents and Settings\Vivian\Desktop\Firefox Setup 21.0.exe
[2013/05/28 08:00:03 | 000,266,888 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\bookmarks.html
[2013/05/27 14:59:36 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/05/27 14:59:33 | 002,031,992 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Vivian\Desktop\MGADiag.exe
[2013/05/27 14:45:24 | 000,100,743 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\MGDiag.CLP
[2013/05/27 11:48:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/05/26 05:53:00 | 000,000,968 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
[2013/05/25 17:15:50 | 000,069,658 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
[2013/05/23 16:28:52 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/05/23 16:14:53 | 000,001,820 | ---- | M] () -- C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
[2013/05/23 16:05:37 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Vivian\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/05/21 10:25:32 | 000,037,664 | ---- | M] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/05/18 17:44:55 | 000,487,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/05/18 17:44:55 | 000,080,730 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/05/15 12:21:15 | 002,176,880 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/05/15 11:45:17 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/05/15 11:45:17 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/05/14 16:11:50 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2013/05/14 15:16:25 | 000,001,742 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
[2013/05/14 14:12:31 | 000,001,993 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
[2013/05/14 14:12:31 | 000,000,925 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
[2013/05/14 14:09:27 | 000,000,057 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2013/05/06 21:27:31 | 006,015,488 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2013/05/02 08:28:50 | 000,238,872 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe
[1 C:\Documents and Settings\Vivian\Desktop\*.tmp files -> C:\Documents and Settings\Vivian\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/31 08:07:33 | 000,134,363 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\otl.extra.CLP
[2013/05/31 07:46:40 | 000,001,029 | ---- | C] () -- C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
[2013/05/30 07:03:54 | 000,139,264 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\SystemLook.exe
[2013/05/28 12:00:41 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/05/28 12:00:41 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2013/05/28 12:00:41 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2013/05/28 08:00:02 | 000,266,888 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\bookmarks.html
[2013/05/27 14:40:57 | 000,100,743 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\MGDiag.CLP
[2013/05/25 17:15:50 | 000,069,658 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
[2013/05/23 16:14:53 | 000,001,820 | ---- | C] () -- C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
[2013/05/14 18:38:15 | 000,000,630 | -H-- | C] () -- C:\WINDOWS\tasks\schedule!1822287263.job
[2013/05/14 15:06:45 | 000,000,492 | ---- | C] () -- C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/05/14 14:14:01 | 000,001,742 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HP Photo Creations.lnk
[2013/05/14 14:12:31 | 000,001,993 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
[2013/05/14 14:12:31 | 000,000,925 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
[2013/05/14 14:09:27 | 000,000,057 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2013/03/14 12:14:24 | 000,000,010 | ---- | C] () -- C:\Documents and Settings\Vivian\1pt1
[2013/03/14 11:58:22 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2013/03/14 11:58:22 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2013/03/14 11:58:22 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2013/03/12 13:19:15 | 002,816,504 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data
[2013/03/12 13:07:22 | 000,013,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\SWDUMon.sys
[2013/02/18 15:22:04 | 000,172,332 | ---- | C] () -- C:\WINDOWS\hpoins37.dat
[2013/02/18 15:22:04 | 000,000,632 | ---- | C] () -- C:\WINDOWS\hpomdl37.dat
[2013/02/03 17:52:51 | 000,172,332 | ---- | C] () -- C:\WINDOWS\hpoins37.dat.temp
[2013/02/03 17:52:51 | 000,000,632 | ---- | C] () -- C:\WINDOWS\hpomdl37.dat.temp
[2012/09/29 09:09:43 | 000,558,133 | ---- | C] () -- C:\WINDOWS\System32\sqlite3.dll
[2012/08/22 17:45:35 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/08/22 17:45:35 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/08/22 17:45:35 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/08/22 17:45:35 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/08/22 17:45:35 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/08/19 12:55:46 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\inst.exe
[2012/02/15 11:22:34 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/19 11:12:05 | 000,014,336 | ---- | C] () -- C:\Documents and Settings\Vivian\SMS.db
[2011/04/20 09:42:28 | 000,001,022 | ---- | C] () -- C:\Documents and Settings\Vivian\tudouproxy.inf
[2011/02/18 14:21:08 | 000,738,189 | ---- | C] () -- C:\Program Files\wot-20100908-fx+sm.xpi
[2011/02/18 13:24:21 | 010,234,024 | ---- | C] ( ) -- C:\Program Files\fwinstall.exe
[2010/09/13 09:10:26 | 000,000,112 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\5FG7121.dat
[2010/04/08 21:41:20 | 000,000,671 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\vso_ts_preview.xml
[2010/04/08 21:41:02 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\pcouffin.cat
[2010/04/08 21:41:02 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Vivian\Application Data\pcouffin.inf
[2009/05/31 10:07:54 | 000,000,098 | ---- | C] () -- C:\Documents and Settings\Vivian\default.pls
[2009/04/21 15:08:37 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\Vivian\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/21 14:08:43 | 000,001,572 | ---- | C] () -- C:\Program Files\Disk Defragmenter.lnk

========== ZeroAccess Check ==========

[2009/10/13 00:08:14 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 05:42:06 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 05:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 05:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013/04/24 17:04:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\360safe
[2012/08/22 18:54:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2013/03/12 13:11:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar
[2013/03/12 13:11:15 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2009/04/21 15:26:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2010/07/29 05:27:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\kingsoft
[2010/01/01 03:05:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2013/05/31 10:00:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Radialpoint
[2010/01/01 03:06:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
[2013/05/14 18:38:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\StarApp
[2012/08/22 16:25:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TELUS
[2013/03/14 11:49:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2013/05/14 15:16:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Visan
[2010/04/09 08:20:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\vsosdk
[2010/05/09 14:09:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2013/04/24 16:59:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\360Login
[2010/04/25 08:27:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\3M
[2013/04/25 17:20:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\AIRPLAY
[2013/03/12 13:11:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\AVG SafeGuard toolbar
[2011/02/10 17:29:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/07/19 17:38:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\com.Shutterfly.ExpressUploader
[2009/04/21 15:27:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\DAEMON Tools
[2013/02/20 10:33:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\DAEMON Tools Lite
[2009/04/21 15:27:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\DAEMON Tools Pro
[2013/05/31 11:07:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Dropbox
[2010/06/20 15:58:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Facebook
[2010/06/29 22:51:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\FreeAudioPack
[2010/06/29 22:56:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\FreeCDRipper
[2011/07/26 22:41:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\GARMIN
[2011/01/04 00:48:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Geniesoft
[2010/04/25 08:44:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\GetRightToGo
[2010/09/03 09:59:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\LG Electronics
[2010/10/13 22:18:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\MxBoost
[2013/03/14 11:51:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\PCToolsFirewallPlus
[2010/06/02 22:17:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\PIPI
[2012/08/19 13:01:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Radialpoint
[2011/02/05 15:20:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Sammsoft
[2012/03/29 11:38:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Smart PDF Converter
[2013/01/19 09:18:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Smilebox
[2012/08/19 13:01:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\TELUS
[2013/03/12 13:56:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\uTorrent
[2013/05/14 15:16:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Visan
[2013/02/20 10:33:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Vivian\Application Data\Vso
[2010/09/03 09:59:47 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Vivian\Application Data\{D94BA408-F110-488B-A65E-3AE7945F79E6}

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C31F31E6
< End of report >


----------



## emeraldnzl (Nov 3, 2007)

Hello errorloading,

Do you know about this program?

*KPProtector*

And also did you have *Kingsoft Antivirus* on your machine?

Tell me when you return.

*For now*

In Google Chrome:


Click the wrench icon on the browser toolbar.
Click Tools.
Select Extensions.
 Click the trash can icon by *Coupons Inc. or Coupon Printer Manager*
A confirmation dialog will appear, click Remove.
*Next*

Please run OTL.exe


Under the *Custom Scans/Fixes* box at the bottom, copy and paste the content of the quote box below:



> :OTL
> O4 - HKLM..\Run: [WJNews_197226] "C:\Program Files\Wuji\197226\WJNews.exe" -mini File not found
> 
> :Commands
> [emptytemp]



Then click the *Run Fix* button at the top
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply.The log is saved in the same location as OTL.
*When you return please post
OTL fix log
and tell me about KPProtector and Kingsoft Antivirus
*


----------



## errorloading (Feb 4, 2011)

I could find the Coupons Inc or Coupon Printer Manager in the extensions, but manage to remove Coupon Printer by using the Add or Remove Program feature in the Control Panel.

I know nothing about KP Protector and do not have Kingsoft Antivirus installed in my computer.

Attached is the OTL fix log
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WJNews_197226 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Chung-Yan
->Temp folder emptied: 9726 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 14533547 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 13664 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 14912571 bytes
->Google Chrome cache emptied: 6541807 bytes
->Flash cache emptied: 0 bytes

User: Karen
->Temp folder emptied: 6520 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 14591457 bytes
->Flash cache emptied: 690 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 66765 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 74786 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: philso
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: pso
->Temp folder emptied: 218072 bytes
->Temporary Internet Files folder emptied: 33182 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 17573936 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 492 bytes

User: tso
->Temp folder emptied: 280540 bytes
->Temporary Internet Files folder emptied: 34109 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 17491399 bytes
->Google Chrome cache emptied: 1215718 bytes
->Flash cache emptied: 492 bytes

User: Vivian
->Temp folder emptied: 374141 bytes
->Temporary Internet Files folder emptied: 84865895 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 114740935 bytes
->Google Chrome cache emptied: 40117245 bytes
->Flash cache emptied: 3164 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 133421 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 270 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 1027964 bytes
RecycleBin emptied: 20992 bytes

Total Files Cleaned = 314.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 06012013_092014

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Thank you


----------



## emeraldnzl (Nov 3, 2007)

> I could find the Coupons Inc or Coupon Printer Manager in the extensions, but manage to remove Coupon Printer by using the Add or Remove Program feature in the Control Panel.


Normally I would just include them in a fix but Chrome breaks if you do that and if you use it that would mean a reinstall.



> I know nothing about KP Protector and do not have Kingsoft Antivirus installed in my computer.


Let's deal with that then.

Please run OTL.exe


Under the *Custom Scans/Fixes* box at the bottom, copy and paste the content of the quote box below:



> :Files
> C:\Program Files\kuping4
> 
> :Commands
> [reboot]



Then click the *Run Fix* button at the top
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply.The log is saved in the same location as OTL.


----------



## errorloading (Feb 4, 2011)

========== FILES ==========
C:\Program Files\kuping4\TempWallFile folder moved successfully.
C:\Program Files\kuping4\TempDownLoad\UserLive\tempfile folder moved successfully.
C:\Program Files\kuping4\TempDownLoad\UserLive folder moved successfully.
C:\Program Files\kuping4\TempDownLoad\TagInfo\tempfile folder moved successfully.
C:\Program Files\kuping4\TempDownLoad\TagInfo folder moved successfully.
C:\Program Files\kuping4\TempDownLoad\SystemTheme\dataXml folder moved successfully.
C:\Program Files\kuping4\TempDownLoad\SystemTheme folder moved successfully.
C:\Program Files\kuping4\TempDownLoad\Home\tempfile folder moved successfully.
C:\Program Files\kuping4\TempDownLoad\Home folder moved successfully.
C:\Program Files\kuping4\TempDownLoad folder moved successfully.
C:\Program Files\kuping4\SystemConfig folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\UpdateUi\ui\UpdateSkin folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\UpdateUi\ui\SkinCenter folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\UpdateUi\ui folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\UpdateUi folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\UpdateNotice folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\slice folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\progress folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\notice folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\Menu folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\list folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\IndivCenter\upload folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\IndivCenter\Personal-information folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\IndivCenter\My-share folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\IndivCenter\My-resources folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\IndivCenter\daohang folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\IndivCenter folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\ImageLook folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\IconListEx folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\feedback folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\DownloadWebDlg folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\cursor folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\color folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\application folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui\about folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ui folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\tooltipUi folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\SettingMenuDlgConfig folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\newUi folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\login\ui folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\login folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\ImageLookDlgConfig folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\FeedbackDlgConfig folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\DownloadWebImageDlg folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\cheakskin folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\CenterDlgConfig folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\AppDlgConfig folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748;\AboutDlgConfig folder moved successfully.
C:\Program Files\kuping4\skinConfig\&#40664;&#35748; folder moved successfully.
C:\Program Files\kuping4\skinConfig folder moved successfully.
C:\Program Files\kuping4\QuickenFunctionConfig\Setup folder moved successfully.
C:\Program Files\kuping4\QuickenFunctionConfig\rich_media folder moved successfully.
C:\Program Files\kuping4\QuickenFunctionConfig\Powerboot folder moved successfully.
C:\Program Files\kuping4\QuickenFunctionConfig\Management folder moved successfully.
C:\Program Files\kuping4\QuickenFunctionConfig\home folder moved successfully.
C:\Program Files\kuping4\QuickenFunctionConfig\deskIco folder moved successfully.
C:\Program Files\kuping4\QuickenFunctionConfig folder moved successfully.
C:\Program Files\kuping4\MSGBoxSkin\UI folder moved successfully.
C:\Program Files\kuping4\MSGBoxSkin folder moved successfully.
C:\Program Files\kuping4\MiniConfig\&#40664;&#35748;\ui folder moved successfully.
C:\Program Files\kuping4\MiniConfig\&#40664;&#35748; folder moved successfully.
C:\Program Files\kuping4\MiniConfig folder moved successfully.
C:\Program Files\kuping4\kpTailor\skiniconfig\&#40664;&#35748;\&#25552;&#31034;&#26694; folder moved successfully.
C:\Program Files\kuping4\kpTailor\skiniconfig\&#40664;&#35748;\Temp folder moved successfully.
C:\Program Files\kuping4\kpTailor\skiniconfig\&#40664;&#35748;\Prompt folder moved successfully.
C:\Program Files\kuping4\kpTailor\skiniconfig\&#40664;&#35748;\menu_ui folder moved successfully.
C:\Program Files\kuping4\kpTailor\skiniconfig\&#40664;&#35748;\cheakskin folder moved successfully.
C:\Program Files\kuping4\kpTailor\skiniconfig\&#40664;&#35748; folder moved successfully.
C:\Program Files\kuping4\kpTailor\skiniconfig folder moved successfully.
C:\Program Files\kuping4\kpTailor folder moved successfully.
C:\Program Files\kuping4\bho folder moved successfully.
C:\Program Files\kuping4\Appsoftconfig\softtempfile folder moved successfully.
C:\Program Files\kuping4\Appsoftconfig\image folder moved successfully.
C:\Program Files\kuping4\Appsoftconfig folder moved successfully.
C:\Program Files\kuping4 folder moved successfully.
========== COMMANDS ==========

OTL by OldTimer - Version 3.2.69.0 log created on 06022013_055938


----------



## emeraldnzl (Nov 3, 2007)

Please download Malwarebytes' Anti-Malware from *Here*

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to *Update Malwarebytes' Anti-Malware* and *Launch Malwarebytes' Anti-Malware*, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "*Perform Quick Scan*", then click *Scan*.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that *everything is checked*, and click *Remove Selected*.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy & Paste the entire report in your next reply.
Extra Note:
*If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.*


----------



## errorloading (Feb 4, 2011)

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5706

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

2/7/2011 3:08:39 PM
mbam-log-2011-02-07 (15-08-39).txt

Scan type: Quick scan
Objects scanned: 292693
Time elapsed: 19 minute(s), 55 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 11

Memory Processes Infected:
c:\documents and settings\networkservice\application data\EVEydvXl.exe (Trojan.Downloader) -> 3476 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\{84C3C236-F588-4c93-84F4-147B2ABBE67B} (Adware.Adrotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adShotHlpr.adShotHlpr (Adware.Adrotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adShotHlpr.adShotHlpr.1.0 (Adware.Adrotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CscrptXt.CscrptXt (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CscrptXt.CscrptXt.1.0 (Adware.EZlife) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Software\Microsoft\idln2 (Malware.Trace) -> Value: idln2 -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\bk (Malware.Trace) -> Value: bk -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\RegistryMonitor2 (Malware.Trace) -> Value: RegistryMonitor2 -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\documents and settings\Vivian\application data\systemproc (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
c:\documents and settings\networkservice\application data\EVEydvXl.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\application data\iewvnvwfp9.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\application data\MLc2Zi4Y.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\application data\oVqKGqg8.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\IM4ABKAV\sd[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\tso\application data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\tso\application data\mvhgkr.dat (Malware.Trace) -> Quarantined and deleted successfully.
c:\zrpt.xml (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\secushr.dat (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\pso\application data\scgdfgasfbh.bat (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\application data\asdfasfas.bat (Malware.Trace) -> Quarantined and deleted successfully.


----------



## emeraldnzl (Nov 3, 2007)

How is your computer now?


----------



## errorloading (Feb 4, 2011)

I believe everything is working fine now, but the startup still seems to be a bit slow.

Thank you very much.


----------



## emeraldnzl (Nov 3, 2007)

> but the startup still seems to be a bit slow.


This might help:

Click *Start > Run*

enter *msconfig*

choose the *Startup* tab

*uncheck* unwanted startup programs and click Apply > OK

Restart you computer

You can turn them back on by reversing the process.

*Now*

To remove the tools we have been using:


Double-click *OTL.exe* to run it. (Vista users, please right click on *OTL.exe* and select "Run as an *Administrator*")
Click on the *CleanUp!* button
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose *Yes.*
MBAM can be uninstalled via control panel add/remove but it may be a useful tool to keep.

*After that*

Press the Solved button if your computers problems are fixed.

Have a nice computing day.


----------



## errorloading (Feb 4, 2011)

When I log in as user "Theresa So", there are a few unwanted screen showed up at the startup:

1) Window Security Alert
To help protect your computer, Windows Firewall has blocked some features of this program

2) Name: Tudou (in Chinese) 1.30
Registration
iTudou 2.3

After I changed the unwanted startup programs, the following msg showed up at startup:

Choose the Normal Startup mode on the General Tab to start Windows normally & undo the changes you made using the system configuration utility.

I do as instructed, i.e. choose Normal startup mode on the General Tab.

Pls advise what to do next.

Thank you.


----------



## emeraldnzl (Nov 3, 2007)

> After I changed the unwanted startup programs, the following msg showed up at startup:
> 
> Choose the Normal Startup mode on the General Tab to start Windows normally & undo the changes you made using the system configuration utility.


Looks as though you may have stopped some essential programs. Not a problem because when you booted normally it should have restored them.



> Name: Tudou (in Chinese) 1.30
> Registration
> iTudou 2.3


Well what do you know... I thought we had removed that one. Either it is coming back (which means there is still infection there) or we missed some part of it.

If you still have OTL then carry out the fix below. If you don't have it now please download *OTL* to your desktop.

Then please run OTL.exe


Under the *Custom Scans/Fixes* box at the bottom, copy and paste the content of the quote box below:



> :OTL
> C:\Documents and Settings\Vivian\tudouproxy.inf
> 
> :Files
> ...



Then click the *Run Fix* button at the top
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply.The log is saved in the same location as OTL.
*After that*

Please download ComboFix from this location:

*Link*

** IMPORTANT !!! Save ComboFix.exe to your Desktop*

*Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.*


Double click on ComboFix.exe & follow the prompts.

If you have an older Operating System you may be asked whether you want to install the Recovery Console. Click yes and follow any prompts.

Your desktop may go blank. This is normal.

ComboFix may appear to be doing nothing for quite long periods, this is normal, just leave it to do it's job.

ComboFix may reboot your machine. This is normal too. 

***Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall***

When finished, it will produce a log for you. Please include the *C:\ComboFix.txt* in your next reply.

*So when you return please post
OTL fix log
ComboFix.txt
*


----------



## errorloading (Feb 4, 2011)

I seem to hv problem running the "Run Fix". Every time I started it, the computer is stoned. Pls advise what to do.


----------



## emeraldnzl (Nov 3, 2007)

Okay, I am thinking now that this might be a particular infection.

Forget my previous instruction and do this:

Please download Farbar Recovery Scan Tool and save it to your desktop.

*Note*: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.


Right click to run as administrator. When the tool opens click *Yes* to disclaimer.
Press *Scan* button.
It will produce a log called (*FRST.txt*) in the same directory the tool is run from. 
Please copy and paste log back here.
The first time the tool is run, it makes also another log (*Addition.txt*). Please also paste that into your reply.


----------



## errorloading (Feb 4, 2011)

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 05-06-2013 01
Ran by Vivian (administrator) on 06-06-2013 09:28:34
Running from C:\Documents and Settings\Vivian\My Documents\Downloads
Microsoft Windows XP Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\McciCMService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(Radialpoint SafeCare Inc.) C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe
(Skype Technologies S.A.) C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Alcatel-Lucent) C:\Program Files\TELUS\McciTrayApp.exe
(SAMSUNG ELECTRONICS) C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Dropbox, Inc.) C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
(Farbar) C:\Documents and Settings\Vivian\My Documents\Downloads\FRST(1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TELUS_McciTrayApp] "C:\Program Files\TELUS\McciTrayApp.exe" [1561088 2012-06-11] (Alcatel-Lucent)
HKLM\...\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe [126976 2006-07-21] (SAMSUNG ELECTRONICS)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2010-11-29] (Apple Inc.)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [947152 2013-01-27] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [421160 2011-04-14] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
Winlogon\Notify\!SASWinLogon: C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [X]
Winlogon\Notify\WgaLogon: WgaLogon.dll ()
HKCU\...\Run: [HP Photosmart 7520 series (NET)] "C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN2AU294Q705XX:NW" -scfn "HP Photosmart 7520 series (NET)" -AutoStart 1 [1818472 2012-05-08] (Hewlett-Packard Co.)
HKCU\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2010-03-08] (Google Inc.)
HKCU\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [SmileboxTray] "C:\Documents and Settings\Vivian\Application Data\Smilebox\SmileboxTray.exe" [x]
HKCU\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [152872 2007-06-27] (Nero AG)
HKCU\...\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem [2215944 2010-10-18] (Sammsoft)
HKU\Administrator\...\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [x]
HKU\Chung-Yan\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Chung-Yan\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\Default User\...\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe" [x]
HKU\Guest\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Guest\...\Run: [msnmsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\Guest\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\Guest\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
HKU\Guest\...\Run: [Akuhaves] rundll32.exe "C:\WINDOWS\ojexiyayidad.dll",Startup [x]
HKU\Guest\...\Run: [Facebook Update] "C:\Documents and Settings\Guest\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [ 2012-07-11] (Facebook Inc.)
HKU\Karen\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Karen\...\Run: [msnmsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\Karen\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\philso\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\philso\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\philso\...\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\pso\...\Run: [HP Photosmart 7520 series (NET)] "C:\Program Files\HP\HP Photosmart 7520 series\bin\ScanToPCActivationApp.exe" -scfn "HP Photosmart 7520 series (NET)" -AutoStart 1 [ 2012-05-08] (Hewlett-Packard Co.)
HKU\tso\...\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [x]
HKU\tso\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\tso\...\Run: [Google Update] "C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c [ 2009-10-31] (Google Inc.)
HKU\tso\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\???ˉiTudou.lnk
ShortcutTarget: ???ˉiTudou.lnk -> C:\Documents and Settings\Vivian\My Documents\iTudou\iTudou.exe (No File)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\???ˉ·é?ùíá?1.lnk
ShortcutTarget: ???ˉ·é?ùíá?1.lnk -> C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\·é?ùTudou\TudouVa.exe (土豆网)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\启动iTudou.lnk
ShortcutTarget: 启动iTudou.lnk -> C:\Documents and Settings\Vivian\My Documents\iTudou\iTudou.exe (No File)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\启动飞速土豆.lnk
ShortcutTarget: 启动飞速土豆.lnk -> C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\·é?ùTudou\TudouVa.exe (No File)
Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?rd=1&ucc=CA&dcc=CA&opt=0&ocid=iehp&tc=19
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll No File
BHO: TSToolbarBHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll No File
BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
BHO: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll No File
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll" No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
PDF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
PDF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll No File
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll No File
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll No File
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll No File
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [77824 2008-05-13] (SuperAdBlocker.com)
Winsock: Catalog5 04 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 75.153.176.9

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\0dr2gaab.default
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @baidu.com/npxbdsetup - C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @Motive.com/NpMotive,version=1.0 - C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF Plugin: @ncity3d.com/NCity3dPlayer - C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
FF Plugin: @radialpoint.com/SPA,version=1 - C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
FF Plugin: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 - C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultSearchURL: (AVG Secure Search) - http://mysearch.avg.com/search?cid={75845DC5-2FA8-4D2F-8139-DB74C5925FA1}&mid=2a886f6ebd5347d39e5fd16d67cda10b-46c6454c2414415d7d2d2b57f0e699c1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=dsp&q={searchTerms}
CHR DefaultSuggestURL: (AVG Secure Search) - http://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\27.0.1453.110\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.230.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Microsoft Office 2003) - C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (VGS player plugin for Firefox) - C:\Program Files\Mozilla Firefox\plugins\npvgsplayer.dll ()
CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npdrmv2.dll (Microsoft Corporation)
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program Files\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))
CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)
CHR Plugin: (RocketLife Secure Plug-In Layer) - C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
CHR Plugin: (Facebook Plugin) - C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll ( )
CHR Plugin: (NCity3D plugin for firefox) - C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
CHR Plugin: (Motive Plugin) - C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (TELUS security advisor) - C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (BaiduSetUp Plugin) - C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
CHR Plugin: (Shockwave Flash) - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (Windows Presentation Foundation) - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Skype Click to Call) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0
CHR Extension: (Radialpoint SPD Extension) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj\1.0_0
CHR Extension: (AVG SafeGuard toolbar) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0

========================== Services (Whitelisted) =================

R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
R2 ServicepointService; C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe [10294584 2012-03-09] (Radialpoint SafeCare Inc.)
R2 Skype C2C Service; C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3289208 2013-05-14] (Skype Technologies S.A.)
S3 ALG; %SystemRoot%\System32\alg.exe [x]
S2 Amsp; 
S2 vToolbarUpdater15.2.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe [x]

==================== Drivers (Whitelisted) ====================

R1 AmdK8; C:\Windows\System32\DRIVERS\AmdK8.sys [36864 2006-07-01] (Advanced Micro Devices)
R1 ASPI32; C:\Windows\System32\Drivers\ASPI32.sys [25244 1999-09-10] (Adaptec)
R1 avgtp; C:\WINDOWS\system32\drivers\avgtpx86.sys [37664 2013-05-21] (AVG Technologies)
S3 CCDECODE; C:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)
S3 DrvAgent32; C:\WINDOWS\system32\Drivers\DrvAgent32.sys [23456 2011-02-19] (Phoenix Technologies)
R1 FsVga; C:\Windows\System32\DRIVERS\fsvga.sys [12160 2004-08-04] (Microsoft Corporation)
R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [144384 2008-04-13] (Windows (R) Server 2003 DDK provider)
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2007-03-07] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2007-03-07] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2007-03-07] (HP)
R3 LgBttPort; C:\Windows\System32\DRIVERS\lgbtport.sys [12160 2009-09-29] (LG Electronics Inc.)
R3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbus.sys [10496 2009-09-29] (LG Electronics Inc.)
R3 LGVMODEM; C:\Windows\System32\DRIVERS\lgvmodem.sys [12928 2009-09-29] (LG Electronics Inc.)
R3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41888 2007-05-09] (Logitech Inc.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
S3 MREMP50; C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [21248 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [20096 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))
S3 NABTSFEC; C:\Windows\System32\DRIVERS\NABTSFEC.sys [85248 2008-04-14] (Microsoft Corporation)
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
R3 NVENETFD; C:\Windows\System32\DRIVERS\NVENETFD.sys [54016 2008-01-28] (NVIDIA Corporation)
R0 nvgts; C:\Windows\System32\DRIVERS\nvgts.sys [132096 2008-01-25] (NVIDIA Corporation)
R3 nvnetbus; C:\Windows\System32\DRIVERS\nvnetbus.sys [22016 2008-01-28] (NVIDIA Corporation)
R3 PID_PEPI; C:\Windows\System32\DRIVERS\LV302V32.SYS [1276832 2007-05-09] (Logitech Inc.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12872 2010-02-17] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67656 2010-05-10] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SLIP; C:\Windows\System32\DRIVERS\SLIP.sys [11136 2008-04-14] (Microsoft Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-04-21] (Duplex Secure Ltd.)
S3 streamip; C:\Windows\System32\DRIVERS\StreamIP.sys [15232 2008-04-14] (Microsoft Corporation)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2013-03-15] ()
S3 usbbus; C:\Windows\System32\DRIVERS\lgusbbus.sys [13056 2010-01-21] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgusbdiag.sys [20864 2010-01-21] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgusbmodem.sys [24960 2010-01-21] (LG Electronics Inc.)
S3 WSTCODEC; C:\Windows\System32\DRIVERS\WSTCODEC.SYS [19200 2008-04-14] (Microsoft Corporation)
S4 Abiosdsk; No ImagePath
S4 abp480n5; No ImagePath
S4 adpu160m; No ImagePath
S4 Aha154x; No ImagePath
S4 aic78u2; No ImagePath
S4 aic78xx; No ImagePath
S4 AliIde; No ImagePath
S4 amsint; No ImagePath
S4 asc; No ImagePath
S4 asc3350p; No ImagePath
S4 asc3550; No ImagePath
S4 Atdisk; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S4 cd20xrnt; No ImagePath
S1 Changer; No ImagePath
S4 CmdIde; No ImagePath
S4 Cpqarray; No ImagePath
U4 dac2w2k; No ImagePath
S4 dac960nt; No ImagePath
S4 dpti2o; No ImagePath
S3 GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS [x]
S4 hpn; No ImagePath
S1 i2omgmt; No ImagePath
S4 i2omp; No ImagePath
S4 ini910u; No ImagePath
S4 IntelIde; No ImagePath
S2 KAVSafe; \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys [x]
S1 KPProtector; \??\C:\Program Files\kuping4\KPProtector.sys [x]
S1 lbrtfdc; No ImagePath
S4 mraid35x; No ImagePath
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [x]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [x]
S1 PCIDump; No ImagePath
S3 PDCOMP; No ImagePath
S3 PDFRAME; No ImagePath
S3 PDRELI; No ImagePath
S3 PDRFRAME; No ImagePath
S3 pepifilter; system32\DRIVERS\lv302af.sys [x]
S4 perc2; No ImagePath
S4 perc2hib; No ImagePath
S3 PID_08A0; system32\DRIVERS\LV302AV.SYS [x]
S4 ql1080; No ImagePath
S4 Ql10wnt; No ImagePath
S4 ql12160; No ImagePath
S4 ql1240; No ImagePath
S4 ql1280; No ImagePath
S4 Simbad; No ImagePath
S4 Sparrow; No ImagePath
S4 symc810; No ImagePath
S4 symc8xx; No ImagePath
S4 sym_hi; No ImagePath
S4 sym_u3; No ImagePath
S4 TosIde; No ImagePath
S4 ultra; No ImagePath
S4 ViaIde; No ImagePath
S3 WDICA; No ImagePath

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-06-03 11:48 - 2013-06-03 11:48 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\Dropbox
2013-06-03 09:07 - 2013-06-03 09:07 - 00000784 ____A C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2013-06-03 09:07 - 2013-06-03 09:07 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-03 09:07 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-06-01 14:04 - 2013-06-01 14:04 - 00006144 __ASH C:\Documents and Settings\tso\My Documents\Thumbs.db
2013-05-31 08:07 - 2013-05-31 08:07 - 00134363 ____A C:\Documents and Settings\Vivian\Desktop\otl.extra.CLP
2013-05-31 08:01 - 2013-05-31 11:26 - 00124444 ____A C:\Documents and Settings\Vivian\Desktop\OTL.Txt
2013-05-31 07:46 - 2013-05-31 07:50 - 00602112 ____A (OldTimer Tools) C:\Documents and Settings\Vivian\Desktop\OTL.exe
2013-05-30 18:22 - 2013-05-30 18:24 - 00000482 ____A C:\Documents and Settings\pso\My Documents\churchchoir.csv
2013-05-30 18:20 - 2013-05-30 18:24 - 00017920 ____A C:\Documents and Settings\pso\My Documents\churchchoir.xls
2013-05-30 07:05 - 2013-05-30 07:05 - 00000590 ____A C:\Documents and Settings\Vivian\Desktop\SystemLook.txt
2013-05-30 07:03 - 2013-05-30 07:04 - 00139264 ____A C:\Documents and Settings\Vivian\Desktop\SystemLook.exe
2013-05-28 18:32 - 2013-05-28 18:32 - 00021965 ____A C:\Documents and Settings\Guest\Desktop\bookmarks.html
2013-05-28 12:00 - 2013-05-28 12:00 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-05-28 08:53 - 2013-05-28 11:59 - 21289608 ____A (Mozilla) C:\Documents and Settings\Vivian\Desktop\Firefox Setup 21.0.exe
2013-05-28 08:05 - 2013-05-28 08:05 - 00007738 ____A C:\Documents and Settings\Karen\Desktop\bookmarks.html
2013-05-28 08:04 - 2013-05-28 08:04 - 00007640 ____A C:\Documents and Settings\Chung-Yan\Desktop\bookmarks.html
2013-05-28 08:03 - 2013-05-28 08:03 - 00028032 ____A C:\Documents and Settings\tso\Desktop\bookmarks.html
2013-05-28 08:01 - 2013-05-28 08:01 - 00053856 ____A C:\Documents and Settings\pso\Desktop\bookmarks.html
2013-05-28 08:00 - 2013-05-28 08:00 - 00266888 ____A C:\Documents and Settings\Vivian\Desktop\bookmarks.html
2013-05-27 14:40 - 2013-05-27 14:45 - 00100743 ____A C:\Documents and Settings\Vivian\Desktop\MGDiag.CLP
2013-05-27 14:17 - 2013-05-27 14:17 - 00001018 ____A C:\Documents and Settings\tso\Desktop\Shortcut to driverlicence.lnk
2013-05-27 12:43 - 2013-05-27 14:59 - 02031992 ____A (Microsoft Corporation) C:\Documents and Settings\Vivian\Desktop\MGADiag.exe
2013-05-26 17:40 - 2013-05-26 17:41 - 00017392 ____A C:\AdwCleaner[S1].txt
2013-05-26 16:00 - 2013-05-28 12:00 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-05-26 06:47 - 2013-05-26 06:47 - 00000000 __SHD C:\Documents and Settings\tso\IECompatCache
2013-05-26 06:28 - 2013-05-26 06:28 - 00004577 ____A C:\Documents and Settings\Vivian\Desktop\eset.txt
2013-05-25 19:13 - 2013-05-25 19:13 - 00000000 ____D C:\Program Files\ESET
2013-05-25 18:47 - 2013-05-25 18:47 - 00000000 ____D C:\_OTL
2013-05-25 17:15 - 2013-05-25 17:15 - 00069658 ____A C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
2013-05-25 17:15 - 2013-05-25 17:15 - 00000000 ____D C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly_files
2013-05-25 15:45 - 2013-05-25 15:45 - 00011731 ____A C:\Documents and Settings\Vivian\Desktop\JRT.txt
2013-05-25 15:28 - 2013-05-25 15:28 - 00000000 ____D C:\Windows\ERUNT
2013-05-25 15:27 - 2013-05-25 15:28 - 00000000 ____D C:\JRT
2013-05-24 15:11 - 2013-05-25 15:21 - 00000000 ____D C:\FRST
2013-05-23 21:08 - 2013-05-23 21:08 - 00000000 ____D C:\Documents and Settings\pso\Application Data\Motive
2013-05-23 21:02 - 2013-05-23 21:02 - 00000000 ____D C:\Documents and Settings\pso\Application Data\AVG SafeGuard toolbar
2013-05-23 16:32 - 2013-05-23 16:32 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\PriceGong
2013-05-23 16:28 - 2013-05-23 16:28 - 00012994 ____A C:\Windows\KB2510531-IE8.log
2013-05-23 16:14 - 2013-05-23 16:14 - 00001820 ____A C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
2013-05-23 16:13 - 2013-05-23 16:26 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Motive
2013-05-23 16:13 - 2013-05-23 16:18 - 00000000 ____D C:\Program Files\Common Files\Motive
2013-05-23 16:13 - 2013-05-23 16:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Motive
2013-05-23 15:59 - 2013-05-23 15:59 - 00037114 ____A C:\Windows\KB2744842-IE8.log
2013-05-23 15:58 - 2013-05-23 15:59 - 00036950 ____A C:\Windows\KB2618444-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00030243 ____A C:\Windows\KB2598845-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00029602 ____A C:\Windows\KB2467659.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00000000 __HDC C:\Windows\$NtUninstallKB2467659$
2013-05-23 15:57 - 2013-05-23 16:01 - 00007281 ____A C:\Windows\spupdsvc.log
2013-05-23 15:57 - 2013-05-23 15:58 - 00037767 ____A C:\Windows\KB982381-IE8.log
2013-05-23 15:56 - 2013-05-23 15:57 - 00039585 ____A C:\Windows\ie8.log
2013-05-23 15:56 - 2013-05-23 15:57 - 00000000 __HDC C:\Windows\ie8
2013-05-23 15:51 - 2011-08-16 03:45 - 00006144 ____C (Microsoft Corporation) C:\Windows\System32\dllcache\iecompat.dll
2013-05-23 15:50 - 2013-05-23 15:50 - 00003774 ____A C:\Windows\KB951978.log
2013-05-23 15:45 - 2013-05-23 15:59 - 00140674 ____A C:\Windows\ie8_main.log
2013-05-23 15:45 - 2013-05-23 15:46 - 00035668 ____A C:\Windows\ie8Uninst.log
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\TELUS
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\Radialpoint
2013-05-23 14:16 - 2013-05-23 14:16 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\AVG SafeGuard toolbar
2013-05-21 18:32 - 2013-05-21 18:32 - 00000000 ____D C:\Documents and Settings\tso\Application Data\AVG SafeGuard toolbar
2013-05-21 10:25 - 2013-05-21 10:25 - 00000000 ____D C:\Windows\System32\cache
2013-05-16 13:07 - 2013-05-16 13:07 - 00000000 ____D C:\dbfecd5f7d2e63eac17b4786
2013-05-15 21:48 - 2013-05-23 15:59 - 00121115 ____A C:\Windows\KB2829530-IE8.log
2013-05-15 12:16 - 2013-05-23 16:29 - 00016442 ____A C:\Windows\KB2847204-IE8.log
2013-05-15 12:16 - 2013-05-15 12:17 - 00000000 ____D C:\78415340c7ea0ba5fa
2013-05-15 12:16 - 2013-05-15 12:16 - 00006960 ____A C:\Windows\KB2820197.log
2013-05-15 12:16 - 2013-05-15 12:16 - 00000000 __HDC C:\Windows\$NtUninstallKB2820197$
2013-05-15 12:11 - 2013-05-15 12:11 - 00000000 __HDC C:\Windows\$NtUninstallKB2829361$
2013-05-15 11:08 - 2013-05-15 12:11 - 00010405 ____A C:\Windows\KB2829361.log
2013-05-14 18:38 - 2013-06-06 09:02 - 00000630 ___AH C:\Windows\Tasks\schedule!1822287263.job
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\StarApp
2013-05-14 18:01 - 2013-05-14 18:00 - 00090112 ____A C:\Windows\Minidump\Mini051413-01.dmp
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Visan
2013-05-14 15:06 - 2013-06-06 09:25 - 00000492 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-05-14 14:58 - 2001-08-17 13:53 - 00006784 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\serscan.sys
2013-05-14 14:14 - 2013-05-14 14:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
2013-05-14 14:13 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Visan
2013-05-14 14:13 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP Photo Creations
2013-05-14 14:13 - 2013-05-14 14:14 - 00000000 ____D C:\Program Files\HP Photo Creations
2013-05-14 14:12 - 2013-05-14 14:12 - 00001993 ____A C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2013-05-14 14:12 - 00000925 ____A C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2012-05-08 17:23 - 02215784 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkinsBC11.exe
2013-05-14 14:12 - 2012-05-08 17:23 - 01961320 ____A (Hewlett-Packard Co.) C:\Windows\System32\HPScanTRDrv_PS7520.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00513384 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkstsBC11.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00495464 ____A (Hewlett-Packard) C:\Windows\System32\HPWia1_PS7520.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00267624 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkstsBC11LM.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00219496 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkcoiBC11.dll
2013-05-14 14:12 - 2012-05-08 14:03 - 00563048 ____N (Hewlett-Packard Co.) C:\Windows\System32\HPDiscoPMBC11.dll
2013-05-14 14:09 - 2013-05-14 14:09 - 00000057 ____A C:\Documents and Settings\All Users\Application Data\Ament.ini
2013-05-13 10:21 - 2013-05-13 10:21 - 00000000 ____D C:\Program Files\Common Files\Skype

==================== One Month Modified Files and Folders ========

2013-06-06 09:25 - 2013-05-14 15:06 - 00000492 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-06-06 09:15 - 2009-10-31 06:36 - 00000970 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
2013-06-06 09:11 - 2013-02-27 23:29 - 00000384 ___AH C:\Windows\Tasks\Microsoft Antimalware Scheduled Scan.job
2013-06-06 09:11 - 2010-03-08 15:18 - 00000880 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-06 09:09 - 2011-02-07 13:40 - 01441111 ____A C:\Windows\WindowsUpdate.log
2013-06-06 09:03 - 2012-06-15 00:46 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\Dropbox
2013-06-06 09:03 - 2012-06-15 00:36 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Dropbox
2013-06-06 09:02 - 2013-05-14 18:38 - 00000630 ___AH C:\Windows\Tasks\schedule!1822287263.job
2013-06-06 09:02 - 2013-04-24 16:57 - 00000306 ____A C:\Windows\Tasks\FSPlatform.job
2013-06-06 09:02 - 2010-03-08 15:18 - 00000876 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-06 09:01 - 2013-05-01 09:27 - 00000306 ____A C:\Windows\Tasks\FSPlatform1.job
2013-06-06 09:01 - 2012-08-22 18:02 - 00000157 ____A C:\Windows\wiadebug.log
2013-06-06 09:01 - 2012-08-22 18:02 - 00000048 ____A C:\Windows\wiaservc.log
2013-06-06 09:01 - 2009-04-21 14:12 - 00000062 __ASH C:\Documents and Settings\Vivian\Local Settings\desktop.ini
2013-06-06 09:01 - 2009-04-21 14:12 - 00000062 __ASH C:\Documents and Settings\LocalService\Local Settings\desktop.ini
2013-06-06 09:01 - 2009-04-21 14:12 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-06 09:01 - 2009-04-21 14:11 - 00000062 __ASH C:\Documents and Settings\NetworkService\Local Settings\desktop.ini
2013-06-05 22:07 - 2012-08-22 18:02 - 00032522 ____A C:\Windows\SchedLgU.Txt
2013-06-05 22:06 - 2009-04-21 14:12 - 00000278 __SHC C:\Documents and Settings\Vivian\ntuser.ini
2013-06-05 22:03 - 2012-08-19 13:01 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Radialpoint
2013-06-05 21:45 - 2012-07-07 00:29 - 00000536 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-05 20:53 - 2012-04-30 07:57 - 00000990 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
2013-06-05 20:09 - 2010-07-29 05:13 - 00000278 _ASHC C:\Documents and Settings\pso\ntuser.ini
2013-06-05 19:28 - 2010-07-29 05:13 - 00000062 __ASH C:\Documents and Settings\pso\Local Settings\desktop.ini
2013-06-05 14:19 - 2009-04-21 06:54 - 00000339 _RASH C:\boot.ini
2013-06-05 14:19 - 2004-08-04 05:00 - 00000608 ____A C:\Windows\win.ini
2013-06-05 14:19 - 2004-08-04 05:00 - 00000227 ____A C:\Windows\system.ini
2013-06-04 18:18 - 2009-04-22 14:54 - 00000278 __ASH C:\Documents and Settings\tso\ntuser.ini
2013-06-04 18:12 - 2009-04-22 14:54 - 00000062 __ASH C:\Documents and Settings\tso\Local Settings\desktop.ini
2013-06-04 18:10 - 2011-02-05 17:35 - 00000000 ____D C:\Windows\pss
2013-06-04 09:15 - 2010-07-29 10:07 - 00000000 ____D C:\Documents and Settings\tso\update
2013-06-03 19:57 - 2009-08-13 18:49 - 00000262 ____A C:\Windows\Tasks\Disk Cleanup.job
2013-06-03 19:29 - 2013-02-27 13:23 - 00000120 ____A C:\Windows\setupact.log
2013-06-03 12:01 - 2013-02-27 15:25 - 00000000 ____D C:\Windows\Temp634E60C6-3D12-8B95-0B47-EFDDDD40F884-Signatures
2013-06-03 11:48 - 2013-06-03 11:48 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\Dropbox
2013-06-03 11:48 - 2010-05-09 14:08 - 00000284 ____A C:\Windows\Tasks\AppleSoftwareUpdate.job
2013-06-03 10:15 - 2009-10-31 06:36 - 00000918 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
2013-06-03 09:07 - 2013-06-03 09:07 - 00000784 ____A C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2013-06-03 09:07 - 2013-06-03 09:07 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-02 15:42 - 2009-04-21 21:43 - 00076576 ___AC C:\Documents and Settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-06-02 14:44 - 2010-12-30 13:31 - 00000000 ____D C:\Documents and Settings\pso\Desktop\2013 ALL DOCU old~new
2013-06-02 14:34 - 2010-07-29 23:48 - 00023552 ___AC C:\Documents and Settings\pso\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-02 14:34 - 2009-04-21 15:08 - 00000069 ___AC C:\Windows\NeroDigital.ini
2013-06-02 08:51 - 2009-04-22 15:27 - 00000000 ____D C:\Documents and Settings\tso\Tracing
2013-06-02 08:48 - 2009-04-22 00:56 - 00000000 ____D C:\Documents and Settings\Vivian\Tracing
2013-06-02 08:42 - 2009-04-21 14:07 - 00000000 ____D C:\Program Files\Messenger
2013-06-01 14:04 - 2013-06-01 14:04 - 00006144 __ASH C:\Documents and Settings\tso\My Documents\Thumbs.db
2013-05-31 11:26 - 2013-05-31 08:01 - 00124444 ____A C:\Documents and Settings\Vivian\Desktop\OTL.Txt
2013-05-31 08:07 - 2013-05-31 08:07 - 00134363 ____A C:\Documents and Settings\Vivian\Desktop\otl.extra.CLP
2013-05-31 07:50 - 2013-05-31 07:46 - 00602112 ____A (OldTimer Tools) C:\Documents and Settings\Vivian\Desktop\OTL.exe
2013-05-30 18:25 - 2010-09-28 19:14 - 00045056 _ASHC C:\Documents and Settings\pso\My Documents\Thumbs.db
2013-05-30 18:24 - 2013-05-30 18:22 - 00000482 ____A C:\Documents and Settings\pso\My Documents\churchchoir.csv
2013-05-30 18:24 - 2013-05-30 18:20 - 00017920 ____A C:\Documents and Settings\pso\My Documents\churchchoir.xls
2013-05-30 07:05 - 2013-05-30 07:05 - 00000590 ____A C:\Documents and Settings\Vivian\Desktop\SystemLook.txt
2013-05-30 07:04 - 2013-05-30 07:03 - 00139264 ____A C:\Documents and Settings\Vivian\Desktop\SystemLook.exe
2013-05-30 06:48 - 2011-03-14 21:50 - 00000000 ___RD C:\Program Files\Skype
2013-05-30 06:48 - 2009-04-23 20:58 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Skype
2013-05-30 06:48 - 2009-04-23 20:57 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Skype
2013-05-30 06:44 - 2009-08-31 16:21 - 00000062 __ASH C:\Documents and Settings\Guest\Local Settings\desktop.ini
2013-05-28 18:32 - 2013-05-28 18:32 - 00021965 ____A C:\Documents and Settings\Guest\Desktop\bookmarks.html
2013-05-28 12:12 - 2009-08-09 09:35 - 00000178 _ASHC C:\Documents and Settings\Karen\ntuser.ini
2013-05-28 12:11 - 2009-08-09 09:35 - 00000062 _ASHC C:\Documents and Settings\Karen\Local Settings\desktop.ini
2013-05-28 12:11 - 2009-08-09 09:23 - 00000278 __ASH C:\Documents and Settings\Chung-Yan\ntuser.ini
2013-05-28 12:10 - 2009-08-09 09:23 - 00000062 __ASH C:\Documents and Settings\Chung-Yan\Local Settings\desktop.ini
2013-05-28 12:01 - 2009-04-22 00:37 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Mozilla
2013-05-28 12:00 - 2013-05-28 12:00 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-05-28 12:00 - 2013-05-26 16:00 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-05-28 11:59 - 2013-05-28 08:53 - 21289608 ____A (Mozilla) C:\Documents and Settings\Vivian\Desktop\Firefox Setup 21.0.exe
2013-05-28 08:55 - 2013-02-25 18:04 - 00281035 ____A C:\Windows\setupapi.log
2013-05-28 08:05 - 2013-05-28 08:05 - 00007738 ____A C:\Documents and Settings\Karen\Desktop\bookmarks.html
2013-05-28 08:04 - 2013-05-28 08:04 - 00007640 ____A C:\Documents and Settings\Chung-Yan\Desktop\bookmarks.html
2013-05-28 08:04 - 2009-08-10 11:20 - 00076576 ___AC C:\Documents and Settings\Karen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-05-28 08:03 - 2013-05-28 08:03 - 00028032 ____A C:\Documents and Settings\tso\Desktop\bookmarks.html
2013-05-28 08:03 - 2009-08-10 14:38 - 00076576 ___AC C:\Documents and Settings\Chung-Yan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-05-28 08:01 - 2013-05-28 08:01 - 00053856 ____A C:\Documents and Settings\pso\Desktop\bookmarks.html
2013-05-28 08:00 - 2013-05-28 08:00 - 00266888 ____A C:\Documents and Settings\Vivian\Desktop\bookmarks.html
2013-05-27 14:59 - 2013-05-27 12:43 - 02031992 ____A (Microsoft Corporation) C:\Documents and Settings\Vivian\Desktop\MGADiag.exe
2013-05-27 14:59 - 2004-08-04 05:00 - 00013646 ____A C:\Windows\System32\wpa.dbl
2013-05-27 14:45 - 2013-05-27 14:40 - 00100743 ____A C:\Documents and Settings\Vivian\Desktop\MGDiag.CLP
2013-05-27 14:17 - 2013-05-27 14:17 - 00001018 ____A C:\Documents and Settings\tso\Desktop\Shortcut to driverlicence.lnk
2013-05-26 17:41 - 2013-05-26 17:40 - 00017392 ____A C:\AdwCleaner[S1].txt
2013-05-26 06:47 - 2013-05-26 06:47 - 00000000 __SHD C:\Documents and Settings\tso\IECompatCache
2013-05-26 06:28 - 2013-05-26 06:28 - 00004577 ____A C:\Documents and Settings\Vivian\Desktop\eset.txt
2013-05-26 05:53 - 2012-04-30 07:57 - 00000968 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
2013-05-25 19:13 - 2013-05-25 19:13 - 00000000 ____D C:\Program Files\ESET
2013-05-25 18:47 - 2013-05-25 18:47 - 00000000 ____D C:\_OTL
2013-05-25 18:37 - 2013-04-24 17:11 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\INISet
2013-05-25 18:37 - 2010-07-29 05:30 - 00000000 ____D C:\Documents and Settings\Vivian\update
2013-05-25 18:23 - 2013-04-24 21:45 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\INISet
2013-05-25 17:15 - 2013-05-25 17:15 - 00069658 ____A C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
2013-05-25 17:15 - 2013-05-25 17:15 - 00000000 ____D C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly_files
2013-05-25 16:54 - 2013-04-24 21:55 - 00000000 ____D C:\Documents and Settings\tso\Local Settings\Application Data\INISet
2013-05-25 15:45 - 2013-05-25 15:45 - 00011731 ____A C:\Documents and Settings\Vivian\Desktop\JRT.txt
2013-05-25 15:28 - 2013-05-25 15:28 - 00000000 ____D C:\Windows\ERUNT
2013-05-25 15:28 - 2013-05-25 15:27 - 00000000 ____D C:\JRT
2013-05-25 15:21 - 2013-05-24 15:11 - 00000000 ____D C:\FRST
2013-05-25 15:05 - 2013-03-12 13:11 - 00000000 ____D C:\Program Files\AVG SafeGuard toolbar
2013-05-24 21:36 - 2013-04-24 18:26 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\INISet
2013-05-23 21:08 - 2013-05-23 21:08 - 00000000 ____D C:\Documents and Settings\pso\Application Data\Motive
2013-05-23 21:02 - 2013-05-23 21:02 - 00000000 ____D C:\Documents and Settings\pso\Application Data\AVG SafeGuard toolbar
2013-05-23 16:32 - 2013-05-23 16:32 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\PriceGong
2013-05-23 16:32 - 2012-09-23 22:48 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\uTorrentControl_v2
2013-05-23 16:32 - 2010-07-12 19:38 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\Google
2013-05-23 16:29 - 2013-05-15 12:16 - 00016442 ____A C:\Windows\KB2847204-IE8.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00232506 ____A C:\Windows\iis6.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00216397 ____A C:\Windows\FaxSetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00103460 ____A C:\Windows\ocgen.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00098699 ____A C:\Windows\tsoc.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00072333 ____A C:\Windows\comsetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00043670 ____A C:\Windows\ntdtcsetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00037905 ____A C:\Windows\netfxocm.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00014875 ____A C:\Windows\MedCtrOC.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00011881 ____A C:\Windows\ocmsn.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00010846 ____A C:\Windows\tabletoc.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00010815 ____A C:\Windows\msgsocm.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00001374 ____A C:\Windows\imsins.log
2013-05-23 16:28 - 2013-05-23 16:28 - 00012994 ____A C:\Windows\KB2510531-IE8.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00066126 ____A C:\Windows\msmqinst.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00049496 ____A C:\Windows\updspapi.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00001374 ____A C:\Windows\imsins.BAK
2013-05-23 16:26 - 2013-05-23 16:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Motive
2013-05-23 16:18 - 2013-05-23 16:13 - 00000000 ____D C:\Program Files\Common Files\Motive
2013-05-23 16:14 - 2013-05-23 16:14 - 00001820 ____A C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
2013-05-23 16:14 - 2013-05-23 16:13 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Motive
2013-05-23 16:14 - 2012-08-19 13:01 - 00000000 ____D C:\Program Files\TELUS
2013-05-23 16:01 - 2013-05-23 15:57 - 00007281 ____A C:\Windows\spupdsvc.log
2013-05-23 16:00 - 2009-04-21 06:50 - 00000000 ____D C:\Windows\Help
2013-05-23 15:59 - 2013-05-23 15:59 - 00037114 ____A C:\Windows\KB2744842-IE8.log
2013-05-23 15:59 - 2013-05-23 15:58 - 00036950 ____A C:\Windows\KB2618444-IE8.log
2013-05-23 15:59 - 2013-05-23 15:45 - 00140674 ____A C:\Windows\ie8_main.log
2013-05-23 15:59 - 2013-05-15 21:48 - 00121115 ____A C:\Windows\KB2829530-IE8.log
2013-05-23 15:59 - 2009-04-21 14:28 - 00000000 ___HD C:\Windows\$hf_mig$
2013-05-23 15:58 - 2013-05-23 15:58 - 00030243 ____A C:\Windows\KB2598845-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00029602 ____A C:\Windows\KB2467659.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00000000 __HDC C:\Windows\$NtUninstallKB2467659$
2013-05-23 15:58 - 2013-05-23 15:57 - 00037767 ____A C:\Windows\KB982381-IE8.log
2013-05-23 15:57 - 2013-05-23 15:56 - 00039585 ____A C:\Windows\ie8.log
2013-05-23 15:57 - 2013-05-23 15:56 - 00000000 __HDC C:\Windows\ie8
2013-05-23 15:57 - 2009-04-21 06:50 - 00000000 ____D C:\Windows\Media
2013-05-23 15:50 - 2013-05-23 15:50 - 00003774 ____A C:\Windows\KB951978.log
2013-05-23 15:46 - 2013-05-23 15:45 - 00035668 ____A C:\Windows\ie8Uninst.log
2013-05-23 15:46 - 2009-06-11 23:45 - 00000000 ____D C:\Windows\ie8updates
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\TELUS
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\Radialpoint
2013-05-23 14:16 - 2013-05-23 14:16 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\AVG SafeGuard toolbar
2013-05-22 22:05 - 2013-04-24 16:56 - 00000000 ____D C:\FunshionMedia
2013-05-21 18:32 - 2013-05-21 18:32 - 00000000 ____D C:\Documents and Settings\tso\Application Data\AVG SafeGuard toolbar
2013-05-21 10:25 - 2013-05-21 10:25 - 00000000 ____D C:\Windows\System32\cache
2013-05-21 10:25 - 2013-03-12 13:11 - 00037664 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx86.sys
2013-05-19 09:49 - 2009-10-13 00:07 - 00000000 ____D C:\Windows\Microsoft.NET
2013-05-18 17:44 - 2009-04-21 06:57 - 00577100 ___AC C:\Windows\System32\PerfStringBackup.INI
2013-05-16 13:07 - 2013-05-16 13:07 - 00000000 ____D C:\dbfecd5f7d2e63eac17b4786
2013-05-15 12:21 - 2009-04-21 06:55 - 02176880 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 12:17 - 2013-05-15 12:16 - 00000000 ____D C:\78415340c7ea0ba5fa
2013-05-15 12:16 - 2013-05-15 12:16 - 00006960 ____A C:\Windows\KB2820197.log
2013-05-15 12:16 - 2013-05-15 12:16 - 00000000 __HDC C:\Windows\$NtUninstallKB2820197$
2013-05-15 12:12 - 2009-04-22 00:28 - 72607752 ___AC (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-15 12:11 - 2013-05-15 12:11 - 00000000 __HDC C:\Windows\$NtUninstallKB2829361$
2013-05-15 12:11 - 2013-05-15 11:08 - 00010405 ____A C:\Windows\KB2829361.log
2013-05-15 11:45 - 2012-07-07 00:29 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-05-15 11:45 - 2011-06-20 00:59 - 00071048 ___AC (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\StarApp
2013-05-14 18:00 - 2013-05-14 18:01 - 00090112 ____A C:\Windows\Minidump\Mini051413-01.dmp
2013-05-14 15:30 - 2011-01-14 15:18 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\HP
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Visan
2013-05-14 15:16 - 2013-05-14 14:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Visan
2013-05-14 15:16 - 2013-05-14 14:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP Photo Creations
2013-05-14 14:14 - 2013-05-14 14:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
2013-05-14 14:14 - 2013-05-14 14:13 - 00000000 ____D C:\Program Files\HP Photo Creations
2013-05-14 14:12 - 2013-05-14 14:12 - 00001993 ____A C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2013-05-14 14:12 - 00000925 ____A C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2010-06-21 10:52 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\HpUpdate
2013-05-14 14:12 - 2009-04-21 21:33 - 00000000 ____D C:\Program Files\HP
2013-05-14 14:11 - 2009-04-21 21:34 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP
2013-05-14 14:09 - 2013-05-14 14:09 - 00000057 ____A C:\Documents and Settings\All Users\Application Data\Ament.ini
2013-05-14 14:08 - 2009-05-22 00:03 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\HP
2013-05-14 13:37 - 2013-05-06 08:43 - 00000000 ____D C:\Documents and Settings\pso\Desktop\cari. cruise
2013-05-14 09:43 - 2011-07-23 17:53 - 00000000 ____D C:\Documents and Settings\pso\My Documents\pso's RECEIPT
2013-05-13 10:21 - 2013-05-13 10:21 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-05-13 10:13 - 2009-05-26 10:38 - 00000000 ____D C:\Documents and Settings\tso\Application Data\Skype
2013-05-12 17:03 - 2010-11-13 13:45 - 00000000 ____D C:\Documents and Settings\pso\Application Data\U3
2013-05-12 10:24 - 2011-02-08 14:37 - 00000000 ____D C:\Documents and Settings\All Users\Documents\Shared Docu
2013-05-12 10:15 - 2009-04-22 14:56 - 00000000 ____D C:\Documents and Settings\tso\Application Data\Mozilla

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

P?     -  &Text  - @ &OEM Text  Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 05-06-2013 01
Ran by Vivian (administrator) on 06-06-2013 09:28:34
Running from C:\Documents and Settings\Vivian\My Documents\Downloads
Microsoft Windows XP Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\McciCMService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(Radialpoint SafeCare Inc.) C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe
(Skype Technologies S.A.) C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Alcatel-Lucent) C:\Program Files\TELUS\McciTrayApp.exe
(SAMSUNG ELECTRONICS) C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Dropbox, Inc.) C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
(Farbar) C:\Documents and Settings\Vivian\My Documents\Downloads\FRST(1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TELUS_McciTrayApp] "C:\Program Files\TELUS\McciTrayApp.exe" [1561088 2012-06-11] (Alcatel-Lucent)
HKLM\...\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe [126976 2006-07-21] (SAMSUNG ELECTRONICS)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2010-11-29] (Apple Inc.)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [947152 2013-01-27] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [421160 2011-04-14] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
Winlogon\Notify\!SASWinLogon: C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [X]
Winlogon\Notify\WgaLogon: WgaLogon.dll ()
HKCU\...\Run: [HP Photosmart 7520 series (NET)] "C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN2AU294Q705XX:NW" -scfn "HP Photosmart 7520 series (NET)" -AutoStart 1 [1818472 2012-05-08] (Hewlett-Packard Co.)
HKCU\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2010-03-08] (Google Inc.)
HKCU\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [SmileboxTray] "C:\Documents and Settings\Vivian\Application Data\Smilebox\SmileboxTray.exe" [x]
HKCU\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [152872 2007-06-27] (Nero AG)
HKCU\...\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem [2215944 2010-10-18] (Sammsoft)
HKU\Administrator\...\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [x]
HKU\Chung-Yan\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Chung-Yan\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\Default User\...\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe" [x]
HKU\Guest\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Guest\...\Run: [msnmsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\Guest\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\Guest\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
HKU\Guest\...\Run: [Akuhaves] rundll32.exe "C:\WINDOWS\ojexiyayidad.dll",Startup [x]
HKU\Guest\...\Run: [Facebook Update] "C:\Documents and Settings\Guest\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [ 2012-07-11] (Facebook Inc.)
HKU\Karen\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Karen\...\Run: [msnmsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\Karen\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\philso\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\philso\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\philso\...\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\pso\...\Run: [HP Photosmart 7520 series (NET)] "C:\Program Files\HP\HP Photosmart 7520 series\bin\ScanToPCActivationApp.exe" -scfn "HP Photosmart 7520 series (NET)" -AutoStart 1 [ 2012-05-08] (Hewlett-Packard Co.)
HKU\tso\...\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [x]
HKU\tso\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\tso\...\Run: [Google Update] "C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c [ 2009-10-31] (Google Inc.)
HKU\tso\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\???痠Tudou.lnk
ShortcutTarget: ???痠Tudou.lnk -> C:\Documents and Settings\Vivian\My Documents\iTudou\iTudou.exe (No File)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\?????1.lnk
ShortcutTarget: ?????1.lnk -> C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\烽?鵗udou\TudouVa.exe (???)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\??iTudou.lnk
ShortcutTarget: ??iTudou.lnk -> C:\Documents and Settings\Vivian\My Documents\iTudou\iTudou.exe (No File)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\??????.lnk
ShortcutTarget: ??????.lnk -> C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\烽?鵗udou\TudouVa.exe (No File)
Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?rd=1&ucc=CA&dcc=CA&opt=0&ocid=iehp&tc=19
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll No File
BHO: TSToolbarBHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll No File
BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
BHO: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll No File
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll" No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
PDF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
PDF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll No File
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll No File
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll No File
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll No File
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [77824 2008-05-13] (SuperAdBlocker.com)
Winsock: Catalog5 04 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 75.153.176.9

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\0dr2gaab.default
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @baidu.com/npxbdsetup - C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @Motive.com/NpMotive,version=1.0 - C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF Plugin: @ncity3d.com/NCity3dPlayer - C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
FF Plugin: @radialpoint.com/SPA,version=1 - C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
FF Plugin: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 - C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultSearchURL: (AVG Secure Search) - http://mysearch.avg.com/search?cid={75845DC5-2FA8-4D2F-8139-DB74C5925FA1}&mid=2a886f6ebd5347d39e5fd16d67cda10b-46c6454c2414415d7d2d2b57f0e699c1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=dsp&q={searchTerms}
CHR DefaultSuggestURL: (AVG Secure Search) - http://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\27.0.1453.110\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.230.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Microsoft Office 2003) - C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (VGS player plugin for Firefox) - C:\Program Files\Mozilla Firefox\plugins\npvgsplayer.dll ()
CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npdrmv2.dll (Microsoft Corporation)
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program Files\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))
CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)
CHR Plugin: (RocketLife Secure Plug-In Layer) - C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
CHR Plugin: (Facebook Plugin) - C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll ( )
CHR Plugin: (NCity3D plugin for firefox) - C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
CHR Plugin: (Motive Plugin) - C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (TELUS security advisor) - C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (BaiduSetUp Plugin) - C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
CHR Plugin: (Shockwave Flash) - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (Windows Presentation Foundation) - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Skype Click to Call) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0
CHR Extension: (Radialpoint SPD Extension) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj\1.0_0
CHR Extension: (AVG SafeGuard toolbar) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0

========================== Services (Whitelisted) =================

R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
R2 ServicepointService; C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe [10294584 2012-03-09] (Radialpoint SafeCare Inc.)
R2 Skype C2C Service; C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3289208 2013-05-14] (Skype Technologies S.A.)
S3 ALG; %SystemRoot%\System32\alg.exe [x]
S2 Amsp; 
S2 vToolbarUpdater15.2.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe [x]

==================== Drivers (Whitelisted) ====================

R1 AmdK8; C:\Windows\System32\DRIVERS\AmdK8.sys [36864 2006-07-01] (Advanced Micro Devices)
R1 ASPI32; C:\Windows\System32\Drivers\ASPI32.sys [25244 1999-09-10] (Adaptec)
R1 avgtp; C:\WINDOWS\system32\drivers\avgtpx86.sys [37664 2013-05-21] (AVG Technologies)
S3 CCDECODE; C:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)
S3 DrvAgent32; C:\WINDOWS\system32\Drivers\DrvAgent32.sys [23456 2011-02-19] (Phoenix Technologies)
R1 FsVga; C:\Windows\System32\DRIVERS\fsvga.sys [12160 2004-08-04] (Microsoft Corporation)
R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [144384 2008-04-13] (Windows (R) Server 2003 DDK provider)
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2007-03-07] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2007-03-07] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2007-03-07] (HP)
R3 LgBttPort; C:\Windows\System32\DRIVERS\lgbtport.sys [12160 2009-09-29] (LG Electronics Inc.)
R3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbus.sys [10496 2009-09-29] (LG Electronics Inc.)
R3 LGVMODEM; C:\Windows\System32\DRIVERS\lgvmodem.sys [12928 2009-09-29] (LG Electronics Inc.)
R3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41888 2007-05-09] (Logitech Inc.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
S3 MREMP50; C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [21248 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [20096 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))
S3 NABTSFEC; C:\Windows\System32\DRIVERS\NABTSFEC.sys [85248 2008-04-14] (Microsoft Corporation)
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
R3 NVENETFD; C:\Windows\System32\DRIVERS\NVENETFD.sys [54016 2008-01-28] (NVIDIA Corporation)
R0 nvgts; C:\Windows\System32\DRIVERS\nvgts.sys [132096 2008-01-25] (NVIDIA Corporation)
R3 nvnetbus; C:\Windows\System32\DRIVERS\nvnetbus.sys [22016 2008-01-28] (NVIDIA Corporation)
R3 PID_PEPI; C:\Windows\System32\DRIVERS\LV302V32.SYS [1276832 2007-05-09] (Logitech Inc.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12872 2010-02-17] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67656 2010-05-10] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SLIP; C:\Windows\System32\DRIVERS\SLIP.sys [11136 2008-04-14] (Microsoft Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-04-21] (Duplex Secure Ltd.)
S3 streamip; C:\Windows\System32\DRIVERS\StreamIP.sys [15232 2008-04-14] (Microsoft Corporation)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2013-03-15] ()
S3 usbbus; C:\Windows\System32\DRIVERS\lgusbbus.sys [13056 2010-01-21] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgusbdiag.sys [20864 2010-01-21] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgusbmodem.sys [24960 2010-01-21] (LG Electronics Inc.)
S3 WSTCODEC; C:\Windows\System32\DRIVERS\WSTCODEC.SYS [19200 2008-04-14] (Microsoft Corporation)
S4 Abiosdsk; No ImagePath
S4 abp480n5; No ImagePath
S4 adpu160m; No ImagePath
S4 Aha154x; No ImagePath
S4 aic78u2; No ImagePath
S4 aic78xx; No ImagePath
S4 AliIde; No ImagePath
S4 amsint; No ImagePath
S4 asc; No ImagePath
S4 asc3350p; No ImagePath
S4 asc3550; No ImagePath
S4 Atdisk; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S4 cd20xrnt; No ImagePath
S1 Changer; No ImagePath
S4 CmdIde; No ImagePath
S4 Cpqarray; No ImagePath
U4 dac2w2k; No ImagePath
S4 dac960nt; No ImagePath
S4 dpti2o; No ImagePath
S3 GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS [x]
S4 hpn; No ImagePath
S1 i2omgmt; No ImagePath
S4 i2omp; No ImagePath
S4 ini910u; No ImagePath
S4 IntelIde; No ImagePath
S2 KAVSafe; \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys [x]
S1 KPProtector; \??\C:\Program Files\kuping4\KPProtector.sys [x]
S1 lbrtfdc; No ImagePath
S4 mraid35x; No ImagePath
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [x]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [x]
S1 PCIDump; No ImagePath
S3 PDCOMP; No ImagePath
S3 PDFRAME; No ImagePath
S3 PDRELI; No ImagePath
S3 PDRFRAME; No ImagePath
S3 pepifilter; system32\DRIVERS\lv302af.sys [x]
S4 perc2; No ImagePath
S4 perc2hib; No ImagePath
S3 PID_08A0; system32\DRIVERS\LV302AV.SYS [x]
S4 ql1080; No ImagePath
S4 Ql10wnt; No ImagePath
S4 ql12160; No ImagePath
S4 ql1240; No ImagePath
S4 ql1280; No ImagePath
S4 Simbad; No ImagePath
S4 Sparrow; No ImagePath
S4 symc810; No ImagePath
S4 symc8xx; No ImagePath
S4 sym_hi; No ImagePath
S4 sym_u3; No ImagePath
S4 TosIde; No ImagePath
S4 ultra; No ImagePath
S4 ViaIde; No ImagePath
S3 WDICA; No ImagePath

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-06-03 11:48 - 2013-06-03 11:48 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\Dropbox
2013-06-03 09:07 - 2013-06-03 09:07 - 00000784 ____A C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2013-06-03 09:07 - 2013-06-03 09:07 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-03 09:07 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-06-01 14:04 - 2013-06-01 14:04 - 00006144 __ASH C:\Documents and Settings\tso\My Documents\Thumbs.db
2013-05-31 08:07 - 2013-05-31 08:07 - 00134363 ____A C:\Documents and Settings\Vivian\Desktop\otl.extra.CLP
2013-05-31 08:01 - 2013-05-31 11:26 - 00124444 ____A C:\Documents and Settings\Vivian\Desktop\OTL.Txt
2013-05-31 07:46 - 2013-05-31 07:50 - 00602112 ____A (OldTimer Tools) C:\Documents and Settings\Vivian\Desktop\OTL.exe
2013-05-30 18:22 - 2013-05-30 18:24 - 00000482 ____A C:\Documents and Settings\pso\My Documents\churchchoir.csv
2013-05-30 18:20 - 2013-05-30 18:24 - 00017920 ____A C:\Documents and Settings\pso\My Documents\churchchoir.xls
2013-05-30 07:05 - 2013-05-30 07:05 - 00000590 ____A C:\Documents and Settings\Vivian\Desktop\SystemLook.txt
2013-05-30 07:03 - 2013-05-30 07:04 - 00139264 ____A C:\Documents and Settings\Vivian\Desktop\SystemLook.exe
2013-05-28 18:32 - 2013-05-28 18:32 - 00021965 ____A C:\Documents and Settings\Guest\Desktop\bookmarks.html
2013-05-28 12:00 - 2013-05-28 12:00 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-05-28 08:53 - 2013-05-28 11:59 - 21289608 ____A (Mozilla) C:\Documents and Settings\Vivian\Desktop\Firefox Setup 21.0.exe
2013-05-28 08:05 - 2013-05-28 08:05 - 00007738 ____A C:\Documents and Settings\Karen\Desktop\bookmarks.html
2013-05-28 08:04 - 2013-05-28 08:04 - 00007640 ____A C:\Documents and Settings\Chung-Yan\Desktop\bookmarks.html
2013-05-28 08:03 - 2013-05-28 08:03 - 00028032 ____A C:\Documents and Settings\tso\Desktop\bookmarks.html
2013-05-28 08:01 - 2013-05-28 08:01 - 00053856 ____A C:\Documents and Settings\pso\Desktop\bookmarks.html
2013-05-28 08:00 - 2013-05-28 08:00 - 00266888 ____A C:\Documents and Settings\Vivian\Desktop\bookmarks.html
2013-05-27 14:40 - 2013-05-27 14:45 - 00100743 ____A C:\Documents and Settings\Vivian\Desktop\MGDiag.CLP
2013-05-27 14:17 - 2013-05-27 14:17 - 00001018 ____A C:\Documents and Settings\tso\Desktop\Shortcut to driverlicence.lnk
2013-05-27 12:43 - 2013-05-27 14:59 - 02031992 ____A (Microsoft Corporation) C:\Documents and Settings\Vivian\Desktop\MGADiag.exe
2013-05-26 17:40 - 2013-05-26 17:41 - 00017392 ____A C:\AdwCleaner[S1].txt
2013-05-26 16:00 - 2013-05-28 12:00 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-05-26 06:47 - 2013-05-26 06:47 - 00000000 __SHD C:\Documents and Settings\tso\IECompatCache
2013-05-26 06:28 - 2013-05-26 06:28 - 00004577 ____A C:\Documents and Settings\Vivian\Desktop\eset.txt
2013-05-25 19:13 - 2013-05-25 19:13 - 00000000 ____D C:\Program Files\ESET
2013-05-25 18:47 - 2013-05-25 18:47 - 00000000 ____D C:\_OTL
2013-05-25 17:15 - 2013-05-25 17:15 - 00069658 ____A C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
2013-05-25 17:15 - 2013-05-25 17:15 - 00000000 ____D C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly_files
2013-05-25 15:45 - 2013-05-25 15:45 - 00011731 ____A C:\Documents and Settings\Vivian\Desktop\JRT.txt
2013-05-25 15:28 - 2013-05-25 15:28 - 00000000 ____D C:\Windows\ERUNT
2013-05-25 15:27 - 2013-05-25 15:28 - 00000000 ____D C:\JRT
2013-05-24 15:11 - 2013-05-25 15:21 - 00000000 ____D C:\FRST
2013-05-23 21:08 - 2013-05-23 21:08 - 00000000 ____D C:\Documents and Settings\pso\Application Data\Motive
2013-05-23 21:02 - 2013-05-23 21:02 - 00000000 ____D C:\Documents and Settings\pso\Application Data\AVG SafeGuard toolbar
2013-05-23 16:32 - 2013-05-23 16:32 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\PriceGong
2013-05-23 16:28 - 2013-05-23 16:28 - 00012994 ____A C:\Windows\KB2510531-IE8.log
2013-05-23 16:14 - 2013-05-23 16:14 - 00001820 ____A C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
2013-05-23 16:13 - 2013-05-23 16:26 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Motive
2013-05-23 16:13 - 2013-05-23 16:18 - 00000000 ____D C:\Program Files\Common Files\Motive
2013-05-23 16:13 - 2013-05-23 16:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Motive
2013-05-23 15:59 - 2013-05-23 15:59 - 00037114 ____A C:\Windows\KB2744842-IE8.log
2013-05-23 15:58 - 2013-05-23 15:59 - 00036950 ____A C:\Windows\KB2618444-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00030243 ____A C:\Windows\KB2598845-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00029602 ____A C:\Windows\KB2467659.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00000000 __HDC C:\Windows\$NtUninstallKB2467659$
2013-05-23 15:57 - 2013-05-23 16:01 - 00007281 ____A C:\Windows\spupdsvc.log
2013-05-23 15:57 - 2013-05-23 15:58 - 00037767 ____A C:\Windows\KB982381-IE8.log
2013-05-23 15:56 - 2013-05-23 15:57 - 00039585 ____A C:\Windows\ie8.log
2013-05-23 15:56 - 2013-05-23 15:57 - 00000000 __HDC C:\Windows\ie8
2013-05-23 15:51 - 2011-08-16 03:45 - 00006144 ____C (Microsoft Corporation) C:\Windows\System32\dllcache\iecompat.dll
2013-05-23 15:50 - 2013-05-23 15:50 - 00003774 ____A C:\Windows\KB951978.log
2013-05-23 15:45 - 2013-05-23 15:59 - 00140674 ____A C:\Windows\ie8_main.log
2013-05-23 15:45 - 2013-05-23 15:46 - 00035668 ____A C:\Windows\ie8Uninst.log
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\TELUS
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\Radialpoint
2013-05-23 14:16 - 2013-05-23 14:16 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\AVG SafeGuard toolbar
2013-05-21 18:32 - 2013-05-21 18:32 - 00000000 ____D C:\Documents and Settings\tso\Application Data\AVG SafeGuard toolbar
2013-05-21 10:25 - 2013-05-21 10:25 - 00000000 ____D C:\Windows\System32\cache
2013-05-16 13:07 - 2013-05-16 13:07 - 00000000 ____D C:\dbfecd5f7d2e63eac17b4786
2013-05-15 21:48 - 2013-05-23 15:59 - 00121115 ____A C:\Windows\KB2829530-IE8.log
2013-05-15 12:16 - 2013-05-23 16:29 - 00016442 ____A C:\Windows\KB2847204-IE8.log
2013-05-15 12:16 - 2013-05-15 12:17 - 00000000 ____D C:\78415340c7ea0ba5fa
2013-05-15 12:16 - 2013-05-15 12:16 - 00006960 ____A C:\Windows\KB2820197.log
2013-05-15 12:16 - 2013-05-15 12:16 - 00000000 __HDC C:\Windows\$NtUninstallKB2820197$
2013-05-15 12:11 - 2013-05-15 12:11 - 00000000 __HDC C:\Windows\$NtUninstallKB2829361$
2013-05-15 11:08 - 2013-05-15 12:11 - 00010405 ____A C:\Windows\KB2829361.log
2013-05-14 18:38 - 2013-06-06 09:02 - 00000630 ___AH C:\Windows\Tasks\schedule!1822287263.job
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\StarApp
2013-05-14 18:01 - 2013-05-14 18:00 - 00090112 ____A C:\Windows\Minidump\Mini051413-01.dmp
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Visan
2013-05-14 15:06 - 2013-06-06 09:25 - 00000492 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-05-14 14:58 - 2001-08-17 13:53 - 00006784 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\serscan.sys
2013-05-14 14:14 - 2013-05-14 14:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
2013-05-14 14:13 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Visan
2013-05-14 14:13 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP Photo Creations
2013-05-14 14:13 - 2013-05-14 14:14 - 00000000 ____D C:\Program Files\HP Photo Creations
2013-05-14 14:12 - 2013-05-14 14:12 - 00001993 ____A C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2013-05-14 14:12 - 00000925 ____A C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2012-05-08 17:23 - 02215784 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkinsBC11.exe
2013-05-14 14:12 - 2012-05-08 17:23 - 01961320 ____A (Hewlett-Packard Co.) C:\Windows\System32\HPScanTRDrv_PS7520.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00513384 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkstsBC11.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00495464 ____A (Hewlett-Packard) C:\Windows\System32\HPWia1_PS7520.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00267624 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkstsBC11LM.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00219496 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkcoiBC11.dll
2013-05-14 14:12 - 2012-05-08 14:03 - 00563048 ____N (Hewlett-Packard Co.) C:\Windows\System32\HPDiscoPMBC11.dll
2013-05-14 14:09 - 2013-05-14 14:09 - 00000057 ____A C:\Documents and Settings\All Users\Application Data\Ament.ini
2013-05-13 10:21 - 2013-05-13 10:21 - 00000000 ____D C:\Program Files\Common Files\Skype

==================== One Month Modified Files and Folders ========

2013-06-06 09:25 - 2013-05-14 15:06 - 00000492 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-06-06 09:15 - 2009-10-31 06:36 - 00000970 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
2013-06-06 09:11 - 2013-02-27 23:29 - 00000384 ___AH C:\Windows\Tasks\Microsoft Antimalware Scheduled Scan.job
2013-06-06 09:11 - 2010-03-08 15:18 - 00000880 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-06 09:09 - 2011-02-07 13:40 - 01441111 ____A C:\Windows\WindowsUpdate.log
2013-06-06 09:03 - 2012-06-15 00:46 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\Dropbox
2013-06-06 09:03 - 2012-06-15 00:36 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Dropbox
2013-06-06 09:02 - 2013-05-14 18:38 - 00000630 ___AH C:\Windows\Tasks\schedule!1822287263.job
2013-06-06 09:02 - 2013-04-24 16:57 - 00000306 ____A C:\Windows\Tasks\FSPlatform.job
2013-06-06 09:02 - 2010-03-08 15:18 - 00000876 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-06 09:01 - 2013-05-01 09:27 - 00000306 ____A C:\Windows\Tasks\FSPlatform1.job
2013-06-06 09:01 - 2012-08-22 18:02 - 00000157 ____A C:\Windows\wiadebug.log
2013-06-06 09:01 - 2012-08-22 18:02 - 00000048 ____A C:\Windows\wiaservc.log
2013-06-06 09:01 - 2009-04-21 14:12 - 00000062 __ASH C:\Documents and Settings\Vivian\Local Settings\desktop.ini
2013-06-06 09:01 - 2009-04-21 14:12 - 00000062 __ASH C:\Documents and Settings\LocalService\Local Settings\desktop.ini
2013-06-06 09:01 - 2009-04-21 14:12 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-06 09:01 - 2009-04-21 14:11 - 00000062 __ASH C:\Documents and Settings\NetworkService\Local Settings\desktop.ini
2013-06-05 22:07 - 2012-08-22 18:02 - 00032522 ____A C:\Windows\SchedLgU.Txt
2013-06-05 22:06 - 2009-04-21 14:12 - 00000278 __SHC C:\Documents and Settings\Vivian\ntuser.ini
2013-06-05 22:03 - 2012-08-19 13:01 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Radialpoint
2013-06-05 21:45 - 2012-07-07 00:29 - 00000536 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-05 20:53 - 2012-04-30 07:57 - 00000990 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
2013-06-05 20:09 - 2010-07-29 05:13 - 00000278 _ASHC C:\Documents and Settings\pso\ntuser.ini
2013-06-05 19:28 - 2010-07-29 05:13 - 00000062 __ASH C:\Documents and Settings\pso\Local Settings\desktop.ini
2013-06-05 14:19 - 2009-04-21 06:54 - 00000339 _RASH C:\boot.ini
2013-06-05 14:19 - 2004-08-04 05:00 - 00000608 ____A C:\Windows\win.ini
2013-06-05 14:19 - 2004-08-04 05:00 - 00000227 ____A C:\Windows\system.ini
2013-06-04 18:18 - 2009-04-22 14:54 - 00000278 __ASH C:\Documents and Settings\tso\ntuser.ini
2013-06-04 18:12 - 2009-04-22 14:54 - 00000062 __ASH C:\Documents and Settings\tso\Local Settings\desktop.ini
2013-06-04 18:10 - 2011-02-05 17:35 - 00000000 ____D C:\Windows\pss
2013-06-04 09:15 - 2010-07-29 10:07 - 00000000 ____D C:\Documents and Settings\tso\update
2013-06-03 19:57 - 2009-08-13 18:49 - 00000262 ____A C:\Windows\Tasks\Disk Cleanup.job
2013-06-03 19:29 - 2013-02-27 13:23 - 00000120 ____A C:\Windows\setupact.log
2013-06-03 12:01 - 2013-02-27 15:25 - 00000000 ____D C:\Windows\Temp634E60C6-3D12-8B95-0B47-EFDDDD40F884-Signatures
2013-06-03 11:48 - 2013-06-03 11:48 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\Dropbox
2013-06-03 11:48 - 2010-05-09 14:08 - 00000284 ____A C:\Windows\Tasks\AppleSoftwareUpdate.job
2013-06-03 10:15 - 2009-10-31 06:36 - 00000918 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
2013-06-03 09:07 - 2013-06-03 09:07 - 00000784 ____A C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2013-06-03 09:07 - 2013-06-03 09:07 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-02 15:42 - 2009-04-21 21:43 - 00076576 ___AC C:\Documents and Settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-06-02 14:44 - 2010-12-30 13:31 - 00000000 ____D C:\Documents and Settings\pso\Desktop\2013 ALL DOCU old~new
2013-06-02 14:34 - 2010-07-29 23:48 - 00023552 ___AC C:\Documents and Settings\pso\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-02 14:34 - 2009-04-21 15:08 - 00000069 ___AC C:\Windows\NeroDigital.ini
2013-06-02 08:51 - 2009-04-22 15:27 - 00000000 ____D C:\Documents and Settings\tso\Tracing
2013-06-02 08:48 - 2009-04-22 00:56 - 00000000 ____D C:\Documents and Settings\Vivian\Tracing
2013-06-02 08:42 - 2009-04-21 14:07 - 00000000 ____D C:\Program Files\Messenger
2013-06-01 14:04 - 2013-06-01 14:04 - 00006144 __ASH C:\Documents and Settings\tso\My Documents\Thumbs.db
2013-05-31 11:26 - 2013-05-31 08:01 - 00124444 ____A C:\Documents and Settings\Vivian\Desktop\OTL.Txt
2013-05-31 08:07 - 2013-05-31 08:07 - 00134363 ____A C:\Documents and Settings\Vivian\Desktop\otl.extra.CLP
2013-05-31 07:50 - 2013-05-31 07:46 - 00602112 ____A (OldTimer Tools) C:\Documents and Settings\Vivian\Desktop\OTL.exe
2013-05-30 18:25 - 2010-09-28 19:14 - 00045056 _ASHC C:\Documents and Settings\pso\My Documents\Thumbs.db
2013-05-30 18:24 - 2013-05-30 18:22 - 00000482 ____A C:\Documents and Settings\pso\My Documents\churchchoir.csv
2013-05-30 18:24 - 2013-05-30 18:20 - 00017920 ____A C:\Documents and Settings\pso\My Documents\churchchoir.xls
2013-05-30 07:05 - 2013-05-30 07:05 - 00000590 ____A C:\Documents and Settings\Vivian\Desktop\SystemLook.txt
2013-05-30 07:04 - 2013-05-30 07:03 - 00139264 ____A C:\Documents and Settings\Vivian\Desktop\SystemLook.exe
2013-05-30 06:48 - 2011-03-14 21:50 - 00000000 ___RD C:\Program Files\Skype
2013-05-30 06:48 - 2009-04-23 20:58 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Skype
2013-05-30 06:48 - 2009-04-23 20:57 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Skype
2013-05-30 06:44 - 2009-08-31 16:21 - 00000062 __ASH C:\Documents and Settings\Guest\Local Settings\desktop.ini
2013-05-28 18:32 - 2013-05-28 18:32 - 00021965 ____A C:\Documents and Settings\Guest\Desktop\bookmarks.html
2013-05-28 12:12 - 2009-08-09 09:35 - 00000178 _ASHC C:\Documents and Settings\Karen\ntuser.ini
2013-05-28 12:11 - 2009-08-09 09:35 - 00000062 _ASHC C:\Documents and Settings\Karen\Local Settings\desktop.ini
2013-05-28 12:11 - 2009-08-09 09:23 - 00000278 __ASH C:\Documents and Settings\Chung-Yan\ntuser.ini
2013-05-28 12:10 - 2009-08-09 09:23 - 00000062 __ASH C:\Documents and Settings\Chung-Yan\Local Settings\desktop.ini
2013-05-28 12:01 - 2009-04-22 00:37 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Mozilla
2013-05-28 12:00 - 2013-05-28 12:00 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-05-28 12:00 - 2013-05-26 16:00 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-05-28 11:59 - 2013-05-28 08:53 - 21289608 ____A (Mozilla) C:\Documents and Settings\Vivian\Desktop\Firefox Setup 21.0.exe
2013-05-28 08:55 - 2013-02-25 18:04 - 00281035 ____A C:\Windows\setupapi.log
2013-05-28 08:05 - 2013-05-28 08:05 - 00007738 ____A C:\Documents and Settings\Karen\Desktop\bookmarks.html
2013-05-28 08:04 - 2013-05-28 08:04 - 00007640 ____A C:\Documents and Settings\Chung-Yan\Desktop\bookmarks.html
2013-05-28 08:04 - 2009-08-10 11:20 - 00076576 ___AC C:\Documents and Settings\Karen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-05-28 08:03 - 2013-05-28 08:03 - 00028032 ____A C:\Documents and Settings\tso\Desktop\bookmarks.html
2013-05-28 08:03 - 2009-08-10 14:38 - 00076576 ___AC C:\Documents and Settings\Chung-Yan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-05-28 08:01 - 2013-05-28 08:01 - 00053856 ____A C:\Documents and Settings\pso\Desktop\bookmarks.html
2013-05-28 08:00 - 2013-05-28 08:00 - 00266888 ____A C:\Documents and Settings\Vivian\Desktop\bookmarks.html
2013-05-27 14:59 - 2013-05-27 12:43 - 02031992 ____A (Microsoft Corporation) C:\Documents and Settings\Vivian\Desktop\MGADiag.exe
2013-05-27 14:59 - 2004-08-04 05:00 - 00013646 ____A C:\Windows\System32\wpa.dbl
2013-05-27 14:45 - 2013-05-27 14:40 - 00100743 ____A C:\Documents and Settings\Vivian\Desktop\MGDiag.CLP
2013-05-27 14:17 - 2013-05-27 14:17 - 00001018 ____A C:\Documents and Settings\tso\Desktop\Shortcut to driverlicence.lnk
2013-05-26 17:41 - 2013-05-26 17:40 - 00017392 ____A C:\AdwCleaner[S1].txt
2013-05-26 06:47 - 2013-05-26 06:47 - 00000000 __SHD C:\Documents and Settings\tso\IECompatCache
2013-05-26 06:28 - 2013-05-26 06:28 - 00004577 ____A C:\Documents and Settings\Vivian\Desktop\eset.txt
2013-05-26 05:53 - 2012-04-30 07:57 - 00000968 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
2013-05-25 19:13 - 2013-05-25 19:13 - 00000000 ____D C:\Program Files\ESET
2013-05-25 18:47 - 2013-05-25 18:47 - 00000000 ____D C:\_OTL
2013-05-25 18:37 - 2013-04-24 17:11 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\INISet
2013-05-25 18:37 - 2010-07-29 05:30 - 00000000 ____D C:\Documents and Settings\Vivian\update
2013-05-25 18:23 - 2013-04-24 21:45 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\INISet
2013-05-25 17:15 - 2013-05-25 17:15 - 00069658 ____A C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
2013-05-25 17:15 - 2013-05-25 17:15 - 00000000 ____D C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly_files
2013-05-25 16:54 - 2013-04-24 21:55 - 00000000 ____D C:\Documents and Settings\tso\Local Settings\Application Data\INISet
2013-05-25 15:45 - 2013-05-25 15:45 - 00011731 ____A C:\Documents and Settings\Vivian\Desktop\JRT.txt
2013-05-25 15:28 - 2013-05-25 15:28 - 00000000 ____D C:\Windows\ERUNT
2013-05-25 15:28 - 2013-05-25 15:27 - 00000000 ____D C:\JRT
2013-05-25 15:21 - 2013-05-24 15:11 - 00000000 ____D C:\FRST
2013-05-25 15:05 - 2013-03-12 13:11 - 00000000 ____D C:\Program Files\AVG SafeGuard toolbar
2013-05-24 21:36 - 2013-04-24 18:26 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\INISet
2013-05-23 21:08 - 2013-05-23 21:08 - 00000000 ____D C:\Documents and Settings\pso\Application Data\Motive
2013-05-23 21:02 - 2013-05-23 21:02 - 00000000 ____D C:\Documents and Settings\pso\Application Data\AVG SafeGuard toolbar
2013-05-23 16:32 - 2013-05-23 16:32 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\PriceGong
2013-05-23 16:32 - 2012-09-23 22:48 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\uTorrentControl_v2
2013-05-23 16:32 - 2010-07-12 19:38 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\Google
2013-05-23 16:29 - 2013-05-15 12:16 - 00016442 ____A C:\Windows\KB2847204-IE8.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00232506 ____A C:\Windows\iis6.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00216397 ____A C:\Windows\FaxSetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00103460 ____A C:\Windows\ocgen.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00098699 ____A C:\Windows\tsoc.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00072333 ____A C:\Windows\comsetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00043670 ____A C:\Windows\ntdtcsetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00037905 ____A C:\Windows\netfxocm.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00014875 ____A C:\Windows\MedCtrOC.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00011881 ____A C:\Windows\ocmsn.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00010846 ____A C:\Windows\tabletoc.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00010815 ____A C:\Windows\msgsocm.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00001374 ____A C:\Windows\imsins.log
2013-05-23 16:28 - 2013-05-23 16:28 - 00012994 ____A C:\Windows\KB2510531-IE8.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00066126 ____A C:\Windows\msmqinst.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00049496 ____A C:\Windows\updspapi.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00001374 ____A C:\Windows\imsins.BAK
2013-05-23 16:26 - 2013-05-23 16:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Motive
2013-05-23 16:18 - 2013-05-23 16:13 - 00000000 ____D C:\Program Files\Common Files\Motive
2013-05-23 16:14 - 2013-05-23 16:14 - 00001820 ____A C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
2013-05-23 16:14 - 2013-05-23 16:13 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Motive
2013-05-23 16:14 - 2012-08-19 13:01 - 00000000 ____D C:\Program Files\TELUS
2013-05-23 16:01 - 2013-05-23 15:57 - 00007281 ____A C:\Windows\spupdsvc.log
2013-05-23 16:00 - 2009-04-21 06:50 - 00000000 ____D C:\Windows\Help
2013-05-23 15:59 - 2013-05-23 15:59 - 00037114 ____A C:\Windows\KB2744842-IE8.log
2013-05-23 15:59 - 2013-05-23 15:58 - 00036950 ____A C:\Windows\KB2618444-IE8.log
2013-05-23 15:59 - 2013-05-23 15:45 - 00140674 ____A C:\Windows\ie8_main.log
2013-05-23 15:59 - 2013-05-15 21:48 - 00121115 ____A C:\Windows\KB2829530-IE8.log
2013-05-23 15:59 - 2009-04-21 14:28 - 00000000 ___HD C:\Windows\$hf_mig$
2013-05-23 15:58 - 2013-05-23 15:58 - 00030243 ____A C:\Windows\KB2598845-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00029602 ____A C:\Windows\KB2467659.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00000000 __HDC C:\Windows\$NtUninstallKB2467659$
2013-05-23 15:58 - 2013-05-23 15:57 - 00037767 ____A C:\Windows\KB982381-IE8.log
2013-05-23 15:57 - 2013-05-23 15:56 - 00039585 ____A C:\Windows\ie8.log
2013-05-23 15:57 - 2013-05-23 15:56 - 00000000 __HDC C:\Windows\ie8
2013-05-23 15:57 - 2009-04-21 06:50 - 00000000 ____D C:\Windows\Media
2013-05-23 15:50 - 2013-05-23 15:50 - 00003774 ____A C:\Windows\KB951978.log
2013-05-23 15:46 - 2013-05-23 15:45 - 00035668 ____A C:\Windows\ie8Uninst.log
2013-05-23 15:46 - 2009-06-11 23:45 - 00000000 ____D C:\Windows\ie8updates
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\TELUS
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\Radialpoint
2013-05-23 14:16 - 2013-05-23 14:16 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\AVG SafeGuard toolbar
2013-05-22 22:05 - 2013-04-24 16:56 - 00000000 ____D C:\FunshionMedia
2013-05-21 18:32 - 2013-05-21 18:32 - 00000000 ____D C:\Documents and Settings\tso\Application Data\AVG SafeGuard toolbar
2013-05-21 10:25 - 2013-05-21 10:25 - 00000000 ____D C:\Windows\System32\cache
2013-05-21 10:25 - 2013-03-12 13:11 - 00037664 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx86.sys
2013-05-19 09:49 - 2009-10-13 00:07 - 00000000 ____D C:\Windows\Microsoft.NET
2013-05-18 17:44 - 2009-04-21 06:57 - 00577100 ___AC C:\Windows\System32\PerfStringBackup.INI
2013-05-16 13:07 - 2013-05-16 13:07 - 00000000 ____D C:\dbfecd5f7d2e63eac17b4786
2013-05-15 12:21 - 2009-04-21 06:55 - 02176880 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 12:17 - 2013-05-15 12:16 - 00000000 ____D C:\78415340c7ea0ba5fa
2013-05-15 12:16 - 2013-05-15 12:16 - 00006960 ____A C:\Windows\KB2820197.log
2013-05-15 12:16 - 2013-05-15 12:16 - 00000000 __HDC C:\Windows\$NtUninstallKB2820197$
2013-05-15 12:12 - 2009-04-22 00:28 - 72607752 ___AC (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-15 12:11 - 2013-05-15 12:11 - 00000000 __HDC C:\Windows\$NtUninstallKB2829361$
2013-05-15 12:11 - 2013-05-15 11:08 - 00010405 ____A C:\Windows\KB2829361.log
2013-05-15 11:45 - 2012-07-07 00:29 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-05-15 11:45 - 2011-06-20 00:59 - 00071048 ___AC (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\StarApp
2013-05-14 18:00 - 2013-05-14 18:01 - 00090112 ____A C:\Windows\Minidump\Mini051413-01.dmp
2013-05-14 15:30 - 2011-01-14 15:18 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\HP
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Visan
2013-05-14 15:16 - 2013-05-14 14:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Visan
2013-05-14 15:16 - 2013-05-14 14:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP Photo Creations
2013-05-14 14:14 - 2013-05-14 14:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
2013-05-14 14:14 - 2013-05-14 14:13 - 00000000 ____D C:\Program Files\HP Photo Creations
2013-05-14 14:12 - 2013-05-14 14:12 - 00001993 ____A C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2013-05-14 14:12 - 00000925 ____A C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2010-06-21 10:52 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\HpUpdate
2013-05-14 14:12 - 2009-04-21 21:33 - 00000000 ____D C:\Program Files\HP
2013-05-14 14:11 - 2009-04-21 21:34 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP
2013-05-14 14:09 - 2013-05-14 14:09 - 00000057 ____A C:\Documents and Settings\All Users\Application Data\Ament.ini
2013-05-14 14:08 - 2009-05-22 00:03 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\HP
2013-05-14 13:37 - 2013-05-06 08:43 - 00000000 ____D C:\Documents and Settings\pso\Desktop\cari. cruise
2013-05-14 09:43 - 2011-07-23 17:53 - 00000000 ____D C:\Documents and Settings\pso\My Documents\pso's RECEIPT
2013-05-13 10:21 - 2013-05-13 10:21 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-05-13 10:13 - 2009-05-26 10:38 - 00000000 ____D C:\Documents and Settings\tso\Application Data\Skype
2013-05-12 17:03 - 2010-11-13 13:45 - 00000000 ____D C:\Documents and Settings\pso\Application Data\U3
2013-05-12 10:24 - 2011-02-08 14:37 - 00000000 ____D C:\Documents and Settings\All Users\Documents\Shared Docu
2013-05-12 10:15 - 2009-04-22 14:56 - 00000000 ____D C:\Documents and Settings\tso\Application Data\Mozilla

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================ Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 05-06-2013 01
Ran by Vivian (administrator) on 06-06-2013 09:28:34
Running from C:\Documents and Settings\Vivian\My Documents\Downloads
Microsoft Windows XP Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\McciCMService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(Radialpoint SafeCare Inc.) C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe
(Skype Technologies S.A.) C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Alcatel-Lucent) C:\Program Files\TELUS\McciTrayApp.exe
(SAMSUNG ELECTRONICS) C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Dropbox, Inc.) C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
(Farbar) C:\Documents and Settings\Vivian\My Documents\Downloads\FRST(1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TELUS_McciTrayApp] "C:\Program Files\TELUS\McciTrayApp.exe" [1561088 2012-06-11] (Alcatel-Lucent)
HKLM\...\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe [126976 2006-07-21] (SAMSUNG ELECTRONICS)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2010-11-29] (Apple Inc.)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [947152 2013-01-27] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [421160 2011-04-14] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
Winlogon\Notify\!SASWinLogon: C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [X]
Winlogon\Notify\WgaLogon: WgaLogon.dll ()
HKCU\...\Run: [HP Photosmart 7520 series (NET)] "C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN2AU294Q705XX:NW" -scfn "HP Photosmart 7520 series (NET)" -AutoStart 1 [1818472 2012-05-08] (Hewlett-Packard Co.)
HKCU\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2010-03-08] (Google Inc.)
HKCU\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [SmileboxTray] "C:\Documents and Settings\Vivian\Application Data\Smilebox\SmileboxTray.exe" [x]
HKCU\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [152872 2007-06-27] (Nero AG)
HKCU\...\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem [2215944 2010-10-18] (Sammsoft)
HKU\Administrator\...\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [x]
HKU\Chung-Yan\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Chung-Yan\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\Default User\...\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe" [x]
HKU\Guest\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Guest\...\Run: [msnmsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\Guest\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\Guest\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
HKU\Guest\...\Run: [Akuhaves] rundll32.exe "C:\WINDOWS\ojexiyayidad.dll",Startup [x]
HKU\Guest\...\Run: [Facebook Update] "C:\Documents and Settings\Guest\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [ 2012-07-11] (Facebook Inc.)
HKU\Karen\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\Karen\...\Run: [msnmsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\Karen\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\philso\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\philso\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [x]
HKU\philso\...\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [ 2010-04-16] (Microsoft Corporation)
HKU\pso\...\Run: [HP Photosmart 7520 series (NET)] "C:\Program Files\HP\HP Photosmart 7520 series\bin\ScanToPCActivationApp.exe" -scfn "HP Photosmart 7520 series (NET)" -AutoStart 1 [ 2012-05-08] (Hewlett-Packard Co.)
HKU\tso\...\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [x]
HKU\tso\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [ 2010-11-29] (Apple Inc.)
HKU\tso\...\Run: [Google Update] "C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c [ 2009-10-31] (Google Inc.)
HKU\tso\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\???膇Tudou.lnk
ShortcutTarget: ???膇Tudou.lnk -> C:\Documents and Settings\Vivian\My Documents\iTudou\iTudou.exe (No File)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\???您?棥?1.lnk
ShortcutTarget: ???您?棥?1.lnk -> C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\鷤?桾udou\TudouVa.exe (???)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\??iTudou.lnk
ShortcutTarget: ??iTudou.lnk -> C:\Documents and Settings\Vivian\My Documents\iTudou\iTudou.exe (No File)
Startup: C:\Documents and Settings\tso\Start Menu\Programs\Startup\??????.lnk
ShortcutTarget: ??????.lnk -> C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\鷤?桾udou\TudouVa.exe (No File)
Startup: C:\Documents and Settings\Vivian\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Documents and Settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?rd=1&ucc=CA&dcc=CA&opt=0&ocid=iehp&tc=19
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll No File
BHO: TSToolbarBHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll No File
BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
BHO: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll No File
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll" No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
PDF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
PDF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll No File
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll No File
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll No File
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll No File
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [77824 2008-05-13] (SuperAdBlocker.com)
Winsock: Catalog5 04 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 75.153.176.9

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Vivian\Application Data\Mozilla\Firefox\Profiles\0dr2gaab.default
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @baidu.com/npxbdsetup - C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @Motive.com/NpMotive,version=1.0 - C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF Plugin: @ncity3d.com/NCity3dPlayer - C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
FF Plugin: @radialpoint.com/SPA,version=1 - C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
FF Plugin: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 - C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultSearchURL: (AVG Secure Search) - http://mysearch.avg.com/search?cid={75845DC5-2FA8-4D2F-8139-DB74C5925FA1}&mid=2a886f6ebd5347d39e5fd16d67cda10b-46c6454c2414415d7d2d2b57f0e699c1bcd95e38&lang=en&ds=be011&pr=sa&d=2013-03-12 13:11:41&v=15.2.0.5&pid=safeguard&sg=2&sap=dsp&q={searchTerms}
CHR DefaultSuggestURL: (AVG Secure Search) - http://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\27.0.1453.110\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.230.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Microsoft Office 2003) - C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (VGS player plugin for Firefox) - C:\Program Files\Mozilla Firefox\plugins\npvgsplayer.dll ()
CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npdrmv2.dll (Microsoft Corporation)
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program Files\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))
CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)
CHR Plugin: (RocketLife Secure Plug-In Layer) - C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
CHR Plugin: (Facebook Plugin) - C:\Documents and Settings\Vivian\Application Data\Facebook\npfbplugin_1_0_3.dll ( )
CHR Plugin: (NCity3D plugin for firefox) - C:\Program Files\CRYSTALCGNew\NCITY3D\npncity3d.dll ( CRYSTALCG)
CHR Plugin: (Motive Plugin) - C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (TELUS security advisor) - C:\Program Files\TELUS\TELUS security advisor\nprpspa.dll (TELUS)
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (BaiduSetUp Plugin) - C:\WINDOWS\Downloaded Program Files\1825796\npxbdsetup.dll ()
CHR Plugin: (Shockwave Flash) - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (Windows Presentation Foundation) - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Skype Click to Call) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0
CHR Extension: (Radialpoint SPD Extension) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj\1.0_0
CHR Extension: (AVG SafeGuard toolbar) - C:\Documents and Settings\Vivian\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0

========================== Services (Whitelisted) =================

R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
R2 ServicepointService; C:\Program Files\TELUS\TELUS security advisor\ServicepointService.exe [10294584 2012-03-09] (Radialpoint SafeCare Inc.)
R2 Skype C2C Service; C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3289208 2013-05-14] (Skype Technologies S.A.)
S3 ALG; %SystemRoot%\System32\alg.exe [x]
S2 Amsp; 
S2 vToolbarUpdater15.2.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe [x]

==================== Drivers (Whitelisted) ====================

R1 AmdK8; C:\Windows\System32\DRIVERS\AmdK8.sys [36864 2006-07-01] (Advanced Micro Devices)
R1 ASPI32; C:\Windows\System32\Drivers\ASPI32.sys [25244 1999-09-10] (Adaptec)
R1 avgtp; C:\WINDOWS\system32\drivers\avgtpx86.sys [37664 2013-05-21] (AVG Technologies)
S3 CCDECODE; C:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)
S3 DrvAgent32; C:\WINDOWS\system32\Drivers\DrvAgent32.sys [23456 2011-02-19] (Phoenix Technologies)
R1 FsVga; C:\Windows\System32\DRIVERS\fsvga.sys [12160 2004-08-04] (Microsoft Corporation)
R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [144384 2008-04-13] (Windows (R) Server 2003 DDK provider)
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2007-03-07] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2007-03-07] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2007-03-07] (HP)
R3 LgBttPort; C:\Windows\System32\DRIVERS\lgbtport.sys [12160 2009-09-29] (LG Electronics Inc.)
R3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbus.sys [10496 2009-09-29] (LG Electronics Inc.)
R3 LGVMODEM; C:\Windows\System32\DRIVERS\lgvmodem.sys [12928 2009-09-29] (LG Electronics Inc.)
R3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41888 2007-05-09] (Logitech Inc.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
S3 MREMP50; C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [21248 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [20096 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))
S3 NABTSFEC; C:\Windows\System32\DRIVERS\NABTSFEC.sys [85248 2008-04-14] (Microsoft Corporation)
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
R3 NVENETFD; C:\Windows\System32\DRIVERS\NVENETFD.sys [54016 2008-01-28] (NVIDIA Corporation)
R0 nvgts; C:\Windows\System32\DRIVERS\nvgts.sys [132096 2008-01-25] (NVIDIA Corporation)
R3 nvnetbus; C:\Windows\System32\DRIVERS\nvnetbus.sys [22016 2008-01-28] (NVIDIA Corporation)
R3 PID_PEPI; C:\Windows\System32\DRIVERS\LV302V32.SYS [1276832 2007-05-09] (Logitech Inc.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12872 2010-02-17] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67656 2010-05-10] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SLIP; C:\Windows\System32\DRIVERS\SLIP.sys [11136 2008-04-14] (Microsoft Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-04-21] (Duplex Secure Ltd.)
S3 streamip; C:\Windows\System32\DRIVERS\StreamIP.sys [15232 2008-04-14] (Microsoft Corporation)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2013-03-15] ()
S3 usbbus; C:\Windows\System32\DRIVERS\lgusbbus.sys [13056 2010-01-21] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgusbdiag.sys [20864 2010-01-21] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgusbmodem.sys [24960 2010-01-21] (LG Electronics Inc.)
S3 WSTCODEC; C:\Windows\System32\DRIVERS\WSTCODEC.SYS [19200 2008-04-14] (Microsoft Corporation)
S4 Abiosdsk; No ImagePath
S4 abp480n5; No ImagePath
S4 adpu160m; No ImagePath
S4 Aha154x; No ImagePath
S4 aic78u2; No ImagePath
S4 aic78xx; No ImagePath
S4 AliIde; No ImagePath
S4 amsint; No ImagePath
S4 asc; No ImagePath
S4 asc3350p; No ImagePath
S4 asc3550; No ImagePath
S4 Atdisk; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S4 cd20xrnt; No ImagePath
S1 Changer; No ImagePath
S4 CmdIde; No ImagePath
S4 Cpqarray; No ImagePath
U4 dac2w2k; No ImagePath
S4 dac960nt; No ImagePath
S4 dpti2o; No ImagePath
S3 GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS [x]
S4 hpn; No ImagePath
S1 i2omgmt; No ImagePath
S4 i2omp; No ImagePath
S4 ini910u; No ImagePath
S4 IntelIde; No ImagePath
S2 KAVSafe; \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys [x]
S1 KPProtector; \??\C:\Program Files\kuping4\KPProtector.sys [x]
S1 lbrtfdc; No ImagePath
S4 mraid35x; No ImagePath
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [x]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [x]
S1 PCIDump; No ImagePath
S3 PDCOMP; No ImagePath
S3 PDFRAME; No ImagePath
S3 PDRELI; No ImagePath
S3 PDRFRAME; No ImagePath
S3 pepifilter; system32\DRIVERS\lv302af.sys [x]
S4 perc2; No ImagePath
S4 perc2hib; No ImagePath
S3 PID_08A0; system32\DRIVERS\LV302AV.SYS [x]
S4 ql1080; No ImagePath
S4 Ql10wnt; No ImagePath
S4 ql12160; No ImagePath
S4 ql1240; No ImagePath
S4 ql1280; No ImagePath
S4 Simbad; No ImagePath
S4 Sparrow; No ImagePath
S4 symc810; No ImagePath
S4 symc8xx; No ImagePath
S4 sym_hi; No ImagePath
S4 sym_u3; No ImagePath
S4 TosIde; No ImagePath
S4 ultra; No ImagePath
S4 ViaIde; No ImagePath
S3 WDICA; No ImagePath

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-06-03 11:48 - 2013-06-03 11:48 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\Dropbox
2013-06-03 09:07 - 2013-06-03 09:07 - 00000784 ____A C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2013-06-03 09:07 - 2013-06-03 09:07 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-03 09:07 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-06-01 14:04 - 2013-06-01 14:04 - 00006144 __ASH C:\Documents and Settings\tso\My Documents\Thumbs.db
2013-05-31 08:07 - 2013-05-31 08:07 - 00134363 ____A C:\Documents and Settings\Vivian\Desktop\otl.extra.CLP
2013-05-31 08:01 - 2013-05-31 11:26 - 00124444 ____A C:\Documents and Settings\Vivian\Desktop\OTL.Txt
2013-05-31 07:46 - 2013-05-31 07:50 - 00602112 ____A (OldTimer Tools) C:\Documents and Settings\Vivian\Desktop\OTL.exe
2013-05-30 18:22 - 2013-05-30 18:24 - 00000482 ____A C:\Documents and Settings\pso\My Documents\churchchoir.csv
2013-05-30 18:20 - 2013-05-30 18:24 - 00017920 ____A C:\Documents and Settings\pso\My Documents\churchchoir.xls
2013-05-30 07:05 - 2013-05-30 07:05 - 00000590 ____A C:\Documents and Settings\Vivian\Desktop\SystemLook.txt
2013-05-30 07:03 - 2013-05-30 07:04 - 00139264 ____A C:\Documents and Settings\Vivian\Desktop\SystemLook.exe
2013-05-28 18:32 - 2013-05-28 18:32 - 00021965 ____A C:\Documents and Settings\Guest\Desktop\bookmarks.html
2013-05-28 12:00 - 2013-05-28 12:00 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-05-28 08:53 - 2013-05-28 11:59 - 21289608 ____A (Mozilla) C:\Documents and Settings\Vivian\Desktop\Firefox Setup 21.0.exe
2013-05-28 08:05 - 2013-05-28 08:05 - 00007738 ____A C:\Documents and Settings\Karen\Desktop\bookmarks.html
2013-05-28 08:04 - 2013-05-28 08:04 - 00007640 ____A C:\Documents and Settings\Chung-Yan\Desktop\bookmarks.html
2013-05-28 08:03 - 2013-05-28 08:03 - 00028032 ____A C:\Documents and Settings\tso\Desktop\bookmarks.html
2013-05-28 08:01 - 2013-05-28 08:01 - 00053856 ____A C:\Documents and Settings\pso\Desktop\bookmarks.html
2013-05-28 08:00 - 2013-05-28 08:00 - 00266888 ____A C:\Documents and Settings\Vivian\Desktop\bookmarks.html
2013-05-27 14:40 - 2013-05-27 14:45 - 00100743 ____A C:\Documents and Settings\Vivian\Desktop\MGDiag.CLP
2013-05-27 14:17 - 2013-05-27 14:17 - 00001018 ____A C:\Documents and Settings\tso\Desktop\Shortcut to driverlicence.lnk
2013-05-27 12:43 - 2013-05-27 14:59 - 02031992 ____A (Microsoft Corporation) C:\Documents and Settings\Vivian\Desktop\MGADiag.exe
2013-05-26 17:40 - 2013-05-26 17:41 - 00017392 ____A C:\AdwCleaner[S1].txt
2013-05-26 16:00 - 2013-05-28 12:00 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-05-26 06:47 - 2013-05-26 06:47 - 00000000 __SHD C:\Documents and Settings\tso\IECompatCache
2013-05-26 06:28 - 2013-05-26 06:28 - 00004577 ____A C:\Documents and Settings\Vivian\Desktop\eset.txt
2013-05-25 19:13 - 2013-05-25 19:13 - 00000000 ____D C:\Program Files\ESET
2013-05-25 18:47 - 2013-05-25 18:47 - 00000000 ____D C:\_OTL
2013-05-25 17:15 - 2013-05-25 17:15 - 00069658 ____A C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
2013-05-25 17:15 - 2013-05-25 17:15 - 00000000 ____D C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly_files
2013-05-25 15:45 - 2013-05-25 15:45 - 00011731 ____A C:\Documents and Settings\Vivian\Desktop\JRT.txt
2013-05-25 15:28 - 2013-05-25 15:28 - 00000000 ____D C:\Windows\ERUNT
2013-05-25 15:27 - 2013-05-25 15:28 - 00000000 ____D C:\JRT
2013-05-24 15:11 - 2013-05-25 15:21 - 00000000 ____D C:\FRST
2013-05-23 21:08 - 2013-05-23 21:08 - 00000000 ____D C:\Documents and Settings\pso\Application Data\Motive
2013-05-23 21:02 - 2013-05-23 21:02 - 00000000 ____D C:\Documents and Settings\pso\Application Data\AVG SafeGuard toolbar
2013-05-23 16:32 - 2013-05-23 16:32 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\PriceGong
2013-05-23 16:28 - 2013-05-23 16:28 - 00012994 ____A C:\Windows\KB2510531-IE8.log
2013-05-23 16:14 - 2013-05-23 16:14 - 00001820 ____A C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
2013-05-23 16:13 - 2013-05-23 16:26 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Motive
2013-05-23 16:13 - 2013-05-23 16:18 - 00000000 ____D C:\Program Files\Common Files\Motive
2013-05-23 16:13 - 2013-05-23 16:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Motive
2013-05-23 15:59 - 2013-05-23 15:59 - 00037114 ____A C:\Windows\KB2744842-IE8.log
2013-05-23 15:58 - 2013-05-23 15:59 - 00036950 ____A C:\Windows\KB2618444-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00030243 ____A C:\Windows\KB2598845-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00029602 ____A C:\Windows\KB2467659.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00000000 __HDC C:\Windows\$NtUninstallKB2467659$
2013-05-23 15:57 - 2013-05-23 16:01 - 00007281 ____A C:\Windows\spupdsvc.log
2013-05-23 15:57 - 2013-05-23 15:58 - 00037767 ____A C:\Windows\KB982381-IE8.log
2013-05-23 15:56 - 2013-05-23 15:57 - 00039585 ____A C:\Windows\ie8.log
2013-05-23 15:56 - 2013-05-23 15:57 - 00000000 __HDC C:\Windows\ie8
2013-05-23 15:51 - 2011-08-16 03:45 - 00006144 ____C (Microsoft Corporation) C:\Windows\System32\dllcache\iecompat.dll
2013-05-23 15:50 - 2013-05-23 15:50 - 00003774 ____A C:\Windows\KB951978.log
2013-05-23 15:45 - 2013-05-23 15:59 - 00140674 ____A C:\Windows\ie8_main.log
2013-05-23 15:45 - 2013-05-23 15:46 - 00035668 ____A C:\Windows\ie8Uninst.log
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\TELUS
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\Radialpoint
2013-05-23 14:16 - 2013-05-23 14:16 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\AVG SafeGuard toolbar
2013-05-21 18:32 - 2013-05-21 18:32 - 00000000 ____D C:\Documents and Settings\tso\Application Data\AVG SafeGuard toolbar
2013-05-21 10:25 - 2013-05-21 10:25 - 00000000 ____D C:\Windows\System32\cache
2013-05-16 13:07 - 2013-05-16 13:07 - 00000000 ____D C:\dbfecd5f7d2e63eac17b4786
2013-05-15 21:48 - 2013-05-23 15:59 - 00121115 ____A C:\Windows\KB2829530-IE8.log
2013-05-15 12:16 - 2013-05-23 16:29 - 00016442 ____A C:\Windows\KB2847204-IE8.log
2013-05-15 12:16 - 2013-05-15 12:17 - 00000000 ____D C:\78415340c7ea0ba5fa
2013-05-15 12:16 - 2013-05-15 12:16 - 00006960 ____A C:\Windows\KB2820197.log
2013-05-15 12:16 - 2013-05-15 12:16 - 00000000 __HDC C:\Windows\$NtUninstallKB2820197$
2013-05-15 12:11 - 2013-05-15 12:11 - 00000000 __HDC C:\Windows\$NtUninstallKB2829361$
2013-05-15 11:08 - 2013-05-15 12:11 - 00010405 ____A C:\Windows\KB2829361.log
2013-05-14 18:38 - 2013-06-06 09:02 - 00000630 ___AH C:\Windows\Tasks\schedule!1822287263.job
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\StarApp
2013-05-14 18:01 - 2013-05-14 18:00 - 00090112 ____A C:\Windows\Minidump\Mini051413-01.dmp
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Visan
2013-05-14 15:06 - 2013-06-06 09:25 - 00000492 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-05-14 14:58 - 2001-08-17 13:53 - 00006784 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\serscan.sys
2013-05-14 14:14 - 2013-05-14 14:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
2013-05-14 14:13 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Visan
2013-05-14 14:13 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP Photo Creations
2013-05-14 14:13 - 2013-05-14 14:14 - 00000000 ____D C:\Program Files\HP Photo Creations
2013-05-14 14:12 - 2013-05-14 14:12 - 00001993 ____A C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2013-05-14 14:12 - 00000925 ____A C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2012-05-08 17:23 - 02215784 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkinsBC11.exe
2013-05-14 14:12 - 2012-05-08 17:23 - 01961320 ____A (Hewlett-Packard Co.) C:\Windows\System32\HPScanTRDrv_PS7520.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00513384 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkstsBC11.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00495464 ____A (Hewlett-Packard) C:\Windows\System32\HPWia1_PS7520.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00267624 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkstsBC11LM.dll
2013-05-14 14:12 - 2012-05-08 17:23 - 00219496 ____A (Hewlett-Packard Co.) C:\Windows\System32\hpinkcoiBC11.dll
2013-05-14 14:12 - 2012-05-08 14:03 - 00563048 ____N (Hewlett-Packard Co.) C:\Windows\System32\HPDiscoPMBC11.dll
2013-05-14 14:09 - 2013-05-14 14:09 - 00000057 ____A C:\Documents and Settings\All Users\Application Data\Ament.ini
2013-05-13 10:21 - 2013-05-13 10:21 - 00000000 ____D C:\Program Files\Common Files\Skype

==================== One Month Modified Files and Folders ========

2013-06-06 09:25 - 2013-05-14 15:06 - 00000492 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-06-06 09:15 - 2009-10-31 06:36 - 00000970 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
2013-06-06 09:11 - 2013-02-27 23:29 - 00000384 ___AH C:\Windows\Tasks\Microsoft Antimalware Scheduled Scan.job
2013-06-06 09:11 - 2010-03-08 15:18 - 00000880 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-06 09:09 - 2011-02-07 13:40 - 01441111 ____A C:\Windows\WindowsUpdate.log
2013-06-06 09:03 - 2012-06-15 00:46 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\Dropbox
2013-06-06 09:03 - 2012-06-15 00:36 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Dropbox
2013-06-06 09:02 - 2013-05-14 18:38 - 00000630 ___AH C:\Windows\Tasks\schedule!1822287263.job
2013-06-06 09:02 - 2013-04-24 16:57 - 00000306 ____A C:\Windows\Tasks\FSPlatform.job
2013-06-06 09:02 - 2010-03-08 15:18 - 00000876 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-06 09:01 - 2013-05-01 09:27 - 00000306 ____A C:\Windows\Tasks\FSPlatform1.job
2013-06-06 09:01 - 2012-08-22 18:02 - 00000157 ____A C:\Windows\wiadebug.log
2013-06-06 09:01 - 2012-08-22 18:02 - 00000048 ____A C:\Windows\wiaservc.log
2013-06-06 09:01 - 2009-04-21 14:12 - 00000062 __ASH C:\Documents and Settings\Vivian\Local Settings\desktop.ini
2013-06-06 09:01 - 2009-04-21 14:12 - 00000062 __ASH C:\Documents and Settings\LocalService\Local Settings\desktop.ini
2013-06-06 09:01 - 2009-04-21 14:12 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-06 09:01 - 2009-04-21 14:11 - 00000062 __ASH C:\Documents and Settings\NetworkService\Local Settings\desktop.ini
2013-06-05 22:07 - 2012-08-22 18:02 - 00032522 ____A C:\Windows\SchedLgU.Txt
2013-06-05 22:06 - 2009-04-21 14:12 - 00000278 __SHC C:\Documents and Settings\Vivian\ntuser.ini
2013-06-05 22:03 - 2012-08-19 13:01 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Radialpoint
2013-06-05 21:45 - 2012-07-07 00:29 - 00000536 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-05 20:53 - 2012-04-30 07:57 - 00000990 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
2013-06-05 20:09 - 2010-07-29 05:13 - 00000278 _ASHC C:\Documents and Settings\pso\ntuser.ini
2013-06-05 19:28 - 2010-07-29 05:13 - 00000062 __ASH C:\Documents and Settings\pso\Local Settings\desktop.ini
2013-06-05 14:19 - 2009-04-21 06:54 - 00000339 _RASH C:\boot.ini
2013-06-05 14:19 - 2004-08-04 05:00 - 00000608 ____A C:\Windows\win.ini
2013-06-05 14:19 - 2004-08-04 05:00 - 00000227 ____A C:\Windows\system.ini
2013-06-04 18:18 - 2009-04-22 14:54 - 00000278 __ASH C:\Documents and Settings\tso\ntuser.ini
2013-06-04 18:12 - 2009-04-22 14:54 - 00000062 __ASH C:\Documents and Settings\tso\Local Settings\desktop.ini
2013-06-04 18:10 - 2011-02-05 17:35 - 00000000 ____D C:\Windows\pss
2013-06-04 09:15 - 2010-07-29 10:07 - 00000000 ____D C:\Documents and Settings\tso\update
2013-06-03 19:57 - 2009-08-13 18:49 - 00000262 ____A C:\Windows\Tasks\Disk Cleanup.job
2013-06-03 19:29 - 2013-02-27 13:23 - 00000120 ____A C:\Windows\setupact.log
2013-06-03 12:01 - 2013-02-27 15:25 - 00000000 ____D C:\Windows\Temp634E60C6-3D12-8B95-0B47-EFDDDD40F884-Signatures
2013-06-03 11:48 - 2013-06-03 11:48 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\Dropbox
2013-06-03 11:48 - 2010-05-09 14:08 - 00000284 ____A C:\Windows\Tasks\AppleSoftwareUpdate.job
2013-06-03 10:15 - 2009-10-31 06:36 - 00000918 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
2013-06-03 09:07 - 2013-06-03 09:07 - 00000784 ____A C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2013-06-03 09:07 - 2013-06-03 09:07 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-02 15:42 - 2009-04-21 21:43 - 00076576 ___AC C:\Documents and Settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-06-02 14:44 - 2010-12-30 13:31 - 00000000 ____D C:\Documents and Settings\pso\Desktop\2013 ALL DOCU old~new
2013-06-02 14:34 - 2010-07-29 23:48 - 00023552 ___AC C:\Documents and Settings\pso\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-02 14:34 - 2009-04-21 15:08 - 00000069 ___AC C:\Windows\NeroDigital.ini
2013-06-02 08:51 - 2009-04-22 15:27 - 00000000 ____D C:\Documents and Settings\tso\Tracing
2013-06-02 08:48 - 2009-04-22 00:56 - 00000000 ____D C:\Documents and Settings\Vivian\Tracing
2013-06-02 08:42 - 2009-04-21 14:07 - 00000000 ____D C:\Program Files\Messenger
2013-06-01 14:04 - 2013-06-01 14:04 - 00006144 __ASH C:\Documents and Settings\tso\My Documents\Thumbs.db
2013-05-31 11:26 - 2013-05-31 08:01 - 00124444 ____A C:\Documents and Settings\Vivian\Desktop\OTL.Txt
2013-05-31 08:07 - 2013-05-31 08:07 - 00134363 ____A C:\Documents and Settings\Vivian\Desktop\otl.extra.CLP
2013-05-31 07:50 - 2013-05-31 07:46 - 00602112 ____A (OldTimer Tools) C:\Documents and Settings\Vivian\Desktop\OTL.exe
2013-05-30 18:25 - 2010-09-28 19:14 - 00045056 _ASHC C:\Documents and Settings\pso\My Documents\Thumbs.db
2013-05-30 18:24 - 2013-05-30 18:22 - 00000482 ____A C:\Documents and Settings\pso\My Documents\churchchoir.csv
2013-05-30 18:24 - 2013-05-30 18:20 - 00017920 ____A C:\Documents and Settings\pso\My Documents\churchchoir.xls
2013-05-30 07:05 - 2013-05-30 07:05 - 00000590 ____A C:\Documents and Settings\Vivian\Desktop\SystemLook.txt
2013-05-30 07:04 - 2013-05-30 07:03 - 00139264 ____A C:\Documents and Settings\Vivian\Desktop\SystemLook.exe
2013-05-30 06:48 - 2011-03-14 21:50 - 00000000 ___RD C:\Program Files\Skype
2013-05-30 06:48 - 2009-04-23 20:58 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Skype
2013-05-30 06:48 - 2009-04-23 20:57 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Skype
2013-05-30 06:44 - 2009-08-31 16:21 - 00000062 __ASH C:\Documents and Settings\Guest\Local Settings\desktop.ini
2013-05-28 18:32 - 2013-05-28 18:32 - 00021965 ____A C:\Documents and Settings\Guest\Desktop\bookmarks.html
2013-05-28 12:12 - 2009-08-09 09:35 - 00000178 _ASHC C:\Documents and Settings\Karen\ntuser.ini
2013-05-28 12:11 - 2009-08-09 09:35 - 00000062 _ASHC C:\Documents and Settings\Karen\Local Settings\desktop.ini
2013-05-28 12:11 - 2009-08-09 09:23 - 00000278 __ASH C:\Documents and Settings\Chung-Yan\ntuser.ini
2013-05-28 12:10 - 2009-08-09 09:23 - 00000062 __ASH C:\Documents and Settings\Chung-Yan\Local Settings\desktop.ini
2013-05-28 12:01 - 2009-04-22 00:37 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Mozilla
2013-05-28 12:00 - 2013-05-28 12:00 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-05-28 12:00 - 2013-05-26 16:00 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-05-28 11:59 - 2013-05-28 08:53 - 21289608 ____A (Mozilla) C:\Documents and Settings\Vivian\Desktop\Firefox Setup 21.0.exe
2013-05-28 08:55 - 2013-02-25 18:04 - 00281035 ____A C:\Windows\setupapi.log
2013-05-28 08:05 - 2013-05-28 08:05 - 00007738 ____A C:\Documents and Settings\Karen\Desktop\bookmarks.html
2013-05-28 08:04 - 2013-05-28 08:04 - 00007640 ____A C:\Documents and Settings\Chung-Yan\Desktop\bookmarks.html
2013-05-28 08:04 - 2009-08-10 11:20 - 00076576 ___AC C:\Documents and Settings\Karen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-05-28 08:03 - 2013-05-28 08:03 - 00028032 ____A C:\Documents and Settings\tso\Desktop\bookmarks.html
2013-05-28 08:03 - 2009-08-10 14:38 - 00076576 ___AC C:\Documents and Settings\Chung-Yan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-05-28 08:01 - 2013-05-28 08:01 - 00053856 ____A C:\Documents and Settings\pso\Desktop\bookmarks.html
2013-05-28 08:00 - 2013-05-28 08:00 - 00266888 ____A C:\Documents and Settings\Vivian\Desktop\bookmarks.html
2013-05-27 14:59 - 2013-05-27 12:43 - 02031992 ____A (Microsoft Corporation) C:\Documents and Settings\Vivian\Desktop\MGADiag.exe
2013-05-27 14:59 - 2004-08-04 05:00 - 00013646 ____A C:\Windows\System32\wpa.dbl
2013-05-27 14:45 - 2013-05-27 14:40 - 00100743 ____A C:\Documents and Settings\Vivian\Desktop\MGDiag.CLP
2013-05-27 14:17 - 2013-05-27 14:17 - 00001018 ____A C:\Documents and Settings\tso\Desktop\Shortcut to driverlicence.lnk
2013-05-26 17:41 - 2013-05-26 17:40 - 00017392 ____A C:\AdwCleaner[S1].txt
2013-05-26 06:47 - 2013-05-26 06:47 - 00000000 __SHD C:\Documents and Settings\tso\IECompatCache
2013-05-26 06:28 - 2013-05-26 06:28 - 00004577 ____A C:\Documents and Settings\Vivian\Desktop\eset.txt
2013-05-26 05:53 - 2012-04-30 07:57 - 00000968 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
2013-05-25 19:13 - 2013-05-25 19:13 - 00000000 ____D C:\Program Files\ESET
2013-05-25 18:47 - 2013-05-25 18:47 - 00000000 ____D C:\_OTL
2013-05-25 18:37 - 2013-04-24 17:11 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\INISet
2013-05-25 18:37 - 2010-07-29 05:30 - 00000000 ____D C:\Documents and Settings\Vivian\update
2013-05-25 18:23 - 2013-04-24 21:45 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\INISet
2013-05-25 17:15 - 2013-05-25 17:15 - 00069658 ____A C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly.htm
2013-05-25 17:15 - 2013-05-25 17:15 - 00000000 ____D C:\Documents and Settings\All Users\Documents\Dry Rub Oven Baked Pork Ribs Soupbelly_files
2013-05-25 16:54 - 2013-04-24 21:55 - 00000000 ____D C:\Documents and Settings\tso\Local Settings\Application Data\INISet
2013-05-25 15:45 - 2013-05-25 15:45 - 00011731 ____A C:\Documents and Settings\Vivian\Desktop\JRT.txt
2013-05-25 15:28 - 2013-05-25 15:28 - 00000000 ____D C:\Windows\ERUNT
2013-05-25 15:28 - 2013-05-25 15:27 - 00000000 ____D C:\JRT
2013-05-25 15:21 - 2013-05-24 15:11 - 00000000 ____D C:\FRST
2013-05-25 15:05 - 2013-03-12 13:11 - 00000000 ____D C:\Program Files\AVG SafeGuard toolbar
2013-05-24 21:36 - 2013-04-24 18:26 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\INISet
2013-05-23 21:08 - 2013-05-23 21:08 - 00000000 ____D C:\Documents and Settings\pso\Application Data\Motive
2013-05-23 21:02 - 2013-05-23 21:02 - 00000000 ____D C:\Documents and Settings\pso\Application Data\AVG SafeGuard toolbar
2013-05-23 16:32 - 2013-05-23 16:32 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\PriceGong
2013-05-23 16:32 - 2012-09-23 22:48 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\uTorrentControl_v2
2013-05-23 16:32 - 2010-07-12 19:38 - 00000000 ____D C:\Documents and Settings\Guest\Local Settings\Application Data\Google
2013-05-23 16:29 - 2013-05-15 12:16 - 00016442 ____A C:\Windows\KB2847204-IE8.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00232506 ____A C:\Windows\iis6.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00216397 ____A C:\Windows\FaxSetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00103460 ____A C:\Windows\ocgen.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00098699 ____A C:\Windows\tsoc.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00072333 ____A C:\Windows\comsetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00043670 ____A C:\Windows\ntdtcsetup.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00037905 ____A C:\Windows\netfxocm.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00014875 ____A C:\Windows\MedCtrOC.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00011881 ____A C:\Windows\ocmsn.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00010846 ____A C:\Windows\tabletoc.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00010815 ____A C:\Windows\msgsocm.log
2013-05-23 16:29 - 2013-02-27 13:23 - 00001374 ____A C:\Windows\imsins.log
2013-05-23 16:28 - 2013-05-23 16:28 - 00012994 ____A C:\Windows\KB2510531-IE8.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00066126 ____A C:\Windows\msmqinst.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00049496 ____A C:\Windows\updspapi.log
2013-05-23 16:28 - 2013-02-27 13:23 - 00001374 ____A C:\Windows\imsins.BAK
2013-05-23 16:26 - 2013-05-23 16:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Motive
2013-05-23 16:18 - 2013-05-23 16:13 - 00000000 ____D C:\Program Files\Common Files\Motive
2013-05-23 16:14 - 2013-05-23 16:14 - 00001820 ____A C:\Documents and Settings\Vivian\Desktop\TELUS Support Centre.lnk
2013-05-23 16:14 - 2013-05-23 16:13 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Motive
2013-05-23 16:14 - 2012-08-19 13:01 - 00000000 ____D C:\Program Files\TELUS
2013-05-23 16:01 - 2013-05-23 15:57 - 00007281 ____A C:\Windows\spupdsvc.log
2013-05-23 16:00 - 2009-04-21 06:50 - 00000000 ____D C:\Windows\Help
2013-05-23 15:59 - 2013-05-23 15:59 - 00037114 ____A C:\Windows\KB2744842-IE8.log
2013-05-23 15:59 - 2013-05-23 15:58 - 00036950 ____A C:\Windows\KB2618444-IE8.log
2013-05-23 15:59 - 2013-05-23 15:45 - 00140674 ____A C:\Windows\ie8_main.log
2013-05-23 15:59 - 2013-05-15 21:48 - 00121115 ____A C:\Windows\KB2829530-IE8.log
2013-05-23 15:59 - 2009-04-21 14:28 - 00000000 ___HD C:\Windows\$hf_mig$
2013-05-23 15:58 - 2013-05-23 15:58 - 00030243 ____A C:\Windows\KB2598845-IE8.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00029602 ____A C:\Windows\KB2467659.log
2013-05-23 15:58 - 2013-05-23 15:58 - 00000000 __HDC C:\Windows\$NtUninstallKB2467659$
2013-05-23 15:58 - 2013-05-23 15:57 - 00037767 ____A C:\Windows\KB982381-IE8.log
2013-05-23 15:57 - 2013-05-23 15:56 - 00039585 ____A C:\Windows\ie8.log
2013-05-23 15:57 - 2013-05-23 15:56 - 00000000 __HDC C:\Windows\ie8
2013-05-23 15:57 - 2009-04-21 06:50 - 00000000 ____D C:\Windows\Media
2013-05-23 15:50 - 2013-05-23 15:50 - 00003774 ____A C:\Windows\KB951978.log
2013-05-23 15:46 - 2013-05-23 15:45 - 00035668 ____A C:\Windows\ie8Uninst.log
2013-05-23 15:46 - 2009-06-11 23:45 - 00000000 ____D C:\Windows\ie8updates
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\TELUS
2013-05-23 15:24 - 2013-05-23 15:24 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\Radialpoint
2013-05-23 14:16 - 2013-05-23 14:16 - 00000000 ____D C:\Documents and Settings\Guest\Application Data\AVG SafeGuard toolbar
2013-05-22 22:05 - 2013-04-24 16:56 - 00000000 ____D C:\FunshionMedia
2013-05-21 18:32 - 2013-05-21 18:32 - 00000000 ____D C:\Documents and Settings\tso\Application Data\AVG SafeGuard toolbar
2013-05-21 10:25 - 2013-05-21 10:25 - 00000000 ____D C:\Windows\System32\cache
2013-05-21 10:25 - 2013-03-12 13:11 - 00037664 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx86.sys
2013-05-19 09:49 - 2009-10-13 00:07 - 00000000 ____D C:\Windows\Microsoft.NET
2013-05-18 17:44 - 2009-04-21 06:57 - 00577100 ___AC C:\Windows\System32\PerfStringBackup.INI
2013-05-16 13:07 - 2013-05-16 13:07 - 00000000 ____D C:\dbfecd5f7d2e63eac17b4786
2013-05-15 12:21 - 2009-04-21 06:55 - 02176880 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 12:17 - 2013-05-15 12:16 - 00000000 ____D C:\78415340c7ea0ba5fa
2013-05-15 12:16 - 2013-05-15 12:16 - 00006960 ____A C:\Windows\KB2820197.log
2013-05-15 12:16 - 2013-05-15 12:16 - 00000000 __HDC C:\Windows\$NtUninstallKB2820197$
2013-05-15 12:12 - 2009-04-22 00:28 - 72607752 ___AC (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-15 12:11 - 2013-05-15 12:11 - 00000000 __HDC C:\Windows\$NtUninstallKB2829361$
2013-05-15 12:11 - 2013-05-15 11:08 - 00010405 ____A C:\Windows\KB2829361.log
2013-05-15 11:45 - 2012-07-07 00:29 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-05-15 11:45 - 2011-06-20 00:59 - 00071048 ___AC (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-05-14 18:38 - 2013-05-14 18:38 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\StarApp
2013-05-14 18:00 - 2013-05-14 18:01 - 00090112 ____A C:\Windows\Minidump\Mini051413-01.dmp
2013-05-14 15:30 - 2011-01-14 15:18 - 00000000 ____D C:\Documents and Settings\pso\Local Settings\Application Data\HP
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ___RD C:\Documents and Settings\Vivian\My Documents\HP Photo Creations
2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Visan
2013-05-14 15:16 - 2013-05-14 14:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Visan
2013-05-14 15:16 - 2013-05-14 14:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP Photo Creations
2013-05-14 14:14 - 2013-05-14 14:14 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\Hewlett-Packard
2013-05-14 14:14 - 2013-05-14 14:13 - 00000000 ____D C:\Program Files\HP Photo Creations
2013-05-14 14:12 - 2013-05-14 14:12 - 00001993 ____A C:\Documents and Settings\All Users\Desktop\HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2013-05-14 14:12 - 00000925 ____A C:\Documents and Settings\All Users\Desktop\Shop for Supplies - HP Photosmart 7520 series.lnk
2013-05-14 14:12 - 2010-06-21 10:52 - 00000000 ____D C:\Documents and Settings\Vivian\Application Data\HpUpdate
2013-05-14 14:12 - 2009-04-21 21:33 - 00000000 ____D C:\Program Files\HP
2013-05-14 14:11 - 2009-04-21 21:34 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\HP
2013-05-14 14:09 - 2013-05-14 14:09 - 00000057 ____A C:\Documents and Settings\All Users\Application Data\Ament.ini
2013-05-14 14:08 - 2009-05-22 00:03 - 00000000 ____D C:\Documents and Settings\Vivian\Local Settings\Application Data\HP
2013-05-14 13:37 - 2013-05-06 08:43 - 00000000 ____D C:\Documents and Settings\pso\Desktop\cari. cruise
2013-05-14 09:43 - 2011-07-23 17:53 - 00000000 ____D C:\Documents and Settings\pso\My Documents\pso's RECEIPT
2013-05-13 10:21 - 2013-05-13 10:21 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-05-13 10:13 - 2009-05-26 10:38 - 00000000 ____D C:\Documents and Settings\tso\Application Data\Skype
2013-05-12 17:03 - 2010-11-13 13:45 - 00000000 ____D C:\Documents and Settings\pso\Application Data\U3
2013-05-12 10:24 - 2011-02-08 14:37 - 00000000 ____D C:\Documents and Settings\All Users\Documents\Shared Docu
2013-05-12 10:15 - 2009-04-22 14:56 - 00000000 ____D C:\Documents and Settings\tso\Application Data\Mozilla

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================


----------



## emeraldnzl (Nov 3, 2007)

Download attached *fixlist.txt* file and save it to the Desktop.

*NOTE.* It's important that both files, *FRST* and *fixlist.txt *are in the same location or the fix will not work.

*NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system*

Run *FRST/FRST64* and press the *Fix* button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.


----------



## errorloading (Feb 4, 2011)

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 05-06-2013 01
Ran by Vivian at 2013-06-07 09:08:38 Run:2
Running from C:\Documents and Settings\Vivian\My Documents\Downloads
Boot Mode: Normal

==============================================

C:\Documents and Settings\Vivian\My Documents\iTudou\iTudou.exe not found.
C:\Documents and Settings\tso\Start Menu\Programs\Startup\???&#57836;?&#58078;?1.lnk not found.
C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\&#28925;?&#40279;udou\TudouVa.exe not found.
C:\Documents and Settings\tso\Start Menu\Programs\Startup\??iTudou.lnk => Moved successfully.
C:\Documents and Settings\Vivian\My Documents\iTudou\iTudou.exe not found.
C:\Documents and Settings\tso\Start Menu\Programs\Startup\??????.lnk => Moved successfully.
C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\&#28925;?&#40279;udou\TudouVa.exe not found.

==== End of Fixlog ====


----------



## emeraldnzl (Nov 3, 2007)

Now please go back to post #37 and carry out the instruction to run ComboFix.


----------



## errorloading (Feb 4, 2011)

ComboFix 13-06-08.02 - Vivian 9/2013 Sun 6:35.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.936.86.1033.18.1983.1025 [GMT -7:00]
执行位置: c:\documents and settings\Vivian\My Documents\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Guest\Application Data\PriceGong
c:\documents and settings\Guest\Application Data\PriceGong\Data\1.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\a.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\b.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\c.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\d.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\e.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\f.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\g.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\h.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\i.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\j.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\k.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\l.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\m.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\n.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\o.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\p.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\q.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\r.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\s.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\t.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\u.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\v.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\w.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\wlu.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\x.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\y.txt
c:\documents and settings\Guest\Application Data\PriceGong\Data\z.txt
c:\program files\Common Files\dyfm.ico
c:\windows\Downloaded Program Files\1825796
c:\windows\Downloaded Program Files\1825796\BaiduSetupAx_1.dll
c:\windows\Downloaded Program Files\1825796\npxbdsetup.dll
c:\windows\system32\Cache
c:\windows\system32\Cache\075884af680ff6dc.fb
c:\windows\system32\Cache\227113dfa1ca894d.fb
c:\windows\system32\Cache\49fbbc5a8678d502.fb
c:\windows\system32\Cache\5c54eb1a1655b076.fb
c:\windows\system32\Cache\613e8ce7ab7106af.fb
c:\windows\system32\Cache\633a76311867bd11.fb
c:\windows\system32\Cache\691f14230153a9e1.fb
c:\windows\system32\Cache\6cb409d7ac73d9f1.fb
c:\windows\system32\Cache\7614bd6cfa99e546.fb
c:\windows\system32\Cache\77664b6ccc36be9f.fb
c:\windows\system32\Cache\881b3593316772f0.fb
c:\windows\system32\Cache\98657d0579ae1930.fb
c:\windows\system32\Cache\afcb6feaf8c57186.fb
c:\windows\system32\Cache\c4e10d1be905349b.fb
c:\windows\system32\Cache\d5c0f4e7bbe35bf3.fb
c:\windows\system32\Cache\d9ca663388d21ec0.fb
c:\windows\system32\Cache\f2cda51fd108941f.fb
c:\windows\system32\Cache\f34d8db84131d925.fb
.
.
((((((((((((((((((((((((( 2013-05-09 至 2013-06-09 的新的档案 )))))))))))))))))))))))))))))))
.
.
2013-06-08 16:40 . 2013-05-13 06:19 7016152 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D516F22C-00A3-4A35-B9CD-917F6D72FC26}\mpengine.dll
2013-06-07 15:50 . 2013-05-13 06:19 7016152 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-06-03 18:48 . 2013-06-03 18:48 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Dropbox
2013-06-03 16:07 . 2013-04-04 21:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-06-03 16:07 . 2013-06-03 16:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-05-28 19:00 . 2013-05-28 19:00 -------- d-----w- c:\program files\Mozilla Maintenance Service
2013-05-26 13:47 . 2013-05-26 13:47 -------- d-sh--w- c:\documents and settings\tso\IECompatCache
2013-05-26 02:13 . 2013-05-26 02:13 -------- d-----w- c:\program files\ESET
2013-05-26 01:47 . 2013-05-26 01:47 -------- d-----w- C:\_OTL
2013-05-25 22:28 . 2013-05-25 22:28 -------- d-----w- c:\windows\ERUNT
2013-05-25 22:27 . 2013-05-25 22:28 -------- d-----w- C:\JRT
2013-05-24 22:11 . 2013-05-25 22:21 -------- d-----w- C:\FRST
2013-05-24 04:08 . 2013-05-24 04:08 -------- d-----w- c:\documents and settings\pso\Application Data\Motive
2013-05-24 04:02 . 2013-05-24 04:02 -------- d-----w- c:\documents and settings\pso\Application Data\AVG SafeGuard toolbar
2013-05-23 23:31 . 2013-05-23 23:32 -------- d-----w- c:\documents and settings\Guest\Application Data\HPAppData
2013-05-23 23:13 . 2013-05-23 23:14 -------- d-----w- c:\documents and settings\Vivian\Application Data\Motive
2013-05-23 23:13 . 2013-05-23 23:18 -------- d-----w- c:\program files\Common Files\Motive
2013-05-23 23:13 . 2013-05-23 23:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2013-05-23 22:56 . 2013-05-23 22:57 -------- dc-h--w- c:\windows\ie8
2013-05-23 22:51 . 2011-08-16 10:45 6144 -c----w- c:\windows\system32\dllcache\iecompat.dll
2013-05-23 22:24 . 2013-05-23 22:24 -------- d-----w- c:\documents and settings\Guest\Application Data\Radialpoint
2013-05-23 22:24 . 2013-05-23 22:24 -------- d-----w- c:\documents and settings\Guest\Application Data\TELUS
2013-05-23 21:16 . 2013-05-23 21:16 -------- d-----w- c:\documents and settings\Guest\Application Data\AVG SafeGuard toolbar
2013-05-23 05:06 . 2013-05-23 05:11 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\HPAppData
2013-05-23 05:06 . 2013-05-23 05:06 -------- d-----w- c:\documents and settings\NetworkService\Application Data\HPAppData
2013-05-22 01:32 . 2013-05-22 01:32 -------- d-----w- c:\documents and settings\tso\Application Data\AVG SafeGuard toolbar
2013-05-16 20:07 . 2013-05-16 20:07 -------- d-----w- C:\dbfecd5f7d2e63eac17b4786
2013-05-15 19:16 . 2013-05-15 19:17 -------- d-----w- C:\78415340c7ea0ba5fa
2013-05-15 01:38 . 2013-05-15 01:38 -------- d-----w- c:\documents and settings\All Users\Application Data\StarApp
2013-05-14 22:16 . 2013-05-14 22:16 -------- d-----w- c:\documents and settings\Vivian\Application Data\Visan
2013-05-14 21:58 . 2001-08-17 20:53 6784 ----a-w- c:\windows\system32\drivers\serscan.sys
2013-05-14 21:14 . 2013-05-14 21:14 -------- d-----w- c:\documents and settings\Vivian\Application Data\Hewlett-Packard
2013-05-14 21:13 . 2013-05-14 22:16 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Photo Creations
2013-05-14 21:13 . 2013-05-14 22:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Visan
2013-05-14 21:13 . 2013-05-14 21:14 -------- d-----w- c:\program files\HP Photo Creations
2013-05-14 21:12 . 2012-05-08 21:03 563048 ------w- c:\windows\system32\HPDiscoPMBC11.dll
2013-05-14 21:12 . 2012-05-09 00:23 495464 ----a-w- c:\windows\system32\HPWia1_PS7520.dll
2013-05-14 21:12 . 2012-05-09 00:23 1961320 ----a-w- c:\windows\system32\HPScanTRDrv_PS7520.dll
2013-05-14 21:12 . 2012-05-09 00:23 513384 ----a-w- c:\windows\system32\hpinkstsBC11.dll
2013-05-14 21:12 . 2012-05-09 00:23 267624 ----a-w- c:\windows\system32\hpinkstsBC11LM.dll
2013-05-14 21:12 . 2012-05-09 00:23 2215784 ----a-w- c:\windows\system32\hpinkinsBC11.exe
2013-05-14 21:12 . 2012-05-09 00:23 219496 ----a-w- c:\windows\system32\hpinkcoiBC11.dll
2013-05-13 17:21 . 2013-05-13 17:21 -------- d-----w- c:\program files\Common Files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-21 17:25 . 2013-03-12 20:11 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-05-15 18:45 . 2012-07-07 07:29 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-15 18:45 . 2011-06-20 07:59 71048 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-02 15:28 . 2012-08-23 02:10 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-04-16 22:17 . 2004-08-04 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-04-16 22:17 . 2004-08-04 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2013-04-16 22:17 . 2004-08-04 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2013-04-12 23:28 . 2004-08-04 12:00 385024 ------w- c:\windows\system32\html.iec
2013-04-10 01:31 . 2004-08-04 12:00 1876352 ----a-w- c:\windows\system32\win32k.sys
2013-04-02 14:09 . 2013-04-02 14:09 4550656 ----a-w- c:\windows\system32\GPhotos.scr
2013-03-28 17:21 . 2013-03-28 17:21 2148152 ----a-w- c:\documents and settings\pso\Local Settings\Application Data\BcsKtYcHW.dll
2013-03-28 17:21 . 2013-03-28 17:21 45056 ----a-r- c:\documents and settings\pso\Application Data\Microsoft\Installer\{37331C16-3E97-4A20-80D8-BFB43AB0E2FB}\UNINST_Uninstall_C_EBD1846850A64C858760A659B987DCFF.exe
2013-03-28 17:21 . 2013-03-28 17:21 45056 ----a-r- c:\documents and settings\pso\Application Data\Microsoft\Installer\{37331C16-3E97-4A20-80D8-BFB43AB0E2FB}\ARPPRODUCTICON.exe
2013-03-15 16:42 . 2013-03-12 20:07 13464 ----a-w- c:\windows\system32\drivers\SWDUMon.sys
2013-02-27 22:27 . 2013-02-27 22:27 20546152 ----a-w- c:\program files\Firefox Setup 18.0.exe
2011-02-19 19:17 . 2011-02-19 19:10 53539128 -c--a-w- c:\program files\lws110_x64.exe
2011-02-18 20:24 . 2011-02-18 20:24 10234024 -c--a-w- c:\program files\fwinstall.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 . 4AFB3B0919649F95C1964AA1FAD27D73 . 361600 . . [5.1.2600.5625] . . c:\windows\$NtUninstallKB2509553$\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[-] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
.
[-] 2010-08-17 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024] . . c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe
[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\spoolsv.exe
[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\dllcache\spoolsv.exe
[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2347290$\spoolsv.exe
[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\spoolsv.exe
[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2004-08-04 . 7435B108B935E42EA92CA94F59C8E717 . 57856 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\spoolsv.exe
.
[-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys
[-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
[-] 2004-08-04 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys
.
[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll
[-] 2010-08-23 . 736B12B725AEB2B07F0241A9F680CB10 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
[-] 2008-04-14 . BD38D1EBE24A46BD3EDA059560AFBA12 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\$NtUninstallKB2296011$\comctl32.dll
[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\ERDNT\cache\comctl32.dll
[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\ServicePackFiles\i386\comctl32.dll
[-] 2004-08-04 . A77DFB85FAEE49D66C74DA6024EBC69B . 611328 . . [5.82] . . c:\windows\$NtServicePackUninstall$\comctl32.dll
[-] 2004-08-04 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[-] 2004-08-04 . 5AF68A5E44734A082442668E9C787743 . 1050624 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
.
[-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\$NtUninstallKB2509553$\mswsock.dll
[-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\ERDNT\cache\mswsock.dll
[-] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\mswsock.dll
[-] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
[-] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\mswsock.dll
[-] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\mswsock.dll
[-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\mswsock.dll
[-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\mswsock.dll
[-] 2004-08-04 . 4E74AF063C3271FBEA20DD940CFD1184 . 245248 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\mswsock.dll
.
[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe
[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regedit.exe
[-] 2004-08-04 . 783AFC80383C176B22DBF8333343992D . 146432 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe
.
[-] 2011-11-01 . 6BAD1BED9872E62049E487FB91AE2F3A . 1288704 . . [5.1.2600.6168] . . c:\windows\system32\ole32.dll
[-] 2011-11-01 . 6BAD1BED9872E62049E487FB91AE2F3A . 1288704 . . [5.1.2600.6168] . . c:\windows\system32\dllcache\ole32.dll
[-] 2011-11-01 . 7D9DDE1AB4B00DDB173F5A16E9206517 . 1289216 . . [5.1.2600.6168] . . c:\windows\$hf_mig$\KB2624667\SP3QFE\ole32.dll
[-] 2010-07-16 . 7A6A7900B5E322763430BA6FD9A31224 . 1288192 . . [5.1.2600.6010] . . c:\windows\$NtUninstallKB2624667$\ole32.dll
[-] 2010-07-16 . 8D51FB47062F2A1A9EFECCEF338A4C46 . 1289216 . . [5.1.2600.6010] . . c:\windows\$hf_mig$\KB979687\SP3QFE\ole32.dll
[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB979687$\ole32.dll
[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\ole32.dll
[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ole32.dll
[-] 2004-08-04 . 4FE9D9FA62D020E35E0AC6D1AEEB96F0 . 1281536 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ole32.dll
.
[-] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\usp10.dll
[-] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\dllcache\usp10.dll
[-] 2010-04-16 . F8894BCC961D461674002B4BAE7AECC1 . 406016 . . [1.0420.2600.5969] . . c:\windows\$hf_mig$\KB981322\SP3QFE\usp10.dll
[-] 2008-04-14 . 7D7D8501F3CB45D0408CDEFA08CDAEFF . 406016 . . [1.0420.2600.5512] . . c:\windows\$NtUninstallKB981322$\usp10.dll
[-] 2008-04-14 . 7D7D8501F3CB45D0408CDEFA08CDAEFF . 406016 . . [1.0420.2600.5512] . . c:\windows\ERDNT\cache\usp10.dll
[-] 2008-04-14 . 7D7D8501F3CB45D0408CDEFA08CDAEFF . 406016 . . [1.0420.2600.5512] . . c:\windows\ServicePackFiles\i386\usp10.dll
[-] 2004-08-04 . 2EB58F9DCD6AB320B46744A4EA48B2D2 . 406528 . . [1.0420.2600.2180] . . c:\windows\$NtServicePackUninstall$\usp10.dll
.
[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ksuser.dll
[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\dllcache\ksuser.dll
[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\ServicePackFiles\i386\ksuser.dll
[-] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\$NtServicePackUninstall$\ksuser.dll
[-] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\ksuser.dll
.
[-] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\shsvcs.dll
[-] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\dllcache\shsvcs.dll
[-] 2009-07-27 . 888CD7B39C37E13A2419BECFAAF0A28C . 135168 . . [6.00.2900.5853] . . c:\windows\$hf_mig$\KB971029\SP3QFE\shsvcs.dll
[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\$NtUninstallKB971029$\shsvcs.dll
[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\ERDNT\cache\shsvcs.dll
[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\shsvcs.dll
[-] 2004-08-04 . E7518DC542D3EBDCB80EDD98462C7821 . 134656 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\shsvcs.dll
.
[-] 2008-04-14 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msimg32.dll
[-] 2008-04-14 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\system32\msimg32.dll
[-] 2004-08-04 . B5331F2B6F37C66C29C847F3B94FF900 . 4608 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msimg32.dll
.
[-] 2010-12-09 . 15CE4DBC22FAB90B3CA5352AF1FFF81C . 718336 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntdll.dll
[-] 2010-12-09 . F8F0D25CA553E39DDE485D8FC7FCCE89 . 718336 . . [5.1.2600.6055] . . c:\windows\system32\ntdll.dll
[-] 2010-12-09 . F8F0D25CA553E39DDE485D8FC7FCCE89 . 718336 . . [5.1.2600.6055] . . c:\windows\system32\dllcache\ntdll.dll
[-] 2009-02-09 . 911DDF2E16761643A47225F654D811E5 . 714752 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB2393802$\ntdll.dll
[-] 2009-02-09 . B0913005EE3FC15D7F72472D0B8A30EB . 715264 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntdll.dll
[-] 2008-04-14 . 27D9ED8CB8B62D1E0A8E5ACE6CF52E2F . 706048 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\ntdll.dll
[-] 2008-04-14 . 27D9ED8CB8B62D1E0A8E5ACE6CF52E2F . 706048 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntdll.dll
[-] 2004-08-04 . BB5CBFFC096497506167BCE1D9690EF2 . 708096 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ntdll.dll
.
[-] 2009-02-27 . 3F790874A85819E94574F3E7AF9C5806 . 177152 . . [5.1.2600.5768] . . c:\windows\system32\msctfime.ime
[-] 2009-02-27 . 3F790874A85819E94574F3E7AF9C5806 . 177152 . . [5.1.2600.5768] . . c:\windows\system32\dllcache\msctfime.ime
[-] 2009-02-27 . 30B7D847BA9075AA8E1122FB6AF3D1B5 . 177152 . . [5.1.2600.5768] . . c:\windows\$hf_mig$\KB961503\SP3QFE\msctfime.ime
[-] 2008-04-14 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB961503$\msctfime.ime
[-] 2008-04-14 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msctfime.ime
[-] 2004-08-04 . D87041EAA67ECA4394F6D5D09C0C2885 . 177152 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msctfime.ime
.
[-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys
[-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
[-] 2004-08-04 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys
.
[-] 2010-09-18 07:18 . 842900DEDBC8E3E8DBCCCB298FD88F65 . 953856 . . [4.1.6151] . . c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll
[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll
[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\dllcache\mfc40u.dll
[-] 2008-04-14 12:41 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\$NtUninstallKB2387149$\mfc40u.dll
[-] 2008-04-14 12:41 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\ERDNT\cache\mfc40u.dll
[-] 2008-04-14 12:41 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\ServicePackFiles\i386\mfc40u.dll
[-] 2004-08-04 12:00 . DDF8D47ACF8FC3FE5F7F2B95C4D4D136 . 924432 . . [4.1.6140] . . c:\windows\$NtServicePackUninstall$\mfc40u.dll
.
[-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\midimap.dll
[-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll
[-] 2004-08-04 . 3B4702155BB2AE9DC00C06A68834BDFA . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\midimap.dll
.
[-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rasadhlp.dll
[-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll
[-] 2004-08-04 . 4CAEC028C1E21C75E17877D4522D3DB4 . 8192 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\rasadhlp.dll
.
[-] 2008-04-14 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wshtcpip.dll
[-] 2008-04-14 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\system32\wshtcpip.dll
[-] 2004-08-04 . A7F95A53EE055115DF03588997A47D4D . 19968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wshtcpip.dll
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12 130736 ----a-w- c:\documents and settings\Vivian\Application Data\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12 130736 ----a-w- c:\documents and settings\Vivian\Application Data\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12 130736 ----a-w- c:\documents and settings\Vivian\Application Data\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12 130736 ----a-w- c:\documents and settings\Vivian\Application Data\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Photosmart 7520 series (NET)"="c:\program files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe" [2012-05-08 1818472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-03-08 39408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-04-19 18678376]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-28 152872]
"AROReminder"="c:\program files\Advanced Registry Optimizer\ARO.exe" [2010-10-18 2215944]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TELUS_McciTrayApp"="c:\program files\TELUS\McciTrayApp.exe" [2012-06-11 1561088]
"SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2006-07-21 126976]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-30 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10e.exe" [2010-01-27 256280]
.
c:\documents and settings\Vivian\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe [2013-6-5 27989976]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Tudou\\·é?ùTudou\\TudouVa.exe"=
"c:\\Documents and Settings\\tso\\My Documents\\·é?ùTudou\\TudouVa.exe"=
"c:\\Documents and Settings\\tso\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\tso\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\TELUS\\TELUS security advisor\\ServicepointService.exe"=
"c:\program files\Tudou\?¤¨|?¨′Tudou\TudouVa.exe"= 
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\program files\Tudou\??è?§|??§??Tudou\TudouVa.exe"= 
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
.
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [3/12/2013 1:11 PM 37664]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [6/3/2013 9:07 AM 418376]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/3/2013 9:07 AM 701512]
R2 ServicepointService;ServicepointService;c:\program files\TELUS\TELUS security advisor\ServicepointService.exe [8/19/2012 1:01 PM 10294584]
R3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [6/11/2012 4:22 PM 240208]
R3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\drivers\lgbtport.sys [9/29/2009 8:11 AM 12160]
R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\drivers\lgbtbus.sys [9/29/2009 8:11 AM 10496]
R3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\drivers\lgvmodem.sys [9/29/2009 8:11 AM 12928]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/3/2013 9:07 AM 22856]
S1 KPProtector;KPProtector;\??\c:\program files\kuping4\KPProtector.sys --> c:\program files\kuping4\KPProtector.sys [?]
S2 Amsp;Amsp; [x]
S2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [6/11/2012 4:22 PM 193616]
S2 KAVSafe;KAVSafe;\??\c:\windows\system32\Drivers\KAVSafe.sys --> c:\windows\system32\Drivers\KAVSafe.sys [?]
S2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [5/14/2013 1:26 PM 3289208]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2/28/2013 6:45 PM 161384]
S2 vToolbarUpdater15.2.0;vToolbarUpdater15.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe --> c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe [?]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [2/19/2011 11:34 AM 23456]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [4/8/2010 9:41 PM 47360]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [3/12/2013 1:07 PM 13464]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4/21/2009 3:10 PM 717296]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
FunshionServiceTools REG_MULTI_SZ FunshionSvr
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-06-06 02:11 1165776 ----a-w- c:\program files\Google\Chrome\Application\27.0.1453.110\Installer\chrmstp.exe
.
'计划任务' 文件夹 里的内容
.
2013-06-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-07 18:45]
.
2013-06-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 18:50]
.
2013-06-04 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 12:42]
.
2013-06-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
- c:\documents and settings\tso\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-04-30 12:48]
.
2013-06-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
- c:\documents and settings\tso\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-04-30 12:48]
.
2013-06-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-08 22:18]
.
2013-06-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-08 22:18]
.
2013-06-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
- c:\documents and settings\tso\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-10-31 13:36]
.
2013-06-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
- c:\documents and settings\tso\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-10-31 13:36]
.
2013-06-09 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\documents and settings\All Users\Application Data\HP Photo Creations\Communicator.exe [2013-05-14 22:16]
.
2013-06-09 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 19:11]
.
.
------- 而外的扫描 -------
.
uStart Page = 
uInternet Settings,ProxyOverride = local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254 75.153.176.9
TCP: Interfaces\{F5D8976E-2CE8-46E0-BC66-A161DBFBDA3F}: DhcpNameServer = 192.168.1.254 75.153.176.9
FF - ProfilePath - c:\documents and settings\Vivian\Application Data\Mozilla\Firefox\Profiles\0dr2gaab.default\
FF - ExtSQL: 2013-05-14 14:14; [email protected]; c:\program files\Hewlett-Packard\SmartPrint\QPExtension
FF - ExtSQL: 2013-05-26 16:00; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - ExtSQL: !HIDDEN! 2013-02-18 14:26; [email protected]; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-SmileboxTray - c:\documents and settings\Vivian\Application Data\Smilebox\SmileboxTray.exe
AddRemove-EasylifeGadget Updater - c:\docume~1\ALLUSE~1\APPLIC~1\INSTAL~1\EASYLI~1\Setup.exe
AddRemove-{6343F7D2-731A-6943-9C60-237070968C1B} - c:\docume~1\ALLUSE~1\APPLIC~1\INSTAL~1\{DBA31~1\Setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-09 06:41
Windows 5.1.2600 Service Pack 3 NTFS
.
扫描被隐藏的进程 。。。 
.
扫描被隐藏的启动组 。。。 
.
扫描被隐藏的文件 。。。 
.
扫描完成
被隐藏的档案: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1454471165-1788223648-725345543-1003\渧"*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:fc,8b,08,c5,29,48,f8,00
DUMPHIVE0.003 (REGF)
.
--------------------- 运行进程下的动态链接库 ---------------------
.
- - - - - - - > 'winlogon.exe'(692)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
完成时间: 2013-06-09 06:43:24
ComboFix-quarantined-files.txt 2013-06-09 13:43
ComboFix2.txt 2012-08-23 01:18
ComboFix3.txt 2011-02-11 02:31
.
Pre-Run: 413,207,887,872 bytes free
Post-Run: 413,182,164,992 bytes free
.
- - End Of File - - 7AA56F893C47271B7AA2C55FF88DA582
8F558EB6672622401DA993E1E865C861


----------



## emeraldnzl (Nov 3, 2007)

Hello errorloading,

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open *notepad* and copy/paste the text in the quotebox below into it:


```
KillAll::

Driver::
avgtp
Amsp
KAVSafe
vToolbarUpdater15.2.0
c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe

File::
c:\windows\system32\drivers\avgtpx86.sys
c:\windows\system32\Drivers\KAVSafe.sys

Folder::
c:\\Documents and Settings\\tso
c:\program files\Tudou

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List]
"c:\\Documents and Settings\\tso\\My Documents\\·é?ùTudou\\TudouVa.exe"=-
"c:\program files\Tudou\?¤¨|?¨?Tudou\TudouVa.exe"= -

Reboot::
```
Save this as *CFScript.txt*, in the same location as ComboFix.exe










Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it will produce a log for you at *C:\ComboFix.txt*. Please post that here for further review.

*After that*

Please download *SystemLook* from one of the links below and save it to your Desktop.
*Download Mirror #1
Download Mirror #2*

Double-click *SystemLook.exe* to run it.
Copy the content of the following codebox into the main textfield:

```
:reg
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost /sub
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found at on your Desktop entitled *SystemLook.txt*

*When you return please post
ComboFix.txt
SystemLook.txt
*


----------



## errorloading (Feb 4, 2011)

ComboFix 13-06-08.02 - Vivian 0/2013 Mon 13:26:28.6.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.936.86.1033.18.1983.1236 [GMT -7:00]
执行位置: c:\documents and settings\Vivian\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\Vivian\My Documents\Downloads\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\windows\system32\drivers\avgtpx86.sys"
"c:\windows\system32\Drivers\KAVSafe.sys"
.
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( 驱动/服务 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_AMSP
-------\Legacy_AVGTP
-------\Legacy_KAVSAFE
-------\Legacy_VTOOLBARUPDATER15.2.0
-------\Service_Amsp
-------\Service_avgtp
-------\Service_KAVSafe
-------\Service_vToolbarUpdater15.2.0
.
.
((((((((((((((((((((((((( 2013-05-10 至 2013-06-10 的新的档案 )))))))))))))))))))))))))))))))
.
.
2013-06-09 17:31 . 2013-05-13 06:19 7016152 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0BDC04C8-DD1B-4CDD-896F-49551CF8A3BE}\mpengine.dll
2013-06-09 15:41 . 2013-05-13 06:19 7016152 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-06-03 18:48 . 2013-06-03 18:48 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Dropbox
2013-06-03 16:07 . 2013-04-04 21:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-06-03 16:07 . 2013-06-03 16:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-05-28 19:00 . 2013-05-28 19:00 -------- d-----w- c:\program files\Mozilla Maintenance Service
2013-05-26 13:47 . 2013-05-26 13:47 -------- d-sh--w- c:\documents and settings\tso\IECompatCache
2013-05-26 02:13 . 2013-05-26 02:13 -------- d-----w- c:\program files\ESET
2013-05-26 01:47 . 2013-05-26 01:47 -------- d-----w- C:\_OTL
2013-05-25 22:28 . 2013-05-25 22:28 -------- d-----w- c:\windows\ERUNT
2013-05-25 22:27 . 2013-05-25 22:28 -------- d-----w- C:\JRT
2013-05-24 22:11 . 2013-05-25 22:21 -------- d-----w- C:\FRST
2013-05-23 23:31 . 2013-05-23 23:32 -------- d-----w- c:\documents and settings\Guest\Application Data\HPAppData
2013-05-23 23:13 . 2013-05-23 23:14 -------- d-----w- c:\documents and settings\Vivian\Application Data\Motive
2013-05-23 23:13 . 2013-05-23 23:18 -------- d-----w- c:\program files\Common Files\Motive
2013-05-23 23:13 . 2013-05-23 23:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2013-05-23 22:56 . 2013-05-23 22:57 -------- dc-h--w- c:\windows\ie8
2013-05-23 22:51 . 2011-08-16 10:45 6144 -c----w- c:\windows\system32\dllcache\iecompat.dll
2013-05-23 22:24 . 2013-05-23 22:24 -------- d-----w- c:\documents and settings\Guest\Application Data\Radialpoint
2013-05-23 22:24 . 2013-05-23 22:24 -------- d-----w- c:\documents and settings\Guest\Application Data\TELUS
2013-05-23 21:16 . 2013-05-23 21:16 -------- d-----w- c:\documents and settings\Guest\Application Data\AVG SafeGuard toolbar
2013-05-23 05:06 . 2013-05-23 05:11 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\HPAppData
2013-05-23 05:06 . 2013-05-23 05:06 -------- d-----w- c:\documents and settings\NetworkService\Application Data\HPAppData
2013-05-16 20:07 . 2013-05-16 20:07 -------- d-----w- C:\dbfecd5f7d2e63eac17b4786
2013-05-15 19:16 . 2013-05-15 19:17 -------- d-----w- C:\78415340c7ea0ba5fa
2013-05-15 01:38 . 2013-05-15 01:38 -------- d-----w- c:\documents and settings\All Users\Application Data\StarApp
2013-05-14 22:16 . 2013-05-14 22:16 -------- d-----w- c:\documents and settings\Vivian\Application Data\Visan
2013-05-14 21:58 . 2001-08-17 20:53 6784 ----a-w- c:\windows\system32\drivers\serscan.sys
2013-05-14 21:14 . 2013-05-14 21:14 -------- d-----w- c:\documents and settings\Vivian\Application Data\Hewlett-Packard
2013-05-14 21:13 . 2013-05-14 22:16 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Photo Creations
2013-05-14 21:13 . 2013-05-14 22:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Visan
2013-05-14 21:13 . 2013-05-14 21:14 -------- d-----w- c:\program files\HP Photo Creations
2013-05-14 21:12 . 2012-05-08 21:03 563048 ------w- c:\windows\system32\HPDiscoPMBC11.dll
2013-05-14 21:12 . 2012-05-09 00:23 495464 ----a-w- c:\windows\system32\HPWia1_PS7520.dll
2013-05-14 21:12 . 2012-05-09 00:23 1961320 ----a-w- c:\windows\system32\HPScanTRDrv_PS7520.dll
2013-05-14 21:12 . 2012-05-09 00:23 513384 ----a-w- c:\windows\system32\hpinkstsBC11.dll
2013-05-14 21:12 . 2012-05-09 00:23 267624 ----a-w- c:\windows\system32\hpinkstsBC11LM.dll
2013-05-14 21:12 . 2012-05-09 00:23 2215784 ----a-w- c:\windows\system32\hpinkinsBC11.exe
2013-05-14 21:12 . 2012-05-09 00:23 219496 ----a-w- c:\windows\system32\hpinkcoiBC11.dll
2013-05-13 17:21 . 2013-05-13 17:21 -------- d-----w- c:\program files\Common Files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-21 17:25 . 2013-03-12 20:11 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-05-15 18:45 . 2012-07-07 07:29 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-15 18:45 . 2011-06-20 07:59 71048 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-02 15:28 . 2012-08-23 02:10 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-04-16 22:17 . 2004-08-04 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-04-16 22:17 . 2004-08-04 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2013-04-16 22:17 . 2004-08-04 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2013-04-12 23:28 . 2004-08-04 12:00 385024 ------w- c:\windows\system32\html.iec
2013-04-10 01:31 . 2004-08-04 12:00 1876352 ----a-w- c:\windows\system32\win32k.sys
2013-04-02 14:09 . 2013-04-02 14:09 4550656 ----a-w- c:\windows\system32\GPhotos.scr
2013-03-15 16:42 . 2013-03-12 20:07 13464 ----a-w- c:\windows\system32\drivers\SWDUMon.sys
2013-02-27 22:27 . 2013-02-27 22:27 20546152 ----a-w- c:\program files\Firefox Setup 18.0.exe
2011-02-19 19:17 . 2011-02-19 19:10 53539128 -c--a-w- c:\program files\lws110_x64.exe
2011-02-18 20:24 . 2011-02-18 20:24 10234024 -c--a-w- c:\program files\fwinstall.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 . 4AFB3B0919649F95C1964AA1FAD27D73 . 361600 . . [5.1.2600.5625] . . c:\windows\$NtUninstallKB2509553$\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[-] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
.
[-] 2010-08-17 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024] . . c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe
[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\spoolsv.exe
[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\dllcache\spoolsv.exe
[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2347290$\spoolsv.exe
[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\spoolsv.exe
[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2004-08-04 . 7435B108B935E42EA92CA94F59C8E717 . 57856 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\spoolsv.exe
.
[-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys
[-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
[-] 2004-08-04 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys
.
[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll
[-] 2010-08-23 . 736B12B725AEB2B07F0241A9F680CB10 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
[-] 2008-04-14 . BD38D1EBE24A46BD3EDA059560AFBA12 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\$NtUninstallKB2296011$\comctl32.dll
[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\ERDNT\cache\comctl32.dll
[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\ServicePackFiles\i386\comctl32.dll
[-] 2004-08-04 . A77DFB85FAEE49D66C74DA6024EBC69B . 611328 . . [5.82] . . c:\windows\$NtServicePackUninstall$\comctl32.dll
[-] 2004-08-04 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[-] 2004-08-04 . 5AF68A5E44734A082442668E9C787743 . 1050624 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
.
[-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\$NtUninstallKB2509553$\mswsock.dll
[-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\ERDNT\cache\mswsock.dll
[-] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\mswsock.dll
[-] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
[-] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\mswsock.dll
[-] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\mswsock.dll
[-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\mswsock.dll
[-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\mswsock.dll
[-] 2004-08-04 . 4E74AF063C3271FBEA20DD940CFD1184 . 245248 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\mswsock.dll
.
[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe
[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regedit.exe
[-] 2004-08-04 . 783AFC80383C176B22DBF8333343992D . 146432 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe
.
[-] 2011-11-01 . 6BAD1BED9872E62049E487FB91AE2F3A . 1288704 . . [5.1.2600.6168] . . c:\windows\system32\ole32.dll
[-] 2011-11-01 . 6BAD1BED9872E62049E487FB91AE2F3A . 1288704 . . [5.1.2600.6168] . . c:\windows\system32\dllcache\ole32.dll
[-] 2011-11-01 . 7D9DDE1AB4B00DDB173F5A16E9206517 . 1289216 . . [5.1.2600.6168] . . c:\windows\$hf_mig$\KB2624667\SP3QFE\ole32.dll
[-] 2010-07-16 . 7A6A7900B5E322763430BA6FD9A31224 . 1288192 . . [5.1.2600.6010] . . c:\windows\$NtUninstallKB2624667$\ole32.dll
[-] 2010-07-16 . 8D51FB47062F2A1A9EFECCEF338A4C46 . 1289216 . . [5.1.2600.6010] . . c:\windows\$hf_mig$\KB979687\SP3QFE\ole32.dll
[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB979687$\ole32.dll
[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\ole32.dll
[-] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ole32.dll
[-] 2004-08-04 . 4FE9D9FA62D020E35E0AC6D1AEEB96F0 . 1281536 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ole32.dll
.
[-] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\usp10.dll
[-] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\dllcache\usp10.dll
[-] 2010-04-16 . F8894BCC961D461674002B4BAE7AECC1 . 406016 . . [1.0420.2600.5969] . . c:\windows\$hf_mig$\KB981322\SP3QFE\usp10.dll
[-] 2008-04-14 . 7D7D8501F3CB45D0408CDEFA08CDAEFF . 406016 . . [1.0420.2600.5512] . . c:\windows\$NtUninstallKB981322$\usp10.dll
[-] 2008-04-14 . 7D7D8501F3CB45D0408CDEFA08CDAEFF . 406016 . . [1.0420.2600.5512] . . c:\windows\ERDNT\cache\usp10.dll
[-] 2008-04-14 . 7D7D8501F3CB45D0408CDEFA08CDAEFF . 406016 . . [1.0420.2600.5512] . . c:\windows\ServicePackFiles\i386\usp10.dll
[-] 2004-08-04 . 2EB58F9DCD6AB320B46744A4EA48B2D2 . 406528 . . [1.0420.2600.2180] . . c:\windows\$NtServicePackUninstall$\usp10.dll
.
[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ksuser.dll
[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\dllcache\ksuser.dll
[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\ServicePackFiles\i386\ksuser.dll
[-] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\$NtServicePackUninstall$\ksuser.dll
[-] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\ksuser.dll
.
[-] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\shsvcs.dll
[-] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\dllcache\shsvcs.dll
[-] 2009-07-27 . 888CD7B39C37E13A2419BECFAAF0A28C . 135168 . . [6.00.2900.5853] . . c:\windows\$hf_mig$\KB971029\SP3QFE\shsvcs.dll
[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\$NtUninstallKB971029$\shsvcs.dll
[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\ERDNT\cache\shsvcs.dll
[-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\shsvcs.dll
[-] 2004-08-04 . E7518DC542D3EBDCB80EDD98462C7821 . 134656 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\shsvcs.dll
.
[-] 2008-04-14 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msimg32.dll
[-] 2008-04-14 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\system32\msimg32.dll
[-] 2004-08-04 . B5331F2B6F37C66C29C847F3B94FF900 . 4608 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msimg32.dll
.
[-] 2010-12-09 . 15CE4DBC22FAB90B3CA5352AF1FFF81C . 718336 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntdll.dll
[-] 2010-12-09 . F8F0D25CA553E39DDE485D8FC7FCCE89 . 718336 . . [5.1.2600.6055] . . c:\windows\system32\ntdll.dll
[-] 2010-12-09 . F8F0D25CA553E39DDE485D8FC7FCCE89 . 718336 . . [5.1.2600.6055] . . c:\windows\system32\dllcache\ntdll.dll
[-] 2009-02-09 . 911DDF2E16761643A47225F654D811E5 . 714752 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB2393802$\ntdll.dll
[-] 2009-02-09 . B0913005EE3FC15D7F72472D0B8A30EB . 715264 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntdll.dll
[-] 2008-04-14 . 27D9ED8CB8B62D1E0A8E5ACE6CF52E2F . 706048 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\ntdll.dll
[-] 2008-04-14 . 27D9ED8CB8B62D1E0A8E5ACE6CF52E2F . 706048 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntdll.dll
[-] 2004-08-04 . BB5CBFFC096497506167BCE1D9690EF2 . 708096 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ntdll.dll
.
[-] 2009-02-27 . 3F790874A85819E94574F3E7AF9C5806 . 177152 . . [5.1.2600.5768] . . c:\windows\system32\msctfime.ime
[-] 2009-02-27 . 3F790874A85819E94574F3E7AF9C5806 . 177152 . . [5.1.2600.5768] . . c:\windows\system32\dllcache\msctfime.ime
[-] 2009-02-27 . 30B7D847BA9075AA8E1122FB6AF3D1B5 . 177152 . . [5.1.2600.5768] . . c:\windows\$hf_mig$\KB961503\SP3QFE\msctfime.ime
[-] 2008-04-14 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB961503$\msctfime.ime
[-] 2008-04-14 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msctfime.ime
[-] 2004-08-04 . D87041EAA67ECA4394F6D5D09C0C2885 . 177152 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msctfime.ime
.
[-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys
[-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
[-] 2004-08-04 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys
.
[-] 2010-09-18 07:18 . 842900DEDBC8E3E8DBCCCB298FD88F65 . 953856 . . [4.1.6151] . . c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll
[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll
[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\dllcache\mfc40u.dll
[-] 2008-04-14 12:41 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\$NtUninstallKB2387149$\mfc40u.dll
[-] 2008-04-14 12:41 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\ERDNT\cache\mfc40u.dll
[-] 2008-04-14 12:41 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\ServicePackFiles\i386\mfc40u.dll
[-] 2004-08-04 12:00 . DDF8D47ACF8FC3FE5F7F2B95C4D4D136 . 924432 . . [4.1.6140] . . c:\windows\$NtServicePackUninstall$\mfc40u.dll
.
[-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\midimap.dll
[-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll
[-] 2004-08-04 . 3B4702155BB2AE9DC00C06A68834BDFA . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\midimap.dll
.
[-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rasadhlp.dll
[-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll
[-] 2004-08-04 . 4CAEC028C1E21C75E17877D4522D3DB4 . 8192 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\rasadhlp.dll
.
[-] 2008-04-14 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wshtcpip.dll
[-] 2008-04-14 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\system32\wshtcpip.dll
[-] 2004-08-04 . A7F95A53EE055115DF03588997A47D4D . 19968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wshtcpip.dll
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12 130736 ----a-w- c:\documents and settings\Vivian\Application Data\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12 130736 ----a-w- c:\documents and settings\Vivian\Application Data\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12 130736 ----a-w- c:\documents and settings\Vivian\Application Data\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12 130736 ----a-w- c:\documents and settings\Vivian\Application Data\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Photosmart 7520 series (NET)"="c:\program files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe" [2012-05-08 1818472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-03-08 39408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-04-19 18678376]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-28 152872]
"AROReminder"="c:\program files\Advanced Registry Optimizer\ARO.exe" [2010-10-18 2215944]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TELUS_McciTrayApp"="c:\program files\TELUS\McciTrayApp.exe" [2012-06-11 1561088]
"SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2006-07-21 126976]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-30 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10e.exe" [2010-01-27 256280]
.
c:\documents and settings\Vivian\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Vivian\Application Data\Dropbox\bin\Dropbox.exe [2013-6-7 27989816]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Tudou\\·é?ùTudou\\TudouVa.exe"=
"c:\\Documents and Settings\\tso\\My Documents\\·é?ùTudou\\TudouVa.exe"=
"c:\\Documents and Settings\\tso\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\tso\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\TELUS\\TELUS security advisor\\ServicepointService.exe"=
"c:\program files\Tudou\?¤¨|?¨′Tudou\TudouVa.exe"= 
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\program files\Tudou\??è?§|??§??Tudou\TudouVa.exe"= 
"c:\program files\Tudou\??¨¨??ì|???ì??Tudou\TudouVa.exe"= 
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]
R2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [6/11/2012 4:22 PM 193616]
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [6/3/2013 9:07 AM 418376]
R2 ServicepointService;ServicepointService;c:\program files\TELUS\TELUS security advisor\ServicepointService.exe [8/19/2012 1:01 PM 10294584]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [5/14/2013 1:26 PM 3289208]
R3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [6/11/2012 4:22 PM 240208]
R3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\drivers\lgbtport.sys [9/29/2009 8:11 AM 12160]
R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\drivers\lgbtbus.sys [9/29/2009 8:11 AM 10496]
R3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\drivers\lgvmodem.sys [9/29/2009 8:11 AM 12928]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/3/2013 9:07 AM 22856]
S1 KPProtector;KPProtector;\??\c:\program files\kuping4\KPProtector.sys --> c:\program files\kuping4\KPProtector.sys [?]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/3/2013 9:07 AM 701512]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2/28/2013 6:45 PM 161384]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [2/19/2011 11:34 AM 23456]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [4/8/2010 9:41 PM 47360]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [3/12/2013 1:07 PM 13464]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4/21/2009 3:10 PM 717296]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
FunshionServiceTools REG_MULTI_SZ FunshionSvr
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-06-06 02:11 1165776 ----a-w- c:\program files\Google\Chrome\Application\27.0.1453.110\Installer\chrmstp.exe
.
'计划任务' 文件夹 里的内容
.
2013-06-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-07 18:45]
.
2013-06-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 18:50]
.
2013-06-04 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 12:42]
.
2013-06-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
- c:\documents and settings\tso\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-04-30 12:48]
.
2013-06-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
- c:\documents and settings\tso\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-04-30 12:48]
.
2013-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-08 22:18]
.
2013-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-08 22:18]
.
2013-06-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007Core.job
- c:\documents and settings\tso\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-10-31 13:36]
.
2013-06-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1788223648-725345543-1007UA.job
- c:\documents and settings\tso\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-10-31 13:36]
.
2013-06-10 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\documents and settings\All Users\Application Data\HP Photo Creations\Communicator.exe [2013-05-14 22:16]
.
2013-06-10 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 19:11]
.
.
------- 而外的扫描 -------
.
uStart Page = 
uInternet Settings,ProxyOverride = local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254 75.153.176.9
TCP: Interfaces\{F5D8976E-2CE8-46E0-BC66-A161DBFBDA3F}: DhcpNameServer = 192.168.1.254 75.153.176.9
FF - ProfilePath - c:\documents and settings\Vivian\Application Data\Mozilla\Firefox\Profiles\0dr2gaab.default\
FF - ExtSQL: 2013-05-14 14:14; [email protected]; c:\program files\Hewlett-Packard\SmartPrint\QPExtension
FF - ExtSQL: 2013-05-26 16:00; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - ExtSQL: !HIDDEN! 2013-02-18 14:26; [email protected]; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-10 13:43
Windows 5.1.2600 Service Pack 3 NTFS
.
扫描被隐藏的进程 。。。 
.
扫描被隐藏的启动组 。。。 
.
扫描被隐藏的文件 。。。 
.
扫描完成
被隐藏的档案: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1454471165-1788223648-725345543-1003\渧"*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:fc,8b,08,c5,29,48,f8,00
DUMPHIVE0.003 (REGF)
.
--------------------- 运行进程下的动态链接库 ---------------------
.
- - - - - - - > 'winlogon.exe'(696)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(416)
c:\windows\system32\WININET.dll
c:\documents and settings\Vivian\Application Data\Dropbox\bin\DropboxExt.19.dll
c:\windows\IME\SPGRMR.DLL
c:\program files\Common Files\Microsoft Shared\INK\SKCHUI.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\program files\SUPERAntiSpyware\SASSEH.DLL
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
.
------------------------ 其他运行进程 ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\conime.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicator.exe
.
**************************************************************************
.
完成时间: 2013-06-10 13:49:36 - 电脑已重新启动
ComboFix-quarantined-files.txt 2013-06-10 20:49
ComboFix2.txt 2013-06-09 13:43
ComboFix3.txt 2012-08-23 01:18
ComboFix4.txt 2011-02-11 02:31
.
Pre-Run: 413,228,789,760 bytes free
Post-Run: 413,035,225,088 bytes free
.
- - End Of File - - AB0640A8D7AF999ADC3A38D0082A5C8B
8F558EB6672622401DA993E1E865C861

SystemLook 30.07.11 by jpshortstuff
Log created at 13:51 on 10/06/2013 by Vivian
Administrator - Elevation successful

========== reg ==========

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
"HTTPFilter"="HTTPFilter"
"LocalService"="Alerter WebClient LmHosts RemoteRegistry upnphost SSDPSRV"
"NetworkService"="DnsCache"
"netsvcs"="6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule Seclogon SENS Sharedaccess SRService Tapisrv Themes TrkWks W32Time WZCSVC Wmi WmdmPmSp winmgmt wscsvc xmlprov BITS wuauserv ShellHWDetection helpsvc WmdmPmSN napagent hkmsvc"
"DcomLaunch"="DcomLaunch TermService"
"rpcss"="RpcSs"
"imgsvc"="StiSvc"
"termsvcs"="TermService"
"eapsvcs"="eaphost"
"dot3svc"="dot3svc"
"HPZ12"="Pml Driver HPZ12 Net Driver HPZ12"
"hpdevmgmt"="hpqcxs08 hpqddsvc"
"FunshionServiceTools"="FunshionSvr"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\DComLaunch]
"CoInitializeSecurityParam"= 0x0000000001 (1)
"DefaultRpcStackSize"= 0x0000000008 (8)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\dot3svc]
"AuthenticationCapabilities"= 0x0000003020 (12320)
"CoInitializeSecurityParam"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\eapsvcs]
"AuthenticationCapabilities"= 0x0000003020 (12320)
"CoInitializeSecurityParam"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\HTTPFilter]
"CoInitializeSecurityParam"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalService]
"CoInitializeSecurityParam"= 0x0000000001 (1)
"AuthenticationCapabilities"= 0x0000002000 (8192)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\netsvcs]
"CoInitializeSecurityParam"= 0x0000000001 (1)
"AuthenticationCapabilities"= 0x0000003020 (12320)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\PCHealth]
"CoInitializeSecurityParam"= 0x0000000002 (2)
"AuthenticationCapabilities"= 0x0000000040 (64)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\termsvcs]
"CoInitializeSecurityParam"= 0x0000000001 (1)
"DefaultRpcStackSize"= 0x0000000008 (8)

-= EOF =-


----------



## emeraldnzl (Nov 3, 2007)

Looks like you are still having the language issue. Try resetting it again now that hopefully... we have made some progress towards getting rid of the source of this infection.

Here is the link again:

Go to the link below and click on the link Set the default input language in Windows XP

http://office.microsoft.com/en-nz/e...ffice-programs-HA010356057.aspx#_Toc310590335

*After that*

Please download the latest version of TDSSKiller from *here* and save it to your *Desktop*.

Doubleclick on *TDSSKiller.exe* to run the application, then click on *Change parameters.*










Put a checkmark beside *loaded modules*.










A reboot will be needed to apply the changes. Do it.
TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
Then click on *Change parameters* in TDSSKiller.
Check all boxes then click OK.










Click the *Start Scan* button.










The scan should take no longer than 2 minutes.
If a *suspicious object* is detected, the default action will be *Skip*, click on *Continue*.










 If *malicious objects* are found, they will show in the Scan results - Select action for found objects and offer three options.
Ensure *Cure* (default) is selected, then click *Continue* > *Reboot now to finish the cleaning process.*










*Note*: If *Cure* is not available, please choose *Skip* instead, do not choose *Delete* unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of "*TDSSKiller.[Version]_[Date]_[Time]_log.txt*". Please copy and paste the contents of that file here and tell me how the language thing went.


----------



## errorloading (Feb 4, 2011)

08:58:12.0031 3492 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
08:58:12.0609 3492 ============================================================
08:58:12.0609 3492 Current date / time: 2013/06/11 08:58:12.0609
08:58:12.0609 3492 SystemInfo:
08:58:12.0609 3492 
08:58:12.0609 3492 OS Version: 5.1.2600 ServicePack: 3.0
08:58:12.0609 3492 Product type: Workstation
08:58:12.0609 3492 ComputerName: VIVIANSCOMPUTER
08:58:12.0609 3492 UserName: Vivian
08:58:12.0609 3492 Windows directory: C:\WINDOWS
08:58:12.0609 3492 System windows directory: C:\WINDOWS
08:58:12.0609 3492 Processor architecture: Intel x86
08:58:12.0609 3492 Number of processors: 2
08:58:12.0609 3492 Page size: 0x1000
08:58:12.0609 3492 Boot type: Normal boot
08:58:12.0609 3492 ============================================================
08:58:13.0656 3492 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000058
08:58:13.0656 3492 ============================================================
08:58:13.0656 3492 \Device\Harddisk0\DR0:
08:58:13.0656 3492 MBR partitions:
08:58:13.0656 3492 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A380D41
08:58:13.0656 3492 ============================================================
08:58:13.0656 3492 C: <-> \Device\Harddisk0\DR0\Partition1
08:58:13.0703 3492 ============================================================
08:58:13.0703 3492 Initialize success
08:58:13.0703 3492 ============================================================
08:58:17.0390 1040 Deinitialize success


----------



## emeraldnzl (Nov 3, 2007)

That looks good.

How is your machine now?


----------



## errorloading (Feb 4, 2011)

everything seems to be working fine. Thank you.

When I logged in as user "Theresa", the "Tudou" logon page still showed up. It is not a big deal, just to let u know what is happening.


----------



## emeraldnzl (Nov 3, 2007)

> When I logged in as user "Theresa", the "Tudou" logon page still showed up.


Thought we would have got rid of that by now.

Is that showing in your browser and if so what one are you using e.g. is it Firefox?

Tell me when you come back.

*Meantime please do this:*

Please download *SystemLook* from one of the links below and save it to your Desktop.
*Download Mirror #1
Download Mirror #2*

Double-click *SystemLook.exe* to run it.
Copy the content of the following codebox into the main textfield:

```
:folderfind
*Tudou*

:regfind
TudouVa.exe

:filefind
*Tudou*
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found at on your Desktop entitled *SystemLook.txt*


----------



## errorloading (Feb 4, 2011)

it starts as soon as I log in before I start clicking any browser

SystemLook 30.07.11 by jpshortstuff
Log created at 09:57 on 12/06/2013 by Vivian
Administrator - Elevation successful

========== folderfind ==========

Searching for "*Tudou*"
C:\Documents and Settings\tso\My Documents\iTudou d------ [14:22 10/12/2009]
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou d------ [14:29 10/12/2009]
C:\Documents and Settings\tso\My Documents\iTudou\itudou d------ [14:32 10/12/2009]
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou d------ [14:29 10/12/2009]
C:\Documents and Settings\tso\Start Menu\Programs\itudou d------ [14:22 10/12/2009]
C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou d------ [01:47 26/05/2013]
C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\·ÉËÙTudou d------ [01:47 26/05/2013]
C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\·ÉËÙTudou\tudou d------ [01:47 26/05/2013]

========== regfind ==========

Searching for "TudouVa.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe"="飞速土豆1.30"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\TudouVa.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\TudouVa.exe]
@="C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe"="C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe:*isabled:飞速土豆1.30"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\TudouVa.exe"="C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\TudouVa.exe:*:Enabled:飞速土豆1.30"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe"="C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe:*isabled:飞速土豆1.30"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\TudouVa.exe"="C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\TudouVa.exe:*:Enabled:飞速土豆1.30"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe"="C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe:*isabled:飞速土豆1.30"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\TudouVa.exe"="C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\TudouVa.exe:*:Enabled:飞速土豆1.30"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe"="C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe:*isabled:飞速土豆1.30"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\TudouVa.exe"="C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\TudouVa.exe:*:Enabled:飞速土豆1.30"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\·ÉËÙTudou\TudouVa.exe"="飞速土豆1.30"
[HKEY_USERS\S-1-5-21-1454471165-1788223648-725345543-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe"="飞速土豆1.30"
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\·ÉËÙTudou\TudouVa.exe"="飞速土豆1.30"

========== filefind ==========

Searching for "*Tudou*"
C:\Documents and Settings\tso\tudouproxy.inf --a--c- 1022 bytes [21:29 20/04/2011] [18:59 22/11/2011] BEE69026203053B9D8919DCF04051A4B
C:\Documents and Settings\tso\Cookies\[email protected][1].txt --a---- 75 bytes [19:44 04/02/2011] [19:44 04/02/2011] BA9741B2C3910994652E5E9B964324A3
C:\Documents and Settings\tso\Desktop\Unused Desktop Shortcuts\itudou.lnk --a--c- 559 bytes [14:22 10/12/2009] [14:32 10/12/2009] A13AC679938CA7CBA3B670808B84E64D
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\7NJ08KDN\www.tudou[1].xml --a--c- 97 bytes [14:33 10/12/2009] [14:38 10/12/2009] ACC79DAAA9C4518DDD41A367424D89E5
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\9E8BHA44\so.tudou[1].xml --a--c- 13 bytes [14:35 10/12/2009] [14:35 10/12/2009] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\RA3PHIW7\movie.tudou[1].xml --a--c- 13 bytes [14:33 10/12/2009] [14:33 10/12/2009] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\WDRUWJT8\ui.tudou[1].xml --a--c- 13 bytes [23:35 03/06/2010] [23:35 03/06/2010] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
C:\Documents and Settings\tso\My Documents\iTudou\iTudou.exe --a---- 1216512 bytes [06:31 03/08/2009] [06:31 03/08/2009] 3CD46F8A4F79A13C5D050F4F6BE1D440
C:\Documents and Settings\tso\My Documents\iTudou\itudou.ico --a--c- 4286 bytes [09:36 23/07/2009] [09:36 23/07/2009] 1659131AC2384CCBC60C87AA6C9A81DA
C:\Documents and Settings\tso\My Documents\iTudou\itudou.ini --a---- 341 bytes [14:22 10/12/2009] [21:50 11/06/2013] 85C4C9F52B9AF81F4A9CAAF7BD157B2D
C:\Documents and Settings\tso\My Documents\iTudou\iTudou.url --a--c- 46 bytes [14:22 10/12/2009] [14:22 10/12/2009] ADA3DBEEAE02C7E5A2FF3CFB43F8E8F4
C:\Documents and Settings\tso\My Documents\iTudou\TudouUpload.dll --a--c- 105472 bytes [02:02 06/11/2008] [02:02 06/11/2008] DB5DDC4DAD9017C583AF3FAEC48D5699
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\CheckTudouVa.dll --a--c- 253952 bytes [18:18 12/10/2009] [18:18 12/10/2009] B368F4CD69AD024B1365FC37D1C95EC9
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\ICheckTudouVa.xpt --a--c- 186 bytes [18:18 12/10/2009] [18:18 12/10/2009] BD5E036418BA655273E01896AAAF25BB
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudouDetector.dll --a--c- 87464 bytes [23:50 10/10/2009] [23:50 10/10/2009] 4DBAF3F06E605F152443DFD9CDBA54D6
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\TudouVa.exe --a--c- 1323008 bytes [18:19 12/10/2009] [18:19 12/10/2009] 17E777DACBB260346095971EE1737BFD
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudouva.ini --a--c- 380 bytes [05:56 26/03/2009] [17:06 16/07/2010] ED482C2494853F3749BAC235E11CA49F
C:\Documents and Settings\tso\Start Menu\Programs\itudou\itudou.lnk --a---- 571 bytes [14:22 10/12/2009] [14:32 10/12/2009] B4C5B2D075BAAF5B511647FE85749C6A
C:\Documents and Settings\tso\Start Menu\Programs\itudou\Ð¶ÔØitudou.lnk --a---- 571 bytes [14:22 10/12/2009] [14:32 10/12/2009] 5055C35D899954FD9C2CE82D6B0B305E
C:\Documents and Settings\tso\Start Menu\Programs\Startup\Æô¶¯iTudou.lnk --a---- 603 bytes [14:22 10/12/2009] [02:20 29/07/2010] 300D37F566CD8246CC732E5AF0F2B897
C:\Documents and Settings\tso\Start Menu\Programs\Startup\启动iTudou.lnk --a---- 603 bytes [15:40 09/06/2013] [21:50 11/06/2013] 4C2B6D177F82FE975794C926D9DDA8FA
C:\Documents and Settings\Vivian\tudouproxy.inf --a--c- 1022 bytes [16:42 20/04/2011] [17:38 22/11/2011] BEE69026203053B9D8919DCF04051A4B
C:\Documents and Settings\Vivian\My Documents\TudouVa1.30_1010B.exe --a--c- 2290731 bytes [05:59 02/01/2010] [05:59 02/01/2010] ED2F007C1E688441E68A2F1D3DF5A40D
C:\Documents and Settings\Vivian\My Documents\My Videos\tu dou.txt --a--c- 2652 bytes [05:20 28/04/2009] [08:37 26/10/2009] FBCE2D98FDDF0D4CE4275CA94EAD8A52
C:\FRST\Quarantine\启动iTudou.lnk --a---- 603 bytes [17:07 29/07/2010] [01:13 05/06/2013] 846492D3756B59D53490387BCBFF5344
C:\WINDOWS\Prefetch\ITUDOU.EXE-2A0A65EA.pf --a---- 42476 bytes [15:41 09/06/2013] [21:50 11/06/2013] 427A5D002A2D347F89BABA5D45FC8473
C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\·ÉËÙTudou\CheckTudouVa.dll --a--c- 253952 bytes [18:18 12/10/2009] [18:18 12/10/2009] B368F4CD69AD024B1365FC37D1C95EC9
C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\·ÉËÙTudou\ICheckTudouVa.xpt --a--c- 186 bytes [18:18 12/10/2009] [18:18 12/10/2009] BD5E036418BA655273E01896AAAF25BB
C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\·ÉËÙTudou\tudouDetector.dll --a--c- 87464 bytes [23:50 10/10/2009] [23:50 10/10/2009] 4DBAF3F06E605F152443DFD9CDBA54D6
C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\·ÉËÙTudou\TudouVa.exe --a---- 1323008 bytes [18:19 12/10/2009] [18:19 12/10/2009] 17E777DACBB260346095971EE1737BFD
C:\_OTL\MovedFiles\05252013_184704\C_Program Files\Tudou\·ÉËÙTudou\tudouva.ini --a--c- 364 bytes [05:56 26/03/2009] [12:23 29/07/2010] 204EA620F99CCC7E89DFB0E015577323

-= EOF =-


----------



## emeraldnzl (Nov 3, 2007)

Let' have another go at this pesky thing.

Please run OTL.exe


Under the *Custom Scans/Fixes* box at the bottom, copy and paste the content of the quote box below:



> :Reg
> [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
> "C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe"=-
> 
> ...



Then click the *Run Fix* button at the top
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply.The log is saved in the same location as OTL.


----------



## errorloading (Feb 4, 2011)

All processes killed
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\Program Files\Tudou\·ÉËÙTudou\TudouVa.exe deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\TudouVa.exe\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameter s\FirewallPolicy\StandardProfile\AuthorizedApplications\List not found.
========== FILES ==========
C:\Documents and Settings\tso\update folder moved successfully.
C:\Documents and Settings\tso\Tracing\WPPMedia folder moved successfully.
C:\Documents and Settings\tso\Tracing folder moved successfully.
C:\Documents and Settings\tso\Templates folder moved successfully.
C:\Documents and Settings\tso\Start Menu\Programs\¿ì³µ(FlashGet)3.4 folder moved successfully.
C:\Documents and Settings\tso\Start Menu\Programs\·ÉËÙÍÁ¶¹ folder moved successfully.
C:\Documents and Settings\tso\Start Menu\Programs\Startup folder moved successfully.
C:\Documents and Settings\tso\Start Menu\Programs\itudou folder moved successfully.
C:\Documents and Settings\tso\Start Menu\Programs\Accessories\System Tools folder moved successfully.
C:\Documents and Settings\tso\Start Menu\Programs\Accessories\Entertainment folder moved successfully.
C:\Documents and Settings\tso\Start Menu\Programs\Accessories\Accessibility folder moved successfully.
C:\Documents and Settings\tso\Start Menu\Programs\Accessories folder moved successfully.
C:\Documents and Settings\tso\Start Menu\Programs folder moved successfully.
C:\Documents and Settings\tso\Start Menu folder moved successfully.
C:\Documents and Settings\tso\SendTo folder moved successfully.
C:\Documents and Settings\tso\Recent folder moved successfully.
C:\Documents and Settings\tso\PrivacIE folder moved successfully.
C:\Documents and Settings\tso\PrintHood folder moved successfully.
C:\Documents and Settings\tso\NetHood\My Web Sites on MSN folder moved successfully.
C:\Documents and Settings\tso\NetHood folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\update folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\export folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\downloadinfo folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\47979227 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\47774181 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\45783656 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\45704199 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\45691916 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\45497235 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\45377315 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\44221324 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\44220437 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\44218579 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\44214910 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\44214896 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\43628918 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\43456172 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\43325129 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\43265703 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\42388625 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\40353227 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\40351648 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\40349350 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\40346417 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\40212457 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\39334809 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\39063994 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\38633985 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\38633932 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\38631738 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\37530671 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\37530334 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\37530242 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\37530142 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\37530077 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\37529974 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\37529830 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\37529660 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\37529420 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\37528864 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\37527619 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\37520573 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\37516766 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\36508720 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\36480362 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\36386367 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\36303949 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\35811234 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\35393582 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\35034351 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\34911854 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\34884008 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\34305009 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\28625242 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\27686980 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\23324874 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\22145919 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\20903387 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1231200847 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1229476931 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1228166631 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1227837593 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1227570987 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1227324336 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1226844473 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1226778400 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1226586513 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1226357241 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1226127947 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1223092175 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1223092173 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1223091244 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1223091021 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1147774751 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1147425106 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1144113254 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1131199117 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1130849285 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1130765021 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1130764126 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1130665782 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1130599889 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1129962163 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1129942300 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1129648324 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1129643479 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1129610293 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1129502732 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1129494540 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1129476930 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1129465820 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1129109613 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1128788068 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1128631099 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1128444763 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1128166630 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1127324335 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1127092625 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1127070628 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1126877521 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1126357240 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1124145888 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1123092174 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1123092172 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1123092168 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1123091243 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\1121169769 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download\10230276 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou\download folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\tudou folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\Skin\Prog\Prog_4 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\Skin\Prog\Prog_3 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\Skin\Prog\Prog_2 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\Skin\Prog folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\Skin\Pop\Pop_4 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\Skin\Pop\Pop_3 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\Skin\Pop\Pop_2 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\Skin\Pop folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\Skin\Mini\Mini_4 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\Skin\Mini\Mini_3 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\Skin\Mini\Mini_2 folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\Skin\Mini folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\Skin folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou\ad folder moved successfully.
C:\Documents and Settings\tso\My Documents\·ÉËÙTudou folder moved successfully.
C:\Documents and Settings\tso\My Documents\Simple123temp folder moved successfully.
C:\Documents and Settings\tso\My Documents\New Folder (2) folder moved successfully.
C:\Documents and Settings\tso\My Documents\New Folder folder moved successfully.
C:\Documents and Settings\tso\My Documents\NeroVision\ImportedVideo folder moved successfully.
C:\Documents and Settings\tso\My Documents\NeroVision\ExportedVideo folder moved successfully.
C:\Documents and Settings\tso\My Documents\NeroVision\ExportedAudio folder moved successfully.
C:\Documents and Settings\tso\My Documents\NeroVision\CapturedVideo folder moved successfully.
C:\Documents and Settings\tso\My Documents\NeroVision folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Videos\my birthday speech folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Videos folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Scans\2011-02 (Feb) folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Scans\2010-06 (Jun) folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Scans\2010-01 (Jan) folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Scans folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Vivian & the new baby 2009-11-20 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Valentine 2013 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\tso 60th b'day party folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\the Ip family 2009-11-20 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Thanksgiving party 2009 2009-10-12 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Thanksgiving 2009 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Picture folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\New Folder folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\my 60th birthday private party 2009-11-27 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Matthias with the bunny coat 2009-11-17 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Matthias spying around the house 2009-10-25 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Matthias learning to walk 2009-11-17 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Matthias learning to walk 2009-10-24 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Matthias in pyjama 2009-11-02 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Matthias having banana for breakfast 2009-10-24 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Matthias and us 2009-10-12 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Matthias 2009-11-18 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\Matthias 2 2009-11-09 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\jim folder folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\glen pine xmas 2009 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\CCO new office grand opening party 2009-10-16 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\CCO 2009-10-16 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\at home with Matthias 2009-11-24 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\2009-12-07 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\2009-12-01 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\2009-11-29 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures\2009-11-28 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Pictures folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Music\free computer downloads_files\st_data_002\iframe3_data\click25jBaANrvCQBsFy0AAAAAAESjDAAAAAAAAgACLAIAAAAAAP8AAAAECTlJDA folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Music\free computer downloads_files\st_data_002\iframe3_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Music\free computer downloads_files\st_data_002 folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Music\free computer downloads_files\st_data\iframe3_data\ripple_core_iframe_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Music\free computer downloads_files\st_data\iframe3_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Music\free computer downloads_files\st_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Music\free computer downloads_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\My Music folder moved successfully.
C:\Documents and Settings\tso\My Documents\iTudou\_55931814\upload folder moved successfully.
C:\Documents and Settings\tso\My Documents\iTudou\_55931814\pic folder moved successfully.
C:\Documents and Settings\tso\My Documents\iTudou\_55931814\homepage folder moved successfully.
C:\Documents and Settings\tso\My Documents\iTudou\_55931814\download\fileInfo folder moved successfully.
C:\Documents and Settings\tso\My Documents\iTudou\_55931814\download folder moved successfully.
C:\Documents and Settings\tso\My Documents\iTudou\_55931814\convert folder moved successfully.
C:\Documents and Settings\tso\My Documents\iTudou\_55931814 folder moved successfully.
C:\Documents and Settings\tso\My Documents\iTudou\user folder moved successfully.
C:\Documents and Settings\tso\My Documents\iTudou\update folder moved successfully.
C:\Documents and Settings\tso\My Documents\iTudou\itudou\downloadinfo folder moved successfully.
C:\Documents and Settings\tso\My Documents\iTudou\itudou folder moved successfully.
C:\Documents and Settings\tso\My Documents\iTudou folder moved successfully.
C:\Documents and Settings\tso\My Documents\Downloads folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\turkey-101-for-the-poultry-challenged_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\turkey chili_files\a_data_002 folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\turkey chili_files\a_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\turkey chili_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\shepherd pie uses lamb_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\Sesame-green-beans-and-bok-choy_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\Sausage-and-raisin-stuffing_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\redgown_files\fashion_data_003 folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\redgown_files\fashion_data_002 folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\redgown_files\fashion_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\redgown_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\pumpkin bread_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\Nigella-Lawson-s-Christmas-cupcakes_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\martini_files\st_data\iframe3_data\a_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\martini_files\st_data\iframe3_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\martini_files\st_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\martini_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\Italian_Fish_Bake_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\home_family-greek_twist_on_classic_shepherd_s_pie_uses_lamb_topped_with_polenta_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\home_family-feed_a_crowd_with_an_easy_roasted_salmon_recipe_for_herb-roasted_salmon_files\st_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\home_family-feed_a_crowd_with_an_easy_roasted_salmon_recipe_for_herb-roasted_salmon_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\home_family-bread_in_5_minutes_recipe_for_whole_grain_garlic_knots_with_parsley_and_olive_oil_files\a_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\home_family-bread_in_5_minutes_recipe_for_whole_grain_garlic_knots_with_parsley_and_olive_oil_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\Fully-Festive-Ham_files\a_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\Fully-Festive-Ham_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\eveningdress_files\fashion_data_003 folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\eveningdress_files\fashion_data_002 folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\eveningdress_files\fashion_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\eveningdress_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\crisped-Brussels-Sprouts_files\a_data folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\crisped-Brussels-Sprouts_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\banana walnut sour cream bread_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking\Baked-won-ton-dippers_files folder moved successfully.
C:\Documents and Settings\tso\My Documents\cooking folder moved successfully.
C:\Documents and Settings\tso\My Documents folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Temporary Internet Files\Content.IE5\Z0HB08B4 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Temporary Internet Files\Content.IE5\R8Q70L3Q folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Temporary Internet Files\Content.IE5\58RBHEVI folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Temporary Internet Files\Content.IE5\225H3V9B folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Temporary Internet Files\Content.IE5 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Temporary Internet Files\AntiPhishing folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Temporary Internet Files folder moved successfully.
C:\Documents and Settings\tso\Local Settings\temp\Temporary Internet Files\Content.IE5\Z8M7DZJB folder moved successfully.
C:\Documents and Settings\tso\Local Settings\temp\Temporary Internet Files\Content.IE5\VJPGMK17 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\temp\Temporary Internet Files\Content.IE5\0DN2QNSW folder moved successfully.
C:\Documents and Settings\tso\Local Settings\temp\Temporary Internet Files\Content.IE5\02KKN48G folder moved successfully.
C:\Documents and Settings\tso\Local Settings\temp\Temporary Internet Files\Content.IE5 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\temp\Temporary Internet Files folder moved successfully.
C:\Documents and Settings\tso\Local Settings\temp\History\History.IE5 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\temp\History folder moved successfully.
C:\Documents and Settings\tso\Local Settings\temp\Cookies folder moved successfully.
C:\Documents and Settings\tso\Local Settings\temp folder moved successfully.
C:\Documents and Settings\tso\Local Settings\History\History.IE5\MSHist012013061120130612 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\History\History.IE5\MSHist012013060320130610 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\History\History.IE5\MSHist012013052720130603 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\History\History.IE5\MSHist012013052020130527 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\History\History.IE5 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\History folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Apps\2.0\Q5J3GEPP.ARE\DK1OO9JC.C63\manifests folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Apps\2.0\Q5J3GEPP.ARE\DK1OO9JC.C63 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Apps\2.0\Q5J3GEPP.ARE folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Apps\2.0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Apps folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Yahoo\YSuperChromeSearch folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Yahoo folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Temp\Adobe\Acrobat\10.0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Temp\Adobe\Acrobat folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Temp\Adobe folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Temp folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Skype\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8} folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Skype folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\thumbnails folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\startupCache folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\safebrowsing folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\F folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\E folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\D\47 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\D folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\C\08 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\C folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\B folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\A folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\9 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\8 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\7\4A folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\7 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\6\29 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\6 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\5 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\4 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\3 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\2 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\1 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache\0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\Cache folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Profiles folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Mozilla Firefox\updates\0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Mozilla Firefox\updates folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox\Mozilla Firefox folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla\Firefox folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Mozilla folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Media\9.0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Media\10.0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Media folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Photo Gallery\SqmApi folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Photo Gallery folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Photo Acquisition folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts\{e476658d-2c88-41bf-bcf4-562a457d05c2}\DBStore\LogFiles folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts\{e476658d-2c88-41bf-bcf4-562a457d05c2}\DBStore\Backup\new folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts\{e476658d-2c88-41bf-bcf4-562a457d05c2}\DBStore\Backup folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts\{e476658d-2c88-41bf-bcf4-562a457d05c2}\DBStore folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts\{e476658d-2c88-41bf-bcf4-562a457d05c2} folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts\{07fe9796-79ee-4c33-a53c-e467b2cff8c9}\DBStore\LogFiles folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts\{07fe9796-79ee-4c33-a53c-e467b2cff8c9}\DBStore\Backup\new folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts\{07fe9796-79ee-4c33-a53c-e467b2cff8c9}\DBStore\Backup folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts\{07fe9796-79ee-4c33-a53c-e467b2cff8c9}\DBStore folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts\{07fe9796-79ee-4c33-a53c-e467b2cff8c9} folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts\{04cb5c9e-54b8-470e-a20a-89fb1c9bcbfa}\DBStore\LogFiles folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts\{04cb5c9e-54b8-470e-a20a-89fb1c9bcbfa}\DBStore folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts\{04cb5c9e-54b8-470e-a20a-89fb1c9bcbfa} folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows Live Contacts folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Windows folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Speech\Files\MSASR folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Speech\Files folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Speech folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Silverlight folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Search Enhancement Pack\Search Box Extension folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Search Enhancement Pack folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Outlook folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\OFFICE\12.0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\OFFICE folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SocialNews folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Messenger\[email protected]\ObjectStore\UserTile folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Messenger\[email protected]\ObjectStore\SignatureSounds folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Messenger\[email protected]\ObjectStore\Scenes folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Messenger\[email protected]\ObjectStore\DynamicBackgrounds folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Messenger\[email protected]\ObjectStore\Backgrounds folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Messenger\[email protected]\ObjectStore folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Messenger\[email protected] folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Messenger folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Media Player\Transcoded Files Cache folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Media Player folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer\Services folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Last Active folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\WDRUWJT8 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\RA3PHIW7 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\9E8BHA44 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\7NJ08KDN folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Internet Explorer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\IMJP9_0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\IMJP8_1 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\IMJP12 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\IME12 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\HelpCtr folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\FORMS folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Feeds Cache\GLXYDCRL folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Feeds Cache\AFEYBRFC folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Feeds Cache\59Y2H9IW folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Feeds Cache\4V9DP016 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Feeds Cache folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~ folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~ folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Feeds\Microsoft Feeds~ folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Feeds\Links~ folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Feeds folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1454471165-1788223648-725345543-1007 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\Credentials folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\CD Burning folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Temp folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\System\Flights\prod-en-us_prod_0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\System\Flights\bingtrends_trends7-2-232_5 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\System\Flights folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\System folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Weather_63630244a02f4e4cb6cb9b09b2f886f3\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Weather_63630244a02f4e4cb6cb9b09b2f886f3\7.2.16\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Weather_63630244a02f4e4cb6cb9b09b2f886f3\7.2.16\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Weather_63630244a02f4e4cb6cb9b09b2f886f3\7.2.16\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Weather_63630244a02f4e4cb6cb9b09b2f886f3\7.2.16\images\icons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Weather_63630244a02f4e4cb6cb9b09b2f886f3\7.2.16\images\buttons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Weather_63630244a02f4e4cb6cb9b09b2f886f3\7.2.16\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Weather_63630244a02f4e4cb6cb9b09b2f886f3\7.2.16\footer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Weather_63630244a02f4e4cb6cb9b09b2f886f3\7.2.16\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Weather_63630244a02f4e4cb6cb9b09b2f886f3\7.2.16 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Weather_63630244a02f4e4cb6cb9b09b2f886f3 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\videos_6064022068cb4bd18a6a06908597e0d8\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\videos_6064022068cb4bd18a6a06908597e0d8\7.1.406\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\videos_6064022068cb4bd18a6a06908597e0d8\7.1.406\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\videos_6064022068cb4bd18a6a06908597e0d8\7.1.406\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\videos_6064022068cb4bd18a6a06908597e0d8\7.1.406\images\icons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\videos_6064022068cb4bd18a6a06908597e0d8\7.1.406\images\buttons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\videos_6064022068cb4bd18a6a06908597e0d8\7.1.406\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\videos_6064022068cb4bd18a6a06908597e0d8\7.1.406\footer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\videos_6064022068cb4bd18a6a06908597e0d8\7.1.406\debugconsole folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\videos_6064022068cb4bd18a6a06908597e0d8\7.1.406\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\videos_6064022068cb4bd18a6a06908597e0d8\7.1.406 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\videos_6064022068cb4bd18a6a06908597e0d8 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Translator_f5cbd3ef4c144434b17913278004e270\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Translator_f5cbd3ef4c144434b17913278004e270\7.2.229\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Translator_f5cbd3ef4c144434b17913278004e270\7.2.229\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Translator_f5cbd3ef4c144434b17913278004e270\7.2.229\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Translator_f5cbd3ef4c144434b17913278004e270\7.2.229\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Translator_f5cbd3ef4c144434b17913278004e270\7.2.229 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Translator_f5cbd3ef4c144434b17913278004e270 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Toast Application_d97e92f94d53425fbcf0f2a04b8e5426\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Toast Application_d97e92f94d53425fbcf0f2a04b8e5426\7.1.391\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Toast Application_d97e92f94d53425fbcf0f2a04b8e5426\7.1.391\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Toast Application_d97e92f94d53425fbcf0f2a04b8e5426\7.1.391\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Toast Application_d97e92f94d53425fbcf0f2a04b8e5426\7.1.391\images\buttons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Toast Application_d97e92f94d53425fbcf0f2a04b8e5426\7.1.391\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Toast Application_d97e92f94d53425fbcf0f2a04b8e5426\7.1.391\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Toast Application_d97e92f94d53425fbcf0f2a04b8e5426\7.1.391 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Toast Application_d97e92f94d53425fbcf0f2a04b8e5426 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\SlackerRadio_66c7082f7eab4d166b29bbf246c23ab4\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\SlackerRadio_66c7082f7eab4d166b29bbf246c23ab4\7.2.229\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\SlackerRadio_66c7082f7eab4d166b29bbf246c23ab4\7.2.229\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\SlackerRadio_66c7082f7eab4d166b29bbf246c23ab4\7.2.229\js\com\slacker\util folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\SlackerRadio_66c7082f7eab4d166b29bbf246c23ab4\7.2.229\js\com\slacker\app folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\SlackerRadio_66c7082f7eab4d166b29bbf246c23ab4\7.2.229\js\com\slacker folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\SlackerRadio_66c7082f7eab4d166b29bbf246c23ab4\7.2.229\js\com folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\SlackerRadio_66c7082f7eab4d166b29bbf246c23ab4\7.2.229\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\SlackerRadio_66c7082f7eab4d166b29bbf246c23ab4\7.2.229\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\SlackerRadio_66c7082f7eab4d166b29bbf246c23ab4\7.2.229\flash folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\SlackerRadio_66c7082f7eab4d166b29bbf246c23ab4\7.2.229\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\SlackerRadio_66c7082f7eab4d166b29bbf246c23ab4\7.2.229 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\SlackerRadio_66c7082f7eab4d166b29bbf246c23ab4 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Skype_5a86457b11ab4271bb7c327deb8afa1f\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Skype_5a86457b11ab4271bb7c327deb8afa1f\7.2.229\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Skype_5a86457b11ab4271bb7c327deb8afa1f\7.2.229\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Skype_5a86457b11ab4271bb7c327deb8afa1f\7.2.229\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Skype_5a86457b11ab4271bb7c327deb8afa1f\7.2.229\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Skype_5a86457b11ab4271bb7c327deb8afa1f\7.2.229 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Skype_5a86457b11ab4271bb7c327deb8afa1f folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Search_6f21d9007fa34bc78d94309126de58f5\VersionIndependent\textGhostingStates folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Search_6f21d9007fa34bc78d94309126de58f5\VersionIndependent\newsState folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Search_6f21d9007fa34bc78d94309126de58f5\VersionIndependent\iotdState folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Search_6f21d9007fa34bc78d94309126de58f5\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Search_6f21d9007fa34bc78d94309126de58f5\7.1.382\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Search_6f21d9007fa34bc78d94309126de58f5\7.1.382\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Search_6f21d9007fa34bc78d94309126de58f5\7.1.382\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Search_6f21d9007fa34bc78d94309126de58f5\7.1.382\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Search_6f21d9007fa34bc78d94309126de58f5\7.1.382\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Search_6f21d9007fa34bc78d94309126de58f5\7.1.382 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Search_6f21d9007fa34bc78d94309126de58f5 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Rewards_e3d654a3d16a49cfaba24a26771e9570\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Rewards_e3d654a3d16a49cfaba24a26771e9570\7.1.383\service folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Rewards_e3d654a3d16a49cfaba24a26771e9570\7.1.383\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Rewards_e3d654a3d16a49cfaba24a26771e9570\7.1.383\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Rewards_e3d654a3d16a49cfaba24a26771e9570\7.1.383\jscrollpane folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Rewards_e3d654a3d16a49cfaba24a26771e9570\7.1.383\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Rewards_e3d654a3d16a49cfaba24a26771e9570\7.1.383\images\buttons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Rewards_e3d654a3d16a49cfaba24a26771e9570\7.1.383\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Rewards_e3d654a3d16a49cfaba24a26771e9570\7.1.383\footer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Rewards_e3d654a3d16a49cfaba24a26771e9570\7.1.383\css\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Rewards_e3d654a3d16a49cfaba24a26771e9570\7.1.383\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Rewards_e3d654a3d16a49cfaba24a26771e9570\7.1.383 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Rewards_e3d654a3d16a49cfaba24a26771e9570 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Prefetch_23b6673e9bcb43958801f7dfe7c5a2e3\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Prefetch_23b6673e9bcb43958801f7dfe7c5a2e3\7.1.391\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Prefetch_23b6673e9bcb43958801f7dfe7c5a2e3\7.1.391\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Prefetch_23b6673e9bcb43958801f7dfe7c5a2e3\7.1.391 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Prefetch_23b6673e9bcb43958801f7dfe7c5a2e3 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\News_8c172f78520647fbab760cbf38f51e67\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\News_8c172f78520647fbab760cbf38f51e67\7.2.232\loc\en-us\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\News_8c172f78520647fbab760cbf38f51e67\7.2.232\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\News_8c172f78520647fbab760cbf38f51e67\7.2.232\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\News_8c172f78520647fbab760cbf38f51e67\7.2.232\jscrollpane folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\News_8c172f78520647fbab760cbf38f51e67\7.2.232\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\News_8c172f78520647fbab760cbf38f51e67\7.2.232\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\News_8c172f78520647fbab760cbf38f51e67\7.2.232\footer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\News_8c172f78520647fbab760cbf38f51e67\7.2.232\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\News_8c172f78520647fbab760cbf38f51e67\7.2.232 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\News_8c172f78520647fbab760cbf38f51e67 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Movies_f8da75a8ec1048719a540c7742d133f5\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Movies_f8da75a8ec1048719a540c7742d133f5\7.2.229\jscrollpane folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Movies_f8da75a8ec1048719a540c7742d133f5\7.2.229\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Movies_f8da75a8ec1048719a540c7742d133f5\7.2.229\images\buttons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Movies_f8da75a8ec1048719a540c7742d133f5\7.2.229\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Movies_f8da75a8ec1048719a540c7742d133f5\7.2.229\footer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Movies_f8da75a8ec1048719a540c7742d133f5\7.2.229\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Movies_f8da75a8ec1048719a540c7742d133f5\7.2.229 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Movies_f8da75a8ec1048719a540c7742d133f5 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Messenger_43f4adec83fe47edb0519d615ac57b2a\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Messenger_43f4adec83fe47edb0519d615ac57b2a\7.2.229\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Messenger_43f4adec83fe47edb0519d615ac57b2a\7.2.229\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Messenger_43f4adec83fe47edb0519d615ac57b2a\7.2.229\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Messenger_43f4adec83fe47edb0519d615ac57b2a\7.2.229\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Messenger_43f4adec83fe47edb0519d615ac57b2a\7.2.229 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Messenger_43f4adec83fe47edb0519d615ac57b2a folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Maps_e4b69397ea59436c9d8611b45fdb79f9\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Maps_e4b69397ea59436c9d8611b45fdb79f9\7.1.391\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Maps_e4b69397ea59436c9d8611b45fdb79f9\7.1.391\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Maps_e4b69397ea59436c9d8611b45fdb79f9\7.1.391\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Maps_e4b69397ea59436c9d8611b45fdb79f9\7.1.391\images\notifications folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Maps_e4b69397ea59436c9d8611b45fdb79f9\7.1.391\images\buttons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Maps_e4b69397ea59436c9d8611b45fdb79f9\7.1.391\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Maps_e4b69397ea59436c9d8611b45fdb79f9\7.1.391\footer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Maps_e4b69397ea59436c9d8611b45fdb79f9\7.1.391\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Maps_e4b69397ea59436c9d8611b45fdb79f9\7.1.391 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Maps_e4b69397ea59436c9d8611b45fdb79f9 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\VersionIndependent\AccountData folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\7.2.236\providers folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\7.2.236\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\7.2.236\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\7.2.236\jscrollpane folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\7.2.236\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\7.2.236\images\notifications folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\7.2.236\images\buttons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\7.2.236\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\7.2.236\footer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\7.2.236\debugconsole folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\7.2.236\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548\7.2.236 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Mail_15642ee020d2449d86382022aa6f2548 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Jewel_ba5643622e3a457cb0746595f638d9f6\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Jewel_ba5643622e3a457cb0746595f638d9f6\7.1.391\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Jewel_ba5643622e3a457cb0746595f638d9f6\7.1.391\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Jewel_ba5643622e3a457cb0746595f638d9f6\7.1.391\jscrollpane folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Jewel_ba5643622e3a457cb0746595f638d9f6\7.1.391\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Jewel_ba5643622e3a457cb0746595f638d9f6\7.1.391\images\buttons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Jewel_ba5643622e3a457cb0746595f638d9f6\7.1.391\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Jewel_ba5643622e3a457cb0746595f638d9f6\7.1.391\icons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Jewel_ba5643622e3a457cb0746595f638d9f6\7.1.391\footer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Jewel_ba5643622e3a457cb0746595f638d9f6\7.1.391\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Jewel_ba5643622e3a457cb0746595f638d9f6\7.1.391 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Jewel_ba5643622e3a457cb0746595f638d9f6 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\GeoService Application_9fe4b7bf745a416c9858724091e7b720\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\GeoService Application_9fe4b7bf745a416c9858724091e7b720\7.1.391\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\GeoService Application_9fe4b7bf745a416c9858724091e7b720\7.1.391\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\GeoService Application_9fe4b7bf745a416c9858724091e7b720\7.1.391\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\GeoService Application_9fe4b7bf745a416c9858724091e7b720\7.1.391 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\GeoService Application_9fe4b7bf745a416c9858724091e7b720 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Games_6e70de9fd0324919b424492c3e6a043d\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Games_6e70de9fd0324919b424492c3e6a043d\7.2.224\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Games_6e70de9fd0324919b424492c3e6a043d\7.2.224\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Games_6e70de9fd0324919b424492c3e6a043d\7.2.224 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Games_6e70de9fd0324919b424492c3e6a043d folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Finance_8532f9cb39e34e3ca1e1474c73ed45d2\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Finance_8532f9cb39e34e3ca1e1474c73ed45d2 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Featured_ce53daa069a4a3ad2e3d7d81081f340d\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Featured_ce53daa069a4a3ad2e3d7d81081f340d\7.1.391\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Featured_ce53daa069a4a3ad2e3d7d81081f340d\7.1.391\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Featured_ce53daa069a4a3ad2e3d7d81081f340d\7.1.391\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Featured_ce53daa069a4a3ad2e3d7d81081f340d\7.1.391\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Featured_ce53daa069a4a3ad2e3d7d81081f340d\7.1.391\cache folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Featured_ce53daa069a4a3ad2e3d7d81081f340d\7.1.391 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Featured_ce53daa069a4a3ad2e3d7d81081f340d folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\fbsharedservices_bb9c6e8b961d477e9ec95f9698bde610\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\fbsharedservices_bb9c6e8b961d477e9ec95f9698bde610\7.1.400\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\fbsharedservices_bb9c6e8b961d477e9ec95f9698bde610\7.1.400\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\fbsharedservices_bb9c6e8b961d477e9ec95f9698bde610\7.1.400\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\fbsharedservices_bb9c6e8b961d477e9ec95f9698bde610\7.1.400 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\fbsharedservices_bb9c6e8b961d477e9ec95f9698bde610 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Facebook_76c7b5062c4e4be69d843ace834517ec\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Facebook_76c7b5062c4e4be69d843ace834517ec\7.2.229\service folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Facebook_76c7b5062c4e4be69d843ace834517ec\7.2.229\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Facebook_76c7b5062c4e4be69d843ace834517ec\7.2.229\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Facebook_76c7b5062c4e4be69d843ace834517ec\7.2.229\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Facebook_76c7b5062c4e4be69d843ace834517ec\7.2.229\images\notifications folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Facebook_76c7b5062c4e4be69d843ace834517ec\7.2.229\images\buttons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Facebook_76c7b5062c4e4be69d843ace834517ec\7.2.229\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Facebook_76c7b5062c4e4be69d843ace834517ec\7.2.229\footer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Facebook_76c7b5062c4e4be69d843ace834517ec\7.2.229\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Facebook_76c7b5062c4e4be69d843ace834517ec\7.2.229 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Facebook_76c7b5062c4e4be69d843ace834517ec folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\FacebookLike_08e57417866d4faa981702780b0d36c4\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\FacebookLike_08e57417866d4faa981702780b0d36c4\7.1.400\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\FacebookLike_08e57417866d4faa981702780b0d36c4\7.1.400\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\FacebookLike_08e57417866d4faa981702780b0d36c4\7.1.400\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\FacebookLike_08e57417866d4faa981702780b0d36c4\7.1.400\images\notifications folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\FacebookLike_08e57417866d4faa981702780b0d36c4\7.1.400\images\buttons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\FacebookLike_08e57417866d4faa981702780b0d36c4\7.1.400\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\FacebookLike_08e57417866d4faa981702780b0d36c4\7.1.400\footer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\FacebookLike_08e57417866d4faa981702780b0d36c4\7.1.400\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\FacebookLike_08e57417866d4faa981702780b0d36c4\7.1.400 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\FacebookLike_08e57417866d4faa981702780b0d36c4 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Error Application_6685fcaddd1644138dfc117bdf47c3e6\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Error Application_6685fcaddd1644138dfc117bdf47c3e6\7.1.391\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Error Application_6685fcaddd1644138dfc117bdf47c3e6\7.1.391\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Error Application_6685fcaddd1644138dfc117bdf47c3e6\7.1.391\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Error Application_6685fcaddd1644138dfc117bdf47c3e6\7.1.391\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Error Application_6685fcaddd1644138dfc117bdf47c3e6\7.1.391\footer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Error Application_6685fcaddd1644138dfc117bdf47c3e6\7.1.391\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Error Application_6685fcaddd1644138dfc117bdf47c3e6\7.1.391 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Error Application_6685fcaddd1644138dfc117bdf47c3e6 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240\VersionIndependent\upsellState folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240\VersionIndependent\AccountData folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240\7.1.361\providers folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240\7.1.361\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240\7.1.361\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240\7.1.361\jscrollpane folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240\7.1.361\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240\7.1.361\images\buttons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240\7.1.361\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240\7.1.361\footer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240\7.1.361\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240\7.1.361 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Chat_cf57b0088a3b4f61a0bfaad0ba784240 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\BingTrends_093443cc97e04eebaf28fd4938ad2bc9\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\BingTrends_093443cc97e04eebaf28fd4938ad2bc9\7.2.232\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\BingTrends_093443cc97e04eebaf28fd4938ad2bc9\7.2.232\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\BingTrends_093443cc97e04eebaf28fd4938ad2bc9\7.2.232\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\BingTrends_093443cc97e04eebaf28fd4938ad2bc9\7.2.232\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\BingTrends_093443cc97e04eebaf28fd4938ad2bc9\7.2.232 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\BingTrends_093443cc97e04eebaf28fd4938ad2bc9 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\BingDiagnosticsService_7c2bf9f8891c11e1843e4f6dbbe59b18\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\BingDiagnosticsService_7c2bf9f8891c11e1843e4f6dbbe59b18\7.1.410\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\BingDiagnosticsService_7c2bf9f8891c11e1843e4f6dbbe59b18\7.1.410 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\BingDiagnosticsService_7c2bf9f8891c11e1843e4f6dbbe59b18 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Bing Bar Settings_ac63306dfaef4dd89310251954aea031\VersionIndependent folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Bing Bar Settings_ac63306dfaef4dd89310251954aea031\7.1.384\loc\en-us folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Bing Bar Settings_ac63306dfaef4dd89310251954aea031\7.1.384\loc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Bing Bar Settings_ac63306dfaef4dd89310251954aea031\7.1.384\jscrollpane folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Bing Bar Settings_ac63306dfaef4dd89310251954aea031\7.1.384\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Bing Bar Settings_ac63306dfaef4dd89310251954aea031\7.1.384\images\buttons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Bing Bar Settings_ac63306dfaef4dd89310251954aea031\7.1.384\images folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Bing Bar Settings_ac63306dfaef4dd89310251954aea031\7.1.384\debugconsole folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Bing Bar Settings_ac63306dfaef4dd89310251954aea031\7.1.384\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Bing Bar Settings_ac63306dfaef4dd89310251954aea031\7.1.384 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps\Bing Bar Settings_ac63306dfaef4dd89310251954aea031 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar\Apps folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft\BingBar folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Microsoft folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\INISet folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Identities\{B06486D7-B0F1-4BFC-9DF2-E8C7CBF2B330}\Microsoft\Outlook Express folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Identities\{B06486D7-B0F1-4BFC-9DF2-E8C7CBF2B330}\Microsoft folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Identities\{B06486D7-B0F1-4BFC-9DF2-E8C7CBF2B330} folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Identities folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\HP Photosmart 7520 series\Fax\RecentFaxes folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\HP Photosmart 7520 series\Fax\FaxPCSend folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\HP Photosmart 7520 series\Fax folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\HP Photosmart 7520 series folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\Digital Imaging\vault\temp folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\Digital Imaging\vault folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\Digital Imaging\PhotoCrm\V1.0\RUBY\anonymous folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\Digital Imaging\PhotoCrm\V1.0\RUBY folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\Digital Imaging\PhotoCrm\V1.0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\Digital Imaging\PhotoCrm folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\Digital Imaging\db2\Default_Groups folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\Digital Imaging\db2 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\Digital Imaging\cache2 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP\Digital Imaging folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\HP folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\Install\{F39F54C1-34CD-4C03-BD2A-71D9D33BCD28} folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\Install folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\Download\{D0AB2EBC-931B-4013-9FEB-C9C4C2225C8C}\4.0.1.13525 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\Download\{D0AB2EBC-931B-4013-9FEB-C9C4C2225C8C} folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\Download\{A8394661-71DB-4747-A744-4ABA2F3BBB86} folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\Download\{8F74EDAB-4F90-43EC-BD0D-97F9DBDD06F3} folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.21.145 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D} folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\Download folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\1.3.21.145 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update\1.3.21.135 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Update folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Toolbar History\urls folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Toolbar History\thumbnails folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Toolbar History folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Toolbar DNS data folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Toolbar Cache\7.4.3607.2246\en folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Toolbar Cache\7.4.3607.2246 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Toolbar Cache folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Toolbar folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Google Talk Plugin\data folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Google Talk Plugin folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Custom Buttons\Enterprise folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Custom Buttons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\CrashReports folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Temp folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\SwiftShader folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\PepperFlash\11.7.700.202 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\PepperFlash folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\User StyleSheets folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Session Storage folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\t.cxt.ms\lso.swf folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\t.cxt.ms folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#t.cxt.ms folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#login.yahoo.com folder moved successfully.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#azdrama.net folder moved successfully.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\login.yahoo.com folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\cdnrep.reimage.com\##3EE9DE70A259ECAE folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\cdnrep.reimage.com folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\azdrama.net folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\admin.brightcove.com\##C06509FF679F0D6A folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\admin.brightcove.com folder moved successfully.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot scheduled to be moved on reboot.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache\PD4AL3BB folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot folder moved successfully.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data scheduled to be moved on reboot.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\zh_TW folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\zh_CN folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\tr folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\sr folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\sk folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\ru folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\pt_PT folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\pt_BR folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\pl folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\nl folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\ko folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\ja folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\it folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\id folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\hu folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\fr folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\es_419 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\es folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\en folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\de folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\da folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales\cs folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\_locales folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\content\tabs folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\content\lib folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\content\js folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\content\icons\search_box folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\content\icons\dnt_disabled folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\content\icons folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\content\css folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\content folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj\1.0_0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension State folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Rules folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\databases\http_www.cra-arc.gc.ca_0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\databases folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache folder moved successfully.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google scheduled to be moved on reboot.
C:\Documents and Settings\tso\Local Settings\Application Data\Facebook\Video\Skype folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Facebook\Video\Common\fb#3aac6kprjgot_5w3i6klahxw0-99w9os2s1t8xodfijdzdhavev4uvtv4ioa8i_-gwwtc folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Facebook\Video\Common folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Facebook\Video folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Facebook\Update\Manifest\Initial folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Facebook\Update\Manifest folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Facebook\Update\Download folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Facebook\Update\1.2.205.0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Facebook\Update\1.2.203.0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Facebook\Update folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Facebook\CrashReports folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Facebook folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Downloaded Installations\{53F82112-2FBB-40D3-912A-8460B0D069A7} folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Downloaded Installations folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\AVG SafeGuard toolbar\SiteSafety folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\AVG SafeGuard toolbar\DNT folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\AVG SafeGuard toolbar folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\11\13 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\11\09 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\11 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\10\15 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\10\11 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\10 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\07\13 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\07\09 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\07\07 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\07\02 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\07 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\05\01 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\05 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\04\06 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\04 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\03\10 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\03 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\02\15 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\02\09 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\02 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\01\00 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads\01 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime\downloads folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer\QuickTime folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple Computer folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple\Apple Software Update folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Apple folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Ahead\Nero StartSmart\cache folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Ahead\Nero StartSmart folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Ahead\Nero Home\idx folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Ahead\Nero Home folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Ahead\.thumbnails\normal folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Ahead\.thumbnails\large folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Ahead\.thumbnails\fail folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Ahead\.thumbnails folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Ahead folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe\Updater6\Install folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe\Updater6 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe\TypeSupport\CMaps folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe\TypeSupport folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe\Color folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe\CameraRaw\Cache folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe\CameraRaw folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe\AIR\logs folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe\AIR folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe\Acrobat\9.0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe\Acrobat\10.0 folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe\Acrobat folder moved successfully.
C:\Documents and Settings\tso\Local Settings\Application Data\Adobe folder moved successfully.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings scheduled to be moved on reboot.
C:\Documents and Settings\tso\IETldCache folder moved successfully.
C:\Documents and Settings\tso\IECompatCache folder moved successfully.
C:\Documents and Settings\tso\Favorites\Mozilla Firefox folder moved successfully.
C:\Documents and Settings\tso\Favorites\Microsoft Websites folder moved successfully.
C:\Documents and Settings\tso\Favorites\Links folder moved successfully.
C:\Documents and Settings\tso\Favorites\Bookmarks Toolbar Folder folder moved successfully.
C:\Documents and Settings\tso\Favorites folder moved successfully.
C:\Documents and Settings\tso\Desktop\Unused Desktop Shortcuts folder moved successfully.
C:\Documents and Settings\tso\Desktop folder moved successfully.
C:\Documents and Settings\tso\Cookies folder moved successfully.
C:\Documents and Settings\tso\Application Data\Yahoo!\Companion\CrashLogs folder moved successfully.
C:\Documents and Settings\tso\Application Data\Yahoo!\Companion\Buttons folder moved successfully.
C:\Documents and Settings\tso\Application Data\Yahoo!\Companion folder moved successfully.
C:\Documents and Settings\tso\Application Data\Yahoo! folder moved successfully.
C:\Documents and Settings\tso\Application Data\WinRAR folder moved successfully.
C:\Documents and Settings\tso\Application Data\vlc folder moved successfully.
C:\Documents and Settings\tso\Application Data\U3\temp folder moved successfully.
C:\Documents and Settings\tso\Application Data\U3 folder moved successfully.
C:\Documents and Settings\tso\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS folder moved successfully.
C:\Documents and Settings\tso\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\Quarantine folder moved successfully.
C:\Documents and Settings\tso\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs folder moved successfully.
C:\Documents and Settings\tso\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs folder moved successfully.
C:\Documents and Settings\tso\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware folder moved successfully.
C:\Documents and Settings\tso\Application Data\SUPERAntiSpyware.com folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\jre1.6.0_17 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\9 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\8 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\7 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\63 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\62 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\61 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\60 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\6 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\59 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\58 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\57 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\56 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\55 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\54 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\53 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\52 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\51 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\50 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\5 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\49 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\48 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\47 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\46 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\45 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\44 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\43 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-183a3ce0-n folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\42 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\41 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\40 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-1214acb8-n folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\4 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\39 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\38 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\37 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\36 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\35 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\34 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\33 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\32 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\31 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\30 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\3 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\29 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\28 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\27 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\26 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\25 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\24 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\23 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\22 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\21 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\20 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\2 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\19 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\18 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\17 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\16 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\15 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\14 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\13 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\12 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\11 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\10 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\1 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0\0 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache\6.0 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\SystemCache folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\security folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\log folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\ext folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment\cache folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java\Deployment folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun\Java folder moved successfully.
C:\Documents and Settings\tso\Application Data\Sun folder moved successfully.
C:\Documents and Settings\tso\Application Data\skypePM folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\voicemail folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\httpfe folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\ff folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\ef folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\e9 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\e6 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\e5 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\e0 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\df folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\dc folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\d8 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\d1 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\cd folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\ca folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\c9 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\c6 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\c5 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\c3 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\c2 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\be folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\a9 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\9c folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\98 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\93 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\8e folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\7c folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\7b folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\6a folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\53 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\3f folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\3d folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\23 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\1d folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\0f folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync\05 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1\chatsync folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog1 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\theresagog folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\shared_httpfe folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\shared_dynco folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\Pictures folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\My Skype Received Files folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\DbTemp folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype\Content folder moved successfully.
C:\Documents and Settings\tso\Application Data\Skype folder moved successfully.
C:\Documents and Settings\tso\Application Data\PIPI folder moved successfully.
C:\Documents and Settings\tso\Application Data\PCToolsFirewallPlus folder moved successfully.
C:\Documents and Settings\tso\Application Data\Office Genuine Advantage\data folder moved successfully.
C:\Documents and Settings\tso\Application Data\Office Genuine Advantage folder moved successfully.
C:\Documents and Settings\tso\Application Data\MxBoost folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\plugins\Google Talk Plugin Extras folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\plugins folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\webapps folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\weave\toFetch folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\weave\failed folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\weave\changes folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\weave folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\minidumps folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\healthreport folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\META-INF folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7} folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\wizard\ADA folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\wizard folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\components folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\options folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\lib\weatherbutton\icons folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\lib\uwa folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\lib\panels\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\lib\panels\default\scripts folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\lib\panels\default folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\lib\panels\css folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\lib\panels folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin\lib folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\skin folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\data\search folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\data folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\scripts folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\css folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.YouTube_v2\skin folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.YouTube_v2\js folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.YouTube_v2\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.YouTube_v2\css folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.YouTube_v2 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Twitter\skin\scripts folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Twitter\skin\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Twitter\skin\css folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Twitter\skin folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Twitter\js folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Twitter\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Twitter\css folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Twitter folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.RadioBeta folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\scripts folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\css folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.MyStartFacebook\js folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.MyStartFacebook\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.MyStartFacebook\css folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.MyStartFacebook folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Messaging\skin\scripts folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Messaging\skin\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Messaging\skin\css folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Messaging\skin folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Messaging folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Grooveshark folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\scripts folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\css folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Coupons_v2\skin folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Coupons_v2\js folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Coupons_v2\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Coupons_v2\css folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.Coupons_v2 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.BlekkoMap\skin\scripts folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.BlekkoMap\skin\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.BlekkoMap\skin\css folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.BlekkoMap\skin folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.BlekkoMap\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.BlekkoMap\css folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets\net.vmn.www.BlekkoMap folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\widgets folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\newtab\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\newtab folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\modules folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content\lib folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome\content folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\chrome folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73}\ADA folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions\{00f12770-e60e-4dc6-9105-425bface7c73} folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\extensions folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\chrome folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default\bookmarkbackups folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles\z2u6jnhh.default folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Profiles folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Crash Reports\pending folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox\Crash Reports folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Firefox folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla\Extensions folder moved successfully.
C:\Documents and Settings\tso\Application Data\Mozilla folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Word\STARTUP folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Word folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Windows Live\Toolbar\Feeds folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Windows Live\Toolbar\Custom Buttons\microsoft.windowslive.translator.btn folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Windows Live\Toolbar\Custom Buttons\microsoft.windowslive.news.btn folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Windows Live\Toolbar\Custom Buttons folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Windows Live\Toolbar folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Windows Live folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Windows\Themes folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Windows folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Templates folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\SystemCertificates\My\CTLs folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\SystemCertificates\My\CRLs folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\SystemCertificates\My\Certificates folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\SystemCertificates\My folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\SystemCertificates folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Speech\Files\UserLexicons folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Speech\Files folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Speech folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Protect\S-1-5-21-1454471165-1788223648-725345543-1007 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Protect folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Proof folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\PowerPoint folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Outlook folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Office\Recent folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Office folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Network\Connections\Pbk folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Network\Connections folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Network folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\MSN Messenger\3434587545 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\MSN Messenger\2683304979 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\MSN Messenger folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\MMC folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Media Player folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Internet Explorer\UserData\Z3T03FUG folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Internet Explorer\UserData\E9R3L30C folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Internet Explorer\UserData\CE8UK84L folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Internet Explorer\UserData\7D6H6MPG folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Internet Explorer\UserData folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Internet Explorer\Quick Launch folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Internet Explorer folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\IMJP9_0 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\IMJP8_1 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\IMJP12 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\IME12 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\IME\MSTCIPH folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\IME folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\IdentityCRL\Production folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\IdentityCRL folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\HTML Help folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Excel\XLSTART folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Excel folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1454471165-1788223648-725345543-1007 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Crypto\RSA folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Crypto folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\CryptnetUrlCache\MetaData folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\CryptnetUrlCache\Content folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\CryptnetUrlCache folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Credentials\S-1-5-21-1454471165-1788223648-725345543-1007 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Credentials folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\Address Book folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft\AddIns folder moved successfully.
C:\Documents and Settings\tso\Application Data\Microsoft folder moved successfully.
C:\Documents and Settings\tso\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine folder moved successfully.
C:\Documents and Settings\tso\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs folder moved successfully.
C:\Documents and Settings\tso\Application Data\Malwarebytes\Malwarebytes' Anti-Malware folder moved successfully.
C:\Documents and Settings\tso\Application Data\Malwarebytes folder moved successfully.
C:\Documents and Settings\tso\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys folder moved successfully.
C:\Documents and Settings\tso\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer folder moved successfully.
C:\Documents and Settings\tso\Application Data\Macromedia\Flash Player\macromedia.com\support folder moved successfully.
C:\Documents and Settings\tso\Application Data\Macromedia\Flash Player\macromedia.com folder moved successfully.
C:\Documents and Settings\tso\Application Data\Macromedia\Flash Player\#SharedObjects\MEDYUQS9 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Macromedia\Flash Player\#SharedObjects folder moved successfully.
C:\Documents and Settings\tso\Application Data\Macromedia\Flash Player folder moved successfully.
C:\Documents and Settings\tso\Application Data\Macromedia folder moved successfully.
C:\Documents and Settings\tso\Application Data\lowsec folder moved successfully.
C:\Documents and Settings\tso\Application Data\Identities\{B06486D7-B0F1-4BFC-9DF2-E8C7CBF2B330} folder moved successfully.
C:\Documents and Settings\tso\Application Data\Identities folder moved successfully.
C:\Documents and Settings\tso\Application Data\HpUpdate folder moved successfully.
C:\Documents and Settings\tso\Application Data\HPAppData\XRE folder moved successfully.
C:\Documents and Settings\tso\Application Data\HPAppData folder moved successfully.
C:\Documents and Settings\tso\Application Data\HP\ScLogs folder moved successfully.
C:\Documents and Settings\tso\Application Data\HP folder moved successfully.
C:\Documents and Settings\tso\Application Data\Google\Local Search History folder moved successfully.
C:\Documents and Settings\tso\Application Data\Google folder moved successfully.
C:\Documents and Settings\tso\Application Data\FlashgetSetup folder moved successfully.
C:\Documents and Settings\tso\Application Data\FlashGetBHO folder moved successfully.
C:\Documents and Settings\tso\Application Data\FlashGet\v3\dat\directui\html\client\resource_new folder moved successfully.
C:\Documents and Settings\tso\Application Data\FlashGet\v3\dat\directui\html\client folder moved successfully.
C:\Documents and Settings\tso\Application Data\FlashGet\v3\dat\directui\html folder moved successfully.
C:\Documents and Settings\tso\Application Data\FlashGet\v3\dat\directui folder moved successfully.
C:\Documents and Settings\tso\Application Data\FlashGet\v3\dat folder moved successfully.
C:\Documents and Settings\tso\Application Data\FlashGet\v3 folder moved successfully.
C:\Documents and Settings\tso\Application Data\FlashGet folder moved successfully.
C:\Documents and Settings\tso\Application Data\Facebook folder moved successfully.
C:\Documents and Settings\tso\Application Data\com.Shutterfly.ExpressUploader\Local Store\thumbs folder moved successfully.
C:\Documents and Settings\tso\Application Data\com.Shutterfly.ExpressUploader\Local Store\images folder moved successfully.
C:\Documents and Settings\tso\Application Data\com.Shutterfly.ExpressUploader\Local Store folder moved successfully.
C:\Documents and Settings\tso\Application Data\com.Shutterfly.ExpressUploader folder moved successfully.
C:\Documents and Settings\tso\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#SharedObjects\bin-debug\AppContainer_en_US_prod.swf folder moved successfully.
C:\Documents and Settings\tso\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#SharedObjects\bin-debug folder moved successfully.
C:\Documents and Settings\tso\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#SharedObjects folder moved successfully.
C:\Documents and Settings\tso\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store folder moved successfully.
C:\Documents and Settings\tso\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 folder moved successfully.
C:\Documents and Settings\tso\Application Data\BITS\Torrent folder moved successfully.
C:\Documents and Settings\tso\Application Data\BITS folder moved successfully.
C:\Documents and Settings\tso\Application Data\BHOK IT Consulting\StudioTax 2012\install folder moved successfully.
C:\Documents and Settings\tso\Application Data\BHOK IT Consulting\StudioTax 2012 folder moved successfully.
C:\Documents and Settings\tso\Application Data\BHOK IT Consulting folder moved successfully.
C:\Documents and Settings\tso\Application Data\AVG SafeGuard toolbar\cache\tmp folder moved successfully.
C:\Documents and Settings\tso\Application Data\AVG SafeGuard toolbar\cache folder moved successfully.
C:\Documents and Settings\tso\Application Data\AVG SafeGuard toolbar folder moved successfully.
C:\Documents and Settings\tso\Application Data\Apple Computer\QuickTime folder moved successfully.
C:\Documents and Settings\tso\Application Data\Apple Computer\Logs folder moved successfully.
C:\Documents and Settings\tso\Application Data\Apple Computer folder moved successfully.
C:\Documents and Settings\tso\Application Data\Ahead\NeroVision\NVFACache folder moved successfully.
C:\Documents and Settings\tso\Application Data\Ahead\NeroVision folder moved successfully.
C:\Documents and Settings\tso\Application Data\Ahead\Nero Burning ROM folder moved successfully.
C:\Documents and Settings\tso\Application Data\Ahead folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\LogTransport2 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Linguistics\Dictionaries folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Linguistics folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Headlights folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Flash Player\AssetCache\2CE6B847 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Flash Player\AssetCache folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Flash Player\AFCache folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Flash Player folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\CS4ServiceManager folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Color\Settings folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Color\Proofing folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Color folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\CameraRaw\Defaults folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\CameraRaw folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\AIR\Updater\Update folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\AIR\Updater\Background folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\AIR\Updater folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\AIR\ELS\com.Shutterfly.ExpressUploader folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\AIR\ELS\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\AIR\ELS folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\AIR folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Volumes folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Tools folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Styles folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Selective Color folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Render Settings folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Patterns folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Menu Customization folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Materials folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Lights folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Levels folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Keyboard Shortcuts folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Hue and Saturation folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Gradients folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Exposure folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Duotones folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Custom Shapes folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Curves folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Contours folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Color Swatches folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Channel Mixer folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Brushes folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Black and White folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets\Actions folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Presets folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Adobe Photoshop CS4 Settings\WorkSpaces folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4\Adobe Photoshop CS4 Settings folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Photoshop CS4 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe PDF\Settings folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe PDF folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Media Player\Local Store\settings folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Media Player\Local Store\measurement folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Media Player\Local Store\cache folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Media Player\Local Store folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Adobe Media Player folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\9.0\JavaScripts folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\9.0\Forms folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\9.0\Collab folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\9.0 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\10.0\Synchronizer\resources folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\10.0\Synchronizer\metadata folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\10.0\Synchronizer folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\10.0\Security\CRLCache folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\10.0\Security folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\10.0\JSCache folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\10.0\JavaScripts folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\10.0\Forms folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\10.0\Collab folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\10.0\assets folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat\10.0 folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe\Acrobat folder moved successfully.
C:\Documents and Settings\tso\Application Data\Adobe folder moved successfully.
C:\Documents and Settings\tso\Application Data folder moved successfully.
Folder move failed. C:\Documents and Settings\tso scheduled to be moved on reboot.
C:\Documents and Settings\Vivian\tudouproxy.inf moved successfully.
C:\Documents and Settings\Vivian\My Documents\TudouVa1.30_1010B.exe moved successfully.
C:\Documents and Settings\Vivian\My Documents\My Videos\tu dou.txt moved successfully.
File\Folder C:\WINDOWS\Prefetch\ITUDOU.EXE not found.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Vivian\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Vivian\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Chung-Yan
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Karen
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33918 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 29260 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: philso
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: pso
->Temp folder emptied: 194870 bytes
->Temporary Internet Files folder emptied: 703981 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 17819038 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 492 bytes

User: tso

User: Vivian
->Temp folder emptied: 489322 bytes
->Temporary Internet Files folder emptied: 621612 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 55865156 bytes
->Google Chrome cache emptied: 182462268 bytes
->Flash cache emptied: 2376 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 127864 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 246.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 06132013_101131

Files\Folders moved on Reboot...
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#cdnrep.reimage.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys\#admin.brightcove.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer\sys scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support\flashplayer scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com\support scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU\macromedia.com scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\VYJZUWPU scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash\WritableRoot scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data\Shockwave Flash scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default\Pepper Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data\Default scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome\User Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google\Chrome scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data\Google scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings\Application Data scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso\Local Settings scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\tso scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


----------



## emeraldnzl (Nov 3, 2007)

Oh dear it looks like we took a lot more along with the Tudou one.

We may need to restore or reinstall a number of things.

The question is, how is your computer?


----------



## errorloading (Feb 4, 2011)

my computer is running fine. The Tudou sign in screen only starts when I log in as Theresa. It doesn't border me that much. Everything else is working fine, so just don't worry about fixing that part. Thank you very much for all your help for quick attention.


----------



## errorloading (Feb 4, 2011)

Hi

I just log in as user: Theresa and discovered that I can't use FireFox, because the system can't load it. there is still an error msg showed up when I log in as user "Guest" and the Administrator's starting screen is pretty slow.


----------



## emeraldnzl (Nov 3, 2007)

> discovered that I can't use FireFox


Yes one of the things that got partially removed in error.

Simplest thing to do for Firefox is to download and install it again.

Firefox may be downloaded from *Here*.

Same thing for Flash

Go here to download the latest *Adobe Flash Player*

Make sure you untick the box "Yes install Chrome as default browser and Google Toolbar for Internet Explorer" option before downloading.

After that try out Firefox and tell me how your computer is again.


----------



## errorloading (Feb 4, 2011)

Everything seems to be fine except when I logged in as a "Guest" user, then the error msg showed up again.


----------



## emeraldnzl (Nov 3, 2007)

Hell errorloading,



> I logged in as a "Guest" user, then the error msg showed up again.


Pesky thing, still there.

We will have another look at that but for now we need to redress a problem with that last attempt to remove Tudou.

Some files that I think you will want were moved at the same time as the bad one. I want to look in the folder they went to so that I can get the correct path to copy them back.

*Now*


Double-click *SystemLook.exe* to run it.
Copy the content of the following codebox into the main textfield:

```
:dir
C:\_OTL\MovedFiles /s
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. It might be quite long so if you run into difficulty posting your may have to split your replies to get it all in.
*Note:* The log can also be found at on your Desktop entitled *SystemLook.txt*


----------



## errorloading (Feb 4, 2011)

Hi,

As I haven't heard fm u for quite a while, pls advise if my case is considered to be solved? Thank u


----------



## emeraldnzl (Nov 3, 2007)

Hello errorloading,

I was waiting to hear back from you.

Whether your case is solved is up to you.

My worry was that when we made the last attempt to remove the "error msg" we moved some files that you might have wanted to use. Because of that, in my last post I was asking you to carry out a search so that we could attempt to replace anything you might be missing.

If however you are happy with your machine and everything you want is there, then we can consider the case solved.

Tell me what you think.


----------



## errorloading (Feb 4, 2011)

I am pretty happy with my computer now. Thank you very much for all you help. Have a nice day.


----------

