Windows 7 Repair and Hard Drive Failure

Before the Windows 7 Repair window showed up the computer would just shut down soon after boot.
Thinking that it was a bad update as a major one occurred about the same time I did a system recovery back to 4 days ago.
When it rebooted afterwards the Windows 7 Repair window shows up with all the icons on the desktop gone as well as programs in the startup menu.

Tried to copy otl to the desktop, but as soon as it was copied it disappeared.
I then was able to copy it to a folder in the root. I tried running it, but the computer shut down on it's own.

I then booted into safe mode and was able to copy otl to the desktop. So I ran it in SAFE mode. Here's the logs:

OTL Extras logfile created on: 6/21/2011 12:02:36 AM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\Susan\Desktop
An unknown product (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 2.53 Gb Available Physical Memory | 88.12% Memory free
5.75 Gb Paging File | 5.43 Gb Available in Paging File | 94.52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 326.01 Gb Total Space | 223.12 Gb Free Space | 68.44% Space Free | Partition Type: NTFS
Drive D: | 9.34 Gb Total Space | 0.95 Gb Free Space | 10.16% Space Free | Partition Type: NTFS
Drive E: | 194.79 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 14.92 Gb Total Space | 6.97 Gb Free Space | 46.73% Space Free | Partition Type: FAT32

Computer Name: SUSAN-PC | User Name: Susan | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1"
https [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1"
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – C:\Program Files\ParetoLogic\FileCure\FileCure_noapp.exe %1 (ParetoLogic)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}" = Google Gmail Notifier
"{059CF2AE-188F-45D3-8231-B79A131AC8C2}" = Philips SPC1000NC Webcam
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{0EF5BEA9-B9D3-46d7-8958-FB69A0BAEACC}" = Status
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{102CBC47-7FDE-4E6C-8A3A-67B79833FAC8}" = BPDSoftware_Ini
"{11B2F891-91C8-47ce-945A-A91003EA27FB}" = BPDSoftware
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18AB082B-6584-4F74-8ABC-D5935CF46E4C}" = 8500A909_eDocs
"{1EC71BFB-01A3-4239-B6AF-B1AE656B15C0}" = TrayApp
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2CCBABCB-6427-4A55-B091-49864623C43F}" = Google Toolbar for Firefox
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2FF8C687-DB7D-4adc-A5DC-57983EC25046}" = DeviceDiscovery
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{432A850B-3558-4BFF-B1F9-30626835B523}" = BPD_DSWizards
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{440B915A-0C85-45DB-92AE-75AE14704A64}" = Fax
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{57F60D52-630B-43C5-BD20-176F5CD4EED6}" = bpd_scan
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{6809408A-56A8-4863-A7E9-3723FF8C24A4}" = BPDSoftware_Ini
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{75247E38-5C9B-45D6-ADF8-E11CB56B4990}" = Network
"{77663A9E-EDA4-4873-907D-6315E6D0462A}" = 6400_Help
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{85C8D391-0EAE-4492-8A0A-2EE8B0B6DA03}" = BPDSoftware
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{894A9DFD-6102-40AB-9C4A-1DCA60032D64}" = Quicken Rental Property Manager 2.0
"{89EAD745-088B-4160-B964-42C4D4D273AD}" = Family Tree Maker 2010
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{92A51949-EE4C-466D-AAF0-99E74A49A63F}" = DocMgr
"{9A0F591C-6ACB-225D-7CEE-4C5F9BEFEB7D}" = Amazon MP3 Uploader
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9F6CFB0-806D-11E0-8EA1-B8AC6F97B88E}" = Google Earth Plug-in
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{AF3F7695-D506-443E-9100-0EC94151120E}" = J6400_Basic
"{AF930591-F59C-4EBA-A431-72202065666C}" = HP Officejet J6400 Series
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B495547C-01F8-4836-A2E6-749B5F3EA691}" = 8500A909_Help
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C1C441C4-57FA-4950-BDBA-BABFBAA2AA39}" = ParetoLogic FileCure
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{CD8C5C7F-7C58-4F85-8977-A6C08C087912}" = MPM
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{D5DEF057-D3BC-499f-99EE-884ED429B6D1}" = 8500A909g
"{D850BEF5-67AF-4071-9538-FA9AC725D62C}" = Officejet Pro 8500 A909 Series
"{DA8BF070-1358-4a30-A68F-21E0E9421AEF}" = ProductContext
"{DC635845-46D3-404B-BCB1-FC4A91091AFA}" = SmartWebPrinting
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{EA57A1B9-0DD2-44DD-9B70-64E8DA553F6F}" = Philips VLounge
"{EDEA8AB7-7683-4ED2-AA19-E6C078064C0D}" = Microsoft WSE 3.0
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{FA30FFD4-8DF3-4B29-9C2C-EE30584CD795}" = bpd_scan
"{FDC17776-2CA4-48FA-964B-C5E8B6BB535B}" = RegWork
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"4DF2CED4A3F0255B2228A629BC8B64D5D47A37C4" = Windows Driver Package - Philips (SPC1000) Image (07/06/2007 5.8.8.028)
"AB076FF359D7ED09338BED944754FA8949B67836" = Windows Driver Package - Philips CE (phaudlwr) MEDIA (06/19/2007 1.0.0.7)
"AddThis Toolbar" = AddThis Toolbar
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.10
"Browser Defender_is1" = Browser Defender 3.0
"Carbonite Backup" = Carbonite
"com.amazon.music.uploader" = Amazon MP3 Uploader
"Family Tree Builder" = MyHeritage Family Tree Builder
"Family Tree Maker 2010" = Family Tree Maker 2010
"HP Document Manager" = HP Document Manager 2.0
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Smart Web Printing" = HP Smart Web Printing 4.51
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"HPOCR" = OCR Software by I.R.I.S. 13.0
"Logitech Vid" = Logitech Vid HD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MVApplication1" = Memorex exPressit Label Design Studio
"NSS" = Norton Security Scan
"Picasa 3" = Picasa 3
"PowerISO" = PowerISO
"Shop for HP Supplies" = Shop for HP Supplies
"Spyware Doctor" = Spyware Doctor
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Yahoo! Companion" = Yahoo! Toolbar
"zipForm6" = zipForm6

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/16/2011 12:05:30 PM | Computer Name = Susan-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\pc tools
security\networklayer\PCTCFFix64.exe". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 6/16/2011 9:08:00 PM | Computer Name = Susan-PC | Source = Application Hang | ID = 1002
Description = The program MyHeritage.exe version 0.0.0.0 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 4ec Start
Time: 01cc2c8ae08519b0 Termination Time: 11 Application Path: C:\Program Files\MyHeritage\Bin\MyHeritage.exe

Report
Id: 38cc9df1-987e-11e0-b65d-001fc62b636a

Error - 6/17/2011 3:45:35 AM | Computer Name = Susan-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\pc tools
security\networklayer\PCTCFFix64.exe". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 6/18/2011 1:28:47 PM | Computer Name = Susan-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\pc tools
security\networklayer\PCTCFFix64.exe". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 6/18/2011 2:44:39 PM | Computer Name = Susan-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\pc tools
security\networklayer\PCTCFFix64.exe". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 6/18/2011 10:43:01 PM | Computer Name = Susan-PC | Source = VSS | ID = 13
Description =

Error - 6/18/2011 10:43:01 PM | Computer Name = Susan-PC | Source = VSS | ID = 8193
Description =

Error - 6/18/2011 10:43:01 PM | Computer Name = Susan-PC | Source = VSS | ID = 13
Description =

Error - 6/18/2011 10:43:01 PM | Computer Name = Susan-PC | Source = VSS | ID = 8193
Description =

Error - 6/21/2011 12:50:37 AM | Computer Name = Susan-PC | Source = System Restore | ID = 8210
Description =

[ System Events ]
Error - 4/19/2011 1:13:50 AM | Computer Name = Susan-PC | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.0.101
with the system having network hardware address 00-25-AE-62-C5-DF. Network operations
on this system may be disrupted as a result.

Error - 4/19/2011 2:09:40 AM | Computer Name = Susan-PC | Source = DCOM | ID = 10016
Description =

Error - 4/19/2011 2:09:40 AM | Computer Name = Susan-PC | Source = DCOM | ID = 10016
Description =

Error - 4/19/2011 2:28:29 AM | Computer Name = Susan-PC | Source = DCOM | ID = 10016
Description =

Error - 4/19/2011 2:28:29 AM | Computer Name = Susan-PC | Source = DCOM | ID = 10016
Description =

Error - 4/19/2011 6:04:50 PM | Computer Name = Susan-PC | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.0.102
with the system having network hardware address C4-17-FE-28-C2-79. Network operations
on this system may be disrupted as a result.

Error - 4/21/2011 2:42:15 AM | Computer Name = Susan-PC | Source = DCOM | ID = 10016
Description =

Error - 4/21/2011 2:42:15 AM | Computer Name = Susan-PC | Source = DCOM | ID = 10016
Description =

Error - 4/21/2011 2:55:19 AM | Computer Name = Susan-PC | Source = DCOM | ID = 10016
Description =

Error - 4/21/2011 2:55:19 AM | Computer Name = Susan-PC | Source = DCOM | ID = 10016
Description =


< End of report >


================================================================================
==============================================================

OTL logfile created on: 6/21/2011 12:02:36 AM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\Susan\Desktop
An unknown product (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 2.53 Gb Available Physical Memory | 88.12% Memory free
5.75 Gb Paging File | 5.43 Gb Available in Paging File | 94.52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 326.01 Gb Total Space | 223.12 Gb Free Space | 68.44% Space Free | Partition Type: NTFS
Drive D: | 9.34 Gb Total Space | 0.95 Gb Free Space | 10.16% Space Free | Partition Type: NTFS
Drive E: | 194.79 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 14.92 Gb Total Space | 6.97 Gb Free Space | 46.73% Space Free | Partition Type: FAT32

Computer Name: SUSAN-PC | User Name: Susan | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Susan\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\Susan\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (CarboniteService) – C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe (Carbonite, Inc. (www.carbonite.com))
SRV - (Browser Defender Update Service) – C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
SRV - (sdCoreService) – C:\Program Files\PC Tools Security\pctsSvc.exe (PC Tools)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (sdAuxService) – C:\Program Files\PC Tools Security\pctsAuxs.exe (PC Tools)
SRV - (StorSvc) – C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (PCTCore) – C:\Windows\system32\drivers\PCTCore.sys (PC Tools)
DRV - (SBRE) – C:\Windows\System32\drivers\SBREDrv.sys (Sunbelt Software)
DRV - (LVUVC) Logitech Webcam 250(UVC) – C:\Windows\System32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (pctEFA) – C:\Windows\system32\drivers\pctEFA.sys (PC Tools)
DRV - (pctDS) – C:\Windows\system32\drivers\pctDS.sys (PC Tools)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (LVPr2Mon) – C:\Windows\System32\drivers\LVPr2Mon.sys ()
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WSDPrintDevice) – C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (VSTHWBS2) – C:\Windows\System32\drivers\VSTBS23.SYS (Conexant Systems, Inc.)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (SPC1000) USB2.0 PC Camera (SPC1000) – C:\Windows\System32\drivers\spc1000.sys ()
DRV - (phaudlwr) – C:\Windows\System32\drivers\phaudlwr.sys (Philips Applied Technologies)
DRV - (SCDEmu) – C:\Windows\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.myheritage.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.myheritage.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 24 ED 01 F6 5C CB 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://search.conduit.com?SearchSource=10&ctid;=CT2857573
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:25395

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/12/07 15:15:01 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2011/01/13 13:55:09 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\PC Tools Security\BDT\Firefox\ [2011/02/05 13:33:39 | 000,000,000 | —D | M]


O1 HOSTS File: ([2009/06/10 14:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe (Google Inc.)
O4 - HKLM..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe (Carbonite, Inc.)
O4 - HKLM..\Run: [ISTray] C:\Program Files\PC Tools Security\pctsGui.exe (PC Tools)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PCTools FGuard] C:\Program Files\PC Tools Security\BDT\FGuard.exe (Threat Expert Ltd.)
O4 - HKLM..\Run: [spc1000] C:\Windows\vspc1000.exe (Sonix)
O4 - HKCU..\Run: [HhFEKGHKxwvKC] C:\ProgramData\HhFEKGHKxwvKC.exe (eSafe)
O4 - HKCU..\Run: [Logitech Vid] C:\Program Files\Logitech\Vid HD\Vid.exe (Logitech Inc.)
O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\Windows\System32\cmd.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: localhost ([]* in Local intranet)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} https://h50203.www5.hp.com/HPISWeb/Customer…DataManager.CAB (Hewlett-Packard Online Support Services)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2009/06/22 21:35:22 | 000,000,000 | —- | M] () - F:\AUTORUN_.INF – [ FAT32 ]
O32 - AutoRun File - [2007/03/07 20:47:00 | 000,567,808 | —- | M] () - F:\AutoCorrect Backup Document.doc – [ FAT32 ]
O32 - AutoRun File - [2009/06/22 21:35:22 | 000,000,000 | -H– | M] () - F:\autorun.inf – [ FAT32 ]
O32 - AutoRun File - [2010/01/08 09:26:22 | 000,068,608 | —- | M] () - F:\AUTOTEXT CHEAT SHEET.doc – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)


========== Files/Folders - Created Within 30 Days ==========

[2011/06/21 00:00:18 | 000,579,072 | —- | C] (OldTimer Tools) – C:\Users\Susan\Desktop\OTL.exe
[2011/06/20 23:52:21 | 000,000,000 | -H-D | C] – C:\Users\Susan\Desktop\AV1
[2011/06/20 23:46:22 | 000,000,000 | —D | C] – C:\AV1
[2011/06/18 19:46:42 | 000,000,000 | -H-D | C] – C:\Users\Susan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 Repair
[2011/06/18 19:35:28 | 000,465,408 | -H– | C] (eSafe) – C:\ProgramData\HhFEKGHKxwvKC.exe
[2011/06/16 10:40:10 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2011/06/16 10:40:04 | 000,599,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/06/16 10:40:04 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/06/16 10:40:03 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/06/16 10:40:03 | 000,606,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/06/16 10:40:03 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/06/16 10:40:03 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/06/16 10:40:03 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/06/16 10:40:03 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/06/16 10:40:03 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/06/16 10:40:03 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/06/16 10:40:03 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/06/15 11:39:23 | 000,000,000 | -H-D | C] – C:\Users\Susan\Documents\My Scans
[2011/06/15 10:50:00 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ParetoLogic
[2011/06/15 10:49:59 | 000,000,000 | -H-D | C] – C:\ProgramData\ParetoLogic
[2011/06/15 10:49:59 | 000,000,000 | -H-D | C] – C:\ProgramData\FileCure
[2011/06/15 10:49:59 | 000,000,000 | —D | C] – C:\Program Files\Common Files\ParetoLogic
[2011/06/15 10:49:58 | 000,000,000 | —D | C] – C:\Program Files\ParetoLogic
[2011/05/29 09:36:20 | 000,387,600 | —- | C] (MyHeritage) – C:\Windows\System32\FTBSaver.scr
[2011/05/28 22:21:30 | 000,000,000 | -H-D | C] – C:\Users\Susan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AddThis Toolbar
[2011/05/28 22:21:20 | 000,000,000 | —D | C] – C:\Program Files\AddThis Toolbar
[2011/05/28 13:24:51 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011/05/25 06:53:14 | 000,026,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\Diskdump.sys
[2011/05/24 06:54:52 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\poqexec.exe
[2007/12/04 09:29:00 | 000,053,248 | —- | C] ( ) – C:\Windows\System32\cspc1000.dll
[4 C:\Users\Susan\Documents\*.tmp files -> C:\Users\Susan\Documents\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/20 23:58:55 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/06/20 23:58:30 | 2314,067,968 | -HS- | M] () – C:\hiberfil.sys
[2011/06/20 23:55:34 | 000,623,940 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/06/20 23:55:34 | 000,106,316 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/06/20 23:49:09 | 000,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/20 23:49:07 | 000,000,380 | —- | M] () – C:\Windows\tasks\FileCure Startup.job
[2011/06/20 23:26:58 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Users\Susan\Desktop\OTL.exe
[2011/06/18 23:22:01 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/18 23:15:48 | 000,003,408 | —- | M] () – C:\bootsqm.dat
[2011/06/18 19:46:50 | 000,000,208 | -H– | M] () – C:\ProgramData\~40623004
[2011/06/18 19:46:50 | 000,000,152 | -H– | M] () – C:\ProgramData\~40623004r
[2011/06/18 19:46:42 | 000,000,633 | -H– | M] () – C:\Users\Susan\Desktop\Windows 7 Repair.lnk
[2011/06/18 19:46:39 | 000,000,344 | -H– | M] () – C:\ProgramData\40623004
[2011/06/18 19:46:37 | 000,410,624 | -H– | M] () – C:\ProgramData\40623004.exe
[2011/06/18 19:35:27 | 000,465,408 | -H– | M] (eSafe) – C:\ProgramData\HhFEKGHKxwvKC.exe
[2011/06/18 19:33:12 | 000,000,474 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for Susan.job
[2011/06/18 18:00:00 | 000,000,444 | —- | M] () – C:\Windows\tasks\ParetoLogic Registration3.job
[2011/06/17 03:28:03 | 000,014,304 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/17 03:28:03 | 000,014,304 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/17 03:20:44 | 000,000,418 | —- | M] () – C:\Windows\tasks\ParetoLogic Update Version3.job
[2011/06/17 03:20:44 | 000,000,364 | —- | M] () – C:\Windows\tasks\FileCure Default.job
[2011/06/16 18:07:03 | 000,001,081 | -H– | M] () – C:\Users\Susan\Desktop\MyHeritage Family Tree Builder.lnk
[2011/06/16 10:39:58 | 001,123,868 | —- | M] () – C:\Windows\System32\drivers\Cat.DB
[2011/05/29 09:36:20 | 000,387,600 | —- | M] (MyHeritage) – C:\Windows\System32\FTBSaver.scr
[2011/05/27 20:00:02 | 001,638,912 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/05/24 17:52:30 | 000,160,132 | -H– | M] () – C:\Users\Susan\1970 ma.jpg.tif
[4 C:\Users\Susan\Documents\*.tmp files -> C:\Users\Susan\Documents\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/18 23:15:48 | 000,003,408 | —- | C] () – C:\bootsqm.dat
[2011/06/18 19:46:50 | 000,000,208 | -H– | C] () – C:\ProgramData\~40623004
[2011/06/18 19:46:50 | 000,000,152 | -H– | C] () – C:\ProgramData\~40623004r
[2011/06/18 19:46:42 | 000,000,633 | -H– | C] () – C:\Users\Susan\Desktop\Windows 7 Repair.lnk
[2011/06/18 19:46:39 | 000,000,344 | -H– | C] () – C:\ProgramData\40623004
[2011/06/18 19:46:37 | 000,410,624 | -H– | C] () – C:\ProgramData\40623004.exe
[2011/06/15 10:50:15 | 000,000,444 | —- | C] () – C:\Windows\tasks\ParetoLogic Registration3.job
[2011/06/15 10:50:12 | 000,000,380 | —- | C] () – C:\Windows\tasks\FileCure Startup.job
[2011/06/15 10:50:11 | 000,000,364 | —- | C] () – C:\Windows\tasks\FileCure Default.job
[2011/06/15 10:49:59 | 000,000,418 | —- | C] () – C:\Windows\tasks\ParetoLogic Update Version3.job
[2011/05/24 17:52:30 | 000,160,132 | -H– | C] () – C:\Users\Susan\1970 ma.jpg.tif
[2011/02/05 13:33:38 | 000,767,952 | —- | C] () – C:\Windows\BDTSupport.dll
[2010/12/25 23:39:40 | 000,000,172 | —- | C] () – C:\Windows\MyHeritage.INI
[2010/12/25 16:32:44 | 000,454,656 | —- | C] () – C:\Windows\System32\PaintX.dll
[2010/12/24 12:19:06 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/12/15 02:12:44 | 000,003,584 | -H– | C] () – C:\Users\Susan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/07 15:10:57 | 000,232,709 | —- | C] () – C:\Windows\hpwins22.dat
[2010/12/07 14:49:08 | 000,002,940 | —- | C] () – C:\Windows\hpwmdl22.dat.temp
[2010/09/25 15:49:15 | 000,000,411 | —- | C] () – C:\Windows\hpwmdl14.dat.temp
[2010/09/25 15:37:07 | 000,178,769 | —- | C] () – C:\Windows\hpwins14.dat
[2010/09/25 15:37:07 | 000,000,411 | —- | C] () – C:\Windows\hpwmdl14.dat
[2010/09/25 14:43:26 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2010/07/27 08:03:20 | 010,829,656 | —- | C] () – C:\Windows\System32\LogiDPP.dll
[2010/07/27 08:03:20 | 000,102,744 | —- | C] () – C:\Windows\System32\LogiDPPApp.exe
[2010/07/27 08:03:18 | 000,290,648 | —- | C] () – C:\Windows\System32\DevManagerCore.dll
[2010/07/27 07:56:04 | 000,090,411 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2010/05/07 18:46:36 | 000,014,168 | —- | C] () – C:\Windows\System32\drivers\iKeyLFT2.dll
[2010/05/07 18:43:30 | 000,025,824 | —- | C] () – C:\Windows\System32\drivers\LVPr2Mon.sys
[2009/10/14 09:38:37 | 000,002,940 | —- | C] () – C:\Windows\hpwmdl22.dat
[2009/07/13 21:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 21:33:53 | 000,451,552 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 19:05:48 | 000,623,940 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/13 19:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/13 19:05:48 | 000,106,316 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/13 19:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/13 19:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/13 19:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/13 17:19:49 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2009/07/13 16:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 16:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 16:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/10 14:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2008/01/14 18:47:06 | 000,099,712 | —- | C] () – C:\Windows\HPBroker.dll
[2007/12/04 09:30:00 | 003,033,728 | —- | C] () – C:\Windows\System32\drivers\spc1000.sys
[2007/12/04 09:30:00 | 000,028,672 | —- | C] () – C:\Windows\System32\drivers\spc1000c.sys
[2007/12/04 09:29:00 | 000,014,583 | —- | C] () – C:\Windows\spc1000.ini
[2005/08/26 16:28:34 | 000,143,360 | —- | C] () – C:\Windows\unzip.exe
[2005/08/26 16:28:20 | 000,024,576 | —- | C] () – C:\Windows\shortcut.exe
[2005/08/26 16:27:58 | 000,045,056 | —- | C] () – C:\Windows\devenum.exe
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\Windows\System32\OUTLPERF.INI

========== LOP Check ==========

[2010/11/29 00:19:50 | 000,000,000 | -H-D | M] – C:\Users\Susan\AppData\Roaming\Amazon
[2011/04/03 15:06:07 | 000,000,000 | -H-D | M] – C:\Users\Susan\AppData\Roaming\com.amazon.music.uploader
[2011/02/05 13:27:22 | 000,000,000 | -H-D | M] – C:\Users\Susan\AppData\Roaming\DriverFinder
[2010/10/10 12:52:46 | 000,000,000 | -H-D | M] – C:\Users\Susan\AppData\Roaming\Easeware
[2010/10/12 09:21:16 | 000,000,000 | -H-D | M] – C:\Users\Susan\AppData\Roaming\Leadertech
[2011/06/20 21:46:15 | 000,000,000 | -H-D | M] – C:\Users\Susan\AppData\Roaming\MyHeritage
[2010/10/04 10:54:58 | 000,000,000 | -H-D | M] – C:\Users\Susan\AppData\Roaming\RegWork
[2010/12/25 16:32:43 | 000,000,000 | -H-D | M] – C:\Users\Susan\AppData\Roaming\The Complete Genealogy Reporter - FTB
[2011/06/17 03:20:44 | 000,000,364 | —- | M] () – C:\Windows\Tasks\FileCure Default.job
[2011/06/20 23:49:07 | 000,000,380 | —- | M] () – C:\Windows\Tasks\FileCure Startup.job
[2011/06/18 18:00:00 | 000,000,444 | —- | M] () – C:\Windows\Tasks\ParetoLogic Registration3.job
[2011/06/17 03:20:44 | 000,000,418 | —- | M] () – C:\Windows\Tasks\ParetoLogic Update Version3.job
[2010/10/07 21:50:01 | 000,000,266 | —- | M] () – C:\Windows\Tasks\Regwork.job
[2009/07/13 21:53:46 | 000,018,648 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< >

< %SYSTEMDRIVE%\*.* >
[2009/12/18 14:48:52 | 000,004,632 | —- | M] () – C:\0x0409.ini
[2009/12/18 14:48:52 | 000,016,384 | —- | M] () – C:\1033.MST
[2009/01/27 14:51:01 | 000,000,000 | —- | M] () – C:\AdobeDebug.txt
[2009/06/10 14:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/07/13 18:38:58 | 000,383,562 | RHS- | M] () – C:\bootmgr
[2010/09/24 09:55:01 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2011/06/18 23:15:48 | 000,003,408 | —- | M] () – C:\bootsqm.dat
[2009/06/10 14:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1028.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1031.txt
[2007/11/07 08:00:40 | 000,010,134 | —- | M] () – C:\eula.1033.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1036.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1040.txt
[2007/11/07 08:00:40 | 000,000,118 | —- | M] () – C:\eula.1041.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1042.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.2052.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.3082.txt
[2007/11/07 08:00:40 | 000,001,110 | —- | M] () – C:\globdata.ini
[2011/06/20 23:58:30 | 2314,067,968 | -HS- | M] () – C:\hiberfil.sys
[2010/03/18 11:24:04 | 002,301,952 | —- | M] () – C:\hoffer - Copy.qdf
[2010/03/22 17:33:34 | 002,290,032 | —- | M] () – C:\hoffer.qrp
[2007/11/07 08:03:18 | 000,562,688 | —- | M] (Microsoft Corporation) – C:\install.exe
[2007/11/07 08:00:40 | 000,000,843 | —- | M] () – C:\install.ini
[2007/11/07 08:03:18 | 000,076,304 | —- | M] (Microsoft Corporation) – C:\install.res.1028.dll
[2007/11/07 08:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.1031.dll
[2007/11/07 08:03:18 | 000,091,152 | —- | M] (Microsoft Corporation) – C:\install.res.1033.dll
[2007/11/07 08:03:18 | 000,097,296 | —- | M] (Microsoft Corporation) – C:\install.res.1036.dll
[2007/11/07 08:03:18 | 000,095,248 | —- | M] (Microsoft Corporation) – C:\install.res.1040.dll
[2007/11/07 08:03:18 | 000,081,424 | —- | M] (Microsoft Corporation) – C:\install.res.1041.dll
[2007/11/07 08:03:18 | 000,079,888 | —- | M] (Microsoft Corporation) – C:\install.res.1042.dll
[2007/11/07 08:03:18 | 000,075,792 | —- | M] (Microsoft Corporation) – C:\install.res.2052.dll
[2007/11/07 08:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.3082.dll
[2008/04/30 10:09:43 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/03/06 08:16:41 | 000,346,667 | —- | M] () – C:\logfile
[2008/04/30 10:09:43 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/06/20 23:58:32 | 3085,426,688 | -HS- | M] () – C:\pagefile.sys
[2010/03/18 09:00:42 | 000,069,768 | —- | M] () – C:\QRental_Data.qrp
[2009/01/20 18:27:33 | 000,057,456 | —- | M] () – C:\QRental_Data_BackupV1_20100318_BackupV1_20100318.qrp
[2010/04/15 08:34:36 | 003,297,280 | —- | M] () – C:\Quicken Rental Property Manager 2010.lnk.QDF
[2010/03/26 09:42:26 | 000,149,472 | —- | M] () – C:\Quicken Rental Property Manager 2010.lnkOFXLOG.DAT
[2010/03/24 17:21:59 | 000,547,744 | —- | M] () – C:\Quicken Rental Property Manager 2010.lnkOFXOLD.DAT
[2009/12/18 14:48:52 | 000,001,482 | —- | M] () – C:\Setup.INI
[2009/12/18 14:48:52 | 000,036,374 | —- | M] () – C:\Setup.skin
[2009/02/04 10:30:41 | 000,007,202 | —- | M] () – C:\temp.txt
[2007/11/07 08:00:40 | 000,005,686 | —- | M] () – C:\vcredist.bmp
[2010/03/07 12:20:53 | 000,494,888 | —- | M] () – C:\vcredist_x86.log
[2007/11/07 08:09:22 | 001,442,522 | —- | M] () – C:\VC_RED.cab
[2007/11/07 08:12:28 | 000,232,960 | —- | M] () – C:\VC_RED.MSI
[2 C:\*.tmp files -> C:\*.tmp -> ]

< %systemroot%\Fonts\*.com >
[2009/07/13 21:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 21:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 21:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 21:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 14:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/08/12 11:58:10 | 000,314,880 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpfpp082.dll
[2009/07/13 18:15:25 | 000,319,488 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpfppw73.dll
[2008/08/07 13:03:38 | 000,274,944 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpzpp64w.dll
[2009/07/13 18:15:26 | 000,280,064 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpzppw71.dll
[2009/07/13 18:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2003/06/18 17:31:48 | 000,018,944 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2009/07/13 18:16:19 | 000,029,696 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 21:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/09/25 14:09:52 | 000,000,221 | -HS- | M] () – C:\Users\Susan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/06/20 23:26:58 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Users\Susan\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >
[2007/12/04 09:29:00 | 000,013,022 | —- | M] () – C:\Windows\spc1000.src
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-17 10:03:27

========== Alternate Data Streams ==========

@Alternate Data Stream - 208 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84

< End of report >