Spyware / Malware / Virus Removal

Google redirecting me + other problems. [Solved]

25 min read

Looking for the outcome? Ask AI

Sunyata

Post #16November 24, 2011, 9:55 PM UTC

Hello ClementZ

What sort of problems may arise if I burned the CDs from this computer?

There is a chance that the root kit may interfere with your attempts to perform the download/burning tasks.
If you are able to create the boot CD's from your infected computer, you are probably good.

And if I had backed up my files while I had this problem, would the partition be…"in" my backed up files?

No. Not unless you backed up the partition. But, I'd be wary of any files backed up while you had this problem. A root kit's job is to hide and protect other nefarious activities from discovery. We will still have work to do to clean up your machine after the root kit is defeated.

ClementZ

Post #17November 24, 2011, 10:30 PM UTC

One more question. If a CD is not available, is it possible for me to DL the programs onto an external Hard Drive?

Sunyata

Post #18November 25, 2011, 7:08 PM UTC

Hello ClementZ

If a CD is not available, is it possible for me to DL the programs onto an external Hard Drive?

It is not quite as simple as that, but there is a way to do what you ask…

This method works for flash drives as well as external HDs with a USB interface.
One caveat - If your external HD has already been made bootable, such as having an OS already installed on it, this method will overwrite that boot record and you will not be able to boot into that OS after these procedures are followed.

With that warning, please visit this site and follow the directions given for installing Grub4DOS. Please pay very careful attention onto which drive you are installing this application. Because, as above, the application will overwrite any existing boot record and you will then not be able to reach the OS to which it currently points.

One way to make sure is to see which drive appears and disappears in the drive list as you plug/unplug your external drive:

[external image: Posted Image]

Once Grub4DOS is installed on your external HD, go ahead and download the two ISO files we will need to the root directory on your external HD:
gparted-live-0.10.0-3.iso and
Windows 7 64-Bit (x64) Recovery Environment

In order to be able to boot from the Windows 7 recovery ISO, you must change all the spaces in the file name to hyphens (-) like this:
Windows-7-64-bit-Repair-Disc.iso

Then, save the following text in the code box to a text file named menu.lst (please note that the filename has a lower-case "L") to the root directory on your external HD:

timeout 10
default 0

title GParted
map (hd0,0)/gparted-live-0.10.0-3.iso (hd32)
map –hook
chainloader (hd32)
boot

title Windows_7_Repair
map (hd0,0)/Windows-7-64-bit-Repair-Disc.iso (hd32)
map –hook
chainloader (hd32)
boot

title CommandLine
commandline

title Reboot
reboot

title Halt
halt

Now, with your external drive plugged into your USB port, reboot your computer and set the boot options to boot from USB. A Grub4DOS menu should appear allowing you to boot from GParted or Windows_7_Repair.

Once you can do this, follow the instructions in post 13 to remove the root kit partition, restore your MBR and post the log from MBRCheck.exe.

ClementZ

Post #19November 26, 2011, 12:27 AM UTC

Alright, thanks. Just a forwarning; I won't be posting again until Monday, earliest. This because due to a lack of a second computer, I'm getting a friend to download the programs for me, and then give me the programs. Hopefully, that works.

ClementZ

Post #20November 28, 2011, 8:40 PM UTC

Got the programs. Now proceeding to run them.

ClementZ

Post #21November 28, 2011, 9:16 PM UTC

MBR is attached.

Attachments:

📎MBRCheck_11.28.11_16.15.07.txt

Sunyata

Post #22November 28, 2011, 9:58 PM UTC

Hello ClementZ

Your boot record looks good.
Did you use CD's or did you install Grub4DOS on your external drive?

How is your machine behaving? Are there any issues?

We want to confirm that hidden partition is gone. The batfile you used before that did not work has been updated. Lets give that another whirl:

Please download GetPartitions from the link bellow. You must right click on the link and choose Save as…. Save it as GetPartitions.bat on your desktop

getpartitions.bat

Double click it to run it.
It will produce DiskReport.txt log please post results from that log here to me.

Next,

Please download OTL to your desktop.

If you are using Firefox, make sure that your download settings are as follows:

-Tools->Options->Main tab
-Set to "Always ask me where to Save the files".
Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
In the window under Custom Scans/Fixes copy and paste the following

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lîk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Deskuop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results Install|LastSuccessTime /rs
%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
/md5stop

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

In your next post please include:

DiskReport.txt
OTL.txt
Extras.txt

ClementZ

Post #23November 28, 2011, 11:59 PM UTC

GetPartitions.Bat still doesn't work. I shall run OTL when I finish doing HW. (It's due tomorrow) I should have the log done late tonight.

Sunyata

Post #24November 29, 2011, 12:20 AM UTC

Hello ClementZ

No hurry.

When you run OTL, also do this thing with the Disk Manager and post the screen shot. Thanks:

Click on the Start button and then choose Control Panel.
Click on the System and Security link.

Note: If you're viewing the Large icons or Small icons view of Control Panel, you won't see this link so just click on the Administrative Tools icon and skip to Step 4.
In the System and Security window, click on the Administrative Tools heading located near the bottom of the window.
In the Administrative Tools window, double-click on the Computer Management icon.
When Computer Management opens, click on Disk Management on the left side of the window, located under Storage.

After a brief loading period, Disk Management should now appear on the right side of the Computer Management window.

Note: If you don't see Disk Management listed, you may need to click on the |> icon to the left of the Storage icon.

Take a screen Shot of the Disk Management Window and attach the screen shot to your reply.

ClementZ

Post #25November 29, 2011, 3:55 AM UTC

How's my machine acting?
Well, I'm no longer being redirected by Google.

However, my computer is still slower than normal to start up and shut down.
I often get messages like, "please wait for client service or sth." (which never happened before), and when I'm shutting down, I get messages like "shutting down windows update services" (again, which never happened before.
Anywho, logs

OTL.txt
OTL logfile created on: 28/11/2011 10:43:19 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Owner\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

7.93 Gb Total Physical Memory | 6.44 Gb Available Physical Memory | 81.19% Memory free
15.86 Gb Paging File | 14.25 Gb Available in Paging File | 89.89% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 920.04 Gb Total Space | 846.47 Gb Free Space | 92.00% Space Free | Partition Type: NTFS
Drive D: | 11.38 Gb Total Space | 1.69 Gb Free Space | 14.84% Space Free | Partition Type: NTFS
Drive F: | 100.00 Mb Total Space | 37.86 Mb Free Space | 37.86% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Users\Owner\AppData\Roaming\HP SimpleSave Application\StartHelper.exe ()
PRC - C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\ServicepointService.exe (Radialpoint Inc.)
PRC - C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe (Rogers)
PRC - C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgentComHandler.exe (Radialpoint Inc.)
PRC - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Last.fm\LastFM.exe (Last.fm)
PRC - C:\Users\Owner\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe (ArcSoft, Inc.)
PRC - C:\Program Files (x86)\Rogers\SelfHealing\RogersSelfHelpService.exe (Rogers Cable Communications)
PRC - C:\Windows\V0650Mon.exe (Creative Technology Ltd.)
PRC - c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\WhatPulse\WhatPulse.exe (WhatPulse.org)
PRC - C:\Program Files (x86)\Rokario\Bandwidth Monitor\bandmon.exe (Rokario Software)

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Users\Owner\AppData\Roaming\HP SimpleSave Application\StartHelper.exe ()
MOD - C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\Windows7Features.dll ()
MOD - C:\Program Files (x86)\Last.fm\srv_rtaudioplayback.dll ()
MOD - C:\Program Files (x86)\Last.fm\ext_messengernotify.dll ()
MOD - C:\Program Files (x86)\Last.fm\ext_skypenotify.dll ()
MOD - C:\Program Files (x86)\Last.fm\srv_madtranscode.dll ()
MOD - C:\Program Files (x86)\Last.fm\srv_httpinput.dll ()
MOD - C:\Program Files (x86)\Last.fm\LastFmFingerprint1.dll ()
MOD - C:\Program Files (x86)\Last.fm\breakpad.dll ()
MOD - C:\Program Files (x86)\Last.fm\Moose1.dll ()
MOD - C:\Program Files (x86)\Last.fm\LastFmTools1.dll ()
MOD - C:\Program Files (x86)\Last.fm\libfftw3f-3.dll ()
MOD - C:\Program Files (x86)\Last.fm\zlibwapi.dll ()
MOD - c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll ()
MOD - C:\Program Files (x86)\Last.fm\QtNetwork4.dll ()
MOD - C:\Program Files (x86)\Last.fm\QtSql4.dll ()
MOD - C:\Program Files (x86)\Last.fm\QtGui4.dll ()
MOD - C:\Program Files (x86)\Last.fm\QtXml4.dll ()
MOD - C:\Program Files (x86)\Last.fm\QtCore4.dll ()
MOD - C:\Program Files (x86)\Last.fm\imageformats\qmng4.dll ()
MOD - C:\Program Files (x86)\Last.fm\imageformats\qgif4.dll ()
MOD - C:\Program Files (x86)\Last.fm\imageformats\qjpeg4.dll ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (NisSrv) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (ServicepointService) – C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\ServicepointService.exe (Radialpoint Inc.)
SRV - (NSL) – C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\ccSvcHst.exe (Symantec Corporation)
SRV - (BackupService) – C:\Users\Owner\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe (ArcSoft, Inc.)
SRV - (RogersUpdateManager) – C:\Program Files (x86)\Rogers\Update Manager\RogersUpdateManager.exe (Rogers Cable Communications)
SRV - (RogersSelfHelpService) – C:\Program Files (x86)\Rogers\SelfHealing\RogersSelfHelpService.exe (Rogers Cable Communications)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (IAStorDataMgrSvc) Intel® – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (EPSON_EB_RPCV4_01) EPSON V5 Service4(01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE (SEIKO EPSON CORPORATION)
SRV - (EPSON_PM_RPCV4_01) EPSON V3 Service4(01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (SEIKO EPSON CORPORATION)

========== Driver Services (SafeList) ==========

DRV:64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (V0650Vid) – C:\Windows\SysNative\drivers\V0650Vid.sys (Creative Technology Ltd.)
DRV:64bit: - (CtClsFlt) – C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (HECIx64) Intel® – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (PCDSRVC{F36B3A4C-F95654BD-06000000}_0) – c:\Program Files\PC-Doctor for Windows\pcdsrvc_x64.pkms (PC-Doctor, Inc.)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (WDC_SAM) – C:\Windows\SysNative\drivers\wdcsam64.sys (Western Digital Technologies)
DRV:64bit: - (RimUsb) – C:\Windows\SysNative\drivers\RimUsb_AMD64.sys (Research In Motion Limited)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCON/4
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCON/4
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCON/4
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCON/4

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCON/4
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://hp.ca.msn.com/default.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-ca
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E1 12 6E 58 55 1C CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\nprpspa.dll (Rogers)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\nprpspa.dll (Rogers)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Owner\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Owner\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{203FB6B2-2E1E-4474-863B-4C483ECCE78E}: C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_1.2.0.6\coFFNST\ [2011/07/05 21:32:53 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\FinalVideoDownloader\Firefox [2011/09/26 14:47:44 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/11/15 16:26:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/09/19 18:16:00 | 000,000,000 | —D | M]

[2011/11/15 16:27:09 | 000,000,000 | —D | M] (No name found) – C:\Users\Owner\AppData\Roaming\Mozilla\Extensions
[2011/11/25 14:29:12 | 000,000,000 | —D | M] (No name found) – C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\w30wc1oy.default\extensions
[2011/11/17 20:37:14 | 000,000,000 | —D | M] (British English Dictionary) – C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\w30wc1oy.default\extensions\[removed]
[2011/11/24 21:16:43 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/11/24 21:16:43 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/11/23 20:23:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011/09/26 14:47:44 | 000,000,000 | —D | M] (FinalVideoDownloader plugin for Mozilla Firefox) – C:\PROGRAM FILES (X86)\FINALVIDEODOWNLOADER\FIREFOX
() (No name found) – C:\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\W30WC1OY.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011/11/05 02:10:40 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/10/03 05:06:04 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/11/04 22:44:20 | 000,001,538 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\amazon-en-GB.xml
[2011/11/04 22:32:18 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/11/04 22:44:20 | 000,000,947 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\chambers-en-GB.xml
[2011/11/04 22:44:20 | 000,001,180 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-en-GB.xml
[2011/11/04 22:44:20 | 000,001,135 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-en-GB.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Owner\AppData\Local\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.210.7 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U21 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Owner\AppData\Local\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Owner\AppData\Local\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Rogers Servicepoint Agent (Enabled) = C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\nprpspa.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Nexon Game Controller (Enabled) = C:\ProgramData\NexonUS\NGM\npNxGameUS.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Owner\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Skype Click to Call = C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\

O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Norton Safe Web Lite BHO) - {F0DA78E9-6B60-42fb-BC26-EF2CFB8C8FF3} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Norton Safe Web Lite) - {30CEEEA2-3742-40e4-85DD-812BF1CBB83D} - C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\CoIEPlg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [RogersServicepointAgent.exe] C:\Program Files (x86)\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe (Rogers)
O4 - HKLM..\Run: [V0650Mon.exe] C:\Windows\V0650Mon.exe (Creative Technology Ltd.)
O4 - HKCU..\Run: [bandmon] C:\Program Files (x86)\Rokario\Bandwidth Monitor\bandmon.exe (Rokario Software)
O4 - HKCU..\Run: [EPSON NX510 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFIA.EXE /FU "C:\Users\Owner\AppData\Local\Temp\E_SB6F1.tmp" /EF "HKCU" File not found
O4 - HKCU..\Run: [WhatPulse] C:\Program Files (x86)\WhatPulse\WhatPulse.exe (WhatPulse.org)
O4 - Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HP SimpleSave Monitor.lnk = C:\Users\Owner\AppData\Roaming\HP SimpleSave Application\StartHelper.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRemoteRecursiveEvents = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousMachineGroupPolicy = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousUserGroupPolicy = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMBalloonTip = 1
O8:64bit: - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: Download Video - {3B54DEAB-C6D4-48a8-8C32-A70558643400} - C:\Program Files (x86)\FinalVideoDownloader\fvdRunner.html ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab (Solitaire Showdown Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/MessengerGam…1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EF5ABC5E-3819-46FA-B907-6644B8D77739}: DhcpNameServer = [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F14C9C70-7912-4006-82E7-648CDC421877}: DhcpNameServer = [removed]
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{c70b017d-9783-11e0-a847-406186961016}\Shell - "" = AutoRun
O33 - MountPoints2\{c70b017d-9783-11e0-a847-406186961016}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/11/28 22:34:13 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Owner\Desktop\OTL.exe
[2011/11/28 19:08:41 | 000,000,000 | -HSD | C] – C:\Boot
[2011/11/28 16:19:41 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{278A27A1-9207-4BE0-A403-839E46F1507E}
[2011/11/28 16:19:19 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{3381A898-1009-4144-B3FB-56C5683A146C}
[2011/11/27 14:17:01 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{816DB371-7AF2-40B8-91C6-36E7D5973FA9}
[2011/11/27 14:16:38 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{62E45F5E-B665-43A5-935B-6099D1EF3F32}
[2011/11/26 22:20:18 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{81927659-C949-4FAC-A1D3-251E791F2721}
[2011/11/26 22:19:56 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{692F06F3-2E31-49E8-9404-94F55287CEB6}
[2011/11/26 10:19:30 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{AD4B8273-9894-4F95-8AEA-31E076187E97}
[2011/11/26 10:19:19 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{8F554A50-B1A1-4CA8-8E52-7CC9223ACF04}
[2011/11/25 18:46:38 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{3E7DA18E-1AE9-4C90-9809-FFA82B5AFFCF}
[2011/11/25 18:46:19 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{7B9454B0-875F-4020-9121-ECAC8840B467}
[2011/11/24 21:16:18 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/11/24 15:39:55 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{5BE57497-DF32-4B4B-B0F0-BBDF7F193633}
[2011/11/24 15:39:40 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{9A774EB4-179A-4C7E-A3C5-69D512F29589}
[2011/11/23 20:50:02 | 000,000,000 | —D | C] – C:\ProgramData\HPSS
[2011/11/23 20:47:40 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Roaming\HPSS
[2011/11/23 20:47:40 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Roaming\HP SimpleSave Application
[2011/11/23 20:41:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2011/11/23 20:34:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\NVIDIA Corporation
[2011/11/23 20:33:46 | 005,067,584 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvsvc64.dll
[2011/11/23 20:33:46 | 000,137,536 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvshext.dll
[2011/11/23 20:33:45 | 010,406,208 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcpl.dll
[2011/11/23 20:33:45 | 003,074,368 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvsvcr.dll
[2011/11/23 20:33:45 | 000,837,952 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\easyupdatusapiu64.dll
[2011/11/23 20:33:45 | 000,222,528 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvmctray.dll
[2011/11/23 20:24:34 | 024,742,720 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvoglv64.dll
[2011/11/23 20:24:34 | 008,792,384 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvwgf2umx.dll
[2011/11/23 20:24:34 | 007,042,880 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvwgf2um.dll
[2011/11/23 20:24:34 | 001,452,648 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvhdagenco6420102.dll
[2011/11/23 20:24:34 | 000,174,184 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\drivers\nvhda64v.sys
[2011/11/23 20:24:34 | 000,029,288 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvhdap64.dll
[2011/11/23 20:24:33 | 024,796,992 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcompiler.dll
[2011/11/23 20:24:33 | 018,871,616 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvoglv32.dll
[2011/11/23 20:24:33 | 017,248,576 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcompiler.dll
[2011/11/23 20:24:33 | 015,693,120 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvd3dumx.dll
[2011/11/23 20:24:33 | 013,205,312 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvd3dum.dll
[2011/11/23 20:24:33 | 007,581,504 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuda.dll
[2011/11/23 20:24:33 | 005,578,560 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuda.dll
[2011/11/23 20:24:33 | 002,808,128 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvapi64.dll
[2011/11/23 20:24:33 | 002,542,912 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvid.dll
[2011/11/23 20:24:33 | 002,458,432 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvapi.dll
[2011/11/23 20:24:33 | 002,401,088 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvid.dll
[2011/11/23 20:24:33 | 002,232,128 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvenc.dll
[2011/11/23 20:24:33 | 002,099,520 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvenc.dll
[2011/11/23 20:24:33 | 001,543,488 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvdispco64.dll
[2011/11/23 20:24:33 | 001,454,400 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvgenco64.dll
[2011/11/23 20:24:33 | 000,068,928 | —- | C] (Khronos Group) – C:\Windows\SysNative\OpenCL.dll
[2011/11/23 20:24:33 | 000,061,248 | —- | C] (Khronos Group) – C:\Windows\SysWow64\OpenCL.dll
[2011/11/23 20:23:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2011/11/23 20:23:27 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2011/11/23 20:23:27 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2011/11/23 20:23:27 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2011/11/23 20:23:08 | 000,000,000 | —D | C] – C:\NVIDIA
[2011/11/23 16:02:26 | 001,566,512 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Owner\Desktop\TDSSKiller.exe
[2011/11/23 15:59:51 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/11/23 15:59:44 | 000,000,000 | –SD | C] – C:\ComboFix
[2011/11/23 15:57:25 | 000,000,000 | —D | C] – C:\Qoobox
[2011/11/23 15:56:43 | 000,000,000 | –SD | C] – C:\32788R22FWJFW
[2011/11/23 15:53:23 | 004,306,335 | R— | C] (Swearware) – C:\Users\Owner\Desktop\ComboFix.exe
[2011/11/23 15:31:18 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{11151DE6-33BA-4734-B54C-BBF73D44797B}
[2011/11/23 15:30:56 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{256FB6F0-B8AD-4B33-85F7-491954BF6486}
[2011/11/22 17:25:32 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{D2041AB1-3846-4020-A9B3-705F36F8606D}
[2011/11/22 17:25:10 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{F34DCCE0-A05C-4A42-BE20-22FE7B0DEAFA}
[2011/11/21 15:54:33 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{F3469460-28E8-4B15-AE50-90BC5FD4969A}
[2011/11/21 15:54:19 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{6AE6E6E6-954A-4256-BD61-8F308A014ED9}
[2011/11/21 15:31:15 | 000,000,000 | —D | C] – C:\ProgramData\NVIDIA Corporation
[2011/11/20 13:25:22 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{6EEA1A87-8A0E-4501-9010-01F075D3CDBC}
[2011/11/20 13:25:11 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{D307C17D-F546-4ADD-9AE8-9F772A229CDA}
[2011/11/19 16:15:48 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{D0444E85-DE17-4894-97DD-CC42D48F515B}
[2011/11/19 16:15:27 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{E4037117-CFBF-4DE3-8EA1-0A729746644F}
[2011/11/18 15:29:27 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{AAD73463-076A-40CB-873B-90B477B5951E}
[2011/11/18 15:29:14 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{5A373632-9D2D-409D-800A-16D622268B79}
[2011/11/17 12:52:38 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{97DF8FD5-C2CE-4F7A-86E2-C75CD05DB75A}
[2011/11/17 12:52:16 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{78B9A9DE-5F40-4BA9-926E-93703F16F572}
[2011/11/16 15:44:07 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{4A09E1B6-79B3-409C-9CDF-7971EAA1B776}
[2011/11/16 15:43:52 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{69D77095-2683-4034-AFB9-AA56E0D547D9}
[2011/11/15 16:47:15 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011/11/15 16:26:59 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Roaming\Mozilla
[2011/11/15 15:50:42 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{BDCA6907-DCF5-44BE-8631-1B7914AC9824}
[2011/11/15 15:50:26 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{14A75A70-55EB-450D-97DB-9356BDEB46BE}
[2011/11/14 15:23:35 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{E4164FD4-DE00-4425-A0D0-E56D236416FC}
[2011/11/14 15:23:24 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{CC2AEDEB-B1E5-4DC7-A59A-5FBAF9796A48}
[2011/11/13 14:22:59 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{968CD2CF-B4BA-4822-A335-8DFDAF4CAA55}
[2011/11/13 14:22:37 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{B5C075D1-2ECB-46CD-BE5C-5D36B78E5136}
[2011/11/12 16:54:32 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{A7B76261-612D-4473-9243-D85712D1A845}
[2011/11/12 16:54:21 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{6EF37251-1427-4C99-90AA-F5AEDE8A6D72}
[2011/11/11 16:18:51 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{FB92C0AA-318D-497A-AB06-27018C6FCE5E}
[2011/11/11 16:18:29 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{6A456E28-7E83-4531-948D-EBDA88FD1C45}
[2011/11/10 16:35:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Security Client
[2011/11/10 16:35:55 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2011/11/10 15:51:47 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{F449E489-C73A-4E6A-AE19-857A5C6A2A35}
[2011/11/10 15:51:35 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{E76F13C4-C124-4B6B-A5CB-5F1A366136FE}
[2011/11/09 20:57:22 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{A4DCB714-FA3E-4A6B-82F6-91E9BA277466}
[2011/11/09 20:56:53 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{63CC545D-8260-4AA3-A0E3-A9EC93D0BBFB}
[2011/11/09 20:36:13 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Restore
[2011/11/09 15:25:42 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{58019084-ABC4-4EE6-9655-8A13B4E8AB30}
[2011/11/09 15:25:19 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{B6A166AD-DDC3-4AB4-B513-07661D368BDF}
[2011/11/08 15:44:05 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{CCA101C4-ECC2-4A85-A254-41906779718C}
[2011/11/08 15:43:49 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{195BF2D5-6D37-47A4-A505-70028D900538}
[2011/11/07 15:29:49 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{CCF7DEE2-D596-4DC1-9D77-9BE47349DB96}
[2011/11/07 15:29:39 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{1BF12443-E763-4244-9784-B8F630EFA60D}
[2011/11/06 14:32:40 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{C6E5ABB4-82FF-4023-BAC6-64C8EE6BD0E4}
[2011/11/06 14:32:18 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{3F69E7BD-8D4D-4536-B02C-7FFAF35B8FC7}
[2011/11/05 15:01:22 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{11D6AE38-E03F-4BC3-AA05-6FAF86139E67}
[2011/11/05 15:01:02 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{10ABBD41-82EF-4CFA-A181-FF6D45C8CA4F}
[2011/11/04 22:15:27 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{CB2EBAB4-861C-460A-9698-414EEDE7886A}
[2011/11/04 22:15:05 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{4495CA94-B293-453D-ACD4-F7F9E83BDC52}
[2011/11/04 10:14:48 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{7BC02BA9-DEEA-4387-B3CC-3CDF502C8B30}
[2011/11/04 10:14:34 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{FDF49A03-CE2C-47AB-BEF0-C4CBBA8A0F4F}
[2011/11/03 14:52:22 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{3E62040F-6A25-4096-9ABC-5696865D3DB7}
[2011/11/03 14:52:00 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{4B2EA468-F192-4BD7-AC8F-A9C6A32EA054}
[2011/11/02 14:42:12 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{DA008DF9-86DB-4559-99E7-5A1A7CEB834C}
[2011/11/02 14:42:01 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{0AE76BBF-D6D9-4A1D-9802-E8CE86C4FEB2}
[2011/11/01 14:35:20 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{90A78DE0-E769-48BB-A397-83447BE0FB42}
[2011/11/01 14:35:06 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{E4D73456-CD48-482F-B6D4-333F01ABB9BE}
[2011/10/31 14:31:04 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{88966CE6-CBB1-4854-9919-5CA8A30286EE}
[2011/10/31 14:30:42 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{EDF29D43-2027-4444-B9CD-FCB3671B12CF}
[2011/10/30 10:03:01 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{F092F200-485F-4293-90BA-AC3899C42C62}
[2011/10/30 10:02:38 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{A7601A95-0565-4FB5-8157-3CCEAA3E3A4C}
[1 C:\Users\Owner\Documents\*.tmp files -> C:\Users\Owner\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/11/28 22:34:08 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Owner\Desktop\OTL.exe
[2011/11/28 21:53:24 | 000,729,756 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2011/11/28 21:53:24 | 000,630,488 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2011/11/28 21:53:24 | 000,111,572 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2011/11/28 21:51:00 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1331670900-2246307111-1120618914-1000UA.job
[2011/11/28 16:51:00 | 000,000,856 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1331670900-2246307111-1120618914-1000Core.job
[2011/11/28 16:20:50 | 000,020,432 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/11/28 16:20:50 | 000,020,432 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/11/28 16:12:49 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/11/28 16:12:33 | 2090,135,551 | -HS- | M] () – C:\hiberfil.sys
[2011/11/27 14:12:39 | 000,000,653 | —- | M] () – C:\ProgramData\SHSupdates.xml
[2011/11/25 15:54:52 | 000,166,480 | —- | M] () – C:\Users\Owner\AppData\Local\tmpIMG008.JPG
[2011/11/25 14:27:57 | 000,000,332 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForOwner.job
[2011/11/24 17:32:20 | 000,001,945 | —- | M] () – C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HP SimpleSave Monitor.lnk
[2011/11/23 16:01:52 | 001,547,478 | —- | M] () – C:\Users\Owner\Desktop\TDSSKiller.zip
[2011/11/23 15:53:27 | 004,306,335 | R— | M] (Swearware) – C:\Users\Owner\Desktop\ComboFix.exe
[2011/11/22 16:48:25 | 000,441,224 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2011/11/22 12:06:52 | 001,566,512 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Owner\Desktop\TDSSKiller.exe
[2011/11/21 16:23:04 | 000,000,512 | —- | M] () – C:\Users\Owner\Documents\MBR.dat
[2011/11/20 18:56:02 | 000,822,916 | —- | M] () – C:\Users\Owner\AppData\Local\census.cache
[2011/11/20 18:55:53 | 000,112,588 | —- | M] () – C:\Users\Owner\AppData\Local\ars.cache
[2011/11/20 18:49:32 | 000,000,036 | —- | M] () – C:\Users\Owner\AppData\Local\housecall.guid.cache
[2011/11/20 16:28:02 | 000,000,448 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for Owner.job
[2011/11/10 16:36:23 | 000,001,945 | —- | M] () – C:\Windows\epplauncher.mif
[2011/11/10 16:36:00 | 000,735,006 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/11/10 16:08:17 | 000,001,620 | —- | M] () – C:\Users\Owner\Desktop\windows-kb890830-x64-v4.2 - Shortcut.lnk
[2011/11/09 20:36:15 | 000,000,296 | —- | M] () – C:\ProgramData\~58HREEfJXgfTZ4
[2011/11/09 20:36:14 | 000,000,216 | —- | M] () – C:\ProgramData\~58HREEfJXgfTZ4r
[2011/11/09 20:36:07 | 000,000,344 | —- | M] () – C:\ProgramData\58HREEfJXgfTZ4
[2011/11/07 22:51:00 | 024,796,992 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcompiler.dll
[2011/11/07 22:51:00 | 024,742,720 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvoglv64.dll
[2011/11/07 22:51:00 | 018,871,616 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvoglv32.dll
[2011/11/07 22:51:00 | 017,248,576 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcompiler.dll
[2011/11/07 22:51:00 | 015,693,120 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvd3dumx.dll
[2011/11/07 22:51:00 | 013,205,312 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvd3dum.dll
[2011/11/07 22:51:00 | 010,406,208 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcpl.dll
[2011/11/07 22:51:00 | 008,792,384 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvwgf2umx.dll
[2011/11/07 22:51:00 | 007,581,504 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuda.dll
[2011/11/07 22:51:00 | 007,042,880 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvwgf2um.dll
[2011/11/07 22:51:00 | 005,578,560 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuda.dll
[2011/11/07 22:51:00 | 005,067,584 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvsvc64.dll
[2011/11/07 22:51:00 | 003,074,368 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvsvcr.dll
[2011/11/07 22:51:00 | 002,808,128 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvapi64.dll
[2011/11/07 22:51:00 | 002,542,912 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvid.dll
[2011/11/07 22:51:00 | 002,458,432 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvapi.dll
[2011/11/07 22:51:00 | 002,401,088 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvid.dll
[2011/11/07 22:51:00 | 002,232,128 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvenc.dll
[2011/11/07 22:51:00 | 002,099,520 | —- | M] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvenc.dll
[2011/11/07 22:51:00 | 001,543,488 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvdispco64.dll
[2011/11/07 22:51:00 | 001,454,400 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvgenco64.dll
[2011/11/07 22:51:00 | 000,837,952 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\easyupdatusapiu64.dll
[2011/11/07 22:51:00 | 000,222,528 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvmctray.dll
[2011/11/07 22:51:00 | 000,137,536 | —- | M] (NVIDIA Corporation) – C:\Windows\SysNative\nvshext.dll
[2011/11/07 22:51:00 | 000,068,928 | —- | M] (Khronos Group) – C:\Windows\SysNative\OpenCL.dll
[2011/11/07 22:51:00 | 000,061,248 | —- | M] (Khronos Group) – C:\Windows\SysWow64\OpenCL.dll
[2011/11/07 22:51:00 | 000,007,384 | —- | M] () – C:\Windows\SysNative\nvinfo.pb
[2011/11/07 18:53:44 | 000,321,856 | —- | M] () – C:\Windows\SysWow64\nvStreaming.exe
[1 C:\Users\Owner\Documents\*.tmp files -> C:\Users\Owner\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/11/28 19:11:51 | 000,383,786 | RHS- | C] () – C:\bootmgr
[2011/11/25 15:54:52 | 000,166,480 | —- | C] () – C:\Users\Owner\AppData\Local\tmpIMG008.JPG
[2011/11/23 22:09:25 | 000,001,945 | —- | C] () – C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HP SimpleSave Monitor.lnk
[2011/11/23 16:01:51 | 001,547,478 | —- | C] () – C:\Users\Owner\Desktop\TDSSKiller.zip
[2011/11/21 16:23:04 | 000,000,512 | —- | C] () – C:\Users\Owner\Documents\MBR.dat
[2011/11/20 18:56:02 | 000,822,916 | —- | C] () – C:\Users\Owner\AppData\Local\census.cache
[2011/11/20 18:55:53 | 000,112,588 | —- | C] () – C:\Users\Owner\AppData\Local\ars.cache
[2011/11/20 18:49:32 | 000,000,036 | —- | C] () – C:\Users\Owner\AppData\Local\housecall.guid.cache
[2011/11/15 16:46:46 | 000,000,908 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1331670900-2246307111-1120618914-1000UA.job
[2011/11/15 16:46:45 | 000,000,856 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1331670900-2246307111-1120618914-1000Core.job
[2011/11/10 16:36:00 | 000,735,006 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/11/10 16:35:57 | 000,001,899 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/11/10 16:35:37 | 000,001,945 | —- | C] () – C:\Windows\epplauncher.mif
[2011/11/10 16:08:17 | 000,001,620 | —- | C] () – C:\Users\Owner\Desktop\windows-kb890830-x64-v4.2 - Shortcut.lnk
[2011/11/09 20:36:14 | 000,000,296 | —- | C] () – C:\ProgramData\~58HREEfJXgfTZ4
[2011/11/09 20:36:14 | 000,000,216 | —- | C] () – C:\ProgramData\~58HREEfJXgfTZ4r
[2011/11/09 20:36:07 | 000,000,344 | —- | C] () – C:\ProgramData\58HREEfJXgfTZ4
[2011/11/07 18:53:44 | 000,321,856 | —- | C] () – C:\Windows\SysWow64\nvStreaming.exe
[2011/07/30 13:12:25 | 002,205,064 | —- | C] () – C:\ProgramData\shs_setup_4059-354328.exe
[2011/07/30 13:12:23 | 000,000,653 | —- | C] () – C:\ProgramData\SHSupdates.xml
[2011/07/29 19:38:38 | 001,896,720 | —- | C] () – C:\Users\Owner\AppData\Local\tmpIMG023.JPG
[2011/06/24 22:01:50 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2011/03/29 16:14:24 | 000,000,004 | RHS- | C] () – C:\ProgramData\sysqcl1129139270.dat
[2011/02/12 18:33:22 | 000,044,817 | —- | C] () – C:\Users\Owner\AppData\Local\tmpTAJ_FATHER4.1
[2011/02/12 18:33:21 | 000,050,969 | —- | C] () – C:\Users\Owner\AppData\Local\tmpTAJ_FATHER4.0
[2011/02/12 18:33:21 | 000,044,848 | —- | C] () – C:\Users\Owner\AppData\Local\tmpTAJ_FATHER4.JPG
[2011/01/22 13:39:45 | 000,001,940 | —- | C] () – C:\Users\Owner\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/01/12 01:41:34 | 000,003,584 | —- | C] () – C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/01 21:16:38 | 000,346,337 | —- | C] () – C:\Users\Owner\AppData\Local\tmp001.2
[2011/01/01 21:16:36 | 000,324,615 | —- | C] () – C:\Users\Owner\AppData\Local\tmp001.1
[2010/12/12 03:58:23 | 000,000,000 | —- | C] () – C:\Users\Owner\AppData\Roaming\wklnhst.dat
[2010/09/23 21:37:09 | 001,043,762 | —- | C] () – C:\Users\Owner\AppData\Local\tmpP9100064.JPG
[2010/09/23 21:37:08 | 005,925,433 | —- | C] () – C:\Users\Owner\AppData\Local\tmpP9100064.0
[2010/07/15 17:45:05 | 000,007,597 | —- | C] () – C:\Users\Owner\AppData\Local\Resmon.ResmonCfg
[2010/07/05 11:57:43 | 000,000,097 | —- | C] () – C:\Windows\SysWow64\PICSDK.ini
[2010/07/05 11:57:42 | 000,073,220 | —- | C] () – C:\Windows\SysWow64\EPPICPrinterDB.dat
[2010/07/05 11:57:42 | 000,031,053 | —- | C] () – C:\Windows\SysWow64\EPPICPattern131.dat
[2010/07/05 11:57:42 | 000,029,114 | —- | C] () – C:\Windows\SysWow64\EPPICPattern1.dat
[2010/07/05 11:57:42 | 000,027,417 | —- | C] () – C:\Windows\SysWow64\EPPICPattern121.dat
[2010/07/05 11:57:42 | 000,021,021 | —- | C] () – C:\Windows\SysWow64\EPPICPattern3.dat
[2010/07/05 11:57:42 | 000,015,670 | —- | C] () – C:\Windows\SysWow64\EPPICPattern5.dat
[2010/07/05 11:57:42 | 000,013,280 | —- | C] () – C:\Windows\SysWow64\EPPICPattern2.dat
[2010/07/05 11:57:42 | 000,010,673 | —- | C] () – C:\Windows\SysWow64\EPPICPattern4.dat
[2010/07/05 11:57:42 | 000,004,943 | —- | C] () – C:\Windows\SysWow64\EPPICPattern6.dat
[2010/07/05 11:57:42 | 000,001,140 | —- | C] () – C:\Windows\SysWow64\EPPICPresetData_PT.dat
[2010/07/05 11:57:42 | 000,001,140 | —- | C] () – C:\Windows\SysWow64\EPPICPresetData_BP.dat
[2010/07/05 11:57:42 | 000,001,137 | —- | C] () – C:\Windows\SysWow64\EPPICPresetData_ES.dat
[2010/07/05 11:57:42 | 000,001,130 | —- | C] () – C:\Windows\SysWow64\EPPICPresetData_FR.dat
[2010/07/05 11:57:42 | 000,001,130 | —- | C] () – C:\Windows\SysWow64\EPPICPresetData_CF.dat
[2010/07/05 11:57:42 | 000,001,104 | —- | C] () – C:\Windows\SysWow64\EPPICPresetData_EN.dat
[2010/07/05 11:53:19 | 000,000,079 | —- | C] () – C:\Windows\EPNX510.ini
[2009/09/29 18:25:16 | 000,013,312 | —- | C] () – C:\Windows\LPRES.DLL
[2009/07/14 00:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat

========== LOP Check ==========

[2011/07/06 11:33:31 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\AVG
[2011/07/05 21:31:01 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\AVG10
[2010/12/12 03:55:16 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\DVDVideoSoft
[2011/02/09 17:45:10 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\DVDVideoSoftIEHelpers
[2010/07/05 22:20:21 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\Epson
[2011/10/01 12:30:18 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\FinalVideoDownloader
[2010/12/20 19:09:40 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\foobar2000
[2011/08/07 20:45:57 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\FreeYoutubeToMP3TURBOConverter
[2011/07/09 15:52:03 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\FrostWire
[2010/07/05 12:00:08 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\Leadertech
[2011/08/26 18:01:59 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\Registry Mechanic
[2011/01/11 19:54:56 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\RocketFish
[2011/11/23 22:34:34 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\Rogers Online Protection
[2011/03/05 12:13:27 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\Rokario
[2010/08/28 16:48:32 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\SystemRequirementsLab
[2011/01/19 16:22:02 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\Tific
[2010/07/05 15:06:22 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\WhatPulse
[2010/07/06 17:46:23 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\WinBatch
[2011/03/15 18:58:29 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\Windows Live Writer
[2011/04/30 09:33:05 | 000,000,544 | —- | M] () – C:\Windows\Tasks\PCDRScheduledMaintenance.job
[2011/10/03 13:47:33 | 000,032,610 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/11/20 07:40:07 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2010/07/08 12:44:04 | 000,000,500 | —- | M] () – C:\FINIS_IT.TXT
[2011/11/28 16:12:33 | 2090,135,551 | -HS- | M] () – C:\hiberfil.sys
[2006/12/02 02:37:14 | 000,904,704 | —- | M] (Microsoft Corporation) – C:\msdia80.dll
[2011/11/28 16:12:42 | 4218,503,167 | -HS- | M] () – C:\pagefile.sys
[2011/11/23 16:03:59 | 000,077,150 | —- | M] () – C:\TDSSKiller.2.6.20.0_23.11.2011_16.03.04_log.txt

< %systemroot%\Fonts\*.com >
[2009/07/14 00:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 15:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/13 14:42:24 | 000,302,448 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 23:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Deskuop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"NoAutoRebootWithLoggedOnUsers" = 1
"IncludeRecommendedUpdates" = 1
"AUOptions" = 4
"BalloonType" = 6

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results Install|LastSuccessTime /rs >

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.ADML >
[2009/07/13 21:30:02 | 000,003,695 | —- | M] () MD5=7A4C7F3CB156543113596988479CAFCE – C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7ef5713984067904\Explorer.adml

< MD5 for: EXPLORER.ADMX >
[2009/06/10 15:53:55 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\winsxs\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_71af9b5b0a86e6b7\Explorer.admx

< MD5 for: EXPLORER.EXE >
[2009/10/06 01:06:36 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_b8b0208ee0ce1889\explorer.exe
[2011/02/26 01:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 00:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 20:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 00:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/31 00:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 00:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 01:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 07:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/10/06 01:35:29 | 002,868,736 | —- | M] (Microsoft Corporation) MD5=6D4F9E4B640B413C6F73414327484C80 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_addea9f19345cd81\explorer.exe
[2009/08/03 01:19:07 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 01:34:59 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009/08/03 00:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 08:24:45 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 01:38:38 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009/08/03 00:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 20:39:10 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 01:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2009/10/06 01:31:09 | 002,868,736 | —- | M] (Microsoft Corporation) MD5=CA17F8620815267DC838E30B68CB5052 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_ae5b763cac6d568e\explorer.exe
[2011/02/26 01:26:45 | 002,870,784 | —- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009/08/03 01:17:37 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[2009/10/06 00:53:03 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_b8335443c7a68f7c\explorer.exe

< MD5 for: EXPLORER.EXE.4000.DMP >
[2011/11/11 16:25:25 | 002,309,304 | —- | M] () MD5=3B71FB064C3BA6CA81E4AD7626957A58 – C:\Users\Owner\AppData\Local\CrashDumps\explorer.exe.4000.dmp

< MD5 for: EXPLORER.EXE.5904.DMP >
[2011/11/10 21:42:06 | 002,399,871 | —- | M] () MD5=DF3676087AFE63D2027449E2A5B71E8E – C:\Users\Owner\AppData\Local\CrashDumps\explorer.exe.5904.dmp

< MD5 for: EXPLORER.EXE.6136.DMP >
[2011/11/10 18:30:12 | 002,237,689 | —- | M] () MD5=B7F8B744DBDA69EA283CAAC9502EEF50 – C:\Users\Owner\AppData\Local\CrashDumps\explorer.exe.6136.dmp

< MD5 for: EXPLORER.EXE.MUI >
[2009/07/13 21:26:48 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\en-US\explorer.exe.mui
[2009/07/13 21:26:48 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_61e778c48d52d19b\explorer.exe.mui
[2009/07/13 21:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2009/07/13 21:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c3c2316c1b39396\explorer.exe.mui

< MD5 for: EXPLORER.EXE-A80E4F97.PF >
[2011/11/15 17:11:15 | 000,123,826 | —- | M] () MD5=379BBD7DEAE7390486150CEFFB6135F4 – C:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf

< MD5 for: IEXPLORE.EXE >
[2009/07/13 20:17:29 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=2C32E3E596CFE660353753EABEFB0540 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_19ba3f8a72d988f3\iexplore.exe
[2009/04/19 23:56:28 | 000,060,416 | —- | M] () MD5=753BC16326FEE4A421ACB636CCD602F4 – C:\ComboFix\iexplore.exe
[2010/11/20 08:28:25 | 000,695,056 | —- | M] (Microsoft Corporation) MD5=86257731DDB311FBC283534CC0091634 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1196a9003b674a92\iexplore.exe
[2011/04/03 16:09:22 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2011/04/03 16:09:22 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_17a944edb4ca4c7a\iexplore.exe
[2005/08/15 12:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\ComboFix\en-US\iexplore.exe
[2010/11/20 07:22:51 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C613E69C3B191BB02C7A191741A1D024 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1beb53526fc80c8d\iexplore.exe
[2011/04/03 16:09:21 | 000,754,480 | —- | M] (Microsoft Corporation) MD5=F1424C1B9B1813BF825E45DF3790BC8A – C:\Program Files\Internet Explorer\iexplore.exe
[2011/04/03 16:09:21 | 000,754,480 | —- | M] (Microsoft Corporation) MD5=F1424C1B9B1813BF825E45DF3790BC8A – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_0d549a9b80698a7f\iexplore.exe
[2009/07/13 20:43:43 | 000,696,600 | —- | M] (Microsoft Corporation) MD5=F2B0D41E1D08D0B2006DF5AA2E74C81E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_0f6595383e78c6f8\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2011/04/03 16:09:22 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2011/04/03 16:09:22 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_07013012b816cb66\iexplore.exe.mui
[2011/04/03 16:09:23 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2011/04/03 16:09:23 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_1155da64ec778d61\iexplore.exe.mui
[2009/07/13 21:29:20 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_09122aaf762607df\iexplore.exe.mui
[2009/07/13 21:29:20 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_0b433e7773148b79\iexplore.exe.mui
[2009/07/13 21:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_1366d501aa86c9da\iexplore.exe.mui
[2009/07/13 21:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_1597e8c9a7754d74\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-4B6C9213.PF >
[2011/11/15 19:05:27 | 000,119,630 | —- | M] () MD5=497592808F198420A40BAD5483D7B08C – C:\Windows\Prefetch\IEXPLORE.EXE-4B6C9213.pf

< MD5 for: IEXPLORE.EXE-908C99F8.PF >
[2011/11/15 17:19:23 | 000,112,782 | —- | M] () MD5=A51A4B72221C5C00E9F9BC996D7B60E6 – C:\Windows\Prefetch\IEXPLORE.EXE-908C99F8.pf

< MD5 for: WINLOGON.ADML >
[2009/07/13 21:25:22 | 000,008,013 | —- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f0f9032ef6930070\WinLogon.adml

< MD5 for: WINLOGON.ADMX >
[2009/06/10 16:04:41 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.1.7600.16385_none_d7024e6992f3424d\WinLogon.admx

< MD5 for: WINLOGON.EXE >
[2010/11/20 08:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/20 08:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 20:39:52 | 000,389,120 | —- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 02:01:57 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 01:24:40 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2010/11/20 08:00:25 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F – C:\Windows\SysNative\en-US\winlogon.exe.mui
[2010/11/20 08:00:25 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7601.17514_en-us_291e96fa1ab5fc7b\winlogon.exe.mui
[2009/07/13 21:29:52 | 000,022,528 | —- | M] (Microsoft Corporation) MD5=56D03B64B8C483C1D12A8E4577B3B332 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7600.16385_en-us_26ed83321dc778e1\winlogon.exe.mui

< MD5 for: WINLOGON.MFL >
[2009/07/13 21:27:22 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\SysNative\wbem\en-US\winlogon.mfl
[2009/07/13 21:27:22 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_en-us_84afd4fd38ffd276\winlogon.mfl

< MD5 for: WINLOGON.MOF >
[2009/07/13 15:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\SysNative\wbem\winlogon.mof
[2009/07/13 15:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.1.7600.16385_none_dc2dbb778f98e40f\winlogon.mof

========== Alternate Data Streams ==========

@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:D287FACF
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:0B4227B4
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:D1B5B4F1

< End of report >

Extras.txt
OTL Extras logfile created on: 28/11/2011 10:43:19 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Owner\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

7.93 Gb Total Physical Memory | 6.44 Gb Available Physical Memory | 81.19% Memory free
15.86 Gb Paging File | 14.25 Gb Available in Paging File | 89.89% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 920.04 Gb Total Space | 846.47 Gb Free Space | 92.00% Space Free | Partition Type: NTFS
Drive D: | 11.38 Gb Total Space | 1.69 Gb Free Space | 14.84% Space Free | Partition Type: NTFS
Drive F: | 100.00 Mb Total Space | 37.86 Mb Free Space | 37.86% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – "C:\Program Files (x86)\File Type Assistant\tsassist.exe" "%1" (Trusted Software ApS)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [runas] – cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – "C:\Program Files (x86)\File Type Assistant\tsassist.exe" "%1" (Trusted Software ApS)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [runas] – cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1FB31F44-D4D0-4D76-944A-A1A5D79FD321}" = Windows Live Family Safety
"{3C5E60F1-0821-4B07-97EA-84EB5A927CF6}" = MobileMe Control Panel
"{42738DB0-FC3E-4672-A99B-9372F5696E30}" = Microsoft Security Client
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{88E60521-1E4E-4785-B9F1-1798A4BD0C30}" = HP MediaSmart SmartMenu
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9C98CA38-4C1A-4AC8-B55C-169497C8826B}" = Apple Mobile Device Support
"{9CD0F7D3-B67F-4BF8-8784-D73AD229FF1E}" = iTunes
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 285.79
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 285.79
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 285.79
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 285.79
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver [removed]
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{CEA21F20-DBF4-464C-8B81-28B8508AFDDD}" = Windows Live Family Safety
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"EPSON NX510 Series" = EPSON NX510 Series Printer Uninstall
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"OfficeTrial" = Microsoft Office Home and Student 60 day trial
"PC-Doctor for Windows" = Hardware Diagnostic Tools
"Rocketfish VF0650" = Rocketfish HD Webcam (1.00.06.00)
"WinRAR archiver" = WinRAR 4.01 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{13A5E785-5197-4EAD-8EE3-D660271E49BC}" = Feedback Tool
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{17B4760F-334B-475D-829F-1A3E94A6A4E6}" = HP Setup
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 29
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{3023EBDA-BF1B-4831-B347-E5018555F26E}" = Movie Theme Pack for HP MediaSmart Video
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{33A783E8-DC11-427F-A56C-8ED43EEC0695}" = RPS CRT
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}" = HP Advisor
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{48F22622-1CC2-4A83-9C1E-644DD96F832D}" = Epson Event Manager
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A1F0A1A-474C-4151-8534-5F61832D88CD}" = Comic Life
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7C5B4583-7CBF-4289-B195-03B553959DEA}" = VoiceOver Kit
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{7FC8C210-A319-4835-A87D-B935EFB4C148}" = Microsoft Live Search Toolbar
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90024193-9F13-4877-89D5-A1CDF0CBBF28}" = Feedback Tool
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.PUBLISHERR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PUBLISHERR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PUBLISHERR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PUBLISHERR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.SingleImage_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PUBLISHERR_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0409-1000-0000000FF1CE}_Office14.PUBLISHERR_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0409-1000-0000000FF1CE}_Office14.SingleImage_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.PUBLISHERR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.SingleImage_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.PUBLISHERR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.PUBLISHERR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0116-0409-1000-0000000FF1CE}_Office14.PUBLISHERR_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0116-0409-1000-0000000FF1CE}_Office14.SingleImage_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91140000-0019-0000-0000-0000000FF1CE}" = Microsoft Office Publisher 2010
"{91140000-0019-0000-0000-0000000FF1CE}_Office14.PUBLISHERR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9E1BAB75-EB78-440D-94C0-A3857BE2E733}" = System Requirements Lab
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB49B509-8FCA-45E6-9FB9-9E4AEEB8F148}" = System Requirements Lab CYRI
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video
"{B60DCA15-56A3-4D2D-8747-22CF7D7B588B}" = HP Support Assistant
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer
"{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}" = HP Support Information
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C611CF88-969D-43E6-A877-D6D6439DD081}" = HP Remote Solution
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CC8E94A2-55C7-4460-953C-2A790180578C}" = LightScribe System Software
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D46D081B-F60E-467E-A7C4-117B70D76731}" = HP Update
"{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DF802C05-4660-418c-970C-B988ADB1D316}" = Microsoft Live Search Toolbar
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}" = DVD Menu Pack for HP MediaSmart Video
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Bandwidth Monitor_is1" = Bandwidth Monitor
"EPSON Scanner" = EPSON Scan
"FinalVideoDownloader_is1" = Final Video Downloader 2011
"Free 3D Photo Maker_is1" = Free 3D Photo Maker version 2.0.6
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Video to JPG Converter_is1" = Free Video to JPG Converter version 1.8.7
"HP Remote Solution" = HP Remote Solution
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}" = Movie Theme Pack for HP MediaSmart Video
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"InstallShield_{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}" = DVD Menu Pack for HP MediaSmart Video
"LastFM_is1" = Last.fm 1.5.4.27091
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Mozilla Firefox 8.0 (x86 en-GB)" = Mozilla Firefox 8.0 (x86 en-GB)
"NSS" = Norton Security Scan
"NST" = Norton Safe Web Lite
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.PUBLISHERR" = Microsoft Publisher 2010
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"RadialpointClientGateway_is1" = Rogers Servicepoint Agent 3.7.44
"Rocketfish Live! Central" = Rocketfish Live! Central
"Rogers Self Help Software" = Rogers Self Help Software
"Rogers Update Manager" = Rogers Update Manager
"RSH Home Networking Wizard" = RSH Home Networking Wizard
"Trusted Software Assistant_is1" = File Type Assistant
"Uninstall_is1" = Uninstall 1.0.0.1
"WhatPulse" = WhatPulse [removed]
"WinLiveSuite" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 26/11/2011 6:47:44 PM | Computer Name = Owner-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9260703

Error - 26/11/2011 6:47:45 PM | Computer Name = Owner-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 26/11/2011 6:47:45 PM | Computer Name = Owner-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9261701

Error - 26/11/2011 6:47:45 PM | Computer Name = Owner-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9261701

Error - 26/11/2011 6:47:46 PM | Computer Name = Owner-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 26/11/2011 6:47:46 PM | Computer Name = Owner-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9262699

Error - 26/11/2011 6:47:46 PM | Computer Name = Owner-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9262699

Error - 26/11/2011 6:47:47 PM | Computer Name = Owner-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 26/11/2011 6:47:47 PM | Computer Name = Owner-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9263698

Error - 26/11/2011 6:47:47 PM | Computer Name = Owner-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9263698

[ Hewlett-Packard Events ]
Error - 16/09/2011 4:26:30 PM | Computer Name = Owner-PC | Source = Hewlett-Packard | ID = 0
Description =

Error - 24/09/2011 10:01:16 AM | Computer Name = Owner-PC | Source = Hewlett-Packard | ID = 0
Description = en-CA Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP
Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String
msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode
mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)

at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a()

Error - 29/09/2011 3:45:43 PM | Computer Name = Owner-PC | Source = Hewlett-Packard | ID = 0
Description = en-CA Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP
Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String
msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode
mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)

at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a()

Error - 06/10/2011 3:31:13 PM | Computer Name = Owner-PC | Source = Hewlett-Packard | ID = 0
Description = en-CA Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP
Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String
msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode
mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)

at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a()

Error - 07/10/2011 12:05:10 AM | Computer Name = Owner-PC | Source = Hewlett-Packard | ID = 0
Description =

Error - 07/10/2011 5:38:10 PM | Computer Name = Owner-PC | Source = Hewlett-Packard | ID = 0
Description =

Error - 07/10/2011 5:38:11 PM | Computer Name = Owner-PC | Source = Hewlett-Packard | ID = 0
Description =

Error - 07/10/2011 5:38:12 PM | Computer Name = Owner-PC | Source = Hewlett-Packard | ID = 0
Description =

Error - 07/10/2011 5:38:12 PM | Computer Name = Owner-PC | Source = Hewlett-Packard | ID = 0
Description =

Error - 24/10/2011 3:55:40 PM | Computer Name = Owner-PC | Source = Hewlett-Packard | ID = 0
Description = en-CA Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP
Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String
msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode
mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)

at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a()

[ System Events ]
Error - 26/11/2011 2:42:18 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7023
Description = The Superfetch service terminated with the following error: %%2

Error - 27/11/2011 1:16:39 AM | Computer Name = Owner-PC | Source = DCOM | ID = 10010
Description =

Error - 27/11/2011 3:12:51 PM | Computer Name = Owner-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%835 Error Code: 0x80004005 Error description: Unspecified error Reason: %%842

Error - 27/11/2011 3:13:00 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7023
Description = The Superfetch service terminated with the following error: %%2

Error - 28/11/2011 4:37:30 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7023
Description = The Superfetch service terminated with the following error: %%2

Error - 28/11/2011 4:52:20 PM | Computer Name = Owner-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%835 Error Code: 0x80004005 Error description: Unspecified error Reason: %%842

Error - 28/11/2011 4:52:48 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7023
Description = The Superfetch service terminated with the following error: %%2

Error - 28/11/2011 4:59:28 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error:
%%1115

Error - 28/11/2011 4:59:28 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7023
Description = The Server service terminated with the following error: %%1062

Error - 28/11/2011 5:14:24 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7023
Description = The Superfetch service terminated with the following error: %%2

< End of report >

Attachments:

📎DiskManagement.png

ClementZ

Post #26November 29, 2011, 3:57 AM UTC

Proceeding to turn off comp. Cya tomorrow Sunyata Thanks for the help thus far.

Sunyata

Post #27November 29, 2011, 7:55 PM UTC

Hello ClementZ

Let's run an OTL Fix

Please reopen [external image: Posted Image].

Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

:processes
killallprocesses

:OTL
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
O4 - HKLM..\Run: [] File not found
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
[2011/11/23 15:56:43 | 000,000,000 | –SD | C] – C:\32788R22FWJFW
[2011/11/28 16:19:41 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{278A27A1-9207-4BE0-A403-839E46F1507E}
[2011/11/28 16:19:19 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{3381A898-1009-4144-B3FB-56C5683A146C}
[2011/11/27 14:17:01 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{816DB371-7AF2-40B8-91C6-36E7D5973FA9}
[2011/11/27 14:16:38 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{62E45F5E-B665-43A5-935B-6099D1EF3F32}
[2011/11/26 22:20:18 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{81927659-C949-4FAC-A1D3-251E791F2721}
[2011/11/26 22:19:56 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{692F06F3-2E31-49E8-9404-94F55287CEB6}
[2011/11/26 10:19:30 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{AD4B8273-9894-4F95-8AEA-31E076187E97}
[2011/11/26 10:19:19 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{8F554A50-B1A1-4CA8-8E52-7CC9223ACF04}
[2011/11/25 18:46:38 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{3E7DA18E-1AE9-4C90-9809-FFA82B5AFFCF}
[2011/11/25 18:46:19 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{7B9454B0-875F-4020-9121-ECAC8840B467}
[2011/11/24 15:39:55 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{5BE57497-DF32-4B4B-B0F0-BBDF7F193633}
[2011/11/24 15:39:40 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{9A774EB4-179A-4C7E-A3C5-69D512F29589}
[2011/11/23 15:31:18 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{11151DE6-33BA-4734-B54C-BBF73D44797B}
[2011/11/23 15:30:56 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{256FB6F0-B8AD-4B33-85F7-491954BF6486}
[2011/11/22 17:25:32 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{D2041AB1-3846-4020-A9B3-705F36F8606D}
[2011/11/22 17:25:10 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{F34DCCE0-A05C-4A42-BE20-22FE7B0DEAFA}
[2011/11/21 15:54:33 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{F3469460-28E8-4B15-AE50-90BC5FD4969A}
[2011/11/21 15:54:19 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{6AE6E6E6-954A-4256-BD61-8F308A014ED9}
[2011/11/20 13:25:22 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{6EEA1A87-8A0E-4501-9010-01F075D3CDBC}
[2011/11/20 13:25:11 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{D307C17D-F546-4ADD-9AE8-9F772A229CDA}
[2011/11/19 16:15:48 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{D0444E85-DE17-4894-97DD-CC42D48F515B}
[2011/11/19 16:15:27 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{E4037117-CFBF-4DE3-8EA1-0A729746644F}
[2011/11/18 15:29:27 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{AAD73463-076A-40CB-873B-90B477B5951E}
[2011/11/18 15:29:14 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{5A373632-9D2D-409D-800A-16D622268B79}
[2011/11/17 12:52:38 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{97DF8FD5-C2CE-4F7A-86E2-C75CD05DB75A}
[2011/11/17 12:52:16 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{78B9A9DE-5F40-4BA9-926E-93703F16F572}
[2011/11/16 15:44:07 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{4A09E1B6-79B3-409C-9CDF-7971EAA1B776}
[2011/11/16 15:43:52 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{69D77095-2683-4034-AFB9-AA56E0D547D9}
[2011/11/15 15:50:42 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{BDCA6907-DCF5-44BE-8631-1B7914AC9824}
[2011/11/15 15:50:26 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{14A75A70-55EB-450D-97DB-9356BDEB46BE}
[2011/11/14 15:23:35 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{E4164FD4-DE00-4425-A0D0-E56D236416FC}
[2011/11/14 15:23:24 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{CC2AEDEB-B1E5-4DC7-A59A-5FBAF9796A48}
[2011/11/13 14:22:59 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{968CD2CF-B4BA-4822-A335-8DFDAF4CAA55}
[2011/11/13 14:22:37 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{B5C075D1-2ECB-46CD-BE5C-5D36B78E5136}
[2011/11/12 16:54:32 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{A7B76261-612D-4473-9243-D85712D1A845}
[2011/11/12 16:54:21 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{6EF37251-1427-4C99-90AA-F5AEDE8A6D72}
[2011/11/11 16:18:51 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{FB92C0AA-318D-497A-AB06-27018C6FCE5E}
[2011/11/11 16:18:29 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{6A456E28-7E83-4531-948D-EBDA88FD1C45}
[2011/11/10 15:51:47 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{F449E489-C73A-4E6A-AE19-857A5C6A2A35}
[2011/11/10 15:51:35 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{E76F13C4-C124-4B6B-A5CB-5F1A366136FE}
[2011/11/09 20:57:22 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{A4DCB714-FA3E-4A6B-82F6-91E9BA277466}
[2011/11/09 20:56:53 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{63CC545D-8260-4AA3-A0E3-A9EC93D0BBFB}
[2011/11/09 15:25:42 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{58019084-ABC4-4EE6-9655-8A13B4E8AB30}
[2011/11/09 15:25:19 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{B6A166AD-DDC3-4AB4-B513-07661D368BDF}
[2011/11/08 15:44:05 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{CCA101C4-ECC2-4A85-A254-41906779718C}
[2011/11/08 15:43:49 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{195BF2D5-6D37-47A4-A505-70028D900538}
[2011/11/07 15:29:49 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{CCF7DEE2-D596-4DC1-9D77-9BE47349DB96}
[2011/11/07 15:29:39 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{1BF12443-E763-4244-9784-B8F630EFA60D}
[2011/11/06 14:32:40 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{C6E5ABB4-82FF-4023-BAC6-64C8EE6BD0E4}
[2011/11/06 14:32:18 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{3F69E7BD-8D4D-4536-B02C-7FFAF35B8FC7}
[2011/11/05 15:01:22 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{11D6AE38-E03F-4BC3-AA05-6FAF86139E67}
[2011/11/05 15:01:02 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{10ABBD41-82EF-4CFA-A181-FF6D45C8CA4F}
[2011/11/04 22:15:27 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{CB2EBAB4-861C-460A-9698-414EEDE7886A}
[2011/11/04 22:15:05 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{4495CA94-B293-453D-ACD4-F7F9E83BDC52}
[2011/11/04 10:14:48 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{7BC02BA9-DEEA-4387-B3CC-3CDF502C8B30}
[2011/11/04 10:14:34 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{FDF49A03-CE2C-47AB-BEF0-C4CBBA8A0F4F}
[2011/11/03 14:52:22 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{3E62040F-6A25-4096-9ABC-5696865D3DB7}
[2011/11/03 14:52:00 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{4B2EA468-F192-4BD7-AC8F-A9C6A32EA054}
[2011/11/02 14:42:12 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{DA008DF9-86DB-4559-99E7-5A1A7CEB834C}
[2011/11/02 14:42:01 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{0AE76BBF-D6D9-4A1D-9802-E8CE86C4FEB2}
[2011/11/01 14:35:20 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{90A78DE0-E769-48BB-A397-83447BE0FB42}
[2011/11/01 14:35:06 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{E4D73456-CD48-482F-B6D4-333F01ABB9BE}
[2011/10/31 14:31:04 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{88966CE6-CBB1-4854-9919-5CA8A30286EE}
[2011/10/31 14:30:42 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{EDF29D43-2027-4444-B9CD-FCB3671B12CF}
[2011/10/30 10:03:01 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{F092F200-485F-4293-90BA-AC3899C42C62}
[2011/10/30 10:02:38 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Local\{A7601A95-0565-4FB5-8157-3CCEAA3E3A4C}
[1 C:\Users\Owner\Documents\*.tmp files -> C:\Users\Owner\Documents\*.tmp -> ]
[2011/11/09 20:36:15 | 000,000,296 | —- | M] () – C:\ProgramData\~58HREEfJXgfTZ4
[2011/11/09 20:36:14 | 000,000,216 | —- | M] () – C:\ProgramData\~58HREEfJXgfTZ4r
[2011/11/09 20:36:07 | 000,000,344 | —- | M] () – C:\ProgramData\58HREEfJXgfTZ4
[2011/11/25 15:54:52 | 000,166,480 | —- | C] () – C:\Users\Owner\AppData\Local\tmpIMG008.JPG
[2011/06/24 22:01:50 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2011/03/29 16:14:24 | 000,000,004 | RHS- | C] () – C:\ProgramData\sysqcl1129139270.dat
[2011/02/12 18:33:22 | 000,044,817 | —- | C] () – C:\Users\Owner\AppData\Local\tmpTAJ_FATHER4.1
[2011/02/12 18:33:21 | 000,050,969 | —- | C] () – C:\Users\Owner\AppData\Local\tmpTAJ_FATHER4.0
[2011/02/12 18:33:21 | 000,044,848 | —- | C] () – C:\Users\Owner\AppData\Local\tmpTAJ_FATHER4.JPG
[2011/01/12 01:41:34 | 000,003,584 | —- | C] () – C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/01 21:16:38 | 000,346,337 | —- | C] () – C:\Users\Owner\AppData\Local\tmp001.2
[2011/01/01 21:16:36 | 000,324,615 | —- | C] () – C:\Users\Owner\AppData\Local\tmp001.1
[2010/09/23 21:37:09 | 001,043,762 | —- | C] () – C:\Users\Owner\AppData\Local\tmpP9100064.JPG
[2010/09/23 21:37:08 | 005,925,433 | —- | C] () – C:\Users\Owner\AppData\Local\tmpP9100064.0
[2011/07/09 15:52:03 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\FrostWire
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:D287FACF
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:0B4227B4
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:D1B5B4F1

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\helpfile\shell\open\command]
""=""%1" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\edit\command]
""=""%1" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\command]
""=""%1" %*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\merge\command]
""=""%1" %*"

:Commands
[purity]
[emptytemp]
[Reboot]

Push [external image: Posted Image]
OTL may ask to reboot the machine. Please do so if asked.
Click [external image: Posted Image].
A report will open. Copy and Paste that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

How is the machine behaving now? Are there still issues?

ClementZ

Post #28November 29, 2011, 8:18 PM UTC

Should I check LOP check and Purity check, like I did last time?

Sunyata

Post #29November 29, 2011, 8:22 PM UTC

Hello ClementZ

Should I check LOP check and Purity check, like I did last time?

Nope. Just push the Run Fix button after you copy/paste the fix.

ClementZ

Post #30November 29, 2011, 8:37 PM UTC

All processes killed ========== PROCESSES ========== ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully. 64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully. File Protocol\Handler\livecall - No CLSID value found not found. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully. File Protocol\Handler\ms-help - No CLSID value found not found. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-itss\ deleted successfully. File Protocol\Handler\ms-itss - No CLSID value found not found. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully. File Protocol\Handler\msnim - No CLSID value found not found. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype-ie-addon-data\ deleted successfully. File Protocol\Handler\skype-ie-addon-data - No CLSID value found not found. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlmailhtml\ deleted successfully. File Protocol\Handler\wlmailhtml - No CLSID value found not found. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlpg\ deleted successfully. File Protocol\Handler\wlpg - No CLSID value found not found. 64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found. C:\32788R22FWJFW\EN-US folder moved successfully. C:\32788R22FWJFW folder moved successfully. C:\Users\Owner\AppData\Local\{278A27A1-9207-4BE0-A403-839E46F1507E} folder moved successfully. C:\Users\Owner\AppData\Local\{3381A898-1009-4144-B3FB-56C5683A146C} folder moved successfully. C:\Users\Owner\AppData\Local\{816DB371-7AF2-40B8-91C6-36E7D5973FA9} folder moved successfully. C:\Users\Owner\AppData\Local\{62E45F5E-B665-43A5-935B-6099D1EF3F32} folder moved successfully. C:\Users\Owner\AppData\Local\{81927659-C949-4FAC-A1D3-251E791F2721} folder moved successfully. C:\Users\Owner\AppData\Local\{692F06F3-2E31-49E8-9404-94F55287CEB6} folder moved successfully. C:\Users\Owner\AppData\Local\{AD4B8273-9894-4F95-8AEA-31E076187E97} folder moved successfully. C:\Users\Owner\AppData\Local\{8F554A50-B1A1-4CA8-8E52-7CC9223ACF04} folder moved successfully. C:\Users\Owner\AppData\Local\{3E7DA18E-1AE9-4C90-9809-FFA82B5AFFCF} folder moved successfully. C:\Users\Owner\AppData\Local\{7B9454B0-875F-4020-9121-ECAC8840B467} folder moved successfully. C:\Users\Owner\AppData\Local\{5BE57497-DF32-4B4B-B0F0-BBDF7F193633} folder moved successfully. C:\Users\Owner\AppData\Local\{9A774EB4-179A-4C7E-A3C5-69D512F29589} folder moved successfully. C:\Users\Owner\AppData\Local\{11151DE6-33BA-4734-B54C-BBF73D44797B} folder moved successfully. C:\Users\Owner\AppData\Local\{256FB6F0-B8AD-4B33-85F7-491954BF6486} folder moved successfully. C:\Users\Owner\AppData\Local\{D2041AB1-3846-4020-A9B3-705F36F8606D} folder moved successfully. C:\Users\Owner\AppData\Local\{F34DCCE0-A05C-4A42-BE20-22FE7B0DEAFA} folder moved successfully. C:\Users\Owner\AppData\Local\{F3469460-28E8-4B15-AE50-90BC5FD4969A} folder moved successfully. C:\Users\Owner\AppData\Local\{6AE6E6E6-954A-4256-BD61-8F308A014ED9} folder moved successfully. C:\Users\Owner\AppData\Local\{6EEA1A87-8A0E-4501-9010-01F075D3CDBC} folder moved successfully. C:\Users\Owner\AppData\Local\{D307C17D-F546-4ADD-9AE8-9F772A229CDA} folder moved successfully. C:\Users\Owner\AppData\Local\{D0444E85-DE17-4894-97DD-CC42D48F515B} folder moved successfully. C:\Users\Owner\AppData\Local\{E4037117-CFBF-4DE3-8EA1-0A729746644F} folder moved successfully. C:\Users\Owner\AppData\Local\{AAD73463-076A-40CB-873B-90B477B5951E} folder moved successfully. C:\Users\Owner\AppData\Local\{5A373632-9D2D-409D-800A-16D622268B79} folder moved successfully. C:\Users\Owner\AppData\Local\{97DF8FD5-C2CE-4F7A-86E2-C75CD05DB75A} folder moved successfully. C:\Users\Owner\AppData\Local\{78B9A9DE-5F40-4BA9-926E-93703F16F572} folder moved successfully. C:\Users\Owner\AppData\Local\{4A09E1B6-79B3-409C-9CDF-7971EAA1B776} folder moved successfully. C:\Users\Owner\AppData\Local\{69D77095-2683-4034-AFB9-AA56E0D547D9} folder moved successfully. C:\Users\Owner\AppData\Local\{BDCA6907-DCF5-44BE-8631-1B7914AC9824} folder moved successfully. C:\Users\Owner\AppData\Local\{14A75A70-55EB-450D-97DB-9356BDEB46BE} folder moved successfully. C:\Users\Owner\AppData\Local\{E4164FD4-DE00-4425-A0D0-E56D236416FC} folder moved successfully. C:\Users\Owner\AppData\Local\{CC2AEDEB-B1E5-4DC7-A59A-5FBAF9796A48} folder moved successfully. C:\Users\Owner\AppData\Local\{968CD2CF-B4BA-4822-A335-8DFDAF4CAA55} folder moved successfully. C:\Users\Owner\AppData\Local\{B5C075D1-2ECB-46CD-BE5C-5D36B78E5136} folder moved successfully. C:\Users\Owner\AppData\Local\{A7B76261-612D-4473-9243-D85712D1A845} folder moved successfully. C:\Users\Owner\AppData\Local\{6EF37251-1427-4C99-90AA-F5AEDE8A6D72} folder moved successfully. C:\Users\Owner\AppData\Local\{FB92C0AA-318D-497A-AB06-27018C6FCE5E} folder moved successfully. C:\Users\Owner\AppData\Local\{6A456E28-7E83-4531-948D-EBDA88FD1C45} folder moved successfully. C:\Users\Owner\AppData\Local\{F449E489-C73A-4E6A-AE19-857A5C6A2A35} folder moved successfully. C:\Users\Owner\AppData\Local\{E76F13C4-C124-4B6B-A5CB-5F1A366136FE} folder moved successfully. C:\Users\Owner\AppData\Local\{A4DCB714-FA3E-4A6B-82F6-91E9BA277466} folder moved successfully. C:\Users\Owner\AppData\Local\{63CC545D-8260-4AA3-A0E3-A9EC93D0BBFB} folder moved successfully. C:\Users\Owner\AppData\Local\{58019084-ABC4-4EE6-9655-8A13B4E8AB30} folder moved successfully. C:\Users\Owner\AppData\Local\{B6A166AD-DDC3-4AB4-B513-07661D368BDF} folder moved successfully. C:\Users\Owner\AppData\Local\{CCA101C4-ECC2-4A85-A254-41906779718C} folder moved successfully. C:\Users\Owner\AppData\Local\{195BF2D5-6D37-47A4-A505-70028D900538} folder moved successfully. C:\Users\Owner\AppData\Local\{CCF7DEE2-D596-4DC1-9D77-9BE47349DB96} folder moved successfully. C:\Users\Owner\AppData\Local\{1BF12443-E763-4244-9784-B8F630EFA60D} folder moved successfully. C:\Users\Owner\AppData\Local\{C6E5ABB4-82FF-4023-BAC6-64C8EE6BD0E4} folder moved successfully. C:\Users\Owner\AppData\Local\{3F69E7BD-8D4D-4536-B02C-7FFAF35B8FC7} folder moved successfully. C:\Users\Owner\AppData\Local\{11D6AE38-E03F-4BC3-AA05-6FAF86139E67} folder moved successfully. C:\Users\Owner\AppData\Local\{10ABBD41-82EF-4CFA-A181-FF6D45C8CA4F} folder moved successfully. C:\Users\Owner\AppData\Local\{CB2EBAB4-861C-460A-9698-414EEDE7886A} folder moved successfully. C:\Users\Owner\AppData\Local\{4495CA94-B293-453D-ACD4-F7F9E83BDC52} folder moved successfully. C:\Users\Owner\AppData\Local\{7BC02BA9-DEEA-4387-B3CC-3CDF502C8B30} folder moved successfully. C:\Users\Owner\AppData\Local\{FDF49A03-CE2C-47AB-BEF0-C4CBBA8A0F4F} folder moved successfully. C:\Users\Owner\AppData\Local\{3E62040F-6A25-4096-9ABC-5696865D3DB7} folder moved successfully. C:\Users\Owner\AppData\Local\{4B2EA468-F192-4BD7-AC8F-A9C6A32EA054} folder moved successfully. C:\Users\Owner\AppData\Local\{DA008DF9-86DB-4559-99E7-5A1A7CEB834C} folder moved successfully. C:\Users\Owner\AppData\Local\{0AE76BBF-D6D9-4A1D-9802-E8CE86C4FEB2} folder moved successfully. C:\Users\Owner\AppData\Local\{90A78DE0-E769-48BB-A397-83447BE0FB42} folder moved successfully. C:\Users\Owner\AppData\Local\{E4D73456-CD48-482F-B6D4-333F01ABB9BE} folder moved successfully. C:\Users\Owner\AppData\Local\{88966CE6-CBB1-4854-9919-5CA8A30286EE} folder moved successfully. C:\Users\Owner\AppData\Local\{EDF29D43-2027-4444-B9CD-FCB3671B12CF} folder moved successfully. C:\Users\Owner\AppData\Local\{F092F200-485F-4293-90BA-AC3899C42C62} folder moved successfully. C:\Users\Owner\AppData\Local\{A7601A95-0565-4FB5-8157-3CCEAA3E3A4C} folder moved successfully. C:\Users\Owner\Documents\~WRL0005.tmp deleted successfully. C:\ProgramData\~58HREEfJXgfTZ4 moved successfully. C:\ProgramData\~58HREEfJXgfTZ4r moved successfully. C:\ProgramData\58HREEfJXgfTZ4 moved successfully. C:\Users\Owner\AppData\Local\tmpIMG008.JPG moved successfully. C:\ProgramData\ezsidmv.dat moved successfully. C:\ProgramData\sysqcl1129139270.dat moved successfully. C:\Users\Owner\AppData\Local\tmpTAJ_FATHER4.1 moved successfully. C:\Users\Owner\AppData\Local\tmpTAJ_FATHER4.0 moved successfully. C:\Users\Owner\AppData\Local\tmpTAJ_FATHER4.JPG moved successfully. C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini moved successfully. C:\Users\Owner\AppData\Local\tmp001.2 moved successfully. C:\Users\Owner\AppData\Local\tmp001.1 moved successfully. C:\Users\Owner\AppData\Local\tmpP9100064.JPG moved successfully. C:\Users\Owner\AppData\Local\tmpP9100064.0 moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\xml\data folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\xml folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\themes\frostwirePro_theme folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\themes folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\overlays folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\image_cache\static.frostwire.com\images\overlays folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\image_cache\static.frostwire.com\images\banners folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\image_cache\static.frostwire.com\images folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\image_cache\static.frostwire.com folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\image_cache folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\azureus\torrents folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\azureus\tmp folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\azureus\plugins folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\azureus\net folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\azureus\logs\save folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\azureus\logs folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\azureus\dht folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\azureus\active folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\azureus folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\.NetworkShare\Incomplete folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\.NetworkShare folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire\.AppSpecialShare folder moved successfully. C:\Users\Owner\AppData\Roaming\FrostWire folder moved successfully. ADS C:\ProgramData\Temp:D287FACF deleted successfully. ADS C:\ProgramData\Temp:0B4227B4 deleted successfully. ADS C:\ProgramData\Temp:D1B5B4F1 deleted successfully. ========== REGISTRY ========== HKEY_LOCAL_MACHINE\SOFTWARE\Classes\helpfile\shell\open\command\\""|""%1" %*" /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\edit\command\\""|""%1" %*" /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\command\\""|""%1" %*" /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\merge\command\\""|""%1" %*" /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: AppData User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 56502 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Owner ->Temp folder emptied: 613619244 bytes ->Temporary Internet Files folder emptied: 24131530 bytes ->Java cache emptied: 14040 bytes ->FireFox cache emptied: 42807898 bytes ->Google Chrome cache emptied: 368778776 bytes ->Flash cache emptied: 490 bytes User: Public User: TEMP ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32768 bytes ->Flash cache emptied: 2870 bytes User: UpdatusUser ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 56502 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 65030413 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67630 bytes RecycleBin emptied: 111 bytes Total Files Cleaned = 1,063.00 mb OTL by OldTimer - Version 3.2.31.0 log created on 11292011_152529 Files\Folders moved on Reboot… File\Folder C:\Users\Owner\AppData\Local\Temp\OICE_97127DF3-D903-4CF4-8289-1B59C4EA80DF.0\324985DB. not found! File\Folder C:\Users\Owner\AppData\Local\Temp\OICE_29B45C9B-2B32-4087-A698-32A114506573.0\B77F385C. not found! C:\Users\Owner\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. Registry entries deleted on Reboot… Thanks Sunyata The computer is much faster now However, I still get those messages upon starting (not sure about shutting down now)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Google redirecting me + other problems. [Solved]

✨ Ask AI

Ask AI